Good morning
Legal
Privacy statement
How SBA handles your personal data: written to be read, with nothing hidden between the lines.
New for you
Not read yet since you were here
The site keeps an anonymous record of which pages you opened; this is the newest that was not among them.
The short version
We process personal data because our work requires it: helping customers, sending invoices, reading applications. We sell nothing on, we do not advertise with your data and we collect no more than the work asks for. On this website we only measure anything after you say yes to it, and the anonymous profile the site keeps for you can be viewed and erased by yourself.
That is the summary. The full story is below, and it does not deviate from it.
Who we are and what this covers
SBA (Sander Brouwer Automatisering B.V.) is an ICT service provider for the business market. Delivering our services means processing personal data of direct and indirect, existing or potential relations, and of our own employees. That processing is operationally, technically or legally necessary, for example to:
- call, e-mail or write to you for our services or invoicing;
- process, deliver and place orders with suppliers;
- give you access to online self-service environments;
- inform you about changes in legislation and in our products and services;
- execute, manage and support an agreement with you;
- meet statutory retention obligations, such as for the tax authorities.
In these cases SBA is the controller. As an ICT service provider we also process data on behalf of our customers, for example when hosting a customer database. Then SBA is the processor and a data processing agreement records which data we process and how we protect it. All processing complies with the General Data Protection Regulation (GDPR).
Which personal data we process
What we process depends on the relationship and on your role in it. You provide data by using our products and services, filling in a form on the website or e-mailing us.
Customers and their employees and parties directly involved
Name, salutation and where needed date of birth; for certain services a copy, document number and validity of an identity document you provided; address details, phone numbers and e-mail addresses; employee numbers, departments and cost allocations for invoice specifications; specifications of services, connections, hardware, software and licences taken; IP and MAC addresses; login details and actions within self-service environments, the services taken and connected login systems; and the underlying communication by post, e-mail, telephony, contact forms and social media. For business analytics and the execution of the agreed services, data may be ordered, combined, anonymised, aggregated and encrypted.
Suppliers and prospects
Name, salutation, address details, phone numbers, e-mail addresses and the underlying communication. For prospects also the way the contact came about: verbal consent, a business card, a CV, an e-mail or a form.
Employees of SBA
Besides the usual contact details: a copy of the identity document, citizen service number, bank and salary details – because an employer legally needs those.
Camera surveillance
Visibly placed cameras protect our employees and your and our property in and around our office; you are made aware of them on entering. We have a legitimate interest in this (preventing theft and supporting investigation). Footage is automatically deleted after at most 90 days, unless it is part of an ongoing investigation.
What this website does
This site adapts itself to its visitor, and precisely for that reason we are precise about what it keeps.
The adaptive profile. The site anonymously remembers, under a random number in a cookie, which subjects you read on this site, and adapts order, accent and explanation to that. No name, e-mail address or IP address is attached and it never leaves our server. On the profile page you see everything the site knows about your visit, and erase it with one click.
Statistics only after your yes. We use Google Analytics to see how the site is used – but the measuring code is only loaded after you agree to it through the cookie bar. Say nothing or no, and nothing is measured. We have not permitted Google to use this information for its own services or advertising. Details are in the cookie policy.
Forms. What you enter in a form goes by e-mail to the colleague handling it and is only used to follow up your question, application or report.
Videos. Videos on the site come from Vimeo and YouTube. We load them in their privacy-friendly mode (Do Not Track and the cookie-free domain respectively), so viewing a page with video sets no tracking cookies.
What is not there. No advertising cookies, no tracking by LinkedIn, Microsoft or other marketing platforms, no resale of visitor data.
Links to third-party websites are chosen with care, but the privacy statements of those websites govern what happens there; SBA is not responsible for that. External links recognisably open in a new window here.
How long we keep data and how we protect it
We keep your data as long as the agreement requires, unless an administrative or statutory retention obligation prescribes longer. For prospects that is the period in which you reasonably count as interested; for camera footage at most 90 days. Your data lives on our own servers and VPS environments in the Netherlands.
We take appropriate technical and organizational measures against misuse, loss, unauthorised access, unwanted disclosure and unauthorised change:
- everyone who can access your data on behalf of SBA is bound to confidentiality;
- username and password policy on all our systems, with MFA and/or SSO wherever possible;
- encryption of personal data where there is reason to;
- backups to restore data after physical or technical incidents;
- annual external auditing of policy and measures against the ISO 27001 standard;
- employees informed about the importance of data protection.
Think you found a weakness in our security? Report it through our Coordinated Vulnerability Disclosure.
Who we share with
For certain services we engage third parties. Insofar as they access your data in doing their work, we have contractually and organizationally ensured that your data is processed exclusively for the purposes described above. If a supplier is outside Europe, we guarantee the processing is surrounded by the same safeguards. We share only what is necessary.
In a change of ownership or control over (part of) SBA – through merger, sale, reorganization or comparable proceedings – collected data can be part of that transfer; this privacy statement continues to apply to it.
Your rights
Under the GDPR you can turn to us for access to the data we process about you, correction of inaccurate data, erasure and objection to processing, restriction of processing while your request runs, and transfer of your data in a common file format. Consent you gave earlier can be withdrawn at any moment; for the statistics on this site directly on the cookie policy page, for the adaptive profile on the profile page.
With a request, include your full name and address, and a copy of a valid identity document – watermarked and with the citizen service number covered. Sometimes we need additional information, or a request runs through the employer that provided the data within a business agreement. For repeated requests from the same person, costs may be charged, exclusively insofar as legally permitted.
Not happy with how we guard your privacy? Contact us and we will look for a solution together. You can also always lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Questions or a request?
By post: SBA (Sander Brouwer Automatisering B.V.), attn. Privacy Officer, Antoniuslaan 1E, 3341 GA Hendrik-Ido-Ambacht, the Netherlands
By e-mail: contact@sba.nl
SBA may amend the content of this privacy statement. This statement (version 2.0) was last updated on 30-08-2026.