Privacy Statement

1. Introduction

This privacy statement explains how we handle the processing of personal data in the context of our activities. We consider it important to be transparent about what data we collect, how we use it and what rights you have. In this way, we ensure that your privacy is protected in a careful and correct manner.

This statement describes how BODRIES CommV (hereinafter also ‘Kundi’ or ‘we/us/our’) processes personal data in the context of our activities involving third parties.

We are based at Schulstraat 22A/12, 2018 Antwerp, and are registered with the Crossroads Bank for Enterprises under company number 0791.577.804.

We act as data controller within the meaning of European Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or ‘GDPR’).

In doing so, we endeavour to process your personal data in accordance with the applicable data protection legislation, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or ‘GDPR’) and the Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

If you have any questions about the processing of your personal data, you can contact us using the contact details below:

2. Explanation of certain terms

In this privacy statement, we use a number of terms from data protection legislation. Below, we explain these terms in a straightforward manner.

General Data Protection Regulation: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. This Regulation is also commonly referred to as the GDPR (General Data Protection Regulation). This law protects your personal data and grants you rights over what happens to your personal data.

Data subject: the identified or identifiable natural person whose personal data is processed. That is, for example, you when we use your data.

Data Protection Authority: the Data Protection Authority is responsible in Belgium for supervising compliance with the fundamental principles of personal data protection. This authority monitors whether organisations correctly comply with privacy legislation.

Personal data: all data that says something about a person and by which that person can be directly or indirectly identified. Think of your name, email address, telephone number, IP address or location data. Fully anonymous data, which cannot be traced back to a person, are not covered by this.

Processing: an operation or a set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data.

Data controller: a natural or legal person, a governmental entity, a service or another body which, alone or jointly with others, determines the purposes and means of the processing of personal data. The data controller is the organisation or person that decides why and how personal data are processed. In this privacy statement, that is us.

3. Detailed information about our processing activities

In the context of our activities, we process personal data, as do other organisations.

In this section we provide information about:

• Legal basis: for each processing activity it is indicated on which legal basis we rely, such as contractual necessity, legal obligation, legitimate interest or consent. This means that we process personal data in order to comply with contracts, legal obligations, the interests of our company (or third parties) or because you have explicitly given consent for this. The specific legal basis determines which actions we may carry out and under which conditions.
  Please note: if we process your data because this is required by law or because it is necessary for the performance of a contract, then this data must be provided by you. Without this information we cannot continue the cooperation or provision of services, and we cannot comply with our legal obligations.
• Categories of data: we indicate which types of personal data is involved, such as identification data (name, address), contact details, financial information, profession/occupation and purchase data. Data obtained through third parties, public sources or private databases also fall within this scope. This overview helps you to understand which information we collect and process in various situations.
• Processing purposes: for each processing activity it is explained why we need specific personal data, such as the provision of services, management of projects, invoicing, answering questions and informing you about the status of your file. We also use data to improve our provision of services and to maintain contact with clients and interested parties. The purpose of the processing determines how we use your data and which procedures apply thereto.
• Retention period of personal data: we provide information about how long we retain your personal data. This depends on legal obligations, internal policies and the duration of the relationship with you as a client or data subject. Data is not retained for longer than necessary for the purpose of the processing, unless the law requires this. In this way we ensure that your privacy is safeguarded and that data is deleted or anonymised in a timely manner.

3.1. Registration and account management

We process personal data when you create an account on the platform or log in via an external login provider (such as Google or Apple).

Which data we process:

Depending on the chosen registration method, we process, among other things:

• Identification data (e.g. first name, last name)
• Contact details (e.g. email address)
• Account and authentication data (e.g. user ID, password in hashed form);
• Age or majority verification data (confirmation that you are 18 years of age or older)
• Data received from external login providers, such as an email address or public profile data, to the extent that you share these with them and with us
• Verification statuses (e.g. email verified)
• Technical and system data (e.g. date of registration, last update of the account)

Why we (may) process these data:

We process these data to allow you to create and manage an account, to authenticate you securely and to grant you access to the platform, and to enable the use of Single Sign-On (SSO) via external providers (e.g. Google and Apple).

In addition, this data is processed in order to:

• Allow users to register and use a personal account
• Authenticate users securely and grant them access to the platform
• Enable Single Sign-On (SSO) functionalities via external providers
• Ensure the continuity and correct functioning of user accounts
• Verify that the platform is used exclusively by adult users (18+)
• To ensure basic account security and prevent unauthorised access

This processing is necessary for the performance of the agreement between you (as a user) and the platform. To the extent that the processing relates to age verification, account security and the prevention of unauthorised access, it is furthermore based on our legitimate interest in operating a secure, reliable and correctly functioning platform.

How long we retain this data:

We retain this data for as long as your account is active. Following deletion of your account, it will be erased within a reasonable period, unless further retention is required by law or necessary for the handling of disputes.

3.2. Identity and contact verification

We process personal data in order to guarantee the security and reliability of the platform and to prevent misuse.

Which data we process:

• Phone number and verification status
• Technical verification data (e.g. confirmation successful/failed)
• System information relating to verification

Why we (may) process this data:

We process this data in order to prevent fake accounts, fraud and misuse, to safeguard the integrity of the platform and its users, and to enhance the security of interactions between users.

This processing is carried out on the basis of our legitimate interest, namely ensuring a secure, reliable and correctly functioning platform.

How long we retain this data:

Verification data is retained for as long as this is necessary for security purposes, the integrity of the platform, and the prevention of misuse or fraud. The storage period is determined on the basis of the following criteria: the duration of the user’s use of the platform, the necessity to handle disputes or substantiate legal claims, the importance of preventing fraud and misuse and ensuring a secure platform, any statutory obligations that may apply to the retention of data, and the technical and organisational capacity to securely erase data.

3.3. Provision of platform services

We process personal data when you make use of the core functionalities of the platform, such as creating and viewing profiles and listings and searching for cohousing opportunities. The functionality relating to the calculation of matches is explained below in point 3.5 and the functionality relating to communication between users in point 3.6.

Which data we process:

• Profile data (e.g. gender, professional status, nationalities, languages, biography);
• Lifestyle and cohabitation preferences (e.g. social atmosphere, tidiness level, smoking and drinking habits, pets, interests)
• Preferences with regard to properties and rooms (e.g. location, type of property or room, amenities, accessibility needs)
• Budget and rental conditions (e.g. maximum rental price, security deposit, length of stay, domicile);
• Data relating to properties, rooms and listings that you publish (e.g. address details, description, photographs, amenities, house rules)
• System and status data (e.g. publication status, match status, profile completion percentage)
• Statistical usage data (e.g. number of views, favourites, matches, requests)

Why we (may) process these data (purposes):

We process these personal data in order to:

• Allow the platform to function technically and functionally and to be able to actually deliver the services offered
• Make profiles, listings and cohousing offers visible, searchable and comparable to other users
• Enable users to find cohousing opportunities that match their preferences and wishes
• To connect users with one another and to facilitate interactions relating to cohousing
• To continuously improve the relevance, quality and user-friendliness of the platform
• To obtain statistical insights into the use of the platform, without unnecessarily identifying individual users

This processing forms the core of the platform’s service provision and is necessary to offer the functionalities for which users register.

The processing of this personal data is principally based on the performance of the agreement between you and the platform, as this data is necessary to provide the services you expect from the platform.

To the extent that certain data is processed to optimise the operation of the platform, to obtain statistical insights or to improve the user experience (e.g. through aggregated usage statistics), this is done additionally on the basis of our legitimate interest in keeping the platform efficient, relevant and future-proof, always taking into account the interests and rights of users.

How long we retain these data:

We do not retain the personal data processed for the provision of the platform services for longer than necessary, whereby the storage period is determined on the basis of a combination of the following criteria: the duration of your active use of the platform (e.g. for as long as your profile or listing is active), the original purpose for which the data were collected (e.g. matching, visibility of a listing), the necessity of keeping data available for the continuity of service provision (e.g. ongoing matches or contacts), the possibility of follow-up in the event of questions, complaints or disputes, and applicable statutory obligations requiring longer retention. In concrete terms, these data remain available for as long as your user account is active and/or for as long as you keep your profiles or listings active on the platform. When you yourself delete your account or listings, the personal data concerned will be deleted or anonymised, except to the extent that further retention is necessary in the context of statutory obligations, dispute management or legitimate internal purposes (such as security or abuse prevention).

3.4. Matching and generation of compatibility scores

When you make use of the platform’s matching system, we process data in order to calculate and make visible the compatibility between users.

Which data we process:

For the calculation of matching and compatibility scores, we process, depending on the use of the platform, the following categories of personal data, among others:

• Data relating to lifestyle and cohabitation preferences, such as social atmosphere, community style, smoking and pet habits, guest policy and similar preferences
• Data relating to mutual preferences between providers and candidates, including preferences regarding age range, gender, professional status and cohabitation as a couple
• Budgetary and financial preferences, such as maximum rental price, distribution of costs and security deposit
• Location and geographical preferences and data on the situation of the dwelling
• Availability data, such as desired move-in date and intended length of stay
• Characteristics of the dwelling and shared facilities
• Characteristics of the room, such as type, size, furnishings, sanitary facilities and specific amenities;
• Information on rental and conditions of use, such as domicile registration, notice period and insurance requirements
• Automatically generated matching scores and sub-scores, calculated on the basis of the above parameters
• Feedback and ratings that users voluntarily provide about matches

Why we (may) process these data (purposes and legal basis):

We process these data in order to:

• Calculate matches between users
• Provide insight into the degree of compatibility
• Prioritise and make search results and candidates more relevant
• Make the search for suitable co-housing more efficient and relevant
• Continuously evaluate and improve the platform and the matching logic

This processing is based on the performance of the agreement, as matching constitutes a core functionality of the platform. In addition, we process certain match and feedback data on the basis of our legitimate interest in evaluating and improving the quality and operation of the platform.

The generated matching and compatibility scores are displayed to users for informational purposes only and have no automatic or binding consequences. These scores serve to support and clarify possible matches between profiles, but do not lead to automatic exclusion, refusal or restriction of access to the platform or to co-housing opportunities. Users retain full discretion to view profiles, make contact and decide for themselves with whom they wish to take further steps, independently of the proposed scores.

How long we retain this data:

Matching scores and feedback are retained for as long as they are relevant to active profiles or listings. Upon termination of your account, this data is deleted or anonymised, unless it is still necessary for statistical or legal purposes.

3.5. Communication via chat and interactions between users

The platform offers users the ability to communicate with each other via an internal chat function.

What data we process:

When using the chat, we process, among other things:

• Identification data of the chat participants
• The content of sent messages
• Metadata about the communication (e.g. time of sending and reading, linked listing)

Why we (may) process this data (purposes and legal basis):

We process this data in order to enable communication between interested users, to practically facilitate consultation regarding co-housing, and to be able to address misuse or inappropriate behaviour where necessary.

This processing is necessary for the performance of the agreement between you and the platform.

How long we retain this data:

Chat messages are retained for as long as the accounts concerned are active or for as long as this is necessary to enable communication or moderation. Thereafter, they are deleted or anonymised, except where retention is necessary for legal or dispute-related purposes.

3.6. Moderation, reports and complaints

We process personal data when content is reported, reviewed or when measures are taken in the context of moderation.

What data we process:

• Identification and account data of the users concerned
• The reported or reviewed content (profiles, listings, messages)
• Data relating to reports, warnings, blocks or removals
• Communications with reporters and the users concerned

In exceptional cases, the information we process may also relate to allegedly unlawful activities or circumstances that may indicate a punishable offence, to the extent that this is necessary to comply with legal obligations or to safeguard the safety of users and third parties.

Why we (may) process these data (purposes and legal basis):

We process these data in order to:

• Enable individuals and associations to report content on the platform that they consider to be unlawful or contrary to our terms of use, and to receive and record such reports
• Investigate and assess reported content or content identified on our own initiative, and to determine whether such content is unlawful or incompatible with our terms of use
• Take appropriate measures with regard to content or accounts, such as restricting visibility, removing content, suspending or terminating accounts or imposing other restrictions, where this is necessary and justified
• Inform reporters and the users concerned of the receipt of a report, the decision taken and — where applicable — the available remedies
• Take decisions relating to moderation and enforcement in a timely, careful, objective and non-arbitrary manner, and to be able to substantiate and document those decisions
• To handle and review internal complaints, disputes and feedback regarding moderation decisions where there is reason to do so
• To comply with our legal obligations under the Digital Services Act (DSA), including obligations relating to notice-and-action mechanisms, the reasoning of measures and transparency
• To ensure the safety of users and third parties and, in exceptional cases, to inform competent judicial or law enforcement authorities (LEA) when we become aware of information giving rise to a suspicion of a punishable offence threatening the life or safety of persons
• In exceptional situations, when we become aware of information giving rise to a suspicion of a punishable offence threatening the life or safety of persons, to inform competent judicial or law enforcement authorities (LEA) and to provide relevant information, to the extent required by law

This processing is based on our legal obligations, as provided for inter alia in the Digital Services Act.

Where relevant, certain data is additionally processed on the basis of our legitimate interest in ensuring a safe, reliable and legally compliant platform (Article 6(1)(f) GDPR), with due regard for the rights and interests of the users concerned.

How long we retain this data:

Data relating to reports and moderation are retained for as long as necessary for proper handling, accountability and any legal follow-up. In addition, we may retain this data for a reasonable period after handling in order to comply with legal, tax, reporting or audit obligations, or where necessary to safeguard our legal position. This may, for example, be relevant in the context of statutory periods of limitation.

3.7. Transparency and statutory communications

In limited cases, we process personal data or statistical data for transparency and accountability purposes or in the context of statutory information requests.

What data we process:

• Aggregated or pseudonymised data relating to platform use and moderation
• In exceptional cases: identification or account data at the request of competent authorities

Why we (may) process this data (purposes and legal basis):

We process this data in order to comply with legal transparency and reporting obligations and/or to give effect to valid legal orders or information requests.

This processing is based on a legal obligation.

How long we retain this data:

This data is retained for a period of up to seven years, calculated from the moment the legal obligation or information request has been fully handled. This period is aligned with the customary statutory time limitations for transparency and reporting obligations, unless a longer storage period is required by specific legislation or in preparation for legal proceedings.

3.8. Processing of personal data in general communications

We process personal data when you communicate with us outside the use of the platform itself, for example when you contact us by email, telephone or via other general communication channels with general questions, comments or information requests. (For information on the processing of data in the context of reports and complaints, see above.)

What data we process:

In this context, we may process, among others, the following categories of personal data:

• Identification and contact details (e.g. name, email address, telephone number)
• The content of your communication (e.g. emails, messages, questions or comments)
• In the case of telephone contact: data relating to the call, such as the telephone number, date and time of the call and the content thereof

Why we (may) process this data (purposes and legal basis):

We process this personal data in order to handle questions, comments or information requests correctly and efficiently, to communicate with you in connection with your request and to enable internal follow-up and quality assurance of our support.

This processing is in principle based on our legitimate interest, namely the interest in managing communications with (potential) users, interested parties and other contacts in a professional manner. Where the communication falls within the scope of (the preparation of) the use of the platform or a contractual relation, the processing may also be based on contractual necessity.

How long we retain this data:

Communication data is retained for a reasonable period necessary to handle your request and to ensure any follow-up. If the communication forms part of an existing user relationship, the storage periods applicable to platform users apply.

3.9. Marketing communications and targeted advertising

We may process personal data to inform users and interested parties about the platform, its operation and further development, as well as about relevant updates, initiatives or events, including to support the visibility and growth of the community.

Which data we process:

• Identification and contact details (e.g. name, email address)
• Data about your relationship with the platform (e.g. user, interested party)
• Interests and preferences, to the extent that these are apparent from your interactions with our communications or the platform
• Data about interactions with marketing communications (e.g. opening emails, clicking on links)
• Technical and online identifiers collected via cookies, pixels or similar technologies when using our website or advertisements

When using targeted advertising via social media platforms, data that you have provided to these platforms (e.g. profile information or stated interests) may also be processed, as well as data derived by these platforms on the basis of your online behaviour.

Why we (may) process these data (purposes and legal basis):

We process these personal data in order to:

• Inform users and interested parties about the platform, new or improved functionalities and relevant updates
• Inform, engage and further develop the cohousing community around the platform
• Send invitations for information sessions, community events, webinars or similar initiatives
• Disseminate information about collaborations, new initiatives or social projects related to cohousing
• To better align our communications and the platform with the interests and needs of users
• To display targeted advertising via external platforms to persons who may reasonably be assumed to have an interest in cohousing or the platform

For existing users of the platform from whom we have obtained electronic contact details in the context of their use of the platform, we base this communication on our legitimate interest in promoting similar platform services and initiatives (the so-called soft opt-in exception).

Where this legitimate interest does not apply, or where legislation so requires, we base the sending of marketing communications on your consent, which you may withdraw at any time.

For targeted advertising via social media platforms (such as Meta and Google), we and the platform concerned act as (joint) data controllers, as we jointly determine the broad lines of audience targeting, while the platform is responsible for the technical implementation of the advertising infrastructure. Where cookies or similar technologies are used in this context, this is always done in accordance with your cookie preferences. Please note that the social media platforms are also independently responsible for certain processing activities. We therefore recommend that you also consult their privacy statements in this regard.

Important information: you have the right at all times to object to the processing of your personal data for direct marketing and to adjust your preferences for targeted advertising via the settings of the platforms concerned.

How long we retain this data:

We do not retain personal data for marketing and communication activities for longer than necessary, whereby the specific storage period is determined on the basis of, among other things: whether you are a user of the platform or merely an interested party, the type of communication (e.g. newsletter, community update, invitation), the legal basis for the processing (legitimate interest or consent), your interactions with our communications and any unsubscription or objection on your part, and the necessity to record your marketing preferences or objection.

Personal data used for email marketing or similar direct communications are retained for as long as you are subscribed thereto or have not objected. Following unsubscription or withdrawal of your consent, we retain only a limited record of this objection, so that we do not contact you again for marketing purposes.

For data collected via cookies, pixels or similar technologies, different storage periods may apply per cookie or tracker. The specific storage periods and criteria therefor are set out in our cookie policy, where you can find detailed and up-to-date information.

3.10. Collection and publication of reviews or feedback

When users voluntarily share reviews, testimonials or feedback about the platform, we process personal data in that context.

What data we process:

• Identification data (e.g. name or username)
• The content of the review, feedback or testimonial
• Contextual information about the use of the platform

Why we (may) process this data (purposes and legal basis):

We process this data to make user experiences visible, to promote transparency and trust within the cohousing community, and to evaluate and improve the platform and the services provided.

This processing is based on your consent. Reviews or testimonials are only used or published with your agreement.

How long we retain this data:

Reviews and associated personal data is retained for as long as they are relevant to communications relating to the platform or until you withdraw your consent.

3.11. Collaboration with service providers and partners

We process personal data relating to individuals with whom we work as service providers, suppliers, partners or within the context of a similar professional relationship.

Which data we process:

• Identification and contact details
• Professional and contractual data
• Financial and administrative data

Why we (may) process this data (purposes and legal basis):

This data is processed in order to correctly prepare and execute collaborations and agreements, to manage administration, accounting and payments, to comply with statutory obligations and to be able to defend ourselves against potential legal claims.

This data is processed so that we can perform the agreement with the service provider/partner in the normal course of business. We need this data in order to take measures prior to entering into the agreement or to give effect to the agreement to which you are a party. The data is also used for invoicing and accounting purposes (for which we rely on a statutory obligation). Furthermore, we may use your data to defend ourselves against legal proceedings. For this purpose, we rely on our legitimate interest consisting of the right to an effective remedy.

How long we retain this data:

These personal data is retained for as long as the collaboration is ongoing and thereafter for as long as necessary to comply with statutory retention obligations or to handle legal disputes. For certain data, we apply, in accordance with the statutory periods of limitation, a storage period of 10 years.

3.12. Processing of personal data when visiting the website

When you visit our website (even without creating an account or logging in to the cohousing platform, see also the preceding processing activities in this regard), we process your personal data to a limited extent.

Which data we process:

When visiting the website, we may, depending on your settings and choices, process the following categories of personal data, among others:

• Technical and usage data, such as IP address, date and time of the visit, pages visited, browser used and type of device
• Online identifiers and preferences collected via cookies or similar technologies
• Information about interactions with the content of the website (e.g. links clicked)
• Identity and contact details that you voluntarily provide when you submit a question or request information via the website
• Any additional data that you yourself communicate in the context of an information request

Why we (may) process this data (purposes and legal basis):

We process these personal data in order to:

• Ensure the technically correct functioning of the website and to guarantee its security
• Gain insight into the use of the website and to generate statistics on visitor behaviour
• To analyse and improve the content, structure and operation of the website
• To properly handle information requests and questions submitted via the website
• To inform interested parties about the cohousing platform and its operation, without automatically considering them as platform users

For strictly necessary cookies and similar technologies, the processing is based on our legitimate interest in ensuring the correct and secure functioning of the website.

For analytical, marketing or non-essential cookies, we rely on your consent, which you can grant or refuse via the cookie banner, as further explained in the cookie policy.

How long we retain this data:

We do not retain personal data collected during a website visit for longer than necessary, whereby the specific storage period is determined on the basis of, among other things, the type of data (e.g. technical log data, cookie information or contact details), the specific purpose for which the data is processed (analysis, website functionality, answering a question), the legal basis for the processing (legitimate interest or consent), your configured cookie and privacy preferences, and the need to be able to adequately follow up on questions or requests.

For personal data collected via cookies and similar technologies, different storage periods may apply per cookie or tracker. The specific storage periods and characteristics of these cookies are set out in our cookie policy, where you can always consult the most up-to-date and detailed information.

3.13. Internal statistical analysis and product development

In the context of the analysis, evaluation and further development of the platform, we may process personal data arising from the use of the platform.

Which data we process:

• Usage data (e.g. frequency of use of certain functionalities, general interaction patterns, success rates of matches)
• Technical and functional data regarding the use of the platform (e.g. error messages, loading times, use of new or modified features)
• Statistical information based on profile, search and interaction data, to the extent that these are processed in a non-identifiable or only limitedly identifiable manner

Why we (may) process this data (purposes and legal basis):

We process this data in order to:

• Gain insight into the general use of the platform and the functioning of existing functionalities
• Evaluate and improve the quality, performance, accessibility and user-friendliness of the platform
• Develop, test and optimise new features
• Detect and remedy errors, technical problems or structural bottlenecks
• Make well-founded choices with regard to the further development and futureproofing of the platform

These processing activities are carried out on the basis of our legitimate interest in managing and further developing the platform in a high-quality, secure and efficient manner. In doing so, we always take into account the nature of the data, the limited privacy-impact character of statistical and aggregated analyses, and the reasonable expectations of users.

How long we retain this data:

Personal data processed in the context of internal statistical analysis and product development are not retained for longer than is necessary for the purposes described above. The storage period is determined on the basis of objective criteria, including the nature of the data (directly identifiable, pseudonymised or aggregated), the specific analysis or development purpose for which the data is used, the currency and relevance of the data, and the extent to which they still contribute to the improvement, evaluation or further development of the platform. Data linked to active user accounts may temporarily be included in analysis environments, while data from terminated accounts are in principle anonymised or deleted as soon as possible.

4. Transfer of personal data

In the context of our activities and provision of services, your personal data may, to the extent necessary for the purposes pursued, be communicated to or processed by the following categories of recipients:

• Other users of the platform, given that this is inherent to the functioning of a cohousing platform. This includes, among other things, making profiles and listings visible, displaying matching information and enabling communication between interested users.
• Financial and payment service providers, such as banks and providers of electronic payment solutions, to the extent that this follows from administrative, accounting or contractual obligations (e.g. where paid services or premium functionalities are offered).
• External authentication and verification partners, such as providers of Single Sign-On services (e.g. Google and Apple) and telecom or SMS service providers, where this is necessary for registration, login, account security or the prevention of misuse and fake accounts.
• Government entities, administrations, judicial authorities and supervisory authorities, where we are legally obliged to do so or where they lawfully request information from us, including in the context of fiscal, social, judicial or other statutory obligations, as well as in the context of compliance with the Digital Services Act (DSA).
• Professional service providers involved in or necessary for our operations, such as lawyers, accountants, notaries, bailiffs, (judicial) experts and other external advisors, to the extent required for legal, tax, dispute or compliance purposes.
• External compliance, audit and advisory partners, including service providers supporting us with legal, data protection, security or quality control reviews (e.g. audits, internal controls or certification processes).
• Technical and organisational service providers supporting us with IT infrastructure and business processes, such as hosting providers, cloud and collaboration platforms, document and file management systems, CRM systems, analysis tools, communication tools, email and office applications. Where these parties act as data processors, we conclude the required data processing agreements with them and impose appropriate security and confidentiality obligations.
• Marketing and communications partners, including providers of newsletter software, marketing and analysis tools, and communication platforms supporting us in our communications, to the extent this is done in accordance with applicable regulations and the choices you as a data subject have made.
• Providers of social media platforms and online advertising services, in particular Meta and Google, with whom we act as (joint) data controllers for certain marketing and analysis activities. Further information can be found in the privacy policies of these parties: META and Google.
• Third parties in the context of a (proposed) reorganisation or transaction, such as a merger, acquisition, (partial) transfer of activities, restructuring of industry or financing. In such case, personal data may be disclosed to potential or actual acquirers, investors, financiers and their professional advisors, solely to the extent necessary and subject to appropriate safeguards.

Where personal data is transferred to recipients outside the European Economic Area, we ensure that such transfer takes place in compliance with the requirements of the GDPR and with appropriate safeguards, such as standard contractual clauses (SCCs) or other legally recognised mechanisms. Where we invoke external service providers who store personal data in the United States of America for a limited part of the processing, we make use of the applicable EU-US Data Privacy Framework.

Should you wish to obtain further information in this regard, you may contact us at any time using the contact details set out in section 1 of this privacy statement.

5. Your rights

The General Data Protection Regulation (GDPR) grants you a number of rights with regard to your personal data. The exercise of these rights is, however, subject to certain conditions under the GDPR.

Where we have reasonable doubt as to your identity, we may ask you for additional proof of your identity.

We endeavour to respond to your request within a period of one month. Depending on the complexity of the request and/or the number of requests, that period may be extended by a further two months. In the event of such an extension, you will be informed thereof within one month of receipt of the request.

If you wish to exercise any of your rights and/or obtain further information about your rights, you may contact us at any time using the contact details set out in section 1.

5.1. The right of access to your personal data

A request for access to your personal data allows you to consult your personal data. On the basis of this right, you may request a copy of the data we hold about you. This enables you to verify the lawfulness of the processing activity and to check whether the data is accurate.

5.2. The right to rectification of your personal data

You have the right to have inaccurate or incomplete personal data corrected.

5.3. The right to object to the processing of your personal data for direct marketing purposes and the general right to object on grounds of circumstances specific to your particular situation (‘right to object’)

Where personal data is processed for direct marketing purposes, you have the right at any time to object to the processing of your personal data for such marketing.

In other cases, where the processing is based on legitimate interest, you may object to the processing on grounds of circumstances specific to your particular situation (this requires a certain statement of reasons). In some cases, we may be able to demonstrate that we have a legal basis for processing your information that overrides your rights and freedoms. In that case, we must, as data controller, demonstrate why your data may be processed.

5.4. The right to erasure of data and the right to be forgotten

You may request the erasure of your personal data if there is no longer a legitimate reason to process it.

The right to erasure of data is not absolute. You may exercise it in one of the following cases (the list is exhaustive):

• The personal data is no longer necessary to fulfil the purpose pursued;
• We are processing the personal data unlawfully;
• We are required to erase the personal data by a legal obligation;
• You withdraw your consent;
• You have successfully exercised your right to object to the processing.

In certain cases, we may refuse to erase your personal data. In such a case, we will inform you of this when you submit a request for erasure of data.

5.5. The right to restriction of processing

A restriction of data processing means that the processing is ‘frozen’: we may only store the personal data and must cease all other processing activities.

You have the right to restriction of the processing of personal data when (the list is exhaustive):

• You wish to have the accuracy of the data verified;
• The processing is unlawful;
• We no longer need the personal data, but you do for the exercise of a claim asserted by legal proceedings;
• You exercise your right to object, but where we must verify whether this can be complied with.

5.6. The right to withdraw your consent at any time

If we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. The withdrawal of your consent does not affect the lawfulness of the processing that took place before you withdrew your consent.

5.7. The right to data portability

The right to data portability enables you to obtain and reuse personal data for other services. You can only exercise this right if the processing is based on your consent or if it is necessary for the performance of a contract we have with you. Furthermore, this right only relates to personal data that you have provided yourself and this right only applies to digital information.

5.8. The right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with the supervisory authority for data protection matters. In Belgium, this is the Data Protection Authority (‘DPA’). You can get in touch via https://www.gegevensbeschermingsautoriteit.be/burger/acties/contact.

Before lodging a complaint, we encourage you to contact us so that we can find a swift resolution to your complaint.

6. Amendments

We reserve the right to amend this statement from time to time. If the changes are substantial, we will notify you via our website or by email.

Last amendment: 28 April 2026.