This policy explains, in plain language, what personal data Goffin collects, why we collect it, the lawful basis we rely on, how long we keep it, who we share it with and the rights you have. We handle your data carefully, the same way we expect our partners to handle a sample.
01, Who we are
The data controller
Goffin is the Benelux distributor of molecular and immunodiagnostics, bringing together two units, Goffin Molecular Technologies and Goffin Biosciences. For the personal data described in this policy, Goffin is the data controller: we decide why and how it is processed.
You can reach us at our office in Waalwijk, by phone or by email. Our full contact details are in section 10 and in the footer of every page.
- Goffin · Vijzelweg 18a, 5145 NK Waalwijk, The Netherlands
- +31 (0)85 0045479 · Mon–Fri 08:30–17:00
- info@goffinmt.com · we typically reply within 24 hours
02, Data we collect
What personal data we collect
We only collect what we need to answer your questions, prepare a quote, fulfil an order and support your lab. We do not buy personal data, and we do not build advertising profiles. As a B2B diagnostics distributor, the data we process is overwhelmingly professional contact information.
Data you give us
- Identity & contact details, your name, job role, organisation, work email, telephone number and the lab or department address used for delivery and invoicing.
- Enquiry & quote content, the products, assays, platforms or targets you ask about, the contents of your quote basket, and anything you write in a message or order note.
- Account & order records, if you hold an account, your login email and a history of quotes, orders and documentation we have provided.
Data we collect automatically
- Technical & usage data, when you visit our website we may receive your IP address, browser and device type, the pages you view and the date and time, mostly through strictly necessary and (with consent) analytics cookies.
The quote basket on this site is stored locally in your browser (via localStorage) and is not sent to us until you choose to request a quote. We do not intentionally collect special categories of personal data, and our site is not directed at children.
03, Purpose & lawful basis
Why we use it, and our lawful basis
Under the GDPR we must have a lawful basis for every purpose. The table below sets out what we do with your data and the basis we rely on for each activity.
Where we rely on legitimate interests, we have weighed them against your rights and freedoms. Where we rely on consent, you may withdraw it at any time without affecting processing that already took place.
04, Cookies & analytics
Cookies and analytics
We use a small number of cookies to keep the site working and, only with your consent, to understand how it is used so we can improve it. Strictly necessary cookies do not need consent; analytics and any non-essential cookies are only set after you agree.
You can change or withdraw your cookie choices at any time. A full breakdown of the cookies we use, their purpose and lifetime is on our dedicated cookies page.
05, Recipients
Who we share your data with
We never sell your personal data. We share it only where necessary to run our business and provide what you have asked for, and always under appropriate agreements that limit how it may be used.
- Manufacturers & suppliers, the diagnostics brands we represent, where this is needed to quote, configure, ship or support a product for you.
- Logistics & courier partners, to deliver orders and the documentation that travels with them.
- Service providers, IT hosting, email, accounting and similar processors acting on our instructions under a data-processing agreement.
- Authorities & advisers, regulators, auditors or legal advisers where we are required to, or to establish or defend a legal claim.
06, International transfers
Transfers outside the EEA
We keep personal data within the European Economic Area wherever we can. If a manufacturer or service provider we work with is located outside the EEA, we only transfer data where the European Commission has recognised the country as providing adequate protection, or under appropriate safeguards such as the EU Standard Contractual Clauses.
If you would like more detail on a specific transfer relevant to you, contact us using the details in section 10.
07, Retention
How long we keep your data
We keep personal data only for as long as we need it for the purpose it was collected, and then delete or anonymise it. In practice that means:
- Enquiries & quotes that don’t proceed, kept for up to 24 months, then removed, so we can pick up a conversation you return to.
- Orders, contracts & support records, kept for the life of the customer relationship plus a reasonable period afterwards.
- Accounting & invoicing records, kept for at least 7 years to meet our statutory tax obligations in the Netherlands.
- Analytics data, retained in aggregated or pseudonymised form for a limited period as set out on the cookies page.
08, Security
How we protect your data
We apply appropriate technical and organisational measures to keep your data safe, encrypted connections to our website, access controls that limit who can see personal data, and processors who are contractually bound to protect it. We work to a quality-managed (ISO 13485) way of working, which carries through to how we handle records.
No system can be guaranteed completely secure, but if a personal-data breach were ever to put your rights at risk, we would notify the relevant supervisory authority and, where required, you, without undue delay.
09, Your rights
Your rights over your data
Under the GDPR you have a number of rights. You can exercise any of them free of charge by emailing us, we will respond within one month.
Access
Ask for a copy of the personal data we hold about you and how we use it.
Rectification
Have inaccurate or incomplete data corrected or completed.
Erasure
Ask us to delete your data where there is no overriding reason to keep it.
Restriction
Limit how we use your data while a query about it is being resolved.
Portability
Receive data you gave us in a structured, machine-readable format.
Object & withdraw consent
Object to processing based on legitimate interest, and withdraw consent at any time.
You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). We would, of course, appreciate the chance to resolve your concern first.
10, Changes & contact
Changes to this policy, and how to reach us
We may update this policy from time to time, for example, if our processing or the law changes. We will revise the “last updated” date at the top of this page, and where the change is significant we will make it clear. We encourage you to review this page periodically.
To exercise a right, ask a question or raise a privacy concern, please get in touch using the details below. We treat privacy requests as a priority and aim to respond within 24 hours, and in any event within the statutory one month.
Contact us about your data
Questions about this policy or a request about your personal data go to our team in Waalwijk.