Privacy Policy

Applicable as of 25 May 2018 — FUN BRANDS SRL

1. Purpose

This document constitutes the Privacy Policy implemented by FUN BRANDS SRL in the context of its activities.

Protecting your privacy and your personal data is of paramount importance to FUN BRANDS SRL.

This Privacy Policy is drafted to ensure compliance with European Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation, or GDPR).

This Privacy Policy aims to fully inform you on this subject and explains how we collect, use and retain your personal data.

2. What is the scope of this policy ?

What does "processing your data" cover and who is responsible for it ?

We collect and use only the personal data that is necessary in the context of our activities and that allows us to offer you quality products and services.

FUN BRANDS SRL, with registered office at Rue du Fond des Fourches 23D, B-4041 Vottem (Z.I. de Milmort), is the Data Controller for the personal data it processes.

We are therefore your point of contact, as well as that of the supervisory authorities (for example the "Data Protection Authority"), for any question relating to the use of your data by our company.

For certain services, we use specialised third parties who, in some cases, act as processors. They must then follow our instructions and comply with our Privacy Policy. In other cases, these third parties are also joint controllers and must comply with their own legal obligations in this respect.

We ensure that these processors only receive the data strictly necessary to perform their part of the contract.

We may also act as a processor for other entities, whether or not belonging to the FUN BRANDS group. In that case, those entities are the Data Controllers for the personal data. We then follow their instructions.

3. What data is covered by our policy ?

The data covered by this policy is the personal data of natural persons, i.e. data that directly or indirectly allows a person to be identified.

In the context of your relationships and interactions with FUN BRANDS SRL, we may collect various personal data, such as :

Identification and contact data (e.g. title, name, address, date and place of birth, national register number, account number, phone number, email address, IP address, profession) ;
Family situation (e.g. marital status, number of children) ;
Banking, financial and transactional data (e.g. bank details, account numbers, data relating to transfers including the communication, and generally all data recorded during your bank transfers) ;
Data relating to your behaviour and habits regarding the use of our channels (e.g. our shops, our websites, our tablet and smartphone apps) or your consumption (number of products ordered, interval between orders, etc.) ;
Data relating to your preferences and interests, which you communicate to us directly or indirectly, for example via participation in our competitions or events, … ;
Data from your interactions on our dedicated social media pages.

We never process data relating to your racial or ethnic origin, political opinions, religion, philosophical beliefs or trade union membership, your genetic data, your sex life or sexual orientation, unless legislation requires it of us or this results from your own use of our products and services (e.g. you mention this type of information yourself).

4. Guiding principles for processing personal data

FUN BRANDS SRL will, among other things, respect the following principles when processing personal data in the context of managing and performing its commitments :

Lawful data processing : FUN BRANDS SRL processes personal data lawfully in the context of its activities ;
Determined purposes and purpose limitation : FUN BRANDS SRL collects and processes personal data for the lawful purposes determined below ;
Data minimisation : FUN BRANDS SRL limits the processing of personal data to what is necessary for its activities ;
Accuracy of personal data : FUN BRANDS SRL takes all reasonable steps to ensure personal data is accurate and is rectified and/or erased without delay if it is no longer accurate ;
Storage and processing limitation : FUN BRANDS SRL will not process or retain personal data for longer than necessary to carry out its activities ;
Security measures : FUN BRANDS SRL takes the necessary and appropriate technical and/or organisational measures for the security of personal data.

5. When is your personal data collected ?

The data we use may be collected directly from you or obtained from the following sources, in order to verify or enrich our databases :

Publications/databases made accessible by official authorities (e.g. the Belgian Official Gazette) ;
Our client companies or our service providers ;
Websites/social media pages containing information you have made public (e.g. your website or social network) ;
Databases made public by third parties.

Some of your data may also be collected by FUN BRANDS SRL :

When you become a customer or supplier ;
When you register to use our online services (at each login or use) ;
When you fill in the forms and contracts we submit to you ;
When you register at the reception of FUN BRANDS SRL ;
When you use our services and products following the signing of a contract ;
When you subscribe to our newsletters, respond to our competitions, or register on our website ;
When you contact us through the various channels available to you ;
When your data is published or transmitted by authorised third parties or professional data providers ;
When you are filmed by our surveillance cameras located in and around our premises/buildings.

The images are recorded solely to preserve the security of property and persons and to prevent abuse, fraud and other offences against our customers and/or our staff (their presence is indicated by stickers bearing our contact details).

6. On what basis and why do we use your personal data ?

We process your personal data for various purposes. For each processing operation, only the data relevant to the purpose pursued is processed.

In general, we use your personal data :

In the context of performing a contract or taking pre-contractual measures ;
In order to comply with the legal and regulatory provisions to which we are subject ;
For reasons falling within the company's legitimate interest. When we carry out this type of processing, we ensure a balance between this legitimate interest and respect for your privacy ;
When we have obtained your consent.

Personal data is processed by FUN BRANDS SRL for purposes which include, but are not limited to :

Providing you with information about our products and services ;
Assisting you and responding to your requests ;
Enabling the proper performance of agreements entered into ;
Ensuring the financial and accounting management of FUN BRANDS SRL ;
Ensuring good management of customers, equipment and suppliers ;
Conducting market research and establishing usage profiles, carrying out information and/or promotional operations on products and services, those of its group companies and/or its business partners ;
Working to improve existing (or under development) products and services through surveys of current or potential customers, statistics, tests, or comments you send us directly or publish on our websites ;
Meeting legal obligations including responding to official requests from duly authorised public or judicial authorities ;
Detecting and preventing abuse and fraud : we process and manage contact and security data to validate, monitor and ensure the security of transactions and communications via our remote channels ;
Ensuring the provision of services and products by using subcontractors ;
Monitoring our activities (measuring sales, number of appointments, number of calls, visits to our website, …) ;
Improving the quality of individual service to our customers ;
Carrying out prospecting relating to FUN BRANDS SRL products and services, or other products we promote or that are promoted by companies belonging to the FUN BRANDS SRL group ;
Ensuring the security of our premises and infrastructure, and of the people in those places.

7. Who has access to your data and to whom is it transferred ?

Only authorised users have access to your personal data in order to accomplish the aforementioned purposes. Authorised users means people who, in the exercise of their function within FUN BRANDS SRL, are authorised to process personal data on the basis of FUN BRANDS SRL's instructions.

In order to accomplish the aforementioned purposes, FUN BRANDS SRL discloses your personal data to :

Entities of the FUN BRANDS SRL Group ;
Suppliers or subcontractors of these suppliers, so that they can better serve you ;
An external auditor ;
An approved statutory auditor ;
A legal adviser ;
A financial consultant ;
Another professional and/or service provider/adviser ;
A social secretariat, banking institutions, insurers/Funds ;
IT companies or service providers for software programmes and electronic data storage (servers, etc.) ;
Judicial, administrative authorities or police services.

8. How long do we keep your data ?

We keep your personal data for the longest of the periods necessary to comply with the applicable legal and regulatory provisions, or another period taking into account operational constraints such as sound bookkeeping, efficient customer relationship management, and responding to requests from the courts or the regulator.

Data relating to customers is kept for the duration of the contract and for a principled period of ten years after the end of the contractual relationship.

Data relating to potential customers is kept for a maximum of one year, depending on the life cycle of the project for which it was collected and where the person has shown interest.

Some data is archived for longer periods to meet our legal obligations and for evidentiary purposes, in particular to safeguard your rights and the rights of our company. This archived data is only accessible for evidentiary needs in legal proceedings, control by an authorised Authority (e.g. the tax authority), or for the production of documents before judicial, administrative authorities or police services.

9. Security and confidentiality

FUN BRANDS SRL undertakes to adopt the necessary and appropriate technical, physical and organisational measures to protect personal data against unauthorised access, unlawful and unauthorised processing, accidental loss or damage, and unauthorised destruction. These measures are regularly evaluated and, if necessary, updated to ensure maximum protection of the personal data of data subjects.

In the event of a breach or IT leak, FUN BRANDS SRL takes the necessary/appropriate measures to determine its extent and consequences, put an end to it as quickly as possible and, where applicable, limit its impact for the persons concerned.

10. What are your rights and how do you exercise them ?

10.1 Rights of data subjects

In accordance with applicable regulations, you have various rights : the right to request access to your personal data, the right to rectification, the right to erasure, the right to object to processing, the right to withdraw your consent, the right to request a restriction of processing, and the right to data portability.

Right of access, rectification and erasure — Every data subject has the right to request access to their personal data. FUN BRANDS SRL is then required to provide a description and a copy of the data, as well as the reasons why it processes it. If data is inaccurate or incomplete, you may request that it be corrected. Under certain circumstances, you may request the erasure of data, among other things if it is no longer necessary for the purposes for which it was collected. FUN BRANDS SRL may, however, refuse to erase this data, for example for the establishment, exercise or defence of legal claims. Please inform us of any change (marital status, address, …) in order to keep your data up to date.

Right to object, restrict and withdraw consent — You have the right to object to certain processing operations, in particular, without justification, to the use of your data for prospecting purposes, and to request a restriction of processing. For cases other than objection to prospecting, your request must be dated, signed, and justified by serious and legitimate reasons relating to your particular situation. However, you cannot object to processing necessary for the performance of a contract concluded with you, nor to compliance with a legal or regulatory provision to which we are subject. If you have given your consent, you may withdraw it at any time.

Right to data portability — You may request to receive the personal data you have provided to us and to transfer it to another data controller, including directly where technically possible.

10.2 Who to contact ?

To exercise your rights, you may write to us at info@fun-brands.be. In accordance with the regulations, you are also entitled to lodge a complaint with the competent supervisory authority.

11. Transfer of data outside the EEA

In the event of international transfers from the EEA to a third country for which the European Commission has issued an adequacy decision recognising an equivalent level of data protection, your personal data will be transferred on this basis.

For transfers to countries without an adequacy decision, we rely either on an applicable derogation (e.g. international payment), or on the fact that the recipient has agreed to process the data in accordance with the "Standard Contractual Clauses" established by the European Commission. To obtain a copy of these texts, you may send a written request to the address indicated in section 10.2.

12. Personal data breach

Authorised users must, in the exercise of their function, take care to avoid incidents that could infringe the privacy of data subjects. In the event of a personal data breach, appropriate measures are taken as quickly as possible to minimise the risk of damage to the data subjects and to FUN BRANDS SRL.

Any security breach must be reported immediately (to info@fun-brands.be) so that an analysis can be made, the necessary measures taken, and a determination made as to whether the breach must be reported to the Data Protection Authority and/or the data subjects. The report must contain a complete description of the incident, the identity of the person reporting it, the type of incident, and the number of people affected.

In principle, an investigation is launched within 24 hours of an incident being identified or reported, to determine its nature and possible consequences. All breaches are documented in a register recording the cause, the timeline, the response actions and the corrective measures put in place.

13. Changes to this policy

In a world of constant technological change, we will regularly update this Privacy Policy. We invite you to review the latest version of this document on our website, and we will inform you of any substantial changes.

14. How to contact us ?

For any question regarding the use of your personal data under this policy, please contact us by email at info@fun-brands.be.