Privacy Statement

Wattman Europe BV, a Dutch private limited company trading as Wattman World, registered at Koningsbeltweg 74G, 1329 AK Almere, The Netherlands ("Wattman World," "we," "us," or "our"), is the controller responsible for the processing of personal data as described in this Privacy Statement within the meaning of the General Data Protection Regulation (EU) 2016/679 ("GDPR"). Wattman World takes the protection of personal data seriously and processes all personal data in accordance with the GDPR and applicable Dutch data protection legislation. This Privacy Statement explains what personal data we collect, why we collect it, how we use it, with whom we share it, and what rights you have. Questions or concerns regarding this Privacy Statement may be directed to privacy@wattmanworld.com.

This Privacy Statement applies to all personal data collected through the website located at wattmanworld.com (the "Website"), through direct communications with Wattman World (including email, phone, and in-person interactions), and through the purchase, delivery, and servicing of products sold by Wattman World.

Wattman World may collect the following categories of personal data:

• (a) Identity and contact information: name, business name, email address, phone number, mailing address, delivery address, and billing address.
• (b) Transaction and order information: order number, customer number, payment information, bank details (IBAN/BIC), outstanding balances, invoice records, and complaint content.
• (c) Business identifiers: Chamber of Commerce number (KvK), VAT identification number, and similar business registration details where applicable.
• (d) Website usage data: IP address, browser type, device information, pages visited, click behavior, and general geographic location (city/region level) as collected through cookies and similar technologies.
• (e) Communications data: content of emails, contact form submissions, and other messages directed to Wattman World.
• (f) CRM data: name, email, phone, location, order history, and communication records maintained for ongoing customer relationship management.

Wattman World processes personal data only when there is a valid legal basis under Article 6(1) GDPR. The following specifies each processing purpose, the categories of data involved, the legal basis, and the applicable retention period.

Services, Order Management, and Financial Administration

• Order management and fulfillment (processing orders, coordinating delivery and logistics, managing invoicing, processing payments). Data categories: (a), (b), (c), (e). Legal basis: Article 6(1)(b) GDPR, necessary for the performance of a contract. Retention period: Duration of the contract plus seven (7) years for financial records as required by Dutch fiscal retention obligations (Algemene wet inzake rijksbelastingen).
• Customer service and complaint handling (responding to inquiries, resolving complaints, providing after-sale and warranty support). Data categories: (a), (b), (e). Legal basis: Article 6(1)(b) GDPR, necessary for the performance of a contract. Retention period: Duration of the contract plus two (2) years following resolution of the complaint or inquiry.
• Financial administration (maintaining accounting records, tax compliance, audit support). Data categories: (a), (b), (c). Legal basis: Article 6(1)(c) GDPR, necessary for compliance with a legal obligation. Retention period: Seven (7) years following the end of the fiscal year in which the transaction occurred.

Customer Relationship Management

• Customer relationship management (maintaining customer records, order history, and communication logs to provide informed and efficient service). Data categories: (a), (b), (e), (f). Legal basis: Article 6(1)(f) GDPR, legitimate interest. Legitimate interest: Maintaining effective and personalized customer relationships to deliver high-quality service and support. Balancing test: The processing is limited to business contact data and transaction history. The data is not sensitive in nature. Data subjects can reasonably expect that a supplier maintains these records. The impact on privacy is minimal relative to the business benefit. Data subjects may object at any time under Section 10(e). Retention period: Duration of the active customer relationship plus three (3) years following the last meaningful interaction. Earlier deletion upon request.

Marketing

• Marketing communications (sending newsletters, product updates, and promotional materials to existing customers and interested prospects). Data categories: (a), (d), (f). Legal basis: Article 6(1)(f) GDPR, legitimate interest; or Article 6(1)(a) GDPR, consent, where required by applicable law. Legitimate interest: Promoting products and services to individuals who have an existing business relationship with Wattman World or who have expressed interest. Balancing test: Marketing is limited to business-relevant product information. Each communication includes an unsubscribe mechanism. No profiling with significant effects is performed. The impact on privacy is minimal. Data subjects may opt out at any time. Retention period: Until the individual opts out or requests deletion.
• Website analytics (analyzing website traffic and usage patterns to improve website functionality and user experience). Data categories: (d). Legal basis: Article 6(1)(f) GDPR, legitimate interest. Legitimate interest: Improving digital services and understanding how visitors use the Website. Balancing test: Data is collected in anonymized or pseudonymized form where possible. No individual decisions are made based on analytics data. The impact on privacy is minimal. Retention period: Identifiable data retained for no longer than twenty-four (24) months. Anonymized and aggregated data may be retained indefinitely.
• Market research (analyzing market trends and customer needs to inform product and service development). Data categories: (a), (d). Legal basis: Article 6(1)(f) GDPR, legitimate interest. Legitimate interest: Business development and product improvement. Balancing test: Research is conducted on aggregated data where possible. No individual profiling with legal or similarly significant effects. Minimal privacy impact. Retention period: Aggregated research data retained indefinitely. Identifiable data deleted or anonymized within twenty-four (24) months of collection.

Wattman World obtains personal data through the following sources:

• Directly from you: when you place an order, submit a contact form, request a consultation, subscribe to a newsletter, communicate with us by email or phone, or otherwise provide information to Wattman World.
• Through your use of the Website: when cookies and similar technologies collect usage data as described in Section 9 of this Privacy Statement.
• From third-party sources: in limited circumstances, Wattman World may receive personal data from trade show organizers, referral partners, or publicly available business directories, solely for the purpose of establishing business contact.

Wattman World may share personal data with the following categories of recipients, solely to the extent necessary for the purposes described in Section 4:

• Processors: third-party service providers who process personal data on behalf of Wattman World pursuant to a data processing agreement in accordance with Article 28 GDPR. These include payment processors, shipping and logistics carriers, email marketing platforms, website hosting providers, and CRM software providers.
• Affiliated entities: Wattman USA Inc., located in Cape Coral, Florida, United States, to the extent necessary for coordinated customer service or order fulfillment involving international transactions. Data transfers to Wattman USA Inc. are governed by Section 7.
• Manufacturer: Wattman Trains & Trams Inc., 828 Boul Industriel, Granby, QC J2J 1A4, Canada, to the extent necessary for warranty administration, product support, and order fulfillment. Data transfers to the Manufacturer are governed by Section 7.
• Legal and regulatory authorities: government agencies, courts, or regulators when required by applicable law, legal process, or enforceable governmental request.
• Professional advisors: attorneys, accountants, and auditors in connection with the operation of our business, subject to professional confidentiality obligations.

In the ordinary course of business, personal data may be transferred to and processed in countries outside the European Economic Area ("EEA"), including:

• United States of America: in connection with the affiliated entity Wattman USA Inc. and certain service providers.
• Canada: in connection with the Manufacturer, Wattman Trains & Trams Inc. The European Commission has issued an adequacy decision for Canada (for transfers subject to PIPEDA), meaning that Canadian organizations subject to PIPEDA are considered to provide an adequate level of data protection.

For transfers to countries without an adequacy decision (including the United States), Wattman World relies on appropriate safeguards as required by Article 46 GDPR, including Standard Contractual Clauses adopted by the European Commission. A copy of the applicable safeguards may be obtained by contacting privacy@wattmanworld.com.

The specific retention periods applicable to each processing purpose are set out in Section 4. The following general principles apply:

• Personal data is retained only for as long as necessary to fulfill the purpose for which it was collected, unless a longer retention period is required by law.
• When personal data is no longer required, it is securely deleted or irreversibly anonymized.
• In the event of a pending legal claim, complaint, or audit, relevant personal data may be retained beyond the standard retention period until the matter is fully resolved.
• Wattman World periodically reviews its data holdings to ensure compliance with the retention periods specified in this Privacy Statement.

The Website uses cookies and similar technologies to facilitate website functionality, analyze usage patterns, and support marketing efforts. Cookies are small text files placed on your device when you visit the Website.

• Strictly necessary cookies: required for the Website to function properly. These cookies are placed without consent as they are essential for the provision of the service. Legal basis: Article 6(1)(b) GDPR.
• Analytics cookies: used to collect data about how visitors use the Website, including pages visited, time spent, and navigation patterns. These cookies are placed only with your consent. Wattman World uses Google Analytics or similar tools for this purpose. Where Google Analytics is used, IP anonymization is enabled. Legal basis: Article 6(1)(a) GDPR, consent.
• Marketing cookies: used to deliver relevant content and to measure the effectiveness of marketing campaigns. These cookies are placed only with your consent. Legal basis: Article 6(1)(a) GDPR, consent.

Upon your first visit to the Website, a cookie consent banner is displayed allowing you to accept or decline non-essential cookies. You may withdraw your consent at any time by adjusting your cookie preferences through the cookie settings link on the Website or through your browser settings. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

For more information about cookies and how to manage them, visit www.allaboutcookies.org.

Under the GDPR, you have the following rights regarding your personal data. Wattman World will facilitate the exercise of these rights without undue delay and in any event within one (1) month of receipt of a verified request. This period may be extended by two (2) further months where necessary, taking into account the complexity and number of requests. Wattman World will inform you of any such extension within one (1) month of receipt of the request, together with the reasons for the delay.

• Right of access (Article 15 GDPR): you have the right to obtain confirmation as to whether Wattman World processes your personal data and, if so, to obtain a copy of that data together with information about the purposes of processing, the categories of data concerned, the recipients, the retention periods, and your rights.
• Right to rectification (Article 16 GDPR): you have the right to request correction of inaccurate personal data and to have incomplete personal data completed.
• Right to erasure (Article 17 GDPR): you have the right to request deletion of your personal data where (i) the data is no longer necessary for the purposes for which it was collected, (ii) you withdraw consent and no other legal basis applies, (iii) you exercise your right to object and no overriding legitimate grounds exist, or (iv) the data has been unlawfully processed. This right does not apply where processing is necessary for compliance with a legal obligation or for the establishment, exercise, or defense of legal claims.
• Right to restriction of processing (Article 18 GDPR): you have the right to request restriction of processing where (i) you contest the accuracy of the data (for a period enabling verification), (ii) the processing is unlawful and you oppose erasure, (iii) Wattman World no longer needs the data but you require it for legal claims, or (iv) you have objected to processing pending verification of whether our legitimate grounds override yours.
• Right to object (Article 21 GDPR): you have the right to object to processing based on legitimate interest (Article 6(1)(f) GDPR) on grounds relating to your particular situation. Wattman World will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims. Where personal data is processed for direct marketing purposes, you have the right to object at any time, and Wattman World will cease processing for that purpose without exception.
• Right to data portability (Article 20 GDPR): where processing is based on consent or on the performance of a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller without hindrance.
• Right to withdraw consent (Article 7(3) GDPR): where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
• Right not to be subject to automated decision-making (Article 22 GDPR): you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you. Wattman World does not currently engage in automated decision-making of this nature.

To exercise any of the above rights, submit a request to privacy@wattmanworld.com. Wattman World may request verification of your identity before processing the request. There is no charge for exercising your rights, unless requests are manifestly unfounded or excessive, in which case Wattman World may charge a reasonable fee or refuse to act on the request.

If you believe that Wattman World has processed your personal data in violation of the GDPR or applicable Dutch data protection legislation, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):

Autoriteit Persoonsgegevens
Postbus 93374
2509 AJ Den Haag
The Netherlands
Website: www.autoriteitpersoonsgegevens.nl

Wattman World encourages you to contact us first at privacy@wattmanworld.com so that we may attempt to resolve your concern directly.

Wattman World implements appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction, in accordance with Article 32 GDPR. These measures include access controls, encryption of data in transit, secure storage, and regular review of security practices. No method of transmission over the internet or electronic storage is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Wattman World will notify the Autoriteit Persoonsgegevens without undue delay and, where required, will inform affected data subjects in accordance with Articles 33 and 34 GDPR.

The Website and services offered by Wattman World are directed to businesses and individuals of legal age. Wattman World does not knowingly collect personal data from children under the age of sixteen (16). If Wattman World becomes aware that personal data has been collected from a child under sixteen, that data will be deleted promptly. If you believe that personal data of a child under sixteen has been provided to Wattman World, contact privacy@wattmanworld.com.

Wattman World may update this Privacy Statement from time to time to reflect changes in our practices, legal requirements, or business operations. The updated Privacy Statement will be posted on the Website with a revised "Last Updated" date. Where changes are material, Wattman World will take reasonable steps to inform data subjects, including by posting a notice on the Website. Wattman World encourages Visitors to review this Privacy Statement periodically.

For questions, requests, or complaints regarding this Privacy Statement or the processing of your personal data, contact:

Wattman Europe BV, trading as Wattman World
Koningsbeltweg 74G
1329 AK Almere
The Netherlands
Email: privacy@wattmanworld.com