Privacy Policy

Last updated: 07-07-2026

1. Who we are

Pefa B.V. (« Pefa », « we ») operates the website www.pefa.com and the Pefa services, including the Pefa Auction Clock, Pefa Data, Pefa eLog and Pefa Virtual VMS. Pefa B.V. is the controller for the processing of personal data described in this policy. Pefa B.V. Visafslagweg 1, 2583 DM Scheveningen, The Netherlands. Chamber of Commerce: 27310765 servicedesk@pefa.com — +31 (0)70 358 87 87

2. What this policy covers

This policy explains what personal data we process when you visit our website, contact us, or use our services, why we process it, on what legal basis, how long we keep it, and what rights you have.

Where Pefa processes personal data on behalf of a fish auction or another business customer (for example transaction data processed under an agreement with a connected auction), that organisation is the controller and Pefa acts as processor under a data processing agreement. In those cases, the controller’s privacy policy applies; questions and requests can be addressed to that organisation.

3. What personal data we process

Account and contract data. When you apply for a subscription we process the data on the application form: name, business name, contact details, buyer numbers, invoicing details and correspondence.

Service usage data. When you use the Pefa systems we process login data, transactions created under your account, and technical logs needed to operate and secure the services.

eLog reporting data. When you use Pefa eLog we process the catch and landing data you report, including vessel identification and the identity of the master, as required under EU fisheries control legislation (Regulation (EC) No 1224/2009).

Virtual VMS position data. When you use Pefa Virtual VMS we process vessel position data, which we transmit to the competent government authority in accordance with the applicable legal vessel monitoring obligations.

Website data. When you visit www.pefa.com we process limited technical data (IP address, browser type, pages visited) in server logs, and — subject to your cookie preferences — analytics data. See section 8 (Cookies).

Contact and applications. When you contact us or apply for a job, we process the information you send us.

4. Why we process your data and on what legal basis
  • Providing our services and managing your subscription — necessary for the performance of our agreement with you (art. 6(1)(b) GDPR).
  • Transmitting eLog and VMS data to government authorities — necessary to comply with legal obligations resting on you as the reporting party and, where applicable, on Pefa as transmitting party (art. 6(1)(b) and (c) GDPR).
  • Invoicing and administration — necessary to comply with our legal (tax) obligations (art. 6(1)(c) GDPR).
  • Securing our systems, preventing fraud and misuse — our legitimate interest in running secure and reliable services (art. 6(1)(f) GDPR).
  • Website analytics — your consent (art. 6(1)(a) GDPR), collected via our cookie banner.
  • Service communications (maintenance announcements, changes to terms) — our legitimate interest in properly informing users (art. 6(1)(f) GDPR).
  • Newsletters or commercial communications — only with your consent, or to existing customers for similar services with an opt-out in every message (art. 6(1)(a) and (f) GDPR).
5. Who receives your data

We share personal data only where necessary:

  • Connected fish auctions, for the execution of transactions and reporting under your subscription;
  • Government authorities, for eLog declarations and Virtual VMS position data, in accordance with EU and national fisheries legislation;
  • Service providers (processors) that support our operations, such as hosting, e-mail and support tooling. We have data processing agreements in place with these providers: available on request by contacting servicedesk@pefa.com;
  • Other parties only where we are legally required to do so.

We do not sell personal data.

6. International transfers

We store and process personal data within the European Economic Area where possible. Where a service provider processes data outside the EEA, we ensure appropriate safeguards, such as an adequacy decision (including the EU–US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses.

7. How long we keep your data
  • Account and contract data: for the duration of the subscription and up to 2 years thereafter;
  • Invoicing and administration: 7 years (Dutch statutory retention period);
  • eLog and VMS data: in accordance with the retention periods prescribed by fisheries legislation;
  • Server logs and security logs: 12 months;
  • Application data: 4 weeks after the end of the procedure, or 1 year with your consent.
8. Cookies

Our website uses functional cookies (necessary for the website to work, such as language selection and login) and — only with your consent — analytics cookies.

9. Security

We take appropriate technical and organisational measures to protect personal data, including encrypted connections (TLS), access control, logging and regular updates and backups.

10. Your rights

You have the right to access your personal data, and to rectification, erasure, restriction of processing, data portability, and to object to processing based on our legitimate interest. Where processing is based on consent, you can withdraw that consent at any time.

To exercise your rights, contact us at servicedesk@pefa.com. We respond within one month. We may ask you to verify your identity. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the supervisory authority in your own EU member state.

11. Changes to this policy

We may update this privacy policy. The current version is always available on this page.