1 – Purpose of the data controller’s privacy policy

The purpose of this privacy policy is to provide information to persons whose data is processed in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

In this policy, we explain in particular:

• Which personal data is processed by Ebolt.
• For which purposes it is processed.
• The lawfulness of this processing (the legal bases).
• What your rights are.
• What Ebolt’s obligations are.

2 – Data controller

“Data controller” means any entity that determines the purposes and means of the processing operation(s) it carries out. Ebolt and all subsidiaries or branches act as controllers of the personal data under their respective control (hereinafter “Ebolt”). Ebolt may however represent its subsidiaries and respective branches in their capacity as data controller. Ebolt, its subsidiaries and respective branches may – subject to the provisions of the relevant legislation – entrust their tasks and responsibilities to another entity of the holding.

Ebolt is registered under company number: BE0840714440.

Address: 344 rue de Pontillas, 5300 Landenne

Contact e-mail address: info@ebolt.be

3 – Scope of the privacy policy

This privacy policy applies to all our customers (current, former and future) or to natural persons working for or on behalf of our business customers and/or suppliers, to all visitors to the Ebolt website and to any other person contacting us. It concerns the processing of your personal data in connection with the use of the Ebolt website and the services provided by Ebolt.
Insofar as your personal data is provided to us by our business customers and/or suppliers, they have certain responsibilities under the law, including informing you that we process your data.

Ebolt may also process your personal data as a processor on behalf of one of its partners, who will then be the data controller. In that case, we refer to the privacy policy of the partner concerned.

Ebolt may adapt its privacy policy where necessary, for example in the event of a change in circumstances (changes to our services, legislation, etc.). The latest applicable version will be available on the website and we will inform you of any change via our website and, where appropriate, through other communication channels. This policy indicates which version it is and from when it applies.

If you do not wish to provide your personal data and we need it to provide you with information or enter into a contractual relationship with you, we will not be able (i) to provide you with further information about our services and products, (ii) to offer you our services or products or (iii) to enter into a contractual relationship with you.

4 – Some definitions

Personal data is defined as information provided by you or relating to you that allows you to be uniquely identified. A person can be identified directly, for example by reference to an identifier such as your name or identification number, or indirectly, for example by reference to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity.

Examples of personal data: name, address, e-mail address, IP address, account number.

The processing of personal data is any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, dissemination, erasure or destruction of your data.

The data controller is a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

A processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

5 – What personal data about you does Ebolt process?

Categories of personal data processed

• Identification data: first name and surname, address, telephone number, e-mail address, date of birth.
• Electronic identifiers: IP address (PC, tablet or smartphone), cookies (see the cookie policy), etc.
• Contract data: for example the contracts you have concluded with Ebolt, their start and end dates, the price and any indexation parameters, purchase and contact history.
• Data concerning your use of our products and services: for example how you use our online services.
• Professional data: function and title with our business customers and/or suppliers.
• Financial data such as bank account number and payment history.
• Traffic data and location data.
• Consumption data, measurement data, (technical) data of your connection(s), installations, technical infrastructure and other data relevant to the provision of installation and maintenance services, insofar as this data allows you to be identified.
• Other data provided to Ebolt, for example in the context of following up complaints, breakdowns or other contact requests.
• Data from other products and/or services.
• Categories of data subjects (persons whose personal data is processed by Ebolt)
• Website visitors
• Current, former and future (business) customers and their employees and representatives
• Suppliers and their employees and representatives

6 – Purposes of the processing of personal data

In this section, we try to inform you as fully as possible about the purposes of the processing of your personal data and the legal bases on which we rely for this processing. The following list of purposes and legal bases is not exhaustive.

• Website management

• Contact forms on the website

• Provision of services

• Administration, invoicing and accounting

• Provision of information about Ebolt’s products and services

• Improvement of our products and services

• Call centres

• Protection of Ebolt’s rights, property and security

• Compliance with legal or regulatory obligations

• Requesting, concluding and/or performing an installation or maintenance services contract, provision of Software as a Service solutions

• Purchasing, staff coordination, planning and project management

• (Administrative) management of information concerning maintenance, breakdowns and repairs on installations or technical infrastructure in the context of the provision of services

• Collection and processing of data of existing customers, contacts and prospects for marketing purposes (prospecting), including the provision of information about other relevant products and/or services

• Handling of requests, complaints and disputes

7 – Legal bases

Ebolt processes data on the following bases:

a) Your consent, for example when you subscribe to the electronic newsletter.

b) The performance of a contract, if you use our services and are yourself a party to the contract.

c) A legal obligation: we must keep certain financial data for the tax authorities, but also data about our installations, inspections, etc.

d) A legitimate interest: we may keep certain customer data in order to approach you in a targeted way and analyse our services.

8 – To whom may we disclose your personal data?

To achieve the purposes mentioned in the previous section, your personal data will only be disclosed to the following third parties:

• our call centres

• our partners (for example installers of energy and energy-efficiency products);

• the companies and intermediaries we use to manage our receivables (for example debt collection, assignment of receivables);

• the companies that are part of Ebolt, insofar as the processing is carried out by one of the companies authorised to do so;

• the competent authorities;

• our processors (e.g. ICT subcontractors).

• Persons working for these third parties will only have access to the data strictly necessary to carry out their task and are contractually bound to respect the confidentiality of the data.

The above list of third parties is not exhaustive.

9 – Transfer of your personal data to countries outside the European Economic Area (“EEA”)

When we work with third parties established in countries outside the EEA where the level of protection of your personal data is insufficient, we impose contractual obligations on them that have been approved by a competent authority (the standard data protection clauses adopted by the European Commission) and that guarantee adequate protection of your personal data.

10 – How long do we keep your personal data?

Your personal data will not be kept longer than necessary to achieve the purposes for which it was collected. The retention period may therefore vary depending on the purpose. For example, we must keep your invoicing data for 7 years because of accounting and tax obligations. We keep your contract data for up to 10 years after the end of your contract out of legal necessity, in order to be able to use certain data as evidence in the event of a dispute. The personal data of prospects or of natural persons linked to these prospects is kept for up to 12 months after obtaining this personal data. It may however be kept longer if the prospect actually becomes an Ebolt customer. The above list of retention periods is not exhaustive.

11 – Security of your personal data

Ebolt has an internal privacy and security policy.

Ebolt provides the necessary technical and organisational measures to protect your personal data against unauthorised access, loss or unlawful alteration.

Ebolt makes every effort to protect its network as well as possible against unauthorised access and to guarantee the confidentiality of its customers’ personal and operational data.

12 – What privacy rights do you have?

12.1 – Your right of access

You have the right to obtain from us at any time confirmation as to whether or not personal data concerning you is being processed and, where it is, access to that personal data and the following information:

a) the purposes of the processing;

b) the categories of personal data concerned;

c) the recipients or categories of recipients (in particular recipients established in third countries);

d) where possible, the retention period or, where this is not possible, the criteria used to determine that period;

e) the existence of your privacy rights;

f) the right to lodge a complaint with the supervisory authority;

g) the information we have about the source of the personal data where this data is collected via a third party;

h) the existence of automated decision-making.

This information is provided to you by means of this privacy policy.

You also have the right to obtain a copy of the processed data in an intelligible form.

12.2 – Your right to rectification of your personal data

You have the right to obtain the rectification of incomplete, inaccurate, inappropriate or outdated personal data.

12.3 – Your right to erasure of your data (the “right to be forgotten”)

You have the right to obtain the erasure of your personal data without undue delay in the following cases:

a) your personal data is no longer necessary for the purposes for which it was collected or otherwise processed by Ebolt;

b) you object to the processing of your personal data and there are no overriding legitimate grounds for (further) processing by Ebolt;

c) your personal data has been unlawfully processed;

d) your personal data must be erased to comply with a legal obligation;

e) you have withdrawn your consent and there is no other legal basis for the processing.

Please note, however, that we cannot always erase all the personal data requested, for example when the processing of this data is necessary for the establishment, exercise or defence of legal claims, or because we are legally required to keep certain documents, or because we need it for an existing contractual relationship. We will provide you with more detailed information on this in our reply to your request.

12.4 – Your right to restriction of processing

You have the right to obtain the restriction of the processing of your personal data where one of the following applies:

a) you contest the accuracy of this personal data: its use will be restricted for a period allowing Ebolt to verify the accuracy of the data;

b) the processing of your personal data is unlawful: instead of erasure of your data, you request the restriction of its use;

c) Ebolt no longer needs the data for the purposes of the original processing, but you still need it for the establishment, exercise or defence of legal claims: instead of erasure of your data, its use is restricted to the establishment, exercise or defence of legal claims;

d) as long as no decision has been taken regarding the exercise of your right to object to the processing, you request that the use of your personal data be restricted.

Where processing has been restricted, the personal data may, with the exception of storage, only be processed with the consent of the data subject, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest.

12.5 – Your right to portability of your personal data

You have the right to “retrieve” your personal data. You can only do this for the personal data that you communicate, transmit or make available to us yourself, actively or passively, directly or indirectly. This right can only be exercised if your data is processed on the basis of your consent or a contract and if this processing is carried out by automated means. In all other cases, you cannot therefore benefit from this right (for example when the processing of your data is carried out on the basis of a legal obligation or a legitimate interest).

There are 2 aspects to this right:

a) you can ask to receive from Ebolt the personal data concerned in a structured, commonly used and machine-readable format; and

b) you can ask Ebolt to transmit the personal data concerned directly to another data controller. You will then be responsible for the accuracy and security of the e-mail address you provide for the transmission. Ebolt has the right to refuse this transmission if it is not technically possible.

12.6 – Your right to withdraw your consent

Insofar as processing is based on your consent, you also have the right to withdraw that consent at any time. The withdrawal will however only have effect for the future and will not affect the lawfulness of processing carried out on the basis of your consent before the date of withdrawal.

If you withdraw your consent, we may only continue to process the data if there is another legal basis for the processing.

12.7 – Your right to object to the processing of your personal data

You have the right to object, on grounds relating to your particular situation, to the processing of your personal data if the processing is based on a legitimate interest of Ebolt or on a task carried out in the public interest.

Ebolt will no longer process your personal data, unless it can demonstrate compelling legitimate grounds for the processing which override yours, or the processing of the personal data is related to the establishment, exercise or defence of legal claims (for example filing a claim with a court).

13 – Practical information

13.1 – How can I exercise my privacy rights?

If you have any questions about the use of your personal data to which this privacy policy applies, you can contact us at info@ebolt.be

To exercise your right of access and avoid any unauthorised disclosure of your personal data, we may ask to verify your identity. In case of doubt or ambiguity, we will first ask you for additional information. If it is not possible to verify your identity in any other way, we may also ask you to provide us with a copy of the front of your identity card.

The above rights may be exercised in accordance with the requirements and limitations provided for by law. The text of the General Data Protection Regulation therefore takes precedence over what is stated in the description of the rights mentioned above.

13.2 – Are there any costs?

When you submit your request electronically, the information will also be provided to you electronically where possible, unless you request otherwise. In any case, we will provide you with a concise, transparent, intelligible and easily accessible reply.

13.4 – When will I receive a reply?

We will respond to your request as quickly as possible and in any case within one month of receiving it. Depending on the complexity of the requests and the number of requests, this period may be extended by a further two months if necessary. If the period is extended, we will inform you within one month of receiving the request.

13.5 – What happens if Ebolt does not act on my request?

Ebolt has appointed a Data Protection Officer (DPO). If you believe that your privacy question or request has not been handled correctly, or if you would like more information about this privacy policy, you can send a written request to the DPO. You can do so as follows:

• By e-mail: info@ebolt.be

You also have the right to lodge a complaint with the supervisory authority. In Belgium, this is the Data Protection Authority (DPA).

• Website: https://www.autoriteprotectiondonnees.be

Contact details:

Data Protection Authority

Rue de la Presse 35, 1000 Brussels

+32 (0)2 274 48 00

+32 (0)2 274 48 35

contact@apd-gba.be