Oscart Group NV attaches great importance to the protection of your personal data (and that your privacy is respected). In this privacy statement we want to provide clear and transparent information about what data we collect and how we handle personal data. We do everything we can to guarantee your privacy and handle personal data with care. Oscart Group NV is in all cases subject to applicable laws and regulations, including the General Data Protection Regulation (EU 2016/679 Regulation).

• We process your personal data in accordance with the purpose for which it was provided, these purposes and the type of personal data are described in this privacy statement.
• We only process the personal data that is minimally required for their purposes.
• If we need your explicit consent to process your personal data, we will always ask for this.
• We have taken the appropriate technical and organizational measures to ensure the security of your personal data.
• We do not pass on personal data to other parties unless this is necessary to carry out the purposes for which this data was provided or if this is required by law.
• We would like to inform you that we are aware of and respect your rights regarding your personal data.

At Oscart Group NV we are responsible for the way in which your personal data is processed. If you have any questions after reading our privacy statement, you will find our contact details below.

Oscart Group NV
Politieke Gevangenenstraat 28
8530 Harelbeke
Belgium
info@oscart.eu

To whom is this privacy statement addressed?
This privacy statement is addressed to all our current and former members, participants in activities, suppliers, customers, prospects, employees and persons interested in our activities, services or products.

For what purposes do we process your personal data?
For users of the oscart.eu platform:
Personal data e.g. name, first name, e-mail address, language, photo, password, 2-step authentication, user rights, company name, IP address, number of incorrect login attempts, actions taken on the website, e-mail or other messages from Oscart that you have received, are processed by Oscart Group NV for the following purposes and legal grounds:

• Log in to oscart.be (agreement)
• Provide additional security for your account (consent)
• Send a new password by email if you have forgotten your old password (consent)
• Personal contact via email (legitimate interest)
• Display content specific to your business (agreement)
• Blocking accounts after X number of incorrect login attempts (legitimate interest)
• Track users if unwanted actions were performed on company account. (legitimate interest)
• Providing training (agreement)
• Keep track of who has followed a training (legitimate interest)
• Communicating in the correct language (legitimate interest)
• Determining what type of actions you are entitled to (agreement)
• Enable faster user recognition (permission)
• Sending commercial information about our products, newsletters and invitations (consent)
• Sending emails with an offer (directly linked to a recent visit) (consent)

For persons in (in)direct contact with employees of Oscart Group NV:
Personal data e.g. name, first name, address, e-mail address, company name, company telephone number, company address, mobile telephone number, tags, position are processed by Oscart Group NV for the following purposes and legal grounds:

• Answers to incoming questions (consent)
• Prospecting (legitimate interest)
• Preparing quotations and/or invoices (consent and agreement)
• Sending quotations (legitimate interest)
• Manage files (agreement)

Since the processing of personal data is based on consent, you always have the right to withdraw the consent given.

For (former) employees, we refer to the internal regulations.
We only collect personal data provided by you or your company, including registration forms, fill-in forms and contact forms on our website, personal / telephone / e-mail contact, .... We do not collect personal data through third parties, with the exception of trade fair organizations in which we have participated.
We only use the collected data for the purposes for which we obtained the data.

Provision of personal data to third parties
We may provide your information to third parties if this is necessary to achieve the purposes described above or if this is required by law. We rely on a third party (external service provider) for the purposes below:

• Storing and processing data in the cloud (via a Cloud Service Provider)
• Improving the internet environment (web hosting, mail hosting, etc.)
• Providing IT infrastructure (including IT network, servers, etc.)
• Taking care of the (financial) administration
• Offer and distribute newsletters and invitations
• Using government services
• Participate in external training courses
• Organizing activities in collaboration – activities developed with two or more organizations, including co-production

We never pass on personal data to external service providers (processors) with whom we have not concluded a processing agreement (or for which the same provisions are included in the contractual conditions). We will of course make the necessary arrangements with these parties to ensure the security of your personal data and the confidential treatment of your data. In addition, we will not pass on the information you provide to other third parties unless required and permitted by law.

We never sell or rent your personal information to third parties. We never pass on your contact details to third parties for commercial purposes. We may share personal data with other third parties if you give us your express consent. You have the right to withdraw this consent at any time.
Your personal data may be transferred to countries outside the European Economic Area. In that case, your personal data will be protected by specific contractual obligations in accordance with the obligations of European privacy regulations.

Storage period
Oscart Group NV does not store personal data for longer than necessary to achieve the purposes for which the data was provided, taking into account the period required to comply with legal requirements (including in the field of accounting). However, retention periods may differ for each purpose.

Data security
Our partners (processors) and ourselves have taken appropriate technical and organizational measures to protect your personal data against unauthorized access, use, loss or disclosure (… breaches, loss and unlawful processing…).
If an incident occurs involving your data, you will be personally informed in the circumstances provided for by law.

Your rights and obligations regarding your privacy
You have the right to inspect and copy the personal data relating to you. You have the right and obligation to correct and provide your data if it is incorrect or incomplete. You have the right to request the deletion of your personal data when this data is no longer strictly necessary for the purposes for which it was processed. We have the right to determine whether your request is justified. You have the right to restrict data processing. You have the right to request that we no longer process certain data. You can also object to the way your personal data is processed.

For example, you have the right to object to the use of your personal data for direct marketing purposes (using unsubscribe options in emails). You can also ask us to provide your personal information to yourself or to another party. Please use the address at the top of this privacy statement to contact us to exercise your rights, with a motivation for your request attached. We may ask you to identify yourself before we can fulfill the above requests. To prevent abuse, we may ask you to identify yourself. Please enclose a copy of the front of your identity card with your application. We strongly recommend that you make your passport photo invisible and state that it is a copy. None of the above categories of persons are subject to automated decision-making or profiling.

Liability of Oscart
Oscart's liability is limited to repairing foreseeable and direct damage suffered by the customer.

Customer liability
The customer is liable for the legal and contractual use of the services and products and is liable for all damage caused to Oscart or third parties. The content of the communication drawn up by the customer through the use of the services and products remains his own responsibility.

Oscart indemnifies itself against all claims made by third parties against Oscart on the basis of incorrect and/or unlawful use of the service or product.
To gain access to the services and products, the customer receives one or more personal usernames and passwords. The customer is responsible for the confidentiality, security and appropriate use of the usernames and passwords. To this end, the customer must take all necessary measures to ensure this confidentiality, security and appropriate use and to ensure that they are not disclosed to third parties. Oscart excludes all possible liability for damage that could occur in this context. The customer must be responsible for the security of the system.

Complaints
If you have a complaint about the way your personal data is processed or about the exercise of your rights, please contact us directly. You always have the right to file a complaint with the supervisory authority in the field of privacy protection:

Data Protection Authority (GBA)
Drukpersstraat 35, 1000 Brussels
commission@privacycommission.be

Changes to our privacy statement
Oscart Group NV can always adjust its privacy statement. Changes to the privacy statement are always announced on our website. The statement was last modified on June 7, 2018.