This Data Protection Notice applies to all services provided by us and in general to all activities that we carry out.

Grubau BVBA, with registered office at Hoge Akker 1, 8560 Wevelgem, Belgium and with company number BE0420.959.313, is the controller of your personal data.

When collecting and processing your personal data, we respect the Belgian regulations on the protection of personal data, as well as the General Data Protection Regulation (“GDPR”) from its entry into force on 25 May 2018.

Depending on your activities and your relationship with our company, you provide us with the following personal data: name, position, e-mail address, telephone and/or mobile number.

We kindly point out that you are responsible for any data you provide to us and that we rely on its accuracy. If your data is no longer up-to-date, we request that you notify us immediately.

You are not obliged to provide your personal data, but you understand that the provision of certain services or cooperation becomes impossible if you do not agree to the collection and processing.

In the context of our services and activities, we collect and process the contact details of our customers, their staff, employees, appointees and other useful contacts. The purposes for this processing are the execution of the agreements with our customers, customer management, accounting and direct marketing activities such as sending promotional or commercial information. The legal grounds are the execution of the agreement, the fulfillment of legal and regulatory obligations and/or our legitimate interest.For direct marketing activities by e-mail (such as a newsletter or invitation to events), permission will always be requested and can also be withdrawn at any time.

We collect and process the contact details of our suppliers, their staff, employees, appointees and other useful contacts. The purposes of this processing are the execution of this agreement, the management of the suppliers and the accounting. The legal grounds are the execution of the agreement, the fulfillment of legal and regulatory obligations and/or our legitimate interest.

We process the personal data of our employees in the context of our personnel management and payroll administration. Given its specific nature, this processing is more extensively regulated in a Data Protection Policy for Employees.

In addition to the data of customers, suppliers/subcontractors and staff, we also process personal data of others, such as possible new customers/prospects, useful contacts within our sector, network contacts, contacts of experts, etc. The purposes of these processing operations are in the interest of our activities, direct marketing and public relations. The legal basis is our legitimate interest or in some cases the execution of an agreement.

The personal data is stored and processed by us for a period that is necessary in function of the purposes of the processing and in function of the (contractual or non-contractual) relationship that we have with you.

Customer data and data from suppliers will in any case be deleted from our systems after a period of seven years after the termination of the agreement or the project, except with regard to these personal data that we must keep for longer on the basis of specific legislation or in case of an ongoing dispute for which the personal data is still necessary.

In accordance with and under the conditions of the Belgian privacy legislation and the provisions of the General Data Protection Regulation, we inform you that you have the following rights:

• Right of access and inspection: you have the right to take cognizance of the data we have about you and to find out what it is used for free of charge.
• Right to rectification: you have the right to obtain rectification (correction) of your inaccurate personal data, as well as to complete incomplete personal data.
• Right to erasure or restriction: You have the right to request that we erase your personal data or restrict its processing in the circumstances and under the conditions set out in the General Data Protection Regulation. We may refuse the erasure or restriction of any personal data that is necessary for us for the performance of a legal obligation, the performance of the agreement or our legitimate interest, as long as this data is necessary for the purposes for which it was collected.
• Right to data portability: you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format. You have the right to transfer this data to another person responsible for the processing.
• Right to object: you have the right to object to the processing of your personal data for serious and legitimate reasons. Please note, however, that you cannot object to the processing of personal data that is necessary for us to fulfill a legal obligation, the execution of the agreement or our legitimate interest, and this as long as this data is necessary for the purposes for which they were collected.
• Right to withdraw consent: If the processing of personal data is based on prior consent, you have the right to withdraw this consent. These personal data will then only be processed if we have another legal basis for this.
• Automatic decisions and profiling: we confirm that the processing of the personal data does not involve profiling and that you are not subject to fully automated decisions.

You can exercise the aforementioned rights by contacting Mr. Frederik Rigole with contact details: frederik.rigole@grubau.be.

We make every effort to handle your personal data in a careful and legitimate manner in accordance with applicable regulations. If you nevertheless believe that your rights have been violated and your concerns are not addressed within our company, you are free to file a complaint with:

Commission for the Protection of Privacy
Drukpersstraat 35, 1000 Brussels
Phone. 02 274 48 00
Fax machine. 02 274 48 35
Email: commission@privacycommission.be

You can also file a complaint with a court if you believe that you would suffer damage as a result of the processing of your personal data.

Certain personal data collected by us will be transferred to and possibly processed by third party service providers, such as our IT supplier, accountant, reviewer, Mailchimp, as well as by the government.

One or more of the above third parties may be located outside the European Economic Area (“EEA”). However, only personal data will be forwarded to third countries with an adequate level of protection.

The employees, managers and/or representatives of the above-mentioned service providers or institutions and the specialized service providers appointed by them must respect the confidential nature of your personal data and can only use this data for the purposes for which they were provided.

If necessary, your personal data may be passed on to other third parties. This could be the case, for example, if we were to be reorganized in whole or in part, if our activities were to be transferred or if we were declared bankrupt. It is also possible that personal data must be transferred pursuant to a court order or to comply with a certain legal obligation. In that case, we will make reasonable efforts to inform you in advance about this communication to other third parties. However, you acknowledge and understand that in certain circumstances this may not always be technically or commercially feasible or that legal restrictions may apply.

We will under no circumstances sell or make commercially available your personal data to direct marketing agencies or similar service providers, unless with your prior consent.

We take the necessary technical and organizational measures to process your personal data with an adequate level of security and to protect it against destruction, loss, falsification, alteration, unauthorized access or accidental notification to third parties, as well as any other unauthorized processing of this data. .

If a data leak still occurs, we will start an investigation as soon as possible into the nature of the data affected, the extent of the leak and the impact on those involved. We will then inform those involved as soon as possible of the measures to repair and prevent the leak.

Under no circumstances can Grubau BVBA be held liable for any direct or indirect damage resulting from incorrect or unlawful use by a third party of the personal data.

With a view to processing your personal data, we grant access to your personal data to our employees, employees and appointees. We guarantee a similar level of protection by making contractual obligations enforceable against these employees, employees and appointees, which are similar to this Data Protection Notice.