Policy on the protection of personal data

Policy on the protection of personal data

Your personal data information is processed by SA EBENIS (hereinafter ‘SA EBENIS’ or ‘we’), the data controller, whose registered office is at 17 Route d’Esch, L-1470 Luxembourg (Siret no.: 512 938 846 000 15 and intra-community VAT no.: LU 191 459 20).

We understand the importance of protecting personal data. That is why we have drafted this prior information notice in compliance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data (‘GDPR’), as well as the Belgian law of 30 July 2018 on the protection of individuals with regard to the processing of personal data (‘Privacy Law’).

SA EBENIS is concerned with respecting the confidentiality and protection of personal data that it is required to process. As such, SA EBENIS undertakes to act in strict compliance with the laws applicable in this area and, in particular, with the GDPR and the Privacy Law.

Through this Data Protection Policy, we would like to inform you about how we collect, use and protect your personal data.

1. Why do we process your data?

1.1. Browsing our website

Data subjects: Data subjects include visitors to the website as well as persons wishing to communicate or obtain information about the activities offered on the site.

Relevant data categories: It is possible for you to visit our site and find out about our services without having to provide personal data.
Nevertheless, the use of certain cookies is necessary to browse our website.

For further information about this, please refer to our cookie usage policy.

1.2. Communicating with you

Data subjects: People characterised as data subjects include visitors to the website who wish to communicate with SA EBENIS or obtain information (via the contact form or any other means).

Relevant data categories: These include identification data (for example, surname, first name and company details, if applicable) and contact data (e-mail address and telephone number). Other categories of data include the data contained in the message left by the person concerned, as well as the subject of the request.

Purpose: We process data in order to communicate with you and answer your questions. This includes receiving requests for information, suggestions, complaints or any other type of feedback. The data collected is used to improve our services and our interaction with stakeholders based on the feedback received.

Legal basis: The processing of collected data is based on the performance of the contract or pre-contractual steps (Article 6.1, b) of the GDPR). It is necessary in order to be able to answer your questions and to provide the requested service. This data is, therefore, essential for the execution of our contractual obligations. Without it, we cannot carry out our mission.

Duration: All data collected as part of this activity is kept for one year from your last contact, unless a contractual relationship has been established in the meantime.

Recipients: Your data will only be used by SA EBENIS and is authorised subsidiaries.

 

1.3. Website computer maintenance

Data subjects: Data subjects include all persons whose data is processed by SA EBENIS.
Relevant data categories: These include identification data (for example, surname, first name and company details, if applicable) and contact data (e-mail address and telephone number). Connection data (IP address and cookies) is also collected.

Purpose: Data is processed for the purpose of ensuring the proper functioning of SA EBENIS’s IT infrastructure and equipment. This includes preventing and resolving any technical problems, ensuring the security and efficiency of the information systems, and regularly updating hardware and software to meet the needs of the organisation and to keep pace with technological developments.

Legal basis: The processing of such data is necessary for the purposes of our legitimate interest in order to maintain and ensure the security of our IT infrastructure (Article 6.1.f) of the GDPR).

Duration: All data processed during any maintenance operation is not to be retained by the subcontractor performing the maintenance, unless a longer retention period is required for legal or contractual reasons

Recipients: Your data is only processed internally and only by our technical service providers.

 

1.4. Exercising your data rights

Data subjects: Data subjects include all persons who wish to exercise their rights under the GDPR.
Relevant data categories: These include identification data (for example, surname and first name), a data request and proof of the measures taken by SA EBENIS in response to such a request.

Purpose: When you exercise the rights conferred on you by the DFPR and those described in this data protection policy (right of access, rectification, etc.), we retain the data only insofar as it is strictly necessary to prove that we have taken action in response to your requests.

Legal basis: The retention of such data is based on the legal obligation imposed by article 5.2 of the GDPR, namely the duty of accountability.

Duration: We retain your data for this purpose for as long as we may be held liable for failure to comply with requests, i.e. for a maximum of 10 years.

Recipients: Such data will not be passed on to any recipient other than the Data Protection Authority.

 

1.5. Proof of deletion of your data

Data subjects: Data subjects include all persons requesting the deletion of their data processed by SA EBENIS.
Relevant data categories: These include identification data (for example, surname and first name), the deletion request, the date of the actual deletion and the data deletion logs in the database.

Purpose: When you exercise your right to deletion, we retain the data necessary to prove that deletion has taken place. This data storage is for evidential purposes only and contains only the data which is strictly necessary to establish proof of deletion.

Legal basis: The retention of proof of data deletion is based on the legal obligation imposed by Article 5.2 of the GDPR, namely the duty of accountability. This provision establishes a legal obligation within the meaning of Article 17 of the GDPR that may justify an exception to the total erasure of data. The retention of this data is also justified by our legitimate interest in our ability to provide proof of compliance with our legal obligations under the GDPR.

Duration: We retain your data for this purpose for as long as we may be held liable for failure to comply with requests, i.e. for a maximum of 10 years.

Recipients: Such data will not be passed on to any recipient other than the Data Protection Authority.

 

1.6. Social networks

Data subjects: Data subjects include all persons visiting EBENIS SA’s social media networks.
Relevant data categories: This may include data linked to your account, data linked to the sharing of content or to the communications you have with other people.

Duration: The data that you communicate when visiting our pages on social networks is – or could be – processed jointly by the social network and the administrator of the page for the following purposes:

    • the collection of certain data by means of cookies;
    • the improvement of the advertising system run by the social network;
    • for obtaining statistics on the page’s audience.

Such data will only be processed by the page administrator as part of its legitimate interest in obtaining statistics on visitors to its page in order to promote the page appropriately. The audience statistics established by the social network will only be shared with the page administrator in an anonymised form.

Legal basis: The processing of such data is necessary for the purposes of our legitimate interest in promoting our services via social networks, (as laid out in Article 6.1.f of the GDPR).

Duration: Such data is only kept – or could only be kept – for as long as the page exists and you visit it.

The personal data usage policies of each social network can be found by clicking on the following links:

    • Facebook et Instagram,
    • Youtube,
    • LinkedIn,
    • Twitter.

Recipients: This data may be transmitted to service providers assisting SA EBENIS in its digital communication.

 

2. Where is your personal data stored?

Your personal data is stored exclusively on servers located within the EU.

Such data may be communicated to subcontractors of SA EBENIS as part of services provided exclusively on behalf of SA EBENIS (e.g. IT service providers and others) and only on the basis of our instruction. These recipients are, in principle, located in the European Union. If, under exceptional circumstances, they were to be transferred to a country that does not offer an adequate level of protection, then we would ensure that appropriate guarantees govern this transfer. A copy of these appropriate guarantees would then be available upon request.

 

3. How do we protect your personal data?

Your personal data is treated confidentially. SA EBENIS makes every effort to take the necessary technical and organisational measures to ensure the security of your personal data.

 

4. What are your rights? How are you able to exercise them?

You have a number of rights concerning the personal data we process. In particular, you have the right to:

    • The right to information: you have the right to obtain information about the processing of your personal data. Consequently, you have the right to know the purposes of any relevant data processing, the relevant categories of personal data, the categories of recipients to whom the personal data might be transmitted, the criteria used to determine the data retention period and the rights that you may exercise over your personal data. These rights are exercised by means of this document.
    • The right of access: you have the right to access your personal data and to receive a copy of it.
    • The right of rectification: you have the right to ask us to update or correct your personal data if you believe it to be incorrect or incomplete in some way.
    • The right to deletion: you have the right to ask us to delete your personal data or restrict the way we use it, if you believe that we do not have (or no longer have) a legitimate basis for processing it.
    • The right to withdraw consent: you have the right to withdraw your consent at any time to the processing of your personal data based on previously given consent.
    • The right of portability: you have the right to receive your personal data in a structured, conventional and machine-readable format and to transfer it to another party.
    • The right to object: you have the right to object to the processing of personal data under the conditions set out in Article 21 of the GDPR.
    • The right to restriction: you have the right to restrict the processing of your personal data in certain circumstances listed under Article 18 of the GDPR.

For more information about your rights: https://www.dataprotectionauthority.be/citizen.

You may exercise the above rights by sending an e-mail to   or by sending a letter to 17 Route d’Esch, 1470 Hollerich, Luxembourg .

In addition, if you believe that we have not acted in accordance with the law relating to the processing of personal data, you may lodge a complaint with the Data Protection Authority (Data Protection Authority, rue de la Presse 35, 1000 Brussels, +32 (0)2 274 48 00, contact@apd-gba.be).

 

5. Alterations to the current policy

We may alter this policy at any time. In order to keep you informed of the latest changes to our personal data protection policy, we will adjust the revision date each time it is changed. The amended policy will be deemed to take effect from that date.

Please consult this page regularly to keep abreast of any modifications and/or additions.