1. Introduction

1.1. General

The website www.evolane.eu (hereinafter: the “Website”) is provided by Evolane NV (hereinafter: “we” and “us”). Any person who visits our Website (hereinafter: the “Visitor”) almost inevitably discloses certain personal data. This personal data constitutes information that allows us to identify you as a natural person, whether or not we actually do so. You are identifiable as soon as it is possible to create a direct or indirect link between one or more personal data and you as a natural person. The Visitor is also referred to in this privacy statement as “you/your”.
We endeavour to use and process your personal data in accordance with the General Data Protection Regulation (“GDPR”) and other relevant legal provisions. Any reference in this privacy statement to the GDPR is a reference to the Regulation of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).
Through this privacy statement, you are informed of the processing activities we may carry out with your personal data.
This Privacy Statement applies when we act as a data controller of the processing of personal data of our Website, in other words, when we determine the purposes and means of the processing of that personal data.

Please read this privacy statement carefully and make sure you understand it.

1.2. What is personal data?

Personal data is defined in the GDPR as “any information relating to an identifiable person who can be identified, directly or indirectly”. Personal data, in simpler terms, is any information about you that makes it possible to identify you. Personal data includes obvious information, such as your name and contact details, but also less obvious information, such as identification numbers, electronic location data and other online identifiers.

1.3. Changes

We may update this statement from time to time by posting a new version on our Website. This may be necessary, for example, if the law changes, or if we change things in a way that affects the protection of personal data. We recommend that you check this page occasionally to ensure that you are happy with any changes to this privacy statement.

2. Contact details

Our Website is provided and operated by Evolane NV. We are registered in Belgium under registration number 0654.925.093 and our registered office is located at Veldkant 33A, 2250 Kontich.

You can contact us:
(a) by post, to the postal address set out above;
(b) via the contact form on our Website;
(c) by telephone, on +32 3 246 04 50; or
(d) by e-mail, using info@evolane.eu.

We also have a branch office in the Netherlands with the following contact details:
(a) by post, to the postal address set out above;
(b) by telephone, on +31 3 07 45 00 21; or
(c) by e-mail, using info@evolane.eu.

3. What personal data are processed and how are they used?

3.1. Information processing

3.1.1. Browser data (technical data) of visitors
• IP address
• geographical location
• browser type and version
• operating system
• referral source
• duration of your visit, page views and website navigation paths, as well as information about the timing, frequency and pattern of your use of the service.

The source of this data is the use of either necessary cookies, or non-necessary cookies.
– For necessary cookies, the legal basis is our legitimate interest in ensuring the proper technical functioning of the website in accordance with necessary cookies as referred to in our Cookie Statement.
– In the case of non-necessary cookies, the technical data may be processed for the purpose of analysing/improving the use of the website. The legal basis for this processing is your consent.

Retention period: See the Cookie Statement on our Website.

3.1.2. Communication data of visitors
= the data you provide us with when filling in the contact form on our Website or when contacting us by e-mail/telephone. These include:
• Name
• Company name
• Telephone number
• Email address
• Your message

Processing purpose: The communication data can be processed for the purpose of communication with you and record keeping.
The source of the communication data is the information you provide when contacting us.
Legal basis: Our legitimate interest, to be able to respond to requests, questions or comments or to contact you for questions of any kind (e.g. when you contact us by phone, email or social media).
Retention period: Personal data will be kept for 3 years after the response.

3.1.3. Data for the purpose of direct marketing of visitors
• Email address

Processing purpose: The direct marketing data is processed in order to send you newsletters/promotions from us, for which you have given your consent. You may unsubscribe at any time by clicking on the “unsubscribe” link in the relevant e-mail or by any other action described therein.
The source of direct marketing data is the information you provide to us when you sign up for the newsletter.
Legal basis: Consent.
Retention period: Your data will be processed until you unsubscribe.

3.1.4. Job application data
= this is the data you provide us with when you apply for a job with us. These include:
• Name
• Email address
• Phone number
• Resume/CV
• Motivation letter
• Your message

Processing purpose: The job application data is processed in order to evaluate your suitability for a position in our company (personnel management).
The source of the application data is the information you provide us with when you apply via our Website.
Legal basis: Consent.
Retention period: Data will be stored for the duration of the actual application process. Thereafter, the application data can be stored if you have given us your consent.

3.1.5. Testimonial information
= the positive feedback received for publication on our Website.
• Name
• Job title
• Company you work for
• Picture

Processing purpose: The testimonial information may be processed in order to promote our services to our website visitors.
The source of the testimonial information is the information you as a satisfied (former/current) customer wish to post for publication on our Website.
Legal basis: Consent.
Retention period: The data will be stored until you request deletion of the publication.

3.1.6. Other data processing
In addition, we may process your personal data when this is necessary to comply with a legal obligation to which we are subject (such as tax legislation). Without prejudice to the above, we may keep your personal data when this would be necessary for the establishment, exercise or defence of legal claims, whether in legal proceedings or in administrative or extrajudicial proceedings. The legal basis for this processing is our legitimate interests, namely the protection and exercise of our legal rights.

3.2. Processors
A processor is a natural or legal person who processes personal data at our request or on our behalf. We may sometimes contract with this party to provide certain products and/or services. In other words: We use processors because it is necessary for the provision of services. In this case, we will enter into a written agreement with the processor whereby the security of your personal data is guaranteed by the processor. The processor will always act in accordance with our instructions.

We use the following categories of processors:
• Companies we have engaged for marketing purposes;
• Companies we have engaged for ICT technical support and hosting purposes;
• Companies we have engaged for administrative purposes (e.g. CRM system);
• Companies that we have engaged for communication purposes;
• Companies that we have engaged for logistical purposes (e.g. order picking, delivery, etc.);
• Companies we have engaged for analytical purposes;
• Companies we have engaged for payment purposes.

4. Provision of your personal data to third parties

We will not share your personal data with third parties (other than processors) for any purpose, subject to the following exceptions.
In some circumstances, we may be legally obliged to share certain personal data, including yours, if we are involved in legal proceedings or in order to comply with legal obligations, a court order or the instructions of a government authority.
We may provide your personal data to partners whose content appears on our Website under “Partners” for the purpose of enabling them to perform services for you that you have indicated to us that you are interested in. These partners are companies specialised in IT, software, security and hosting. The legal basis for this transmission of personal data to our partners is the performance of a contract to which you are a party or, at your request, in order to take the necessary steps to conclude such a contract. Please note that we have no control over the activities of these third parties or the data they collect and use. We advise you to check the privacy statement of these third parties.
Possible recipients are Akamai, Atlassian, Contentsquare, Dynatrace and Splunk.

5. International transfer (outside EEA) of your personal data

We may store or transfer some or all of your personal data in countries that are not part of the European Economic Area (the “EEA” consists of all EU member states plus Norway, Iceland and Liechtenstein). These are known as “third countries” and may have weaker data protection laws than those in the EEA. This means that we take extra steps to ensure that your personal data is treated as safely and securely as it is in the EEA.

We use specific contracts with external third parties approved by the European Commission (also known as Standard Contractual Clauses: SCC) for the transfer of personal data to third countries. The SCCs guarantee the same level of protection of personal data as would apply under the GDPR. In addition, additional measures are taken to protect your data from unauthorised access. More information is available from the European Commission. Additional measures are also taken to protect your data from unauthorised access.

6. Your rights

Some rights are complex and not all details are included here. Therefore, read the relevant provisions and guidelines from supervisory authorities for a full explanation of these rights.

You may exercise your rights with respect to your personal data by providing written notice to us at info@evolane.eu.

We will respond to your request within one month of receipt. We will normally aim to provide a full response within that time. However, in some cases, particularly if your request is more complex, more time may be required, up to a maximum of three months from the date we receive your request. You will be kept fully informed of our progress.

6.1. The right to inspection

You have the right to confirm whether or not we are processing your personal data and, where we are doing so, to have access to the personal data, together with certain additional information. This additional information includes details on the purpose of the processing, the categories of personal data concerned and the recipients of the personal data. Provided that the rights and freedoms of others are not affected, we will provide you with a copy of your personal data. The first copy will be provided free of charge, but additional copies may be provided for a reasonable fee.

6.2. The right of rectification

You have the right to have inaccurate personal data about you corrected and, taking into account the purposes of the processing, incomplete personal data about you completed.

6.3. The right to erasure (‘right to be forgotten’)

In some cases, you have the right to have your personal data deleted without undue delay. These circumstances include:
– the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
– you withdraw your consent to a processing based on consent;
– you object to the processing according to certain rules of the applicable data protection law (the GDPR);
– the processing is for direct marketing purposes; and
– personal data has been unlawfully processed;
– the personal data must be deleted in order to comply with a legal obligation incumbent upon us.

However, there are exclusions from the right to erasure. The general exclusions include where processing is necessary:
– for the exercise of the right to freedom of expression and information;
– for compliance with a legal obligation incumbent upon us; or
– for the establishment, exercise or defence of legal claims.

6.4. The right to restrict processing

In some cases, you have the right to restrict the processing of your personal data. These circumstances are: you dispute the accuracy of the personal data; the processing is unlawful, but you oppose its erasure; we no longer need the personal data for our processing, but you need the personal data for the establishment, exercise or defence of legal claims; and you have objected to the processing, pending verification of that objection.

If processing is restricted on this basis, we may continue to store your personal data. However, we will only process them in other ways: with your consent; for the establishment, exercise or defence of legal claims; for the protection of the rights of another natural or legal person; or for important reasons of public interest.

6.5. The right to object to the processing

You have the right to object to our processing of your personal data for reasons relating to your particular situation, but only insofar as the legal basis for the processing is that it is necessary for the purposes of the legitimate interests pursued by us or by a third party. If you raise such an objection, we will cease processing the personal data unless we can demonstrate that there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or that the processing is for the establishment, exercise or defence of legal claims.

In addition, you have the right to object to our processing your personal data for direct marketing purposes (including profiling for direct marketing purposes). If you object, we will cease processing your personal data for this purpose.

Furthermore, you have the right to object to our processing your personal data for scientific or historical research purposes or statistical purposes on grounds relating to your particular situation, unless the processing is necessary for the performance of a task carried out in the public interest.

6.6. The right to data portability

Insofar as the legal basis for our processing of your personal data is based on:
(a) consent;
(b) processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract; or
(c) such processing is carried out automatically,
you have the right to receive your personal data from us in a structured, commonly used and machine-readable format.

However, this right does not apply when the rights and freedoms of others would be affected.

6.7. The right to lodge a complaint with a supervisory authority

If you believe that our processing of your personal data is in breach of the General Data Protection Regulation (GDPR), you have the right to lodge a complaint with a supervisory authority responsible for data protection. In Belgium, the supervisory authority is the Data Protection Authority (GBA). In the Netherlands, the supervisory authority is the Authority for the Protection of Personal Data (AP). Data subjects from other Member States have the right to lodge a complaint with their own national supervisory authority. For an overview of the contact details of these authorities, click on this link.

Data Protection Authority (GBA)
Drukpersstraat 35, 1000 Brussels
+32 (0)2 274 48 00
contact@apd-gba.be
https://www.gegevensbeschermingsautoriteit.be

Personal Data Authority (AP)
Bezuidenhoutseweg 30, 2509 AJ The Hague
https://autoriteitpersoonsgegevens.nl/

6.8. The right to withdraw your consent

Insofar as the legal basis for our processing of your personal data is consent, you have the right to withdraw such consent at any time. Revocation does not affect the lawfulness of the processing prior to the revocation.