Who is responsible for your personal information?
CCL Solar B.V., Oude Hoon 4-6, 3991 CZ Houten, the Netherlands ("CCL", "we", "us"), is the controller responsible for your personal information. This privacy policy explains how we process that information when you use our EU webshop, place orders, make enquiries or otherwise deal with us. For privacy enquiries, contact sales@cclsolar.eu or write to us at this address.
Our EU webshop serves business customers in EU countries without a dedicated CCL country webshop, excluding the Netherlands and Germany. Although we sell exclusively to businesses, individuals such as business contacts and sole traders retain their data protection rights. This policy concerns processing by CCL Solar B.V.; it does not automatically cover other group companies.
Why and on what basis do we use your personal information?
The information we process depends on your enquiry, the services you use and the permissions you give. We use personal information for the following purposes and on the following bases under the EU General Data Protection Regulation (GDPR):
- Orders, payments, delivery and contractual services: Article 6(1)(b) GDPR where processing is necessary for a contract with you personally. For contacts acting for a company, Article 6(1)(f) GDPR applies; our legitimate interest is establishing and managing the business relationship with your company.
- Customer accounts and access: Article 6(1)(b) GDPR for your own contractual relationship, or Article 6(1)(f) GDPR for company users and contacts, to manage authorised access and the business relationship.
- Enquiries, advice, complaints and customer support: Article 6(1)(b) GDPR for your own contractual matters or pre-contractual steps you request; otherwise Article 6(1)(f) GDPR, based on our interest in handling your enquiry and, where relevant, legal claims.
- Optional recommendations based on your browsing activity, personalisation or profiling require your consent under Article 6(1)(a) GDPR. Access to or storage on your device must also meet the applicable rules explained in the cookies section.
- Operating, maintaining and securing the website: Article 6(1)(f) GDPR, based on our interest in a functional, available and secure website. Optional audience measurement and behavioural analytics require your consent. The cookies section explains the requirements for access to or storage on your device.
- Participation in customer surveys is voluntary. Surveys and invitations with a promotional purpose are also subject to the requirements in the marketing section.
- Newsletters and electronic marketing: Article 6(1)(a) GDPR where you consent. Where the applicable national rules permit an existing-customer exception for our own similar products or services, the basis may be Article 6(1)(f) GDPR and our interest in promoting those products or services, subject to your rights and interests. The conditions and opt-out options are explained in the marketing section.
- Fraud prevention, prevention of misuse and legal claims: Article 6(1)(f) GDPR, based on our interests in protecting our systems and transactions, preventing financial loss and establishing, exercising or defending legal claims. We consider your rights and interests and use only the information needed.
- Legal retention, accounting and disclosure obligations: Article 6(1)(c) GDPR together with the applicable legal requirements.
- Applications for and management of credit accounts: Article 6(1)(b) GDPR where necessary for your own contract. Assessment of payment risk and business credit decisions may rely on Article 6(1)(f) GDPR, based on our interest in limiting defaults on purchases on credit. For company contacts, account administration relies on our legitimate interest in managing the business relationship.
The following conditions apply to these legal bases:
- Article 6(1)(b) GDPR covers only processing necessary for a contract to which you, as an individual, are a party, or for pre-contractual steps taken at your request.
- For legitimate interests under Article 6(1)(f) GDPR, we assess necessity and balance those interests against your interests, rights and freedoms. Your right to object is explained in the section on objections and withdrawal of consent.
- Consent under Article 6(1)(a) GDPR must be freely given, informed, specific and unambiguous. You can withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
- Article 6(1)(c) GDPR applies where processing is necessary to comply with a legal duty. Using a contact form, customer account or other function does not itself mean you consent to additional analytics or marketing. We provide any further information required before processing your information for a different purpose.
Where is your personal information processed and how long is it kept?
Personal information may be processed outside the European Economic Area (EEA) by group companies or service providers. Transfers to the United Kingdom may rely on the European Commission's adequacy decision under Article 45 GDPR. For the United States, the EU–US Data Privacy Framework adequacy decision applies only where the recipient is actively certified and the processing is covered. Where no applicable adequacy decision exists, an appropriate transfer mechanism is required, such as the Commission's standard contractual clauses under Article 46(2)(c) GDPR, together with an assessment of the protection available and supplementary measures where necessary. You can request information about the applicable safeguards and a copy of the relevant documents from our privacy contact.
Retention depends on the data category and the purpose. We consider the duration of the account or business relationship, the time needed to handle an enquiry or claim, and applicable legal, accounting and tax retention obligations. The reference lifetimes in the cookie list concern storage on your device. They do not determine how long personal information is retained in our systems or by service providers.
When the purpose no longer applies, we delete or anonymise the information unless a legal retention obligation or another valid legal basis requires us to keep it. During a legal retention period, its use is restricted accordingly. We may retain a necessary suppression record under Article 6(1)(f) GDPR so that we can continue to respect your marketing objection.
How do we protect your personal information?
We protect personal information through technical and organisational measures appropriate to the risks, as required by Article 32 GDPR. These include protection during transmission, access controls and limits on permissions.
- Encrypted transmission using HTTPS/TLS, with further safeguards appropriate to the information and connection concerned.
- Payment information is processed only to the extent needed for the payment method you choose. Further information is provided in the payment section.
- Customer accounts are protected by login credentials. You can update the information made editable in your account. Do not share your password with unauthorised people.
- Internal procedures and access controls designed to protect personal information against unauthorised access, loss, misuse or disclosure.
How do we use your personal information for marketing?
Marketing by email or SMS requires your prior consent, unless the applicable national rules permit an existing-customer exception. We use that exception only for our own similar products or services where we obtained your electronic contact details during a sale, offered an easy, free opt-out when collecting them and in every message, and you have not opted out. Any additional national requirements also apply. The GDPR basis is Article 6(1)(a) for consent or Article 6(1)(f) for the permitted exception, based on our interest in promoting our similar products and services and subject to your interests. Telephone marketing must satisfy the applicable national consent and marketing rules. Where permitted without consent, the basis is Article 6(1)(f) and our interest in relevant business communication; where consent is required, Article 6(1)(a) applies. Postal marketing may rely on Article 6(1)(f), subject to applicable rules, your interests and your right to object.
Personalising marketing using your browsing activity, optional tracking technologies or profiles across services requires your corresponding consent.
You can withdraw marketing consent at any time and object to the use of your personal information for direct marketing without giving a reason:
- Update your account preferences where this function is available.
- Use the unsubscribe option in a marketing email or SMS.
- Email sales@cclsolar.eu for the EU webshop. For enquiries concerning CCL Components Ltd in the UK, the group contact is admin@cclcomponents.com.
Where we use personalised social media advertising or match customer lists to create audiences, this requires your separate prior consent under Article 6(1)(a) GDPR. This may involve transmitting email addresses or hashes derived from them; hashed addresses can still be personal information. You can withdraw your consent through our privacy contact.
If you use an available chat, contact form or similar support tool, we process your contact details and message to deal with your enquiry. The basis is Article 6(1)(b) GDPR for your own contractual matter or pre-contractual request, or Article 6(1)(f) GDPR and our interest in handling customer communications. An enquiry is not consent to marketing or additional analytics. Optional analytics and any device access requiring consent need separate consent.
What are your privacy rights?
Subject to the legal conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and data portability (Article 20). Portability covers information you provide where processing is based on consent or a contract and is automated. The section on objections and withdrawal of consent explains those rights. Under Article 77 GDPR, you can complain to a supervisory authority, including the Autoriteit Persoonsgegevens in the Netherlands (www.autoriteitpersoonsgegevens.nl), or the authority in the Member State where you habitually live, work or believe an infringement occurred. This does not affect other remedies. To exercise your rights or ask a privacy question, write to CCL Solar B.V. at the address above or email sales@cclsolar.eu.
Updates to this privacy policy
We update this privacy policy when our processing activities, services or legal requirements change. The version date is shown below. We inform you of material changes where legally required. An update to this policy or your continued use of the website does not replace any new consent that is required.
Analytics
If we use Google Analytics 4, it helps us understand website use and improve our website. We carry out this analytics and audience measurement only with your consent under Article 6(1)(a) GDPR. Storage or access on your device that requires consent is also subject to applicable national cookie rules.
- Personal data: pseudonymous identifiers can still be personal data.
- Retention: the retention information in this policy applies to personal data. The lifetime of a device identifier is separate from any further retention of personal data.
- International transfers: the conditions in the section on where we process and retain personal data apply.
- Withdrawal: you can withdraw your consent at any time through Cookie settings.
If we use Bing Webmaster with visitor tracking that requires consent, we activate that tracking only after your consent under Article 6(1)(a) GDPR and applicable national cookie rules.
Electronic payments
For electronic payments, we process the payment and transaction data needed for your chosen payment method and send the necessary data to the relevant payment service provider using encrypted connections. The lawful basis is Article 6(1)(b) GDPR where you are personally a party to the contract, or Article 6(1)(f) GDPR where you act for a business, based on our legitimate interest in processing payments for that business relationship.
Privacy contact
For privacy questions or requests, contact CCL Solar B.V., Oude Hoon 4-6, 3991 CZ Houten, Netherlands, or email sales@cclsolar.eu.
Last updated: 28 October 2026
Personal data and required information
What information may we process?
- Identity and business contact details, including name, company, role, email address, telephone number and business address.
- Account, enquiry, order, delivery, invoicing and payment data, including information needed to handle complaints.
- Technical access and usage data collected for the purposes described in this policy.
- Consent choices and objection records, where needed to manage your preferences and rights.
- Credit information and other voluntary information, only within the scope of the processing explained to you.
What information do you need to provide?
At the point of collection, we explain which information is required by law or contract or is necessary to enter into a contract, and which information is optional. We also explain the consequences of not providing required information.
- Orders and contracts: without information needed to process the order, we may be unable to fulfil it.
- Delivery and invoicing: we need the address and relevant business details required for delivery and legally compliant invoices.
- Accounts, enquiries and forms: information that is not necessary is marked as optional.
- Marketing: consent is optional and requested separately. Refusing optional marketing does not prevent you from ordering or sending an enquiry.
- Optional personalisation and tracking: you decide through the consent choices described in this policy.
- Credit accounts: we separately explain what information is required and whether an alternative payment method is available.
Protection against automated submissions
Where we use Google reCAPTCHA or another form protection service, it helps prevent automated or abusive submissions. If consent is required for the service or access to your device, it is loaded only after you agree.
Links to other websites
When you follow a link to an external website, the privacy notice of the controller identified there applies. For data transferred through content or services embedded on our website, the responsibilities and lawful bases explained in this policy apply.
Objection and withdrawal of consent
You can object to processing based on legitimate interests in the circumstances below, and you can withdraw consent at any time for future processing:
- Under Article 21 GDPR, you may object to processing based on Article 6(1)(f) GDPR, including related profiling, on grounds relating to your particular situation. We then stop that processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims. You may object to direct marketing, including related profiling, at any time without giving a reason. We then stop using your data for those purposes.
- You can withdraw consent at any time through the settings used to give it or by emailing sales@cclsolar.eu. Withdrawal does not affect the lawfulness of earlier processing. Please use sales@cclsolar.eu for EU storefront requests.
Exercising your data protection rights is normally free of charge. A reasonable fee or refusal may apply only where permitted for manifestly unfounded or excessive requests under Article 12(5) GDPR. A reasonable administrative fee may also apply to additional copies under Article 15(3) GDPR.
We tell you what action we have taken without undue delay and within one month of receiving your request. Where the complexity or number of requests makes an extension necessary, this period may be extended by up to two further months; we explain the extension and its reasons within the first month. If we do not act on your request, we explain why and inform you of your right to complain and seek a judicial remedy. If we have reasonable doubts about your identity, we may request only the additional information needed to confirm it.