Privacy policy

We think your privacy is hugely important!

This privacy statement wishes to provide you with the necessary information regarding the processing of your personal data when visiting our website and associated webshop. We respect our obligations as a data controller in accordance with the European General Data Protection Regulation of 27 April 2016 (AVG) and the Belgian Implementation Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

This privacy statement provides you with more information on what personal data we process, why we process it, how we obtain it, how long we keep it and with whom we share it. This privacy statement applies to all visitors to our website and webshop.

*Please read this privacy notice carefully.*

We reserve the right to amend the provisions of this privacy notice in accordance with the necessities of our business, the evolution of our policies and changes in regulations, administrative positions or case law. The latest version of this privacy statement is the only valid one.

1. DEFINITIONS

Personal data: any information about an identified or identifiable natural person. (For example: Name, address, telephone number, e-mail address, family composition, evaluations, identification number, location data, elements characterising the physical, genetic, psychological, economic, cultural or social identity of that natural person).
Processing: any operation or set of operations involving Personal Data or a set of Personal Data, whether or not carried out by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction of data.
Data subject(s): visitors to our website and webshop, including customers who place an order, both former customers and potential customers.
Processor: the natural person, legal entity, public authority, agency or other body which, alone or jointly with others, determines the purpose of and the means for processing personal data. (For example: the owner of the webshop)
Processor: the natural person, legal entity, public authority, department or other body which processes personal data on behalf of the controller. (For example: the software administrator of the webshop)
Recipient: the natural person, legal entity, public authority, agency or other body, whether a third party or not, to whom/to which personal data are disclosed. (For example: the accountant)
Third party: the natural person, legal entity, governmental authority, agency or other body not being the Data Subjects, neither the Controller nor the Processor, nor the persons authorised under the direct authority of the Controller or the Processor to process the personal data. (For example: the sender of your products)
Consent of the data subject: any freely given, specific, informed and unambiguous expression of will whereby the data subject accepts, by means of a statement or an unambiguous active act, a processing of personal data concerning him/her.

2. WHO IS RESPONSIBLE FOR PROCESSING YOUR PERSONAL DATA?

Bionova NV is responsible for processing your Personal Data. It makes unilateral or joint decisions regarding the purposes and means of processing your Personal Data.

Bionova NV
Kruisstraat 59 A
9930 Zomergem
Belgium
Tel.: +3292792233
E-mail: info@bionova.be
KBO: BE0458.509.397

For specific questions regarding this privacy statement, please contact us at the following e-mail address: info@bionova.be. Please always include the reference 'GDPR' in your communication to ensure its smooth handling.

3. WHAT PERSONAL DATA ARE PROCESSED?

We undertake to collect only the Personal Data necessary for the realisation of our predefined purposes and means of processing your Personal Data. We process Personal Data within the following categories:

Category 1: Name and address details

Category 2: Contact details and communication

Category 3: Billing data

Category 4: Profile data

-Category 5: Direct marketing

4. FOR WHAT LEGITIMATE PURPOSES ARE YOUR PERSONAL DATA PROCESSED?

We process your Personal Data on the basis of the following purposes and legal grounds:

Category of personal data	Purposes	Legal basis
Category 1: Name and address details	- Administration - Supply - demand settlement - Drawing up the sales contract	Execution of the purchase agreement (Art. 6(1)(b) GDPR)
Category 2: Contact details and communication	- Contacting customers in connection with an offer or the purchase agreement - Communication between client and Bionova	Execution of the purchase agreement (Art. 6, lid 1, b) GDPR)
Category 3: Billing data	- Drafting invoices to individuals and companies - Accounting	Legal obligation (Art. 6, lid 1, c) GDPR)
Category 4: Profile data	- Creation of an online profile for future orders - Keeping track of several preferences for the benefit of customers	Consent (Art. 6, lid 1, a) GDPR)
-Category 5: Direct marketing	- Sending e-mails to customers with product information and/or offers	Consent (Art. 6, lid 1, a) GDPR)

5. ARE YOU OBLIGED TO DISCLOSE YOUR PERSONAL DATA?

Regarding Personal Data within the framework of the execution of the agreement and the legal obligations incumbent upon us, you are obliged to communicate this information. If you do not wish to provide this Personal Data, no purchase agreement can be concluded. Consequently, your order on the webshop will not be able to proceed.

However, you are not obliged to create a profile. You can place an order without creating a profile. However, creating a profile may be useful if you wish to place another order in the future.

If you are a child under 13, we are not allowed to process your Personal Data. However, a parent or guardian may place an order or ask a question on your behalf. If you as a parent or guardian discover that your child under the age of 13 has provided us with his/her Personal Data, please notify us immediately so that we can take appropriate action.

6. WHO RECEIVES YOUR PERSONAL DATA?

6.1. Categories of recipients

Your Personal Data are mainly processed for internal purposes. However, for the proper functioning of our website/webshop and the execution of the purchase contract, we need to rely on the following recipients:

- Webshop/website administrator for IT management of our Webshop/website;

- Payment service providers for the execution of online payments;

- Delivery services for the delivery of your order;

- Bookkeeper for our accounts;

- Bailiff for recovery of unpaid invoices or damages;

- Judicial bodies for bringing possible legal action.

If any of the Recipients listed above is a Processor, we will enter into a processing agreement with that Processor to protect your Personal Data. However, we remain responsible for your Personal Data as a Processor.

6.2. Court order or legal obligation

We may, in exceptional circumstances, be required to transfer your Personal Data in response to a court order or to comply with mandatory laws and/or regulations. If reasonably possible, we will endeavour to inform you in advance, unless the giving of such information is restricted by law.

6.3. Transfer to third parties within and outside the EEA

Your Personal Data will not be sold, transferred or communicated to third parties in any way, except in the situations provided for in the current privacy policy or unless you have given your express prior consent.

Your Personal Data will not be transferred to third parties outside the European Economic Area (EEA).

7. IS THERE AUTOMATED PROCESSING?

The processing of Personal Data in the context of profile creation is carried out in an automated manner. The logic underlying this automated manner, its importance and consequences are as follows:

- Logic: With the customer's consent, a profile is created via filling in the necessary details. For this, the customer must create an account with a password. This profile also records previous orders and purchases. If necessary, it is possible to save a product as a favourite.

- Importance: Customers have a better online shopping experience and do not have to go through the entire procedure every time they place a new order.

- Consequences: We have a view of this buyer's buying behaviour and should also store the necessary profile data as part of this profile.

8. ARE COOKIES USED?

We only use functional cookies to make our website/webshop work better. For example, we use a cookie to store your login details and language preference and the contents of your shopping basket.

9. HOW LONG WILL YOUR PERSONAL DATA BE KEPT?

Your Personal Data will not be kept or further processed for longer than is strictly necessary for the purposes for which it was collected. This means that your Personal Data will be deleted by us when it is no longer needed to fulfil our purposes, or when you validly exercise your right to have this Personal Data deleted.

The retention period may vary by category of Personal Data:

Category of personal data	Retention period	Reason/Legal basis
Category 1: Name and address details	5 years after end of agreement	Limitation period for bringing an action.
Category 2: Contact details and communication	5 years after end of agreement	Limitation period for bringing an action.
Category 3: Billing data	7 years from 1 January following the year of the invoice due date	Article 60 §§ 1 and 4 Wb. V.A.T. See also Circular AAFisc No. 14/2014 (No. E.T. 120.000) dated 4 April 2014.
Category 4: Profile data	As long as your account is active.	Consent
-Category 5: Direct marketing	As long as you have not withdrawn your explicit and specific consent.	Consent

10. WHAT ARE YOUR RIGHTS?

You may exercise the rights set out below by sending an e-mail to: Click here to enter text. stating the right you wish to exercise. Please include the word 'GDPR' in the subject of your email. Please also attach a copy of the front of your identity card. This will allow us to identify you. Indeed, without valid identification, we cannot act on your request to exercise your rights.

Exercising your rights is in principle free of charge.

We will respond to your request within a period of 1 month and give it the appropriate follow-up, we may possibly decide to disregard your request in a reasoned manner. Depending on the complexity of your request, this period may be extended by 2 months. In any case, we will inform you further within one month of receiving your request.

In doing so, please also take into account possible more specific provisions, depending on the right you wish to exercise.

10.1. Right of inspection

As a Data Subject, you have the right to access your Personal Data.

If possible, we will provide you with a copy of your Personal Data after your request. If this is not possible, we will provide you with an overview of the Personal Data processed. We may charge a reasonable fee for additional copies due to administrative costs. This information/copy will be provided to you electronically, unless you make a timely request to obtain it on paper.

This right of access does not affect the rights or freedoms of others, including business secrecy or intellectual property and in particular the copyright that protects the software. If a third party (e.g. IT administrator, supplier, ...) is mentioned in the documents you request, the identity of these persons will be shielded from transmission.

10.2. Right of rectification and supplementation

As a Data Subject, you have the right to have inaccurate Personal Data relating to you corrected or incomplete Personal Data completed.

We will check the accuracy of this data after your request for correction or addition and adjust it if necessary.

10.3. Right to be erased (right to be forgotten)

As a Data Subject, you have the right to have the Personal Data concerning you erased without unreasonable delay in the following cases:

- the Personal Data are no longer necessary for the purposes for which they were collected;

- the Data Subject withdraws its consent to the processing of that particular Personal Data;

- the Data Subject objects to the processing of certain Personal Data on the basis of a legitimate interest;

- the Personal Data has been unlawfully processed;

- the Personal Data must be deleted in order to comply with a legal obligation imposed on us by Union or Member State law.

Where we have disclosed such Personal Data and we are required to erase it, in accordance with the above, we shall take the necessary measures, taking into account available technology and implementation costs, to inform other controllers processing such Personal Data of this erasure request.

Notwithstanding the right to erasure, we are entitled to retain personal data for a longer period if this is necessary for the exercise of the right to freedom of expression and information, for the performance of a task in the public interest or in the exercise of public authority, for reasons of public health, for archiving in the public interest, scientific or historical research or statistical purposes or for the establishment, exercise or substantiation of legal claims.

10.4. Right of objection

As a Data Subject, you have the right to object at any time, for reasons relating to your particular situation, to the processing of your Personal Data. You may exercise this objection when processing your Personal Data on the basis of:

- the public interest or;

- a legitimate interest;

- in the context of direct marketing.

We may override this right to object if we can demonstrate that we have compelling legitimate grounds for processing this Personal Data and that these grounds outweigh the interests, rights and freedoms of the Data Subject. Or if we can demonstrate that the processing of this Personal Data is related to the establishment, exercise or support of a legal claim.

10.5. Right to restriction of processing

As a Data Subject, you have the right to obtain restriction of processing of your Personal Data in the following cases:

- when you have exercised your right of rectification, during the time we need to verify the accuracy of your personal data;

- when you have exercised a valid right to object, pending a response from us;

- when the processing is unlawful but you prefer to restrict this processing, instead of erasing the Personal Data concerned;

- when we no longer need this Personal Data but you need it for the establishment, exercise or substantiation of a legal claim.- wanneer u uw recht op correctie heeft uitgeoefend, tijdens de duur die wij nodig hebben om de juistheid van uw persoonsgegevens te controleren;

Where you have properly exercised your right to restrict processing, we will only continue processing this Personal Data:

- With the consent of the Data Subject or;

- For the institution, exercise or substantiation of a legal claim or

- to protect the rights of another natural or legal person or;

- for overriding reasons of general interest for the Union or for a Member State.

This restriction does not apply to the storage of your personal data.

If we will lift the restriction on processing, you will be notified in advance.

10.6. Right to transferability

As a Data Subject, you have the right to obtain a copy of the Personal Data concerning you in order to transfer it, possibly directly, to another Controller. However, this right to portability applies only to Personal Data:

- processed on the basis of the explicit consent of the Data Subject;

- processed via automated processes (Example: profile).

This right is only exercisable to the extent technically feasible for us and if the processing of this Personal Data is not necessary for the fulfilment of a legal obligation incumbent upon us.

10.7. Right to withdraw consent

Where it appears from Article 4 of this privacy policy that certain Personal Data is processed on the basis of your explicit consent, you have the right to withdraw this consent at any time.

However, this does not affect the lawfulness of the processing of this Personal Data prior to the withdrawal of your consent.

11. THE SECURITY OF YOUR PERSONAL DATA?

We have taken the necessary appropriate technical and organisational measures to ensure appropriate security of your personal data.

Furthermore, we apply the necessary security measures on a technical and organizational level to avoid the destruction, loss, falsification, modification, unauthorized access or inadvertent notification to third parties. Access to your Personal Data is only possible for our responsible persons and/or employees for whom it is necessary in function of their duties. We require the same level of security from the Recipients with whom we cooperate.

You yourself must at all times respect the necessary security standards by avoiding all unauthorized access or improper use of your login and access code. You are solely responsible for the use of WIPE-IT's website web shop, your IP address and your identifying information, as well as its confidentiality.

12. WHERE CAN I FILE A COMPLAINT?

If you are not satisfied with the way we handle your personal data, you may file a complaint with the supervisory authority. In Belgium, you can address this complaint to the Belgian Data Protection Authority

https://www.gegevensbeschermingsautoriteit.be/burger

If you have suffered damage as a result of a breach by us of the AVG legislation, you may receive compensation for the damage suffered. However, if we can prove that we are in no way responsible for the harm caused, we cannot be held liable.

The procedure should be initiated at the competent court of the registered office of Bionova nv. Belgian law is applicable to these proceedings.