Purpose of this data protection & privacy policy
This data protection & privacy policy (hereafter the “Policy”) aims to provide explanations to those individuals whose personal data are processed. The legal basis for this Policy is the EU Regulation 2016/679 dated 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR or General Data Protection Regulation) as applicable in the European Economic Area and any comparable regulation applicable in other countries worldwide.
In the context of our business activities as Innovad Group, including the operation of our website, we process personal data about our customers, our suppliers, our partners as well as about the visitors of our website, and we are committed to protecting those personal data and maintaining the accuracy, confidentiality and integrity thereof.
This Policy explains, among other things, which personal data we collect and how we process them, why we process your personal data, the legality of the processing operations, your rights and how to exercise these rights and the obligations of Innovad Group.
1. Innovad Group as controller
“Controller” means any entity that determines the purposes and means of the processing of personal data it carries out. Ranch Topco BV and all its subsidiaries and affiliated entities act as controller for the personal data under their respective control (hereafter together referred to as “Innovad Group”). Ranch Topco BV and its subsidiaries and their respective branches may have their tasks and responsibilities performed by another entity within the holding company without prejudice to what is included in the relevant legislation.
Ranch Topco BV is a limited liability company incorporated under Belgian law with registered office Cogels Osylei 33 in 2600 Berchem (Belgium) and registered with the Crossroads Bank for Enterprises under number 1.032.077.228. Phone: +32 (0)3 667 16 55. Email: [email protected].
2. Scope of this policy
This privacy policy applies to all our (current, former and future) customers, suppliers, partners or natural persons who work for or on behalf of our customers, suppliers and/or partners, to all visitors of the Innovad Group websites and to all other persons who contact us. This Policy applies to the processing of your personal data following the use of the Innovad Group websites and following the products and/or services that we provide in relation to our business.
Innovad Group may amend this Policy when necessary, for example in case of changed circumstances, new legislation or possible changes in the way we collect or process personal data. The most recent version of this Policy is available on the website and through our website and other communication channels if appropriate, we will inform you of any changes or updates.
Personal data is defined as unique information from or about you that makes it possible to identify you as an individual. Examples of personal data include your name, address, email address, IP address and bank account number.
The processing of personal data is any operation relating to personal data, whether or not by automated means, such as collection, recording, organizing, structuring, storage, adaptation, consultation, use, erasure or destruction of your data. A processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.
3. Collection of personal data
We collect the following categories of personal data from you and about you:
identification data: first name, surname, address, telephone number, email address, date of birth, gender;
financial data, such as bank account number and payment history;
professional data, such as your position and title within your organization, contracts which you have concluded with us, products and services you have purchased or delivered, etc.;
electronic data: IP address, cookies (see our cookies policy), etc.;
all navigation and web search information concerning pages from other websites through which you had browsed or had been redirected to in order to arrive at our website;
and all information that you voluntarily provide to us.
Personal data is collected either (i) directly through you when you provide us with your personal data or (ii) indirectly through our collection of your personal data when you use our website or based on documents where your personal data are provided to us, such as contracts, purchase orders, invoices, etc.
4. Processing of personal data
We process your personal data for the following purposes:
provision of products and/or services and providing you from time to time with relevant information about our products and services;
procurement, planning and project management;
administration, invoicing and accounting in order to complete transaction or order you placed with us;
help us understand your needs and interests better in order to improve our products and services;
handling questions, complaints and disputes;
collecting and processing of information, leads and prospects for (direct) marketing purposes, including the provision of information about the relevant products and/or services;
handle your enquiry via the website and contact you (by e-mail or otherwise);
conduct an analysis on website visitor;
increase the functions and user-friendliness of our website and improve the design, content, and user experience thereof;
conduct research such as analyzing how visitors use and navigate our website, etc.; and
compliance with legal or regulatory requirements.
We process these data based on the following legal grounds:
consent, such as when you sign up for an email newsletter;
execution of a contract if you use our products and/or services and you, directly or on behalf of a company, are a party to the contract;
a legal obligation, as we must retain certain data for audit purposes, for guarantees or for tax or social authorities;
a legitimate interest, as we may store certain personal data in order to be able to approach you in a targeted manner or to analyse our products or services.
Your personal data may be accessed within Innovad Group by the following people: the members of staff who need to obtain access to your personal data for the purposes outlined above. And if necessary, your personal data may be accessed for these purposes by other companies of the Innovad Group.
Your personal data will only be communicated to the following third parties in order to achieve the purposes stated above: companies that are affiliated with us and/or to unaffiliated third parties working on our behalf, for us or with us, but only for the purpose listed above, such as our processors (mainly IT processors).
All of those affiliated and unaffiliated parties are required to keep your personal data confidential and may not use it for any purpose other than to carry out the tasks they are performing for us or otherwise required by law.
Unless otherwise stated in this Policy, we will not disclose your personal data to third parties without your permission unless the disclosure is to (i) comply with any law, orders from authorities or a court order; (ii) respond to requests from governmental authorities; or (iii) help prevent fraud or to protect the safety, rights, property or security of us or third parties.
5. Transfer of personal data to countries outside the EEA
When we work with third parties located in countries outside the European Economic Area (EEA) where the level of protection for your personal data could be insufficient, we impose contractual obligations on them that have been approved by a competent authority (based on the standard contractual clauses issued by the European Commission), which ensures adequate protection of your personal data.
6. Retention of personal data
Your personal data will not be retained for any period longer than is necessary for us to achieve the purposes for which they were collected. The retention period may therefore differ depending on the objective. As an example, we must keep invoicing data for 7 years to meet accounting and tax obligations. We store your professional data for 10 years after termination of your contractual relationship out of legal necessity in order to be able to use data as evidence in case of audits or disputes. The personal data of potential customers, suppliers, partners or natural persons associated with them, is kept for 12 months after obtaining these personal data.
7. Security and protection of personal data
Information security is important to us. Therefore, we undertake physical, electronic, technical and administrative measures and safeguards and review them periodically to protect your personal data from unauthorized or inappropriate access and use, loss or unauthorized modification. Innovad Group makes every effort to protect its network and databases as much as possible against unauthorized access and to guarantee the confidentiality of the personal data of its customers, suppliers, partners and natural persons associated with them.
8. Your rights and how to exercise these rights
As an individual, you have the following rights in relation to your processed personal data.
Right to access. You have the right, at any time, to ask us whether or not we process your personal data, and if so, to view said data and receive information about the purposes of processing, the categories of personal data concerned, the recipients, the retention period if possible or otherwise the criteria for determining that period, the source of the data, the right to file a complaint with the supervisory authority.
Right to rectification. You have the right to have incomplete, incorrect, inappropriate or outdated personal data rectified.
Right to erasure or the right to be forgotten. In a certain number of cases, you have the right to have your personal data deleted without undue delay: (i) the personal data are no longer required by Innovad Group for the purposes for which they were collected or otherwise processed, (ii) you object to the processing of your personal data and there are no overriding legitimate grounds for further processing by Innovad Group, (iii) your personal data have been processed unlawfully, (iv) your personal data must be deleted in order to comply with a legal obligation and (v) you have withdrawn your consent and there is no other legal basis on which the processing of personal data can take place.
Right to the restriction of processing. You have the right to restrict the processing of your personal data of one of the following applies: (i) you dispute the accuracy of the personal data, so the use of the data has to be restricted while we check the accuracy, (ii) the processing of your personal data is unlawful but instead of deleting your data, you request its use be restricted, (iii) we no longer need your data for the original processing purposes but the data can be needed for the establishment, exercise or defense of legal claims, so instead of deleting your data, their use will be restricted to the establishment, exercise or defense of legal claims and (iv) as long as a decision has not yet been taken on the exercise of your right to object to the processing, you request that the use of your personal data be restricted.
Right to portability. You are entitled to recover your personal data. This is only possible for personal data you disclose, pass on or make available to us in any way either actively or passively, directly or indirectly. This right can only be exercised if your data are processed on the basis of your consent or a contract and if such processing takes place using automated processes. In all other cases, you cannot invoke this right, like for example when the processing of your data is based on a legal obligation or a legitimate interest. Associated with this right, you can ask us to recover the personal data concerned in a structured, commonly used and machine-readable form, and you can ask us to transfer the personal data concerned directly to another controller, but we have the right to refuse such a transfer if it is technically not possible.
Right to withdraw your consent. When processing is based on your consent, you have the right to withdraw your consent at any time. This withdrawal has only consequences for the future and does not affect the validity of any processing operations carried out with your consent before the date of withdrawal. In the event of withdrawing your consent, we can only continue the processing insofar as another legal basis applies.
Right to object to the processing. You have the right to object to the processing of your personal data based on your particular situation if the processing takes place in the context of the legitimate interest of Innovad Group or the public interest. We will cease processing your personal data unless we can demonstrate compelling and legitimate grounds that outweigh yours, or where the processing of these personal data is related to the establishment, exercise or defense of legal claims.
In order to exercise your rights described above by, you can contact us by sending an email to your usual contact person within Innovad Group, by sending an email to [email protected] or by sending us a letter to the local legal entity of Innovad Group or to the address above (point 1).
Upon receipt of your request, we will answer you as soon as possible and in any case within one month of receipt of your request. Depending on the complexity of the request and the number of requests, this period may be extended by two months if necessary.
9. Data protection officer & complaints
Innovad Group has a designated data protection officer (DPO). If you believe your privacy question or request has not been handled properly, or if you would like to receive more information about this Policy, you can submit a written request to the DPO, who can be contacted by letter on the address mentioned above in point 1 or by email via [email protected].
If you are not satisfied with our response to your request with regard to your exercise of those rights, you have the possibility to submit a complaint to the supervisory data protection authority in the country where you have your residence or your place of work. In Belgium, this is the Data Protection Authority (GBA/APD), with address Drukpersstraat 35 in B-1000 Brussels, tel. +32 (0)2 274 48 00 and email [email protected].