Climagroup BV, with registered office at 3500 Hasselt, Slachthuiskaai 24 and entered in the Crossroads Bank for Enterprises under number 0748.447.743, Register of Legal Entities of Antwerp division Hasselt (hereinafter ‘we’, or ‘Climagroup’), attaches great importance to the protection of privacy. We therefore take all appropriate measures to protect your privacy in accordance with applicable laws and regulations, including Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (‘GDPR’).
For the purposes of this privacy statement, ‘personal data’ means all information about an identified or identifiable natural person (‘the data subject’). A natural person is regarded as identifiable if he or she can be identified directly or indirectly, in particular by means of an identifier such as a name, an identification number, location data, an online identifier or one or more elements characterising the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person. In other words, personal data is any information on the basis of which a person can be identified. This includes, for example, your name, date of birth, address, telephone number and email address, as well as your IP address.
Anonymous data and data about deceased persons or legal entities is not personal data within the meaning of GDPR. Data is only anonymous if there is no way that the user can establish a connection with the data subject.
The term ‘processing’ is very broad and covers, among other things, the collection, recording, organisation, storage, updating, modification, retrieval, consultation, use, distribution, combination, archiving and deletion of data.
When and what personal data do we process, and on what legal basis?
We process your personal data when you:
We process the following personal data in the following cases:
|When do we process personal data?||What personal data?|
|Personal data that you provide to us|
When providing our services, including but not limited to:
The provision of personal data is necessary for the performance of the contract. Consequently, if this data is not provided, the contract cannot be performed.
Competitions and marketing promotions
The provision of personal data is not mandatory. If this data is not provided, you will not have access to marketing promotions or be able to enter competitions.
Visits to our websites
The provision of personal data is necessary to be able to assess the application. Consequently, if this data is not provided, the application cannot be assessed.
|Personal data that we have not obtained directly from you|
The acquisition of personal data in the context of the services
Supplements to your personal data obtained from external sources
Climagroup does not process sensitive data, for example about your racial or ethnic origin, political views, sexual preferences or health.
In principle we also do not collect personal data from anyone under the age of 16. These young people may not pass on personal data or make a declaration of consent without the permission of the person who has parental responsibility.
Why do we process personal data and on what legal basis?
We process personal data for multiple purposes; we only process the personal data that is necessary to achieve the intended purpose.
In the processing of your personal data, the provisions of GDPR and all other applicable privacy legislation are complied with. Our processing activities always take place on the basis of one of the six possible legal grounds, as stated in Art. 6 GDPR.
Usually, one of the following legal grounds is concerned:
|Processing purpose for which the personal data is intended||Legal basis for processing|
|to handle and carry out your request for our products and services||in connection with the preparation or performance of our contract|
|for our customer administration||in connection with the preparation or performance of our contract|
|to provide you with optimal service||in connection with the preparation or performance of our contract|
|in order to improve the contents of our products, services and website||our carefully considered legitimate interest|
|for direct marketing purposes||our carefully considered legitimate interest (customers) or your consent (non-customers)|
|for the sale and promotion of our services and products||our carefully considered legitimate interest|
|to keep track of studies, tests and statistics||our carefully considered legitimate interest|
|for the management of our websites||our carefully considered legitimate interest|
|for the management of our competitions and promotions||our carefully considered legitimate interest|
|to prevent and detect abuses or fraud||our carefully considered legitimate interest|
|to guarantee everyone’s safety||our carefully considered legitimate interest|
|to inform you about our existing or new products and services and those of our affiliated companies (such as parent, subsidiary and fellow group companies)||our carefully considered legitimate interest (customers) or your consent (non-customers)|
|to comply with laws and regulations||to comply with the legal or regulatory provisions to which we are subject|
|in connection with a job application||in connection with the preparation or performance of our contract|
How long do we keep the data for?
Climagroup does not keep personal data any longer than is necessary for the purpose for which it was provided. Bear in mind that numerous legally required and other retention periods entail the storage of personal data. This applies in particular to registration and retention obligations relating to company law or tax law (e.g. the Companies and Associations Code, tax legislation, the Code of Economic Law, etc.). Where no retention obligation exists, personal data is routinely deleted after the purpose for which it was collected has been achieved.
Do we pass on personal data to third parties?
Climagroup does not sell or pass on personal data to third parties, unless:
We will never pass on personal data to other parties with which we have not concluded a processing agreement.
We will of course make the necessary arrangements with such parties (data processors) to ensure the security of your personal data.
Your personal data may also be shared outside Europe. Climagroup undertakes only to appoint data controllers and/or processors outside the European Economic Area who, in accordance with the applicable privacy legislation, provide sufficient guarantees regarding the security and protection of personal data. If a transfer takes place to a country outside the EU, and the European Commission has not determined that that country offers an adequate level of protection, the transfer is always subject to an agreement that meets all requirements for transfers to third countries, such as the approved standard data protection clauses drawn up by the European Commission. The standard provisions approved by the European Commission can be consulted via the following hyperlink: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en.
How do we protect your personal data?
We have taken appropriate technical and organisational measures to protect your personal data against unlawful processing; for example, these include the following measures:
What rights do you have and how can you exercise them?
|The right of access (Article 15 GDPR)|
You have the right to access any data concerning you free of charge. You can ask us:
|The right to rectification (Article 16 GDPR)|
You have the right to have incomplete, incorrect, inappropriate or outdated personal data corrected. You can contact us in the manner indicated below for this purpose.
In order to keep your data up to date, we request that you notify us of any changes.
|The right to erasure (‘right to be forgotten’)(Article 17 GDPR)|
Under certain conditions you can ask us to delete your data. In this case, however, you should bear in mind that we will no longer be able to offer you any services if you should want them. However, your right to be forgotten is not absolute. We have the right to keep your data when necessary for, among other things, compliance with a legal obligation or in order to establish, exercise or support legal claims.
|The right to restriction of processing (Article 18 GDPR)|
You have the right to ask us to restrict the processing of your personal data if one of the following conditions applies:
|The right to data portability (Article 20 GDPR)|
You have the right to ask us to provide you with all your personal data in a structured, commonly used and machine-readable form and, where technically possible, to have it transferred to another controller, if both the following conditions are met:
The technical feasibility of this will be exclusively assessed by us.
|The right to object (Article 21 GDPR)|
You have the right to object to the processing of your personal data for specific reasons applicable to you.
If you wish to oppose the use of your personal data for direct marketing purposes, you do not have to give any reason for this. In other words, you may object to this at any time. If you do so, your personal data will no longer be processed for direct marketing purposes.
|The right not to be subject to automated individual decision-making (Article 22 GDPR)|
You have the right to object to any purely automated processing of your personal data, including profiling, which has legal consequences for you.
However, if such processing is permitted by law or is necessary in order to realise or carry out deliveries of our products or services, we cannot act on a request not to be subject to automated individual decision-making.
|The right to withdraw consent (Article 7 GDPR)|
When your personal data is processed on the basis of your consent, you may withdraw that consent at any time by request (without prejudice to the lawfulness of the processing based on consent before its withdrawal).
Exercising your rights
To exercise the above rights, contact: firstname.lastname@example.org. To enable us to check your identity, please send us a copy of the front of your identity card.
Your personal data is processed by Climagroup, which is responsible for the processing (‘data controller’). This means that we determine the purpose and means of processing of your personal data.
How to contact us
You have the right to submit a complaint to the Data Protection Authority, which is the supervisory authority responsible for privacy protection:
Data Protection Authority (‘DPA’)
+32 (0)2 274 48 00