Privacy Policy

If you are located in the European Economic Area, your personal data is processed in accordance with the GDPR, and the EU Privacy Policy below applies to you. If you are located in the United States, please refer to the US Privacy Policy further below instead.

EU Privacy Policy

Last updated: 16 October 2026

This Privacy Policy explains how Heniff Transportation B.V. and other affiliated EU companies Heniff Repair B.V., Heniff Cleaning B.V., Heniff Transportation GmbH and Heniff Depot B.V. (“Heniff”, “we”, “us”) collect and use your personal data when you visit www.heniff-europe.com (the “Website”).

It applies to personal data collected through the Website wherever you are located. Processing of personal data that does not take place through the Website (for example employee, driver, customer and supplier data held in our operational, HR and finance systems, and CCTV at our sites) is governed by separate internal policies and notices and is not covered here.

1. Who we are and how to contact us

   The controller for personal data collected through this Website is Heniff Transportation Holdings Europe B.V., Leonard Langweg 10, 6121PA, Born, the Netherlands. For any privacy question or request, or to exercise your rights. If you would like to exercise any of your data subject rights, or if you have questions about our data transfers, our legitimate interests, or any other aspect of this policy, please contact our privacy team via [email protected] or by post at the address above us.
   

2. The personal data we process

   The personal data we process depends on your relationship with us. Below we set out the main categories of individuals whose personal data we process and the personal data involved.  

   a. Visitors to our Website. When you visit our Website, we process:

   -          Device and technical data: IP address, browser type and version, device type, operating system and language settings;

   -          Usage data: pages viewed, referring pages, and the date, time and duration of your visit; and

   -          Data collected through cookies and similar technologies (we refer to our Cookie Policy)
   

   b. Job applicants. If you request further information about one of our vacancies, or if you apply by emailing the Heniff Europe HR address shown on our careers page, we process the personal data you choose to send us, which typically includes:

   -          Your name and contact details (email, telephone, postal address); and

   -          The information in your CV and covering message: work history, education, qualifications, and any references or other details you decide to include.
   

   c. Customers, prospective customers, and their personnel. For contact, for providing our services and for concluding and performing a contract, we process:

   -          Business contact details of your contact persons: name, job title, business email and business telephone;

   -          Information needed to provide our services and manage the relationship: shipment, order and service details, correspondence, and customer-service and claim-handling records;

   -          Billing and payment data: invoicing details, payment references, bank or account details, and purchase order numbers.
   

   d. Suppliers, carriers, shippers, subcontractors and other business partners, and their personnel. We process:

   -          Business contact details: name, job title, business email and business telephone;

   -          Contract and performance data relating to the services provided;

   -          Payment data: bank account details, VAT and company registration number, and other data needed to process invoices.
   

   e. Persons recorded by CCTV at our premises. For safety and security we process:

   -          CCTV images of persons at our sites, for example at wash and maintenance bays, as indicated by the camera signage posted at the site entrance.
   

   f. Other people who contact us. If you contact us by email or telephone outside the situations above, we process your name, the organisation you represent, your contact details and the content of your message.
   

   g. Third parties involved in incidents, claims or insurance matters. Where an incident, damage or insurance claim arises in the course of our transport activities, we may process the name, contact details and incident or claim information of the individuals involved, so far as needed to handle the claim or to establish, exercise or defend a legal position.
   

   We do not seek special categories of personal data (such as health data) through the Website or when you contact us, and we kindly ask that you do not send us such personal data.

   When you visit the Website, certain technical data are processed automatically, because this is necessary to deliver the pages to your device and to keep the Website secure (we refer to our Cookie Policy). You cannot use the Website without this. Any other personal data is data you choose to provide. Providing personal data, for example, when you contact us or send a job enquiry, is not a statutory or contractual requirement and you are under no obligation to do so, but if you do not provide the information we need we may be unable to respond to you or to consider your enquiry.
   

3. How we collect it

   We collect personal data (i) automatically through server logs and cookies when you use the Website; (ii) directly from you when you contact us or send a job enquiry; and (iii) in some cases from other sources, for example the organisation you represent if you are a customer or supplier contact, or the parties involved where we handle an incident or claim (see section 4). We do not buy personal data about Website visitors from third parties, and we do not use the Website for marketing or behavioral advertising.
   

4. Personal data we obtain from sources other than you

   In limited cases we may hold personal data about you that we did not receive from you directly, for example your employer or organisation when you are a contact for one of our customers or suppliers, or the parties involved where we handle an incident or claim, or publicly accessible sources such as company websites and trade registers. Where this happens, the personal data is typically your name, business contact details and professional role. We use it for the purposes and on the legal bases set out in section 6, we keep it for the periods set out in section 9, and the rights in section 10 apply equally.
   

5. Cookies and similar technologies

   Full details of each cookie, its purpose and its lifespan are set out in our separate Cookie Policy You can also refuse or delete cookies through your browser settings, although parts of the Website may then not work properly.
   

6. Why we use your personal data, and our legal basis

   We only use your personal data for the purposes below, each with its legal basis under Article 6(1) GDPR:

    

   Purpose	Legal basis
   Operating, maintaining and securing the Website, and preventing misuse (technical data, server logs, strictly necessary cookies)	Legitimate interests (Art. 6(1)(f)): running a safe and functioning Website
   Placing non-essential cookies, if any	Consent (Art. 6(1)(a) GDPR and art. 11.7a Telecommunicatiewet)
   Responding to enquiries you send us by email	Legitimate interests (Art. 6(1)(f)): handling and answering your enquiry, or taking steps at your request before entering a contract (Art. 6(1)(b))
   Handling job enquiries sent to our HR address (assessing your application, contacting you)	Steps prior to a contract at your request (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)): managing our recruitment; consent (Art. 6(1)(a)) if we keep your details for future vacancies
   Providing our services to, and managing our relationship with, customers, including service communications (for example invoices, price changes, customer service)	Performance of our contract (Art. 6(1)(b)); legal obligation for invoicing and tax records (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)): managing the customer relationship
   Engaging suppliers, carriers, shippers and subcontractors, and paying their invoices	Performance of our contract (Art. 6(1)(b)); legal obligation for invoicing and tax records (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)): managing our supply chain
   Operating CCTV at our premises for safety and security	Legitimate interests (Art. 6(1)(f)): protecting people, our premises and our property
   Complying with legal and tax obligations, and handling incidents, claims and insurance matters, including establishing, exercising or defending legal claims	Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f))

   
   

   Several of the purposes above rely on our legitimate interests (Article 6(1)(f) GDPR). Before we rely on that basis, we carry out a legitimate interests assessment (LIA): we weigh our interests, or those of a third party, against your interests, rights and freedoms, and we only proceed where these are not overridden by yours. You also have the right to object to processing based on our legitimate interests (we refer to section 10). If you object, we will stop unless we can demonstrate compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims.
   

7. Who we share your personal data with

   We do not sell your personal data and we do not share it for third-party marketing. We may share it with:

   -          Companies within the Heniff Family of Companies, including our US shared-services function (Long Iron Services LLC) for IT support, accounts payable and headcount administration, on the basis described in our internal Data Protection Policy;

   -          Service providers acting on our instructions under a data processing agreement, in particular our Website hosting provider and our payment provider;

   -          Public authorities, advisers (such as lawyers and auditors) or other third parties where we are legally required to disclose, or where necessary to protect our rights, property or safety;

   -          A buyer or successor in the event of a reorganisation, merger or sale of the business.
   

8. International transfers

   Our Website is hosted in the United States and some of our group IT and finance support is provided from the United States, so your personal data may be transferred to and processed in countries outside the European Economic Area. For these transfers we rely on the European Commission’s Standard Contractual Clauses as safeguards under Chapter V GDPR, and, for recipients certified under the EU-US Data Privacy Framework, on that adequacy decision.
   

   9. How long we keep your personal data
   We keep personal data only as long as necessary for the purpose for which we collected it, and then delete it, unless a longer period is required by law, for example, invoicing and tax records 7 years, as required under Dutch law.
   

   10. Your rights

Under the GDPR you have the right to:

-          access your personal data (Art. 15);

-          have inaccurate data corrected (Art. 16);

-          have your data erased (Art. 17);

-          restrict our processing of your data (Art. 18);

-          receive certain data in a portable, machine-readable format (Art. 20);

-          object to processing based on our legitimate interests (Art. 21);

-          where we rely on your consent, withdraw it at any time, without affecting processing that has already taken place (Art. 7(3)).

We do not take decisions through the Website that are based solely on automated processing and produce legal or similarly significant effects (Art. 22).

To exercise your rights, contact us using the details in section 1. When we handle your request:

-          we respond without undue delay and within one month, which we may extend by up to two further months for complex or numerous requests, and we will tell you if we do;

-          we may ask you for information to confirm your identity before we act;

-          exercising your rights is free of charge, but if a request is manifestly unfounded or excessive we may charge a reasonable fee or refuse it, and we will explain our reasons; and

-          if we decide not to act, we will tell you why within one month.

You have the right to lodge a complaint with your local data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens (www.autoriteitpersoonsgegevens.nl).

11. How we protect your personal data
We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, in line with Article 32 GDPR. No transmission over the internet can be guaranteed fully secure, so please take care over what you send us by email.

12. Changes to this policy
We may update this policy from time to time. We will post any change on this page. Please check this page periodically. This policy was last updated on the date shown at the top.