Privacy Statement

Visma Aera B.V.

1.Introduction

When using P8, iASSET, or ScanGo and interacting with Visma Aera B.V., personal data about you is processed. This Privacy Statement helps you understand what personal data is collected, why it is collected and how Visma Aera B.V. handles, protects, stores, exports, and deletes your personal data.

Personal data is any information relating to an identified or identifiable natural person, such as an email address, street address, phone number, etc.

2.Contact us

If you have any comments or questions about our Privacy Statement, or any privacy concerns, including regarding a possible breach of your privacy, please contact us by sending an email to aera.privacy@visma.com or by using the privacy request form.

You can also contact our oﬃce at:
Visma Aera B.V.
Oﬃce: Plotterweg 38, 3821 BB Amersfoort
Telephone number: +31 (0)341 760 799

3.Visma Aera B.V. as a Processor

For the personal data processed in the applications P8, iASSET, or ScanGo, your employer is the Controller. Visma Aera B.V. does in such cases act as a Processor and processes the personal data on behalf of and according to instructions given by your employer. For more information regarding this, please contact customer support for the specific service.

If you want to invoke your rights in relation to the processing of your personal data in the [Visma application], you should direct this to your employer.

4.Visma Aera B.V. as a Controller

In some cases, Visma Aera B.V. will be the Controller for your personal data processed in the application. This is when Visma Aera B.V. determines the purposes and means of the processing of personal data.

When Visma Aera B.V. is the Controller for your personal data processed in the application P8, iASSET, or ScanGo, section 4.1 applies. When Visma Aera B.V. is the Controller for your personal data processed when interacting with us through other channels, section 4.2 applies.

4.1.Processing activities in the applications P8, iASSET, and ScanGo

Visma Aera B.V. processes your personal data in the applications P8, iASSET, and ScanGo for the processing activities as described below.
Categories of Data Subjects

iASSET:

End users of the customer In certain cases notifications may contain the following categories of data subjects: notifier, victim, suspect/perpetrator

P8:
Internal and external customer employees
Contact persons / rightful claimants for the customer (e.g. counter parties, notary, etc.)

ScanGo:

Internal customer employees
Owners of vehicles
Categories of Personal Data

iASSET:

Contact information, such as name, telephone, address, email, etc.
IP address
Gender
Role information, such as function, company, etc.

In certain cases notifications may contain the following categories of data subjects:
notifier, victim, suspect/perpetrator

P8:

Contact details, such as name, telephone, address, email, etc.
IP address
Gender
Role information, such as function, company, etc.
Company details, such as RVO number, etc.
Financial data
Ownership data
Contract details

ScanGo:

Contact details, such as name, telephone, address, email, etc.
IP address
Role information, such as function, company, etc.
License plate (and photographs of license plates);
Vehicle location data

Processing activities

Service improvement

Visma Aera B.V. continuously strives to improve and develop the quality, functionality, and user experience of our products and services. The personal data we process includes your name, email address, user and web traﬃc information such as login ID, username, and IP address.

Our legal basis for processing your personal data is our legitimate interest, cf. GDPR article 6 nr.

1 f). The legitimate interest is to ensure that we meet our customers’ expectations and fulfills all contractual commitments.

We will process your personal data only as long as necessary to fulfill the purpose. After three years, the personal data is deleted or anonymized for statistical use.

Marketing newsletters

Visma Aera B.V. uses email as a tool to distribute marketing communication, however only if you have consented in accordance with national marketing legislation (if needed). The personal data processed for this purpose is name and email address.

Our legal basis for this processing of personal data is our legitimate interests to provide

Following the instructions for opt-out in the relevant marketing communication
Changing preferences under the relevant account settings if you have an account with Visma Aera B.V.
Contacting us via e-mail at aera.privacy@visma.com
Contacting us via the contact form

Please note that when opting out from receiving marketing communications, you may still receive communications from Visma Aera B.V., such as order confirmations and notifications necessary to manage your account or the services provided to your [employer, municipality, school etc.]

Profiling

When you interact with Visma Aera B.V. as part of using our services, Visma Aera B.V. will be processing your personal data to provide relevant content to you through direct marketing on social media platforms and emails, webpages or in a service, based on your preferences.

The purpose of this profiling is to deliver customized marketing to you, improve your user experience with our services / websites and deliver products that our customers are satisfied with. The personal data processed are aggregated details about you such as IP address, interests (where you have clicked, etc.), username and device. This is done through technologies like cookies. See our Cookie Policy for a complete list of cookies that we use on our website, storage time for each cookie, recipient of cookie-data, and purpose for using said cookie-data.

Our legal basis for this processing of personal data is our legitimate interests to provide relevant content to you, cf. GDPR article 6 nr. 1 f). Visma Aera B.V. ’s services are generally used as tools for work-related purposes, and your behaviour in these tools says little about your personal life. No sensitive data is processed. Your personal data is processed from a business perspective in a way that we believe does not conflict with your freedoms and rights as an individual. The personal data will be deleted when you opt out of being subject to profiling by contacting us via e-mail at aera.privacy@visma.com or by using this form. Cookies are also subject to diﬀerent retention policies.

Security

Our legal basis for this processing of personal data is our legitimate interests, cf. GDPR article 6

nr. 1 f). The legitimate interest is to maintain a secure environment for our customers and operations.

We will only store your personal information for as long as necessary to fulfil the purpose of processing, and your personal data will normally be deleted according to our data deletion policy.

4.2.Other processing activities carried out by Visma Aera B.V.

Visma Aera B.V. also processes your personal data for the processing activities as described below.

Deliver products and services to customers

Visma Aera B.V. processes personal data to manage customer orders, agreements, and payments for the products and services we provide. The data processed includes basic personal details, such as name, address, telephone number, and email, along with invoice-related information. Our legal basis for this processing of personal data is our legitimate interests, cf. GDPR article 6 nr. 1 f). The legitimate interest is to facilitate the delivery of products and services to the customers’ contact person. We will only store your personal information for as long as necessary to fulfil the purpose of processing, but in most cases never longer than 3 years after your last registered activity.

Handling requests and providing support

The purpose of handling questions and concerns raised through a contact form, chatbot or similar on our website is to facilitate communication and support for users interacting with us. If you contact us via such channels, we will process the personal data that you include in the request. This will at minimum include contact details. Our legal basis for this processing of personal data is our legitimate interests, cf. GDPR article 6 nr. 1 f). The legitimate interest is to respond to questions and concerns raised by visitors on our website.

Requests and related correspondence are only stored as long as necessary to fulfil the purpose of processing, and no longer than 3 years after the last correspondence in relation to the request.

Recruitment

Visma Aera B.V. processes personal data during recruitment to eﬀectively manage recruitment processes, handle job applications, evaluate submitted documentation, conduct interviews, and contact references. The personal data processed for this purpose is contact information such as name, address, telephone number, and email, as well as CV, application and other documents

provided through the application. Our legal basis for this processing of personal data is our legitimate interests to find the right candidate, cf. GDPR article 6 nr. 1 f). For candidates that we elect to move forward with and oﬀer a job, we will process certain personal data, including your contact information and other specific

personal data you request us to process, for the purpose of entering into a contract pursuant to GDPR article 6 nr.1 b), which relates to processing necessary to perform a contract or to take steps at your requests, before entering a contract.

The personal data will be deleted when the recruitment process concludes. Typically, this occurs no later than four weeks after the recruitment process is concluded, unless an alternative arrangement is agreed upon with you.

Marketing newsletters

interested individuals with marketing communications, cf. GDPR article 6 nr. 1 f). The personal data will be deleted when you decide to opt out of receiving marketing communications from Visma Aera B.V.. This can be done in the following ways:
Following the instructions for opt-out in the relevant marketing communication Changing preferences under the relevant account settings if you have an account with

Visma Aera B.V.

Contacting us via e-mail at aera.privacy@visma.com

Contacting us via the form
Using the applicable subscription management tool Please note that when opting out from receiving marketing communications, you may stillreceive communications from Visma Aera B.V., such as order confirmations and notifications necessary to manage your account or the services provided to Customers.

Profiling

When you interact with Visma Aera B.V. e.g. by visiting our web pages, downloading content, attending webinars, and as part of using our services, Visma Aera B.V. will be processing your personal data to provide relevant content to you through direct marketing on social median platforms and emails, webpages or in a service, based on your preferences.

The purpose of this profiling is to deliver customized marketing to you, improve your user experience with our services / websites and deliver products that our customers are satisfied with. The personal data processed are aggregated details about you such as IP address, interests (where you have clicked, etc.), username and device. This is done through technologies like cookies. See our Cookie Policy [add link] for a complete list of cookies that we use on our website, storage time for each cookie, recipient of cookie-data, and purpose for using said cookie-data.

Security

Visma Aera B.V. processes personal data in order to detect, mitigate, and prevent security threats and abuse, as well as perform necessary maintenance and debugging. The personal data involved includes your name, email address, user and web traﬃc data such as login ID, username, IP address, and device information. Our legal basis for this processing of personal data is our legitimate interests, cf. GDPR article 6 nr. 1 f). The legitimate interest is to maintain a secure environment for our customers and operations. We will only store your personal information for as long as necessary to fulfil the purpose of processing, and your personal data will be deleted according to our data deletion policy.

Registration for webinars and courses

When registering for webinars and courses, we collect personal data, which is also used forfollow-up after the course, such as issuing course certificates. The personal data processed iscontact information such as name and email, billing details, and details of the registered course. Our legal basis for this processing of personal data is our legitimate interests, cf. GDPR article 6 nr. 1 f). The legitimate interest is to provide webinars and courses to interested individuals.

We will only store your personal information for as long as necessary to fulfil the purpose of processing, and your personal data will be deleted according to our data deletion policy.

Service improvement

Visma Aera B.V. continuously strives to improve and develop the quality, functionality, and user experience of our products, services, and websites. The personal data we process includes your name, email address, user and web traﬃc information such as login ID, username, and IP address. Additionally, we process statistics that indicate how you use our software and engage with content on our website.

Our legal basis for processing your personal data is our legitimate interest, cf. GDPR article 6 nr.

1 f). The legitimate interest is to ensure that we meet our customers’ expectations and fulfills all

contractual commitments. We will process your personal data only as long as necessary to fulfill the purpose. After three years, the personal data is deleted or anonymized for statistical use.

4.3.How your personal data may be shared

4.3.1.Within the Visma Group

Visma Aera B.V. is a part of the Visma Group, which consists of several subsidiaries. In order to

maintain an overview and insight, we may share your personal data across companies in the

Visma Group.

4.3.2.Outside of the Visma Group

Visma Aera B.V. may also share your personal data with external third parties in the following

contexts:

Processors

Visma Aera B.V. uses processors to process personal data. These processors are typicallyvendors of cloud-based services or other IT services. When using processors, Visma Aera B.V. willenter into a data processing agreement in order to safeguard your privacy rights. If processors are located outside the EU/EEA, we ensure legal grounds for such international transfers on yourbehalf, hereunder by using the EU Model Clauses. You are welcome to request more detailedinformation on our processors by contacting us as described in the section “Contact us”.

User communities
If you make a post, comment or similar on user communities or other forums or sites, such information can be read and used by anyone with access to such forums. Visma Aera B.V. is not responsible for any information you submit on such forums or sites.

Business partners

Visma Aera B.V. may share your personal information with partners in the event this is legitimate from a business perspective and according to applicable privacy legislation.

Public authorities
The police and other authorities may request access to personal information from Visma Aera B.V. . In these cases, we will only provide the data if there is a court order etc. to do so.

4.4.Your rights

You can invoke the following rights in relation to our processing of your personal data:
Access. You have the right to request a copy of personal data we process about you.
Rectification. You also have the right to request rectification of inaccurate personal data concerning you. If you have an account for our sites or services, this can usually be done through the appropriate “your account” or “your profile” sections on the applicable site or service.
Deletion. You can request deletion of personal data relating to you.
Restriction. You may ask us to restrict the processing of your personal data
Portability. You may ask us to provide you or others with your personal data in a structured, commonly used and machine-readable format.

Object.You have the right to object to our processing of your personal data on the basis of legitimate interests or for direct marketing purposes. You also have the right to object to our processing of your personal data for the performance of tasks carried out in the public interests or in the exercise of oﬃcial authority or based on legitimate interests.

Please note that there may be certain exceptions or limitations to the abovementioned rights which could apply depending on the specific circumstances of your situation. In such cases, we will provide you with detailed information about the applicable exception or limitation and help you exercise your rights to the fullest extent possible, in accordance with applicable laws and regulations.
Please send a mail to aera.privacy@visma.com to file requests as mentioned in this section. Finally, you also have a right to file a complaint to the data protection authorities with regards to our processing of your personal data.

5.Changes

We encourage you to review the Privacy Statement regularly. If we make significant changes to

the Privacy Statement that materially alter our privacy practices, we will notify you of this.

The Privacy Statement was last updated: 06-01-2025.