Stock & Trade Privacy Policy

This Privacy Policy explains how Begaho B.V., trading as Stock & Trade, processes personal data when you visit our website, contact us, submit stock, communicate with us or do business with us.

Version: 1.3
Last updated: 26 August 2026
Change: The Cookiebot section has been aligned with the standard GDPR banner and the retention period for Cookiebot end-user data has been corrected to a maximum of twelve months.

1. About this Privacy Policy

The Policy covers Stock & Trade’s public website, our contact and stock submission forms, business communications, our supplier and prospect administration, and the processing of data required to assess and manage a potential or existing business relationship.

Stock & Trade focuses on business contacts. The data we process may nevertheless be personal data, for example where it relates to an employee, entrepreneur, contact person or representative of an organisation.

2. Who is responsible for your personal data?

The controller is:

Begaho B.V., trading as Stock & Trade Vossenbeemd 45B 5705 CL Helmond The Netherlands

Dutch Chamber of Commerce number (KvK): 55169333 VAT number: NL851593586B01 Email for privacy enquiries: info@stockandtrade.nl

3. What personal data do we process?

The data we process depends on how you interact with us.

Contact and organisation details

We may process the following data, among other things:

first name and surname;
company name, trading name and website;
job title, department or business role;
business email address;
telephone and WhatsApp number;
business location and address details;
your preference for contact by email, telephone or WhatsApp;
the content and history of our communications.

Data about a stock submission

When you submit stock, we may also process data about:

the description, product categories and composition of the stock;
why the stock is available;
quantities, brands, models, product generations and product conditions;
storage location, preferred timescale and logistical circumstances;
arrangements or restrictions concerning sales countries, sales channels, timing, brand presentation or confidentiality;
the organisation on whose behalf you act and your authority to share the information;
stock lists, warehouse exports, returns reports, photographs, product specifications, condition reports and other files submitted voluntarily;
additional information you provide in an explanation or during subsequent contact.

Business relationship and transaction data

Where discussions lead to an assessment, proposal, agreement or transaction, we may process data about:

the history of contact and assessment;
agreements, proposals and correspondence;
contract, invoicing, payment, transport and transfer data;
internal case statuses and necessary administrative notes.

When you use our website, we may, depending on your consent choice, process data such as:

IP address and technical device and browser data;
pages visited and general usage data;
starting a form, reaching a form step, a technical error and successful server receipt;
cookie preferences and evidence of your consent choice;
limited technical log and security data required to keep the website safe and reliable;
when a form is used: security signals processed by Cloudflare Turnstile, including the IP address, TLS fingerprint, user agent, public sitekey and originating page.

We do not measure the content of your stock submission, your telephone number or other freely entered personal data as analytics parameters.

Business prospect data

For business acquisition, we may process limited data about relevant organisations and their business contacts. This may include the person’s name, position, organisation, business email address, business telephone number, professional profile, country, product category and the business reason for contacting them.

This data may come from the person or organisation concerned, public company websites, public registers, professional networks, trade media, trade fair and industry information, and other lawfully accessible business sources.

4. For what purposes and on what legal bases do we use personal data?

We process personal data only where there is a valid legal basis.

Purpose	Legal basis
Responding to a contact request and maintaining subsequent contact	Our legitimate interest in handling business enquiries and, where you request a proposal or collaboration, taking steps before entering into a contract
Receiving, checking, assessing and following up a stock submission	Our legitimate interest in assessing commercial stock opportunities and, where applicable, taking steps before entering into a contract
Requesting additional information and assessing the origin, composition, ownership position or commercial feasibility of stock	Our legitimate interest in conducting business carefully and responsibly
Entering into and performing an agreement, including arrangements about price, payment, logistics, transfer, channels and confidentiality	Performance of a contract or taking steps before entering into a contract
Maintaining our financial, tax and other statutory records	Compliance with legal obligations
Managing business relationships, suppliers, prospects, communications and follow-up in our administration and CRM	Our legitimate interest in careful and efficient business operations
Contacting relevant businesses and business contacts about potential stock or stock flows	Our legitimate interest in business acquisition, after balancing the interests and rights of the contact concerned
Preventing, investigating and resolving fraud, abuse, spam, security incidents and technical faults	Our legitimate interest in a safe and reliable website and business operation and, where applicable, a legal obligation
Distinguishing human form submissions from automated abuse using Cloudflare Turnstile	Our legitimate interest in the security and availability of our forms and infrastructure
Using non-essential cookies, Google Analytics 4 and any future marketing tags	Your consent
Recording your cookie preference and providing essential website functions	Necessary for the operation of the website and our legitimate interest in demonstrably respecting your choice
Establishing, exercising or defending legal claims	Our legitimate interest in protecting our legal position

Where we rely on a legitimate interest, we balance our business interest against your interests, rights and reasonable expectations. We limit processing to what is necessary for the relevant purpose.

The confirmation in the stock submission form that you have read the Privacy Policy is solely an acknowledgement of having read it. It is not consent to marketing or other non-essential processing.

5. Required and optional data

When stock is submitted, we request only the data needed to receive, assess and follow up the submission. Required fields are marked with an asterisk in the form.

At a minimum, the following information is required to submit stock:

a brief description of the stock;
at least one product category;
at least one stock situation;
at least one product condition;
the country and town, city or region where the stock is located;
company name, first name and surname;
a business email address and telephone number;
confirmation that the organisation owns the goods or is authorised to act on behalf of the stock owner;
confirmation that you have read the Privacy Policy.

Other information is optional, including an estimate of quantities, brands, additional details, preferred timescale, website, job title, contact preference, arrangements or restrictions, and attachments.

Files are not required. Share only information and files that are relevant to the assessment and that you are authorised to share with us. Where possible, do not include special-category personal data, citizen service numbers, copies of identity documents, private information or data about uninvolved third parties in free-text fields or attachments.

If you do not provide required information, we cannot receive the form or may be unable to assess and follow up the submission carefully. Not providing optional information will not prevent submission, but it may mean that we need to request additional information.

7. International transfers

Where possible, we choose processing and storage within the European Economic Area. However, some service providers or their subprocessors may process personal data from a country outside the European Economic Area.

Where personal data is transferred internationally, we use a valid transfer mechanism. This may be a European Commission adequacy decision or standard contractual clauses approved by the European Commission, supplemented by additional security measures where necessary.

An international transfer takes place only to the extent required for the service concerned and within the selected cookie and privacy settings.

For Cloudflare Turnstile, security signals may be processed outside the European Economic Area, including in the United States and through Cloudflare locations worldwide. Before activation, we check the applicable data processing agreement, standard contractual clauses and additional safeguards. Our server does not send an additional IP address to the Turnstile verification API.

8. How long do we retain personal data?

We do not retain personal data for longer than is necessary for the purpose for which it was collected, unless a legal obligation or the protection of our legal position requires a longer period.

Data or record	Retention period
Stock submissions and attachments that do not result in an agreement	Up to 12 months after the assessment or last substantive contact
General contact requests that do not result in a business relationship	Up to 12 months after completion or the last substantive contact
Active relationship and CRM records	For as long as the business relationship or specific follow-up remains active; thereafter, in principle, no more than 24 months after the last substantive contact
Prospect data concerning persons who have not yet been contacted	No more than 12 months after recording or the last reassessment
Prospect and communication data after contact without a business relationship	No more than 12 months after the last substantive contact
Minimal objection or opt-out record for commercial acquisition	Indefinitely, solely to ensure that the objection continues to be respected
Agreements, relevant correspondence and commercial records	During the relationship and thereafter, in principle, no more than 5 years, unless a longer statutory or necessary period applies
Tax and financial records	7 years, or longer where the law requires this for specific data
Routine technical logs	In principle, no more than 30 days
Cloudflare Turnstile token	Valid for no more than 5 minutes and usable once; Stock & Trade does not retain the token after verification
Logs required to investigate a security incident	No more than 12 months, or longer where necessary for a specific incident or legal obligation
Google Analytics 4 event data	14 months; the retention period is not reset with each new event
Cookie preference on the device	12 months
End-user data recorded by Cookiebot concerning the consent choice	No more than 12 months after recording
Privacy requests and their handling	5 years after completion
Backups	No more than 90 days within the routine backup cycle

Where data is held in a backup, it is not reused for routine business purposes. It is removed by overwriting in accordance with the backup cycle or, following restoration, is once again made subject to the applicable deletion and retention periods.

After a retention period expires, we delete or anonymise personal data unless further retention is required because of a legal obligation, ongoing dispute, security incident or specific legal claim.

9. Cookies and website analytics

Cloudflare Turnstile

We use Cloudflare Turnstile in Managed mode as an essential security measure for the contact form and stock submission form. Turnstile helps distinguish automated abuse and spam from legitimate form submissions. The security check forms part of the form and is not used for advertising purposes.

Turnstile processes technical signals such as the IP address, TLS fingerprint, user agent, public sitekey and originating page. Cloudflare uses these signals for bot detection and may also use them under its own responsibility to improve bot detection. We do not send Turnstile a name, email address, telephone number, form content or attachment, and we do not send the IP address again from our server. The short-lived verification token is checked only on the server for validity, one-time use, the expected hostname and the correct form purpose, and is then not retained by us.

This security check is not made dependent on consent to statistics or marketing cookies. We activate Turnstile only after checking the contractual transfer safeguards and our privacy information. More information is available in Cloudflare’s Turnstile Privacy Addendum.

We use Cookiebot, provided by Usercentrics A/S, to inform you about cookies, record your preferences and block non-essential cookies until you consent to them.

On your first visit, the standard GDPR banner displays three equivalent choices: Reject, Allow selection and Allow all. The banner uses explicit consent and does not pre-enable non-essential categories.

By selecting Allow all, you consent to all available cookie categories.
By selecting Reject, you reject non-essential cookies. Preferences, Statistics and Marketing remain disabled. Only essential cookies and security technologies remain active. Google Analytics 4 is not activated by this choice.
The category controls allow you to select Preferences, Statistics and Marketing separately. By selecting Allow selection, you record the combination you have chosen. The detailed view provides additional information for each category.

The Essential category cannot be disabled where the relevant cookies or technologies are required for the safe and correct operation of the website.

You may change or withdraw your choice at any time through the permanent link to the cookie settings on our website. Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Cookiebot records your consent choice so that we can respect and, where necessary, demonstrate it. Cookiebot continuously deletes the end-user data processed for this purpose after no more than twelve months. The current cookies, providers, purposes and retention periods are included in the Cookie Policy that Cookiebot makes available on or through this page.

Google Tag Manager is the central management layer for analytics and any future marketing tags. Relevant storage is set to denied by default until you provide the associated consent. Tags are activated in accordance with your Cookiebot choice.

Google Tag Manager does not itself set cookies, but it may activate services that do. We do not deploy separate marketing tags outside this controlled consent structure.

Google Analytics 4

Google Analytics 4 falls within the Statistics category and is activated only when you consent to it. We use this service to understand at a general level how the website is used and what technical or content improvements are needed.

We limit measurement to predefined events, such as starting the stock submission form, reaching a form step, a technical error and successful server receipt. A successful submission is measured only after the server has actually accepted it.

We do not send the content of a stock submission, telephone number, email address or other freely entered personal data to Google Analytics 4 as analytics parameters. Production, preview and test use separate configurations; preview and test environments do not send data to the production property.

The retention period for Google Analytics 4 event data is set to 14 months, without being reset by new activity.

10. Security of personal data

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, unwanted disclosure and unauthorised alteration.

Depending on the processing, these measures include:

secure connections using HTTPS;
server-side validation in addition to checks in the browser;
access restrictions based on roles and tasks;
secure accounts and careful management of access rights;
separation of production, test and preview environments;
protected storage of confidential data and uploads;
rate limiting and spam and bot protection;
fail-closed server-side verification of single-use Turnstile tokens against the hostname and form purpose, without retaining the token or sending the IP address again from the server;
limited technical logging and monitoring of security incidents;
backups and controlled restoration procedures;
periodic software, dependency and security updates;
appropriate arrangements with service providers that process personal data for us.

No security measure can completely eliminate all risks. We therefore review our measures regularly and adjust them where necessary.

Security of uploads

The stock submission form allows you to add up to 10 files with a total size of no more than 50 MB. Permitted file types are Excel, CSV, PDF, JPG, PNG and WebP.

Among other things, we check file extensions, file types and file sizes, use safe file names and may technically scan files for malicious content. Executable files, archive files and non-permitted file types are rejected. Access to uploaded files is restricted and files are deleted in accordance with the applicable retention periods.

Preferably share files through the secure form. Do not send sensitive stock information through insecure or unnecessary channels. If files are too large, you can submit the offer without them; where necessary, we will contact you about an appropriate way to share additional information.

Personal data breaches

A personal data breach may occur where personal data is lost, altered unintentionally, accessed without authorisation or sent to the wrong recipient.

If a potential personal data breach occurs, we investigate and document what happened. We take measures to contain the incident, prevent further harm and avoid recurrence. Where legally required, we report the breach, where possible, to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, within 72 hours of becoming aware of it. Where a personal data breach is likely to result in a high risk to the individuals concerned, we also inform them.

Do you suspect a security problem or personal data breach involving Stock & Trade? Report it as soon as possible to info@stockandtrade.nl and do not include unnecessary personal data in your first message.

11. Your data protection rights

You have the right to:

receive information about how we use your personal data;
access your personal data;
have inaccurate or incomplete personal data corrected;
have your personal data deleted, to the extent we no longer need it or are not legally required to retain it;
have the processing of your personal data restricted;
object to the processing of your personal data;
receive personal data that you provided to us in a portable format where the right to data portability applies;
withdraw consent previously given at any time.

Withdrawing consent does not affect the lawfulness of processing carried out before it was withdrawn.

Submitting a privacy request

You may submit a privacy request to info@stockandtrade.nl. Preferably state which right the request concerns and which data, communication or stock submission it relates to. This helps us handle your request carefully and specifically.

Do not send a copy of your identity document without being asked. If we have reasonable doubts about your identity, we may request additional information necessary to establish it. We will not request more data than necessary and will choose a secure verification method where possible.

We generally respond within one month of receiving your request. For a complex request or a large number of simultaneous requests, this period may be extended by up to two months. If that is necessary, we will inform you of the extension and the reason for it within the first month.

A privacy request is generally free of charge. Only where a request is manifestly unfounded or excessive, particularly because requests are repeated, may we charge a reasonable fee or refuse to act on the request within the limits of the GDPR. In that case, we will explain why.

Objecting to commercial acquisition

Where we use your personal data for direct marketing or commercial acquisition, you may object at any time. You do not have to give a reason. Once you have objected, we will no longer use your personal data for that purpose.

You may object by emailing info@stockandtrade.nl or by replying directly to the communication you received. To prevent you from being approached again for the same acquisition, we may retain a minimal opt-out or objection record.

Making a complaint

Do you have a question or complaint about how we handle your personal data? Contact us at info@stockandtrade.nl so that we can investigate it.

You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens. More information and the complaints form are available at www.autoriteitpersoonsgegevens.nl.

12. Automated decision-making

Stock & Trade does not make decisions based solely on automated processing that produce legal effects concerning you or otherwise similarly significantly affect you.

Technical checks, analyses and internal classifications may assist employees in handling a contact request, stock submission or acquisition record. Any assessment, rejection, price indication, offer or purchase decision is not made solely by automated means.

13. Changes to this Privacy Policy

We may amend this Privacy Policy where our website, services, data processing activities or legal obligations change. The most recent version is always published on this page. Where appropriate, we will provide separate notice of a material change.

The date on which the Privacy Policy was last updated is stated in the Policy.

14. Privacy contact

Do you have a question about this Privacy Policy or the processing of your personal data? Contact us: