1. INTRODUCTION

This privacy notice provides information to individuals who work for, on behalf of, or are representatives (an “Individual Representative”) of business customers, suppliers and subcontractors of COMPAGNIE D'ENTREPRISES CFE SA, avenue Edmond Van Nieuwenhuyse 30 | 1160 Brussels, or any of its affiliated companies (hereinafter jointly referred to as the “COMPANY”) regarding how their personal information is collected and processed by the COMPANY, in compliance with applicable data protection laws, in particular the European General Data Protection Regulation (hereinafter “GDPR”) and the Belgian law. This privacy notice explains why and how the COMPANY collects personal information about Individual Representatives (the “Personal Data”), what Personal Data is processed, who has access to Personal Data, how the COMPANY protects Personal Data, how long Personal Data is retained, the rights of Individual Representatives and who to contact for further information. This notice is without prejudice to specific provisions set out in any contract entered into between the COMPANY and the applicable customer, supplier or subcontractor.

2. SCOPE

This data protection notice concerns all the services provided by the COMPANY and more generally, all the activities carried out within it.

3. RESPONSIBLE FOR THE PROCESSING AND COMMITMENTS

The COMPANY is responsible for processing your personal data. In the collection and processing of your personal data, we comply with the General Data Protection Regulation (GDPR) as of its entry into force on May 25, 2018, as well as the Belgian law on the protection of personal data.

4. PERSONAL DATA

Depending on your activities and the contractual relationship with the COMPANY, you are likely to provide us with the following personal data: your identity data and your contact details (name, title, address, e-mail address, telephone number, cellphone). For certain specific legal obligations (electronic registration of attendance, 30bis declaration of work), you may have to provide us with additional data in order to register your attendance (such as E-ID data, Limosa number).

You are solely responsible for the accuracy of the data you provide to us. If your data is no longer up to date, it is therefore up to you to inform us immediately.

You are not obliged to communicate your personal data. Please note, however, that it will be impossible for us to offer certain services or collaborate with you if you do not consent to the collection and processing of certain personal data.

5. PURPOSES AND BASIS OF PROCESSING

5.1. Customer data

As part of our services and our activities, we collect and process the identity data and contact details of our customers, their staff, collaborators, agents and any other useful contact person. The purposes of this processing are the execution of agreements with our customers, customer management, accounting and direct prospecting activities, such as sending commercial information. The legal basis is the performance of a contract, compliance with legal and regulatory obligations (such as the 30bis declaration of work) and/or our legitimate interest.

5.2. Data from suppliers and subcontractors

We collect and process the identity data and contact details of our suppliers and subcontractors, as well as their possible (sub)subcontractor(s), their staff, collaborators, agents and any other useful contact person. The purposes of this processing are the execution of this agreement, the management of suppliers/subcontractors, accounting and direct prospecting activities, such as the sending of commercial information. The legal basis is the execution of the contract, the respect of legal and regulatory obligations (such as the compulsory electronic registration of attendance, the declaration of works 30 bis, the attendance list or other obligations during public procurement contracts, etc.) and/or our legitimate interest (such as for direct marketing). For the electronic attendance registration, if necessary, the E-ID data or the Limosa number will be processed. For direct marketing activities by e-mail (such as newsletters or invitations to participate in events), consent will always be requested, and may be withdrawn at any time.

5.3. Personnel dat

We process the personal data of our employees in the context of our personnel management and salary management. Given its specific nature, this processing is dealt with in more detail in a Data Protection Notice for workers.

5.4. Other data

In addition to customer, supplier/subcontractor and employee data, we also process personal data of other individuals, such as new or potential customers, useful contacts within our industry, contacts of networking, expert contacts, etc. The purposes of this processing are in the interest of our activities, direct marketing and public relations. The legal basis is our legitimate interest or in some cases the performance of a contract.

6. DURATION OF PROCESSING

Personal data is kept and processed by us for a period necessary depending on the purposes of the processing and the relationship (contractual or not) between us.

The data of customers and suppliers or subcontractors will, in any case, be removed from our systems at the end of a period of ten years following the termination of the contract or the end of the project, except with regard to personal data that we are required to keep longer under specific legislation or in the event of a dispute for the entire period necessary for this purpose.

7. RIGHTS

In accordance with the provisions of the GDPR and Belgian legislation on the protection of personal data, we inform you that you have the following rights:

• Right of access: you have the right to see the data we hold about you free of charge and to check for what purposes it is used.

• Right of rectification: you have the right to obtain rectification (correction) of incorrect personal data concerning you, as well as the right to complete incomplete personal data.

• Right to be forgotten or to limit data: you have the right to ask us to erase the personal data concerning you as well as to limit the processing of this data in the circumstances and under the conditions stipulated in the GDPR. We may refuse the erasure or limitation of data necessary for salary processing, the performance of a legal obligation, the performance of the employment contract or our legitimate interest, insofar as these data are necessary for the purposes for which they were collected.

• Right to data portability: you have the right to receive the personal data concerning you that you have provided to us, in a structured, commonly used and machine-readable format. You have the right to transmit this data to another controller.

• Right of opposition: you have the right to oppose the processing of your personal data for serious and legitimate reasons. However, you cannot oppose the processing of data necessary for the performance of a legal obligation, the performance of the employment contract or our legitimate interest, provided that this data is necessary for the purposes for which it was collected.

• Right to withdraw consent: if the processing of personal data is based on prior consent, you have the right to withdraw this consent. This personal data will then only be processed if we have another legal basis.

• Automated decisions and profiling: we confirm that the processing of personal data does not include profiling and that you will not be subject to fully automated decisions.

You can exercise the aforementioned rights by sending your request to the following email address: dataprotection@cfe.be

We make every effort to ensure authorized and lawful processing of personal data concerning you in accordance with applicable regulations.

8. TRANSFER OF DATA TO THIRD PARTIES

Certain personal data of workers collected by the employer will be transferred to and may be processed by, third parties, such as our IT supplier, accountant, auditor, social secretariat, as well as by the administration (e.g. in the case declaration of work 30bis, electronic registration of attendance or for the award of public procurement contracts).

One or more of the third parties may be located outside the European Economic Area ("EEA"). However, personal data will only be transmitted to third countries with an adequate level of protection.

The workers, managers and/or representatives of the aforementioned third-party service providers or institutions, as well as the specialist service providers appointed by them, are required to respect the confidential nature of your personal data and may only use this data for the purposes for which they were provided.

If necessary, personal data may be transmitted to other third parties. This may be done in the event of a partial or complete reorganization of the COMPANY, if our activities are transferred or in the event of a declaration of bankruptcy. It is also possible that personal data is transferred due to an order or in order to fulfill a particular legal obligation. In this case, we will make every effort to inform you in advance of this communication to other third parties. You acknowledge and understand, however, that in certain circumstances this information may not always be technically or commercially possible, or that legal limitations may apply.

Finally and for the sole purpose of improving connections and synergies between the entities of the CFE group, we may transmit the data of customers, suppliers and subcontractors to our related companies.

Under no circumstances will we sell your personal data, nor will we make it available to direct marketing agencies or similar service providers without your prior consent.

9. TECHNICAL AND ORGANIZATIONAL MEASURES

We will take the appropriate technical and organizational measures to process the data at a sufficient level of security and to protect the personal data against any destruction, loss, falsification, unauthorized access, as well as any unauthorized processing of this data. Under no circumstances can the COMPANY be held liable for any direct or indirect damage resulting from incorrect or unlawful use of personal data by a third party.

10. ACCESS BY OUR ATTENDANTS

With a view to processing your personal data, we authorize access to your personal data to our employees, collaborators and agents. However, these persons are bound by contractual data protection obligations similar to those described in this information notice.