Last updated: 6 November 2026.
This notice describes how Bronson Climate handles personal data relating to its website, business enquiries, tender procedures, customers and service contacts.
Who is responsible?
Bronson Climate b.v., Valeton 19, 5301 LW Zaltbommel, The Netherlands, is the controller for the processing described here. Telephone: +31 (0)418 760 310. For privacy questions or requests, write to climate [at] bronson.nl (replace [at] with @), or use our postal address.
What data we use
We process names, email addresses, telephone numbers, work or delivery addresses, and relevant business correspondence, quotation, tender, order and service information. We receive these details when you contact us or communicate with us in a business relationship. Our contact form requires your name and email address; the subject and message fields let you explain your request. Without sufficient contact information we may be unable to respond. Please do not include sensitive personal data or confidential research data in the form.
The website and its security services also process technical information such as IP addresses, browser and device information, requested pages, dates and times, and information about suspected misuse. Optional analytics can process identifiers, visits, referral information and interactions.
How we receive your data
You may provide personal data through our website, emails, telephone calls, meetings and correspondence relating to our services. Website technologies can also collect usage information. Future newsletter subscriptions would require their own information and, where required, consent; they are not a current use confirmed for this website.
Why we use data and the legal bases
We use business contact data to respond to enquiries, prepare and follow up quotations and tenders, coordinate deliveries, and provide service and maintenance. When you act for an organisation, the basis is our legitimate interest in communicating with that organisation and providing our products and services. Where we enter into a contract with you personally, or take steps at your request before doing so, the basis is contractual necessity.
We retain records required for tax or other legal obligations on the basis of those obligations. Website security and abuse prevention serve our legitimate interest in protecting our systems and users. Optional analytics requiring consent are based on that consent. You may withdraw consent through the cookie preferences control; this does not affect the lawfulness of processing before withdrawal.
The contact form and optional cookies
You can send an enquiry without accepting optional cookies, including after refusing them. The form uses local WP Armour spam checks. Its developer states that the free plugin does not track users, use cookies or send data to an external spam-checking service. Google reCAPTCHA is no longer connected to Contact Form 7.
WPConsent stores your cookie preference for 30 days. Google Analytics is configured through MonsterInsights. WordPress.com/Jetpack is also connected for website services and statistics. You can reopen cookie preferences using the settings control on the website. See our cookie information for the configured cookie inventory. Cookie duration and the period for which a provider retains data are different things.
Service providers and recipients
We use Microsoft 365 for email and Exact Online for CRM information. The website is hosted through Vevida/Yourhosting. The website uses WordPress.com/Jetpack services provided by Automattic and Wordfence security services provided by Defiant. Google provides Analytics and the Google Drive storage configured for website backups through UpdraftPlus. Providers receive data relevant to the services they supply; not every provider receives your contact-form message.
Provider information: Microsoft data protection terms, Exact services privacy policy, Exact subprocessors, Vevida processing information, Automattic visitor notice and Wordfence privacy information.
Newsletters and sharing personal data with project partners are future plans, not current uses confirmed by Bronson. Before introducing those uses, we will determine the applicable purpose and legal basis, provide the relevant information and obtain consent where required. A contact enquiry does not automatically subscribe you to a newsletter.
Confidentiality and required disclosures
Our policy is to limit disclosure to what is needed to provide our services or fulfil a legal obligation. We may supply relevant information to competent public authorities where legally required. A request from another party does not by itself justify disclosure.
Security
Our security policy is to use proportionate technical and organisational safeguards against loss, misuse and unauthorised access. The website uses HTTPS and Wordfence security controls. Access and security measures require ongoing review; no website or storage system can be guaranteed completely secure.
International processing
Some service providers operate internationally and may process personal data outside the European Economic Area, including in the United States. The applicable protection depends on the service and destination. Relevant mechanisms include an adequacy decision or the European Commission’s Standard Contractual Clauses, together with supplementary measures where required. Microsoft’s data protection terms, Exact’s subprocessor list and the linked website-provider notices explain their respective arrangements. Contact us if you would like further information about the safeguards relevant to your data. We do not claim that all processing is restricted to the Netherlands or the EEA.
How long we keep data
Active enquiries and tenders: we retain relevant records while the procedure genuinely remains ongoing and review the need at least annually.
Closed enquiries without an order: no longer than 24 months after the last substantive contact, and shorter if the data are no longer needed. Necessary records may be retained for a legal obligation or an ongoing dispute.
Customer contacts: we retain relevant contact details during the business relationship, with an annual review to update or remove obsolete contacts and unnecessary details.
Installation and service records: we retain technical information while it is needed for maintenance and support. Personal contact details are reviewed separately; a long-lived installation does not automatically justify retaining every former contact person’s details.
Tax and accounting records: records subject to the ordinary Dutch tax retention requirement are retained for seven years in accordance with that requirement. Specific categories may have a different statutory period. This does not create a blanket seven-year period for every email or CRM record.
Wordfence Live Traffic: the current setting records security-related traffic only, with a maximum age of 30 days. A necessary incident record may need to be kept separately for investigation or a dispute. This setting does not establish the retention of hosting logs or all data processed by security providers.
Jetpack Stats: Automattic states that its identifiable statistics logs are retained for 28 days. Aggregate statistics are distinct from these identifiable logs.
Website analytics: retention is limited to the reporting period needed to understand website use and assess improvements, with a review of that need at least annually. User-level and event-level records are subject to the retention controls of the analytics service. Aggregate reports are distinguished from records that identify or single out a visitor.
Hosting logs, provider recovery copies and website backups: the retention criteria are the period necessary to investigate technical or security issues and to recover from data loss. Backup copies are reviewed when a replacement recovery copy is made and removed when they are no longer needed for recovery or an applicable legal requirement. Provider-operated copies follow the applicable service’s retention and deletion processes. Backups are not used as an active contact or marketing database. If deleted data are restored during recovery, the deletion must be reapplied to the restored system.
Your privacy rights
Depending on the circumstances and applicable law, you may request access, correction, erasure, restriction or portability of your personal data. You may object to processing based on legitimate interests on grounds relating to your particular situation. You may withdraw consent where consent is the basis. These rights have legal conditions and exceptions.
Send your request to climate [at] bronson.nl or our postal address. We may ask for information reasonably necessary to verify your identity. We normally respond within one month and explain any permitted extension. You may complain to the Autoriteit Persoonsgegevens or another competent supervisory authority.
Automated checks and updates
The form uses automated spam checks that can prevent submission. If you experience a problem, call +31 (0)418 760 310. These checks concern form security rather than a decision about eligibility for our products or services.
We will update this notice when our processing changes and show the revision date.