PRIVACY POLICY: DATA PROCESSING AND RESPONSIBILITY

By 'processing' we mean any operation that happens with personal data, such as the collection, storage, retention, consultation, use, communication via dissemination, erasure, archiving or destruction of these data.

Plus Energie BV is responsible for the processing of your personal data. Any questions regarding this subject can be sent to us via correspondence (see address at the bottom of this page) or electronically via info@aeroleaf.eu.

What kind of personal data do we process?

'Personal data' means any information relating to an identified or identifiable natural person.

The personal data we process are the data you communicate to us, such as user data (e.g.: name, first name, gender, language, address, telephone number, e-mail address, age, bank account number and similar data, copy of your identity card, hobby) and technical data we receive when you use our services.

We make decisions based on automatically processed data only if this is necessary to conclude or perform a contract (e.g. when granting a credit) or if you have consented to it.

We do not process so-called 'sensitive' data such as data relating, for example, to (N.B. the list is probably not exhaustive) your racial or ethnic origin, your political, religious or philosophical beliefs, your life and/or sexual orientation and your health. Should we ever be led to process these data, we will only do so after your explicit consent and for purposes made clear to you in advance, or if their processing is necessary within the framework of labour law, social security, preventive medicine or occupational medicine.

For what purposes and on what basis do we use the data you communicate to us?
We use the personal data you communicate to us for various purposes such as:

• Within the framework of managing our contractual relationship and the services resulting from it.
• For the purposes for which you have given us your consent (e.g. use of your e-mail address if you have opted to receive information letters about our products through this channel.
• To carry out statistical analysis.
• To comply with legal obligations or regulations to which we are subject.
• When we have a legitimate interest in processing it, including within the framework of preventing and combating fraud, while ensuring that we maintain a balance between this interest and respect for privacy.
• In a pseudonymous manner for commercial purposes without being able to link the data to your person.

We do not transfer data to third parties unless:

• When we are legally obliged to do so (e.g. to the National Bank Credit Central Office when granting a credit)
• When we are legally permitted to do so (e.g. when transferring our rights and obligations in a session of claims)
• To subcontractors when necessary for the performance of our services (e.g. electronic archiving of invoices)
• To update them (notification to Bpost if mail is returned due to a change of address)
• By means of your prior consent

If the processing of the data, including through a subcontractor, involves transferring the data outside the European Union, we will take care to protect your data in accordance with the relevant European legislation in force. We ensure that any third party to whom we would transfer your data processes it - as we do - in a secure manner by taking the necessary measures to protect it.

How do we protect your data and how long do we keep it?

We take all required technical and organisational measures to protect your personal data. Your data will be kept for as long as necessary for the processing for which it was collected. This varies depending on the end purpose, for example:

• 7 years for documents prepared in an accounting/tax context.
• 8 years after the end of the contractual relationship for evidence kept in the context of litigation files.
• 8 years after the execution of a commercial action that has remained without effect.

Sometimes the period may be longer, including to comply with our legal obligations or in case of a dispute.

At the end of the retention period, personal data will be anonymised, erased or rendered unusable.

What rights do you have?

The personal data we collect/which you communicate to us is subject to the following rights:

• You have the right to access your own personal data. You have the right to obtain confirmation as to whether or not your data are processed, as well as to be informed about the purposes for which we process them, the type of data processed, the persons to whom the data are communicated and the retention period of such data.
• You have the right to receive a copy of the personal data you communicated to us and to transfer or have us transfer that data to another controller.
• Right to rectification/deletion - right to be forgotten.
• You have the right to request the rectification of your own personal data if you find that it is inaccurate or incomplete.
• You have the right to request that your personal data be deleted when they are no longer necessary for the purposes for which they were collected. If you gave your consent to the processing of your data, you have the option to withdraw this consent at any time.
• You have the right to oppose the use of data for marketing purposes.

You have the right to oppose, without justification, the processing of your data for direct marketing or prospecting purposes:

• Right to restriction of processing: You have the right to obtain the restriction of the processing of your data if you dispute the accuracy of the data, if you oppose the erasure of the data and instead request the restriction of its use, or if we no longer need the data for processing but you still need it for the establishment, exercise or substantiation of a legal claim.
• Right to lodge a complaint with the supervisory authority: If you wish, you can always lodge an objection regarding the processing of your data with the Data Protection Authority (formerly the Commission for the Protection of Privacy) at the address below:

Data Protection Authority

Rue du Printing Press 35

1000 Brussels, Belgium

commission@privacycommission.be

Details of our Data Protection Officer (DPO)

To ensure that we process your personal data in accordance with the applicable rules, a Data Protection Officer (DPO) has been appointed:

Plus Energie BV

Data Protection Officer

Arnaud Fraiteurlaan 15

1050 Brussels, Belgium

info@aeroleaf.eu