Pentrox B.V.
Privacy Statement
This privacy statement describes how Pentrox B.V. collects, uses, stores, and protects personal data obtained through the Pentrox website at www.pentrox.nl and the Pentrox Portal at portal.pentrox.nl. It is written to satisfy Article 13 of the General Data Protection Regulation and the guidance issued by the Autoriteit Persoonsgegevens, the Dutch data protection authority. Pentrox B.V. is committed to transparent processing, minimal data collection, and the enforceable rights granted to every data subject.
Every section opens with a short plain-language summary, followed by the legal-grade detail. Where a legal reference is cited, the underlying article of the General Data Protection Regulation is named so that a reader can cross-reference it against the official text.
Controller identity
Pentrox B.V. is the controller, within the meaning of Article 4(7) of the General Data Protection Regulation, for all personal data collected through the Pentrox website at www.pentrox.nl and through the Pentrox Portal at portal.pentrox.nl. Pentrox B.V. determines the purposes and the means of the processing activities described in this statement.
| Registered name | Pentrox B.V. |
|---|---|
| Legal form | Besloten vennootschap (B.V.), Netherlands |
| Chamber of Commerce (KvK) | 42105876 |
| VAT (BTW) | NL869759139B01 |
| Registered office | Keizersgracht 241, 1016 EA Amsterdam, Netherlands |
| Website | www.pentrox.nl |
| Portal | portal.pentrox.nl |
| General contact | info@pentrox.nl |
| Privacy contact | privacy@pentrox.nl |
Pentrox B.V. has not appointed a Data Protection Officer. The company is not required to appoint one under Article 37 of the General Data Protection Regulation, as its core activities do not consist of large-scale regular and systematic monitoring of data subjects or large-scale processing of the special categories of data listed in Article 9. Privacy matters are handled directly by Pentrox management. A formal appointment will be revisited if the core activities of Pentrox B.V. change.
For assessment data that contains personal data of client employees or end users, Pentrox B.V. acts as a processor on behalf of the client, who is the controller. The processor relationship is documented in the Data Processing Agreement executed at the start of each assessment. This privacy statement does not describe the lawful basis for processor-side activities, because Pentrox B.V. is not the controller for that data. A separate description of the processor role is published on the Pentrox Trust and Procurement page at /en/trust under Section 7.
Scope of this notice
| In scope | Personal data collected through the Pentrox website, the contact form, the sample-report request form, any future forms published on www.pentrox.nl, the Pentrox Portal user accounts at portal.pentrox.nl, and server-side logs generated by visits to either domain. |
|---|---|
| Out of scope | Personal data that appears inside assessment artefacts delivered to Pentrox as a processor, such as test credentials of client employees, personal data discovered during an authorised assessment, and data stored in a client environment tested under a signed statement of work. That data is processed under the Data Processing Agreement between Pentrox B.V. and the client. The client is the controller for that data. The Trust and Procurement page at /en/trust describes the processor posture in full. |
If a processing activity is not listed in Section 4 of this statement, Pentrox B.V. does not carry it out on this website or in the Pentrox Portal at the date of publication. New processing activities will be added to this statement before they begin.
Processing activities
This section is the operational heart of the statement. Each processing activity is listed once, with the five items required by Article 13 of the General Data Protection Regulation: purpose, legal basis, categories of data, retention, and recipients. Activities are labelled A to F for cross-reference. Activity F is listed for completeness and is out of scope as explained in Section 3.
A. Website visit
Purpose: security, abuse monitoring, debugging of the Pentrox website, and investigation of incidents affecting the website.
Legal basis: legitimate interest (Article 6(1)(f) of the General Data Protection Regulation). The legitimate interest is the protection of the Pentrox website and its visitors from abuse, scraping, and automated attack traffic. The interest has been weighed against the rights of data subjects. The data is not used for profiling or marketing.
Categories of data: IP address, user agent string, requested URL, HTTP method, HTTP response code, timestamp of the request, and any referrer header sent by the browser.
Retention: 30 days on a rolling basis, after which the records are deleted or irreversibly aggregated.
Recipients: Pentrox B.V. employees with an operational need to review the logs, and Cloudflare, Inc., which operates the network in front of the website and the Portal and processes the technical data of each request to route traffic and to block attacks (see Section 5). Logs are not shared with any other third party, except where required by law or in response to a lawful order.
B. Contact form submission
Purpose: to receive, route, and respond to inquiries sent through the contact form at www.pentrox.nl/en/contact or the Dutch equivalent, and to schedule follow-up communication at the time the visitor has indicated.
Legal basis: pre-contractual steps taken at the request of the data subject (Article 6(1)(b) of the General Data Protection Regulation) when the inquiry relates to a possible assessment or a procurement exchange. Legitimate interest (Article 6(1)(f)) for inquiries that are not connected to a possible contract, where the legitimate interest is the ability of Pentrox B.V. to respond to inbound questions about its services.
Categories of data: name, email address, selected subject category, free-text subject description, message body, optional phone number, optional callback date, optional callback time, IP address of the submitting browser, and timestamp of submission.
Retention: 24 months from the date of the last reply sent by Pentrox B.V. to the data subject. After 24 months the submission is deleted. Where the inquiry results in a Pentrox client account, the related correspondence is retained under the assessment contract and the Data Processing Agreement.
Recipients: Pentrox B.V. employees with an operational need to read and respond. The submission is also delivered to the info@pentrox.nl inbox, which is monitored by Pentrox staff. No third party receives the contents of a contact form submission.
C. Sample report request
Purpose: to fulfil requests submitted through the gated sample-report form, to send the requested redacted sample assessment report by email, and to qualify the request before a response is sent.
Legal basis: pre-contractual steps taken at the request of the data subject (Article 6(1)(b) of the General Data Protection Regulation), because the request is a concrete step taken by a prospective client toward evaluating Pentrox B.V. as a supplier. Legitimate interest (Article 6(1)(f)) applies as a secondary basis for requests that are not connected to a possible contract.
Categories of data: full name, work email address, company name, role or job title, optional phone number, optional free-text description of the intended use of the sample, IP address of the submitting browser, user agent string, language of the submitted form, and timestamp of submission.
Retention: 12 months from the date of submission. Where the requester enters into an assessment contract with Pentrox B.V., the record is retained for the duration of that contract under the Data Processing Agreement and for the period required by Dutch commercial law after the contract ends.
Recipients: Pentrox B.V. employees with an operational need to fulfil the request. No third party receives the contents of a sample report request.
D. Pentrox Portal account data
Purpose: to authenticate Pentrox Portal users, to authorise access to the projects assigned to each user, to display project status and findings to authorised users, to generate audit records of privileged actions, and to recover accounts where a lawful recovery request is made.
Legal basis: performance of a contract (Article 6(1)(b) of the General Data Protection Regulation) for client users whose employer has entered into an assessment contract with Pentrox B.V., because access to the Portal is part of the contracted delivery. Compliance with a legal obligation (Article 6(1)(c)) where retention of audit records is required by applicable law. Legitimate interest (Article 6(1)(f)) for fraud prevention and the security of the Portal.
Categories of data: name of the account holder, email address, hashed password, two-factor authentication seed, role assigned within the Portal, organisation binding, timestamp of last login, timestamps of password and two-factor changes, and audit log entries recording authentication events, privileged actions, and finding lifecycle changes that involve the account.
Retention: for the lifetime of the Pentrox Portal account. Data is not automatically deleted. The account and the data associated with it are removed on explicit written request from the client organisation or from the individual account holder, subject to any retention obligation that applies under Dutch law or under the contract between Pentrox B.V. and the client. Security audit log entries are retained for 12 months from the date of the logged event.
Recipients: Pentrox B.V. employees with an operational need to maintain the Portal and deliver the assessment. Administrators of the client organisation, for the Pentrox Portal users belonging to their own organisation, strictly within the role-based access controls of the Portal. Cloudflare, Inc. operates the network in front of the Portal and processes the technical data of each request in transit (see Section 5); no other third party receives Portal account data.
E. Cookies and local storage
Cookies and local storage items set by the Pentrox website are limited to strictly necessary items as defined by Article 11.7a of the Dutch Telecommunications Act (Telecommunicatiewet). A full description is provided in Section 8 of this statement. No analytics cookies, advertising cookies, or third-party tracking cookies are used at the date of publication.
F. Assessment findings and evidence (processor role, out of scope)
Assessment findings, evidence files, and related personal data that Pentrox B.V. handles during an assessment are processed as a processor on behalf of the client. The client is the controller. This activity is listed for completeness and transparency. It is governed by the Data Processing Agreement between Pentrox B.V. and the client, not by this statement. See Section 7 of the Pentrox Trust and Procurement page at /en/trust for the full description of the processor posture.
International data transfers
Pentrox B.V. stores personal data collected under this statement within the European Economic Area (EEA). The Pentrox website and the Pentrox Portal are hosted in datacenters in the European Union. One transfer to a country outside the European Economic Area takes place; the technical data of every request to the Pentrox website and the Pentrox Portal is processed by Cloudflare, Inc. as described below. No processing activity described in Section 4 involves any other onward transfer to a country outside the European Economic Area or to an international organisation.
Cloudflare, Inc., 101 Townsend Street, San Francisco, California, United States, provides the DNS, the content delivery network and the web application firewall in front of www.pentrox.nl and portal.pentrox.nl. To route traffic and to block attack traffic, Cloudflare processes the IP address, user agent string, requested URL, timestamp and similar technical data of every request to the website and the Portal. The contents of forms and of Portal sessions pass through the Cloudflare network encrypted in transit only and are not stored there. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision under Article 45 of the General Data Protection Regulation (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023). In addition, the Cloudflare data processing addendum incorporates the Standard Contractual Clauses of Article 46(2)(c) of the General Data Protection Regulation, which apply should the adequacy decision cease to be valid.
Apart from the transfer to Cloudflare described above, no transfer of personal data to a country outside the European Economic Area (EEA) takes place at the date of publication, and the other safeguards listed in Chapter V of the General Data Protection Regulation, such as Binding Corporate Rules, are not in use. If Pentrox B.V. begins to transfer personal data outside the European Economic Area in any other way, this statement will be updated in advance of the transfer and the safeguards that apply will be named.
Sub-processors
Pentrox B.V. uses a limited set of sub-processors to operate the Pentrox website and the Pentrox Portal, including hosting, email delivery, and operational tooling. A current sub-processor list is maintained internally and is shared with prospective and existing clients during scoping under a mutual non-disclosure agreement, as stated on the Pentrox Trust and Procurement page. The list is not published on this website because disclosing the supplier stack of a security consultancy to the public increases the attack surface of Pentrox and of its clients.
With the exception of Cloudflare, Inc., whose role and safeguards are described in Section 5, no sub-processor used by Pentrox B.V. processes personal data outside the European Economic Area (EEA) at the date of publication. Changes to the sub-processor list are notified to existing clients in line with the Data Processing Agreement. Where a change affects a processing activity described in this statement, the statement is updated to reflect the new list.
Retention periods
Pentrox B.V. retains personal data for no longer than necessary for the purposes for which it is processed, in line with Article 5(1)(e) of the General Data Protection Regulation. The table below summarises the retention periods. The full description for each processing activity is in Section 4.
| Website visitor logs (Activity A) | 30 days rolling |
|---|---|
| Contact form submissions (Activity B) | 24 months from the date of the last reply |
| Sample report requests (Activity C) | 12 months from the date of submission |
| Pentrox Portal account data (Activity D) | Lifetime of the account. Removal on explicit written request, subject to legal and contractual retention obligations. |
| Security audit log entries | 12 months from the date of the logged event |
| Assessment artefacts (processor role) | As defined in the Data Processing Agreement with each client. |
Where Dutch law requires retention beyond the periods listed above, such as tax and commercial record-keeping obligations under the Dutch Civil Code, Pentrox B.V. retains the records for the legally required period and no longer. Records retained on that basis are stored with restricted access and are used only for the statutory purpose.
Cookies and similar technologies
The Pentrox website uses a small number of strictly necessary cookies and local storage items. Under Article 11.7a of the Dutch Telecommunications Act, strictly necessary items do not require prior consent because they are necessary to deliver the service explicitly requested by the visitor or to protect the security of that service. No analytics, advertising, or third-party tracking items are used at the date of publication.
Session cookie
Purpose: to maintain the visitor session, to carry the cross-site request forgery protection token used by the contact form and the sample-report form, and, where the visitor is logged into the Pentrox Portal, to maintain the authenticated session.
Classification: strictly necessary. No consent required under Article 11.7a of the Dutch Telecommunications Act. Legitimate interest under Article 6(1)(f) of the General Data Protection Regulation for the security of the service.
Lifetime: expires at the end of the browser session or when the session timeout is reached, whichever is earlier.
Theme preference
Purpose: to remember the visitor preference for light or dark presentation of the website. The value is stored in browser local storage and is not sent to the Pentrox server.
Classification: strictly necessary for the visitor experience. Does not transmit personal data. No consent required.
Lifetime: persists until the visitor clears browser storage.
Third-party cookies and tracking
The Pentrox website does not set advertising cookies, analytics cookies, social media tracking pixels, fingerprinting scripts, or any other third-party tracking technology at the date of publication. If any such technology is ever introduced, this section will be updated before it is deployed, a cookie consent banner will be added where required by law, and the underlying processing activity will be added to Section 4 of this statement.
Data subject rights
Under Chapter III of the General Data Protection Regulation, data subjects have a set of enforceable rights in relation to personal data. The rights that apply to the processing activities described in Section 4 are listed below. Each right is named with the article that establishes it, followed by a short description of what it means in practice.
Right of access (Article 15)
You have the right to obtain confirmation of whether Pentrox B.V. processes personal data concerning you, and, where that is the case, access to that personal data and to the information required by Article 15. On request, Pentrox B.V. provides a copy of the personal data undergoing processing.
Right to rectification (Article 16)
You have the right to have inaccurate personal data corrected and to have incomplete personal data completed.
Right to erasure (Article 17)
You have the right to obtain the erasure of personal data concerning you without undue delay where the grounds listed in Article 17(1) apply. Pentrox B.V. may retain personal data where retention is required by Dutch law, for the establishment, exercise, or defence of legal claims, or under the Data Processing Agreement executed with a client. Where an exception applies, Pentrox B.V. explains the exception in the response to the request.
Right to restrict processing (Article 18)
You have the right to obtain a restriction of processing where the grounds listed in Article 18(1) apply, including where the accuracy of the personal data is contested and during the period in which Pentrox B.V. is verifying the accuracy.
Right to data portability (Article 20)
You have the right to receive the personal data concerning you, which you have provided to Pentrox B.V., in a structured, commonly used, and machine-readable format, and the right to transmit that data to another controller, where the processing is based on consent under Article 6(1)(a) or on a contract under Article 6(1)(b) and is carried out by automated means.
Right to object (Article 21)
You have the right to object, on grounds relating to your particular situation, to processing of personal data concerning you that is based on the legitimate interest of Pentrox B.V. under Article 6(1)(f). Where such an objection is lodged, Pentrox B.V. ceases the processing unless it demonstrates compelling legitimate grounds that override the interests, rights, and freedoms of the data subject, or the processing is carried out for the establishment, exercise, or defence of legal claims.
Rights related to automated decision-making (Article 22)
You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. Pentrox B.V. does not carry out such decision-making, as stated in Section 12 of this statement. The right is listed here for completeness.
How to exercise these rights
Requests to exercise any of the rights listed above should be sent by email to privacy@pentrox.nl. Pentrox B.V. responds to a valid request without undue delay and in any event within one month of receipt, in line with Article 12(3) of the General Data Protection Regulation. Where the request is particularly complex or a number of requests are received, that period may be extended by up to two further months, in which case the data subject is informed of the extension and of the reasons for it within one month of receipt of the request.
Pentrox B.V. may request reasonable information to confirm the identity of the requester before disclosing, correcting, or deleting personal data, in line with Article 12(6) of the General Data Protection Regulation. This step is taken to prevent disclosure of personal data to any party other than the data subject.
Right to lodge a complaint
In addition to the rights listed in Section 9, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the General Data Protection Regulation. In the Netherlands, the supervisory authority is the Autoriteit Persoonsgegevens. You have this right at any time and regardless of whether you have raised the matter with Pentrox B.V. beforehand. Pentrox B.V. nevertheless encourages data subjects to contact privacy@pentrox.nl first, so that Pentrox can investigate the matter directly.
| Supervisory authority | Autoriteit Persoonsgegevens |
|---|---|
| Website | https://www.autoriteitpersoonsgegevens.nl/ |
| Postal address | Postbus 93374, 2509 AJ Den Haag, Netherlands |
Legal basis overview
Section 4 of this statement names the legal basis under Article 6(1) of the General Data Protection Regulation for each processing activity. The explanations below describe in plain language what each basis means.
Contract and pre-contractual steps (Article 6(1)(b))
Processing is necessary for the performance of a contract to which the data subject is party, or to take steps at the request of the data subject prior to entering into such a contract. This basis applies to contact form submissions and sample report requests where the inquiry is a step toward a possible assessment contract, and to Pentrox Portal access for users whose employer has contracted Pentrox B.V. to carry out an assessment.
Legal obligation (Article 6(1)(c))
Processing is necessary for compliance with a legal obligation to which Pentrox B.V. is subject. This basis applies to record retention obligations imposed by Dutch tax and commercial law, and to security audit logging where retention is required by applicable regulation.
Legitimate interest (Article 6(1)(f))
Processing is necessary for the purposes of the legitimate interests pursued by Pentrox B.V. or by a third party, except where those interests are overridden by the interests, fundamental rights, or freedoms of the data subject. This basis applies to server access logs, the security of the Pentrox website and the Portal, fraud prevention, and responses to inquiries that are not connected to a possible contract. In each case Pentrox B.V. has weighed its interest against the rights of the data subject before relying on this basis. Where the interest of the data subject would override that of Pentrox, the processing does not take place, and the right to object under Article 21 remains available.
Automated decision-making
Pentrox B.V. does not carry out automated decision-making within the meaning of Article 22 of the General Data Protection Regulation, including profiling, that produces legal effects concerning a data subject or that similarly significantly affects a data subject. No system operated by Pentrox B.V. denies access, sets a price, or takes any other consequential action about a data subject on a purely automated basis. If Pentrox B.V. ever begins to operate such a system, this statement will be updated before the system is deployed, the legal basis will be disclosed, and the safeguards required by Article 22(3) will be put in place.
Security of personal data
Pentrox B.V. implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, and unauthorised access, in line with Article 32 of the General Data Protection Regulation. The measures are documented in the Pentrox internal information security policy and are reviewed regularly.
At a publishable level, the measures include:
- Encryption of personal data in transit using industry-standard transport security.
- Encryption of personal data at rest on the storage volumes that hold the Pentrox Portal and the website database.
- Mandatory two-factor authentication for all Pentrox Portal accounts.
- Role-based access control that limits access to personal data to employees and client users with a demonstrated operational need.
- Audit logging of authentication events, privileged actions, and changes to the lifecycle of a finding in the Pentrox Portal.
- Patching of dependencies on a defined cadence, with out-of-cycle patching for security-critical issues.
- Daily back-up of the Pentrox Portal database, with restoration validation as described on the Pentrox Trust and Procurement page.
Detailed configuration, architecture diagrams, and hardening specifics are not disclosed on this page and are shared with prospective clients under a mutual non-disclosure agreement during vendor evaluation.
Data breach notification
In the event of a personal data breach as defined in Article 4(12) of the General Data Protection Regulation, Pentrox B.V. notifies the Autoriteit Persoonsgegevens without undue delay and, where feasible, not later than 72 hours after having become aware of the breach, in line with Article 33. Notification is delayed beyond 72 hours only where the breach is unlikely to result in a risk to the rights and freedoms of natural persons, in which case the reasons for the delay are documented.
Where the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, Pentrox B.V. communicates the breach to the affected data subjects without undue delay, in line with Article 34. The communication describes in clear and plain language the nature of the breach, the likely consequences, and the measures taken or proposed to address the breach and mitigate its possible adverse effects.
Where Pentrox B.V. acts as a processor on behalf of a client, a personal data breach affecting the processed data is notified to the client as controller without undue delay after Pentrox becomes aware of it, in line with Article 33(2) and the Data Processing Agreement executed with the client. The client, as controller, is then responsible for notification to the supervisory authority and, where required, to the affected data subjects.
Changes to this notice
Pentrox B.V. may update this privacy statement from time to time. Material changes, such as a new processing activity, a change in the legal basis for an existing activity, a change in retention, or the introduction of a new category of recipient, are announced on this page with a revised last-updated date and a short summary of the change.
Where a change is material, existing Pentrox Portal users are notified by email to the address on file. Continued use of the Pentrox website and the Pentrox Portal after the effective date of a change does not constitute consent, where consent is the legal basis for a processing activity. Consent is always collected through an explicit action.
Contact
Questions about this privacy statement, requests to exercise a data subject right, and other privacy matters should be sent to Pentrox B.V. using the details below.
| Privacy contact | privacy@pentrox.nl |
|---|---|
| General contact | info@pentrox.nl |
| Postal address | Pentrox B.V., Keizersgracht 241, 1016 EA Amsterdam, Netherlands |
| Supervisory authority | Autoriteit Persoonsgegevens, https://www.autoriteitpersoonsgegevens.nl/ |
This privacy statement is maintained by Pentrox B.V. and is updated when the underlying facts change. Where this statement and the Data Processing Agreement executed with a client cover the same subject matter, the Data Processing Agreement takes precedence for the personal data processed on behalf of that client.