Translation — if you notice errors, email info@zeres.nl

GDPR & Privacy Policy – ZERES B.V.

Version: 15 February 2026

Last updated: 1 March 2026

1. Who is responsible?

This privacy policy applies to the processing of personal data by:

ZERES B.V. Registered office: Zeeburgerdijk 490, Amsterdam Chamber of Commerce number: 99395142 Email: info@zeres.nl Telephone: 085 – 060 0641 Website: www.zeres.nl

ZERES B.V. is the data controller within the meaning of the General Data Protection Regulation (GDPR).

2. What does ZERES do?

ZERES specialises in administering and registering Emission Reduction Units (ERUs) for businesses, homeowners' associations (VvEs) and private individuals. In that context we process personal data.

3. What personal data do we process?

Depending on your relationship with ZERES, we may process the following data:

Contact details:

• Name
• Company name
• Address details
• Email address
• Telephone number

Contract and administration details:

• Invoice details
• Bank account number
• Chamber of Commerce number
• VAT number

Energy and charging data:

• Charging station ID
• Location data
• kWh consumption data

Website data:

• IP address
• Browser data
• Cookie data
• Browsing behaviour on the website

We do not process special categories of personal data unless this is strictly necessary and legally permitted.

4. For what purposes do we process data?

ZERES processes personal data solely for the following purposes:

• Performing agreements (such as ERU registration services);
• Recording and administering emission reductions;
• Invoicing and financial administration;
• Communicating with clients and partners;
• Complying with statutory obligations;
• Improving our website and services;
• Marketing communications (if consent has been given).

5. On what legal basis do we process data?

We process personal data on the basis of:

• Performance of a contract (Article 6(1)(b) GDPR);
• Legal obligation (Article 6(1)(c) GDPR);
• Legitimate interest (Article 6(1)(f) GDPR);
• Consent, where required (Article 6(1)(a) GDPR).

6. How long do we retain data?

We retain personal data no longer than necessary for the purpose for which it was collected, unless we are legally required to retain data for a longer period (the NEa requires 5 years).

7. Do we share personal data with third parties?

ZERES only provides personal data to third parties where this is necessary for the performance of our services or to comply with statutory obligations.

This may include:

• IT service providers and hosting providers;
• Bookkeeping or accounting firms;
• Competent authorities;
• Payment service providers.

We share data with partners where the client has entered the partner code themselves during registration.

We enter into data processing agreements with processors in accordance with Article 28 GDPR. We do not sell personal data to third parties.

8. Transfers outside the EU

Personal data is in principle processed within the European Economic Area (EEA). If data is processed outside the EEA, we ensure appropriate safeguards in accordance with Chapter V GDPR (such as Standard Contractual Clauses).

9. Security

ZERES takes appropriate technical and organisational measures to protect personal data against loss or unlawful processing. These include:

• Encrypted connections (SSL/TLS);
• Access restrictions based on authorisation; 8 characters including non-alphanumeric characters.
• Two-factor authentication where appropriate;
• Logging and monitoring;
• Periodic security updates.

10. Your rights

You have the right to:

• Obtain access to your personal data;
• Have data corrected;
• Have data erased;
• Restrict processing;
• Object to processing;
• Transfer your data (data portability);
• Withdraw your consent (where applicable).

You can submit a request via: info@zeres.nl. We will respond to your request within one month.

11. Cookies

ZERES uses functional and analytical cookies to ensure the website functions properly and to analyse its use. If marketing cookies are used, we will ask for prior consent via a cookie banner.

Further details may be included in a separate cookie statement.

12. Complaints

If you have a complaint about the processing of your personal data, we request that you first contact us.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, www.autoriteitpersoonsgegevens.nl).

13. Changes

ZERES reserves the right to amend this privacy policy. The most current version is always available on our website.

Cookies

Zeres places the following categories of cookies on your device:

Necessary cookies

These cookies are required for the website to function correctly and are always placed.

• Session cookies for form protection (CSRF) and login session (admin)
• Cloudflare Turnstile for spam protection on contact and registration forms

Analytics cookies (after consent)

Help us improve the website. Only placed after explicit consent via the cookie banner.

• Google Analytics — anonymous visitor statistics, controlled via Google Consent Mode v2

Marketing cookies (after consent)

Used for lead conversion tracking. Only after explicit consent.

You can change your cookie settings at any time via the "Cookie settings" link in the footer.