Privacy Policy
Privacy policy
Ekowz Privacy Policy
This Privacy Policy governs the processing of your personal data by EKOWZ SRL, a company registered in the Belgian Crossroads Bank for Enterprises under the number 0761.881.847, with registered offices at 54 avenue Louise, 1050 Ixelles (Brussels), Belgium (hereinafter referred to as “Ekowz”, “we”, “us” or “our”).
The privacy and security of your (hereinafter referred to as “you” or “your”) personal data are very important to us. The purpose of this Privacy Policy is to specify which categories of personal data we collect through our various activities and services. We explain whether or not your personal data will be disclosed to third parties and the restrictions and safeguards to which we subject such transfers.
We furthermore aim to provide you with a comprehensive view of the purposes for which we process your personal data and which rights you may exercise in that regard.
Article 1 General information
Your personal data may reach us via various means. This may be directly from you via our website: www.ekowz.com, its subdomains and directories (collectively referred to as the “Website”), any other means relating to information or communication technology, including our mobile application (“Application”), emails and voice calls, or via any in-person interactions we might engage in. We may additionally receive your personal data, indirectly, such as from third-party sources.
For the purpose of this Privacy Policy, we are to be considered the controller of your personal data.
This means that the applicable data protection legislation imposes certain obligations on us. The aforementioned legislation includes, in particular, the Belgian Act of 30 July 2018 on the protection of natural persons in relation to the processing of personal data, the Belgian Act of June 13th, 2005, on the electronic communication, the General Data Protection Regulation (Regulation (EU) 2016/679 of 27 April 2016, “GDPR”), including future adaptations and revisions of the previous (hereinafter collectively referred to as the applicable “Data Protection Legislation”).
Should you have any questions regarding this Privacy Policy, or should you feel that your interests are not represented or are inadequately represented, please address your questions to us at dataprivacy@ekowz.com.
Article 2 How we collect personal data
There are multiple ways in which your personal data may reach us. This may be directly or indirectly, via in-person interactions or online, via an action by you or via automated means, etc. We identified the following, non-exhaustive list of collection points:
Last updated on 01 June 2022
- When you visit and use our Website, including when filling in forms thereon or via cookies and similar technologies;
- When you make use of our Application or otherwise access our services, including when filling in forms thereon or via cookies and similar technologies;
- When contacting us, including without limitation, via email, telephone, written letter, etc;
- When organising and participating in meetings, both in an online and offline environment; and
- When your data is provided to us by your employer or client in the context of our services.
Generally, your employer’s or client’s privacy policy will exclusively apply to the processing of such personal data. However, where this should not be the case, we aim to inform you of the application of this Privacy Policy as set out under article 4(B) of this Privacy Policy. - We may also collect and receive personal data from publicly available sources, such as public registers for individuals and public registers for companies, in accordance with the purposes set out below.
Article 3 Personal data we collect and process
In what follows, we will attempt to give you a general overview of the most important categories of personal data we might collect and further process about you. Please note that these categories intend to provide you with an overview as complete as possible, but that we cannot provide you with an exhaustive list due to the nature of our activities. As a general rule, the personal data we process about you will always be linked to the specific purposes identified under article 4 of this Privacy Policy.
Please be aware that the categories of personal data we process about you will depend on the capacity in which you come into contact with us.
Our services are neither intended for nor aimed at children. If we become aware of the unintentional processing of personal data relating to children, we will take measures to immediately delete such data.
A. Basic contact and identification data
This category of personal data includes identification data, meaning basic identifying and/or professional information such as your first name, surname, date of birth, your company name, and your function. This category furthermore includes contact data such as your e-mail address and telephone number. Where required for the purposes set out below, it may additionally refer to demographic information such as your address, security questions, etc.
B. Service data
Refers to the personal data, other than your basic contact identification data and financial data that we may process for the execution of our services in relation to you, your employer, or your client. This data may in particular refer to information relating to the waste you generate, the types of waste you generate, statistics on the waste you generate, etc.
C. Data on your preferences
We collect data about your participation in our conferences, seminars, and other events, including necessary credentials, associations, dietary requirements, personal interests, and preferences. This data additionally includes your subscription to our newsletter, downloads, etc.
D. Financial data
Financial data refers to data relating to billing information, credit card information, account numbers, payment history, etc.
E. Usage and technical data
We collect and store full IP addresses, unique device identifiers, your browser type, time zone settings, operating system, and the specifications of the hardware you use to access our Website and social media accounts. We may furthermore collect personal data when you access our Wi-Fi network and other electronic services. Please note that the concerning data may among others be collected by automated means, such as for example cookies. Please refer to our Cookie Policy for more information relating to our processing of personal data via cookies and similar technologies.
Article 4 How we use personal data
In the next part, we set out the specific purposes for which your personal data may be processed. In addition to explaining why and how we might use your personal data we will provide you with the legal bases on which we base ourselves to legitimately make use of the personal data. Please contact us as described under article 11 of this Privacy Policy, should you have any questions in
relation to the purposes for which we process your personal data.
A. Interactions with us
We may collect and process personal data about you when exchanging communications, whether or not related to the performance of our services. The personal data concerned refers in particular to all basic contact and identification data. The personal data may be used for responding to your queries, the provision of services, and/or other information you may have requested.
Please note that the processing under this section includes interactions both in an online and offline environment. This means that information, such as personal data on a business card you exchanged with us, may also be processed by us.
For the collection and processing of your personal data in relation to our interactions, we base ourselves on our legitimate interest to provide you with the best possible interactions, among others in our provision of services, in answering your requests and by providing you with proper response times.
B. Services
We process your basic contact and identification data in the execution of our services for the purpose of managing your profile. For this purpose, we manage the information for letting you log in to our services, managing your account, managing your waste, managing your statistics, etc.
We process your service data for the purpose of the provision of our services to you, your employer, or your client. For this purpose, we collect information regarding waste disposal, which is then put into connection with the different profiles on our services, general statistics on waste disposal are made, and specific recommendations for waste disposal are made based on the collected service data.
Generally, we do not process your personal data for this purpose in our capacity as controller of your personal data, but rather as a processor, on behalf of another controller, e.g.: your employer or client.
Nevertheless, on certain occasions, we may process your personal data in our capacity of controller, e.g.: where we would use this data for the improvement of our services, by letting you test our services and/or Website and Application or by working together with your employer or client.
For the processing of your personal data for the execution of our services, in our capacity of controller, we will always require your prior, explicit consent. When requiring your consent, we will additionally provide you with a copy of this Privacy Policy. Please note that you can withdraw your consent at any time, as indicated below under article 8.
C. Marketing
We may use your personal data for our marketing purposes. We distinguish our events and our direct marketing processing purposes.
Events – we may use your basic contact and identification data, data on your preferences, and financial data for the purpose of organising events and managing your participation thereto. Your data may be used for our management of payments, management of your food preferences, if any, confirming your participation, asking for feedback, and completing surveys, etc.
For the collection and processing of your personal data in relation to the organisation of events, we base ourselves **on the contract we concluded** when you inscribed to the particular event.
Direct marketing – we may use your basic contact and identification data and data on your preferences for the purpose of providing you with information relating to events, conferences, seminars, and other events we may host or participate in, communications regarding our products and services, newsletters, etc.
For the collection and processing of your personal data in relation to direct marketing, we base ourselves on your consent to receive such communications.
If you are a client or otherwise engage(d) our services, we may send you marketing communications based on the services we provided you with in the past. In that case, we may send you direct marketing communication based on our legitimate interest to keep you informed on related services and evolutions of our business.
When you receive marketing communications from, either on the basis of your consent or on the basis of our legitimate interest, you have at all times the right to opt-out from our receiver list by sending us an email to dataprivacy@ekowz.com or by clicking the unsubscribe button at the bottom of a specific marketing communication.
D. Business administration
We collect and process the basic contact and identification data, preference data, and, where relevant, financial data of individuals acting in their capacity of representatives of their organisations, and of those people who are or might be our business partners or service providers for the purpose of our general business administration.
The personal information may be used for fixing meeting dates, the execution of the services of our service providers, for establishing a business relationship with a service provider, taking into account any dietary requirements you may have, etc.
For the collection and processing of your personal data in relation to our business administration we base ourselves on the contract concluded with the service provider.
However, should there not be a contract in place then we base ourselves on our **legitimate interest to store information on potential partners and/or service providers, including their representatives**.*
E. Compliance and enforcement
We may use your basic contact and identification data, service data, usage and technical data, and financial data for our own compliance with the legal and regulatory obligations imposed on us. These obligations include any fiscal obligations to which we conform.
Please note that we may collect or receive such information from you or from third-party sources, such as official instances managing such documentation from you on their own merit or on your instruction.
We may additionally process your personal data under this section for our own establishment and enforcement of claims or defences of a legal, administrative, or jurisdictional nature.
For the collection and processing of your personal data for compliance with specific legal or regulatory obligations, we base ourselves on our necessity to comply with the various legal obligations to which we are subject.
Where we process the personal data for the purpose of establishing or enforcing our own claims or defences, we base ourselves on our **legitimate interest to protect our commercial, financial and legal interests as permitted by law.
F. Client insights and analytics
We may analyse the information including the personal data necessary for us to directly identify you in relation to other personal data, such as your interactions on the Website, social media, and your communications with us. This information relates in particular to your basic contact and identification data and the usage and technical data.
The gathering and analysis of such information may be performed by using cookies, web beacons, pixel tags, log files, and similar technologies used to gather personal data from the hardware and software you use to visit our Website, including from any mobile devices you may use.
For more information regarding cookies, web beacons, and pixel tags used on our Website and Application, please refer to our Cookie Policy.
For the collection and processing of your personal data for client insights and analysis, we base ourselves on our legitimate interest to use your personal data for the continuous improvement of our services, in order to provide you with the best possible experience, among others on our Website and social media profiles.
G. Security and IT management
We use your basic contact and identification data and usage and technical data for the purpose of ensuring the effective and secure functioning of our information security systems and more generally the online environment that we put at your disposal, including the management of your accounts and password-protected sections of our Website.
The gathering and analysis of such information may, among others, be performed by using cookies, web beacons, pixel tags, log files, and similar technologies used to gather personal data from the hardware and software you use to visit our Website or our Application, including from any mobile devices you may use.
For more information regarding cookies, web beacons, and pixel tags used on our Website and Application, please refer to our Cookie Policy.
For the collection and processing of your personal data for the purpose of securing and ensuring the effective functioning of our online environments, we base ourselves on our legitimate interest to monitor how our Website and Application are used and to detect and prevent fraud, criminal activities, and general misuse of our services.
Article 5 How long we retain your personal data
Our policy is to only retain your personal data for as long as it is required to satisfy the purposes for which we collected it or for which you provided it to us. In what follows we seek to give you the necessary insights in order for you to assess how long your personal data may be retained by us.
As a base rule, we will de-identify or delete any personal data that is no longer considered necessary for the purposes described above or when the retention period as described below has been surpassed. If no retention period has been accorded to a particular processing purpose, the personal data will be deleted or anonymized at the latest within ten (10) years after their collection or receipt
by us.
Nevertheless, please note that your personal data will never be anonymized or deleted when such personal data is to be retained by us in the application of an obligation of legal, administrative, or jurisdictional nature. Such an obligation would effectively forbid us or make it impossible for us to remove your personal data. Such data will only be stored and further processed for the purpose of our compliance and will no longer be processed for any other purpose.
Deletion or anonymization of personal data will always happen without further notice or liability on our part.
We distinguish the following retention periods:
Processing purpose - Retention periods
- Services: Two (2) years after your last access to the services.
- Marketing – event: Two (2) years from the end of our event, excluding
when the information that may be relevant for our
compliance and enforcement. In which case your
personal data will be stored for that purpose for ten
(10) years after the end of the event. - Marketing – direct marketing: Five (5) years from the date of receiving your consent or from the date you last used our services.
- Compliance and enforcement: Ten (10) years after our last business transaction or ten
(10) years after the closure of your file with Ekowz. - Client insights and analytics: Two (2) years after the reception or collection of the
personal data. - Security and IT management: Twelve (12) months after the collection of the
information, except if the information may lead to a
compliance and enforcement action from our side, in
which case it will be held for ten (10) years after its
collection.
Article 6 With whom we share your personal data
In order to provide our services to you and in order to make our Website, Application, and social media pages available to you, we may share your personal data with third-party contractors and/or other controllers. The sharing of your personal data is either performed on the basis of our contract with you, in particular where this is necessary for the performance of our services or is subordinately based
on our legitimate interest to provide our services to you in the best possible manner and allow for the proper communication within our business.
We do not share your personal data with these recipients for secondary or unrelated purposes other than those mentioned in this Privacy Policy, unless expressly otherwise stated at the moment of collecting the particular personal data. The recipients have been carefully selected, and the necessary steps have been taken to ensure the adequate protection of your personal data.
Please consider that due to the complexity and changing nature of our services, we are unable to provide you with an exhaustive list of all recipients with whom your personal data may be shared.
However, we have identified the following recipients that may process personal data about you:
- Slack
- Airtable
- Google Drive
- Notion
- ClickUp
- OVH
- AWS
As stated, we may additionally share your personal data with other recipients, such as:
- Our accountants, auditors, lawyers, or similar advisors when we ask them to provide us with their respective services;
- Any other third party in relation to which we have a duty to disclose or share your personal data in order to comply with our legal obligations;
- Etc.
For more information relating to the recipients of your personal data, you can contact us in accordance with the provisions of article 11.
Article 7 International data transfers
We are a Belgian law firm with offices registered in Belgium only. As a principle, your personal data will be stored and processed in Belgium. However, for the purposes set out in article 4 of this Privacy
Policy, we may transfer personal data to other jurisdictions outside the European Economic Area, and therefore not bound by the obligation in the General Data Protection Regulation. When we transfer your personal data to third parties residing in such jurisdictions, we implement appropriate safeguards in our agreement with those third parties in order to provide your personal data the benefit of an adequate level of data protection and at least a level of data protection equivalent to the level to which you are entitled under the General Data Protection Regulation.
For this purpose, we assess the level of data protection in the country of transit or destination, among others taking into account the adequacy decisions taken by the European Commission. Additionally, we may make use of the Standard Contractual Clauses approved by the European Commission, certification mechanisms, and any other appropriate solutions as required or permitted by the applicable Data Protection Legislation.
Feel free to contact us as set out under article 11 of the Privacy Policy, should you have any questions regarding the international transfers of your personal data and the safeguards we have implemented in that regard.
Article 8 Your data protection rights
Under the applicable Data Protection Legislation, you are entitled to exercise certain rights in relation to your personal data processed by us.
If you would like to be supplied with further information on your rights or wish to exercise them, please write to us at dataprivacy@ekowz.com. We ask of you to properly identify yourself when exercising your data protection rights in order to enable us to execute your request within the hereunder
provided delays.
The exercise of your rights is free and will be executed within one (1) month of the receipt of your request to exercise your rights. We may extend this delay with an additional two (2) months for a total delay of three (3) months, should your request prove to be particularly complex. If we decide to extend the initial delay, we will always inform you of this decision in due time.
In those cases where we deem your request to exercise your rights manifestly unfounded or excessive, we reserve the right to charge you an administrative fee for the execution of your request, or even to refuse to act on your request. You will always be informed within the abovementioned timeframes of our decision.
A. Withdrawal of consent
You have the right to withdraw your consent in relation to all processing activities for which you have previously given us your consent. Please note that withdrawing your consent will not impact the validity of the lawful processing activities performed on your personal data before you withdrew your consent.
B. Right of access
You are entitled to request a copy of the data we process and hold about you. If we process and/or hold personal data about you, you will receive a copy of the information in an understandable format together with an explanation of why and how we hold and use it.
Additionally, you can ask to receive information regarding the recipients or categories of recipients to whom your personal data has been disclosed, including any recipients established in third countries, meaning countries located outside the European Economic Area. Please refer to Article 7 of this Privacy Policy in order to learn how we handle the transfer of personal data to countries located outside the European Economic Area.
C. Right of rectification
You have the right to ask us to correct your personal data. This includes the right to have us correct spelling mistakes or change an address, email addresses, phone numbers, etc.
Additionally, depending on the purposes of the processing, you have the right to complete any incomplete information we process or hold about you.
D. Right of erasure
You have the right to request the deletion of the personal data we process about you. We can object to the deletion of your personal data if the processing is done to comply with legal obligations, for reasons of public interest, or for the establishment, exercise, or defense of our legal claims.
Should you wish to erase your personal data processed on the basis of a contract you concluded with us, we may terminate our performance of the services provided to you under that contract if the processing of such personal data is required for the performance of the contract.
E. Right to restrict the processing of personal data
Under certain circumstances, you have the right to ask us to restrict our processing of your personal data. Please note that in exercising this right, the relevant personal data will remain stored in our possession, but we will not be able to further process it. You can ask us to restrict the processing of your personal data where:
- you believe that the personal data we process on you is inaccurate;
- our processing of your personal data should be unlawful;
- we are no longer required to process your personal data for the purposes set out in article 4, but we are not allowed to delete your personal data due to a legal or other obligation; or
- you object to our processing of your personal data as set out below, but you do not want us to delete your personal data.
F. Right to object to the processing
In those instances where we process and collect your personal data based on our legitimate interest, you have the right to object to our processing of such data. Please note that if you decide to exercise your right to object to our processing of your personal data, we have the right to provide you with our legitimate grounds on which we base ourselves in order to continue the processing of your data.
Our decision to continue the processing of your personal data does not preclude you from filing a complaint with the relevant supervisory authority as set out further below under article 12.
G. Right to data portability
You are entitled to receive the personal data we process or hold on you in a structured, commonly used, and machine-readable format. Furthermore, you have the right to have this personal data transmitted to another data controller, where
- the personal data in question was provided to us by yourself; and
- we process the personal data on the legal basis of your consent or under an agreement you have concluded with us, as detailed under article 4 of this Privacy Policy.
Please be informed that we are allowed to refuse your exercise of this right if we deem the requested action to be taken not to be technically feasible, a legal obligation precludes us from transferring or providing you with such personal data, or if the exercise of your rights under this section goes against our legitimate interest.
Article 9 Security of your personal data
We use generally accepted and reasonable technical and organisational methods consistent with current technological developments with regard to operational security to offer protection against loss, abuse, alteration, or destruction of all personal data we store and process.
Our technical and organisational measures are frequently updated in order to adapt these measures to new technical and organisational procedures and to ensure the continued safety of your personal data.
Please note that our Website and social media accounts may contain links to other websites or internet resources which may also collect personal data, through cookies or other technologies. We carry no responsibility, liability for, or control over those other websites or internet resources or their collection, use, or disclosure of your personal data. We recommend that you review the privacy policies of these other websites and internet resources in order to understand how they collect and process your personal data.
Article 10 Amendments to the Privacy Policy
We may bring adaptations and improvements to the Privacy Policy from time to time. These changes will mainly be made to account for new case law and practices developing in the data protection field, and in order to ensure your control over your personal data.
The most current version of the Privacy Policy will always be displayed on the Website and can be requested as indicated below under article 11. On top of this Privacy Policy, you will be able to check the date on which we last implemented changes to the policy. Please contact us if you wish to consult earlier versions thereof.
Article 11 Your questions and queries
You undertake to communicate accurate personal data to us. You may at any time modify the personal data at our disposal by sending us an email. We cannot be held responsible for any failure of our services related to incorrect information you provided.
Should you have any questions about this Privacy Policy or should you have the feeling that your interests are not or inadequately represented, you can address all your questions to us at the following email address: dataprivacy@ekowz.com.
Article 12 Dispute resolution
This Privacy Policy shall be governed by - and construed in accordance with - the Belgian legislation.
You have the right to file a complaint with the competent data protection authority, being the authority in the Member State of your habitual residence, your place of work, or the place of the alleged infringement of the applicable Data Protection Legislation. Notwithstanding the previous, the lead data protection authority is the Belgian Data Protection Authority (“Autorité de protection des données” or “Gegevensbeschermingsautoriteit”), which can be reached via the following means of communication:
- by following the instructions and filling in the form accessible via this link;
- by sending a letter to Drukpersstraat 35, 1000 Brussels, Belgium;
- by calling the following number +32 (0)2 274 48 00;
- by faxing to +32 (0)2 274 48 35; or
- by sending an email to contact@apd-gba.be.