Introduction

Publican BE places great importance on the secure, transparent and confidential collection and processing of your personal data. In particular, we want to protect the data of our clients, suppliers and other contact persons against loss, leaks, errors, wrongful access or unlawful processing.

By means of this Data Protection Policy we wish to inform you about the collection and processing of your personal data. We ask that you read this Data Protection Policy carefully, since it contains essential information about how your personal data are processed and for which purposes.

By communicating your personal data, you expressly declare that you have taken knowledge of this Data Protection Policy and that you expressly accept it, as well as the processing itself.

Scope of application

This Data Protection Policy relates to all business and services that are provided by (or to) us and to all activities that we perform generally.

Controllers

BV Publican BE, with registered office established at Eugeen Meeusstraat 73, 2170 Antwerp, Belgium, and company number 0791.597.994 is the controller of your personal data.

When collecting and processing your personal data, we respect the Belgian regulations on the protection of personal data, as well as the General Data Protection Regulation ("GDPR") as of its entry into force on 25 May 2018.

Personal data

Depending on your activities and your relationship to our company, we will be processing the following of your personal data: your personal identification data (e.g. name, address, contact details etc.); customer number; national register number (within the framework of our legal obligation); user account details; product usage data (measurement of the engagement of the user accounts with our product(s)); financial identification data; solvency data; financial transactions; company number; professional activities; agreements and settlements.

We wish to point out that you bear responsibility for all of the data that you provide to us and that we rely on the accuracy thereof. If your data should no longer be up-to-date, we ask you to report this to us by e-mail.

You are not obliged to communicate your personal data, but you understand that the granting of certain services or the collaboration becomes impossible if you do not consent to the collection and processing.

Personal data, Processing purposes and legal basis

Within the framework of our services and activities, we collect and process personal data of our clients and principals, their personnel, employees, agents and other useful contact persons. We process the following personal data: personal identification data; client number; log-in credentials for user accounts; usage data of user accounts; data regarding roles and positions of the users within the organisation of the client; product usage data; financial identification data; data concerning solvency; financial transactions; company number; professional activities; agreements and settlements.

The purposes for such processings are the execution of the agreements with our clients, our client management, the optimization of all business and services that are provided by us, the bookkeeping, dispute management, safety, sales and direct marketing activities such as the sending of promotional or commercial information or use on social media. The legal bases are the execution of the agreement, compliance with statutory and regulatory obligations and/or our legitimate interest. For direct marketing activities by e-mail (such as a newsletter or invitation for events) consent will always be requested, and it can also be retracted at any time.

Data of suppliers and subcontractors

We collect and process personal data of our suppliers, subcontractors, agents and distributors, their personnel, employees, agents and other useful contact persons. We process the following personal data: personal identification data, financial identification data, data concerning solvency, financial transactions, professional activities, agreements and settlements, company number, supplier number.

The reasons for such processings are the execution of our agreements, management of the suppliers, the bookkeeping, safety and supply management. The legal bases are the execution of the agreement, compliance with statutory and regulatory obligations and/or our legitimate interest.

Other data

Along with the above-mentioned data, we also process personal data of others, such as possible new clients/prospects, applicants, visitors, useful contacts within our sector, network contacts, etc. The reasons for such processings are in the interest of our activities, direct marketing and public relations. The legal basis is our legitimate interest or, in some cases, the execution of an agreement.

Duration of the processing

The personal data are kept and processed by us for a period that is necessary as a function of the purposes of the processing and as a function of the relationship (whether or not contractual) that we have with you.

Your personal data will in any case be removed from our systems after a period of seven years after termination of the agreement, the collaboration or the project, except with regard to those personal data that we, on the basis of specific legislation, must preserve for a longer period or in the event of an ongoing dispute for which the personal data are still necessary.

Product usage data will be fully and irreversibly anonymized at the latest after a period of 2 years after termination of the agreement.

Rights

In accordance with and subject to the Belgian data protection legislation and the provisions of the GDPR, we hereby inform you that you have the following rights:

• Right to access and inspection: You have the right to access, free of charge, the data we have about you, and to check for what purposes they are used.

• Right to rectification: You have the right to rectify (correct) inaccurate personal data, as well as to complete incomplete personal data.

• Right to data erasure or restriction: You have the right to ask that we erase your personal data or restrict the processing thereof in the circumstances and under conditions set by the GDPR.

• Right to data portability: You have the right to obtain in a structured, common and machine-readable form the personal data you supplied to us. You have the right to transfer these data to another party responsible for the processing.

• Right to object: You have the right to object to the processing of your personal data on serious and legitimate grounds.

• Right to withdraw consent: You have the right to withdraw the consent given by you.

• Automated decision-making and profiling: We confirm that the processing of your personal data does not include profiling and that you are not subject to fully automated decision-making.

You can exercise these rights by contacting info@publican.be.

We make every effort to deal with your personal data in a careful and legitimate manner, in accordance with the applicable legislation. If you nevertheless believe that your rights have been violated and your concerns are not addressed by our company, you are free to file a complaint with the competent supervisory authority:

Belgian Data Protection Authority (Belgische Gegevensbeschermingsautoriteit)

Drukpersstraat 35, 1000 Brussel

+32 (0)2 274 48 00

+32 (0)2 274 48 35

contact@apd-gba.be

Additionally, you may turn to a court in case you feel you suffer any damage as a result of the processing of your personal data.

Transfer to third parties

Specific personal data that are collected by us will be transferred to and possibly processed by third-party service providers, such as our software providers, IT providers, bookkeepers, auditors, professional advisors, insurance companies, suppliers, banks, solicitors, telecommunications providers, etc on a need-to-know basis.

It is possible that one or more of the above-mentioned third parties are located outside of the European Economic Area ("EEA"). However, personal data will only be passed on to third countries where there is a suitable level of protection (for the US: privacy shield protected).

The employees, managers and/or representatives of the above-mentioned service providers or institutions and the specialised service providers hired by them must respect the confidential nature of your personal data and can only use these data for the purposes within whose framework they were provided.

If necessary, your personal data can be transferred to other third parties. For example this can be the case if we should be reorganised in whole or part, our activities should be transferred or if we should be declared bankrupt. It is also possible that personal data must be transferred as a result of a court order or in order to comply with a certain statutory obligation. In that event we will make reasonable efforts to inform you in advance about this communication to other third parties. You will nevertheless acknowledge and understand that in certain circumstances this is not always technically or commercially feasible or that legal restrictions may possibly apply.

We will under no circumstances sell your personal data or make them commercially available to direct marketing agencies or similar service providers, except with your prior consent.

Technical and organisational measures

We take the necessary technical and organisational measures in order to process your personal data with an adequate degree of security, so as to protect them against destruction, loss, falsification, change, unauthorised access or erroneous disclosure to third parties, as well as any other unauthorised processing of these data.

Under no circumstances can any of our companies be held liable for any direct or indirect damage deriving from an erroneous or wrongful use by a third party of the personal data.

Access by third parties

With a view to the processing of your personal data, we grant access to your personal data to our employees, collaborators and agents. We guarantee an equivalent level of protection by making contractual obligations opposable to these employees, collaborators and agents, which are identical to this Data Protection Policy.

Any questions?

If, after reading this Data Protection Policy, you have further questions or comments regarding the collection and processing of your personal data, you can contact info@publican.be.