Privacy statement

We understand how important it is for your personal data to be processed securely and correctly, which is why protecting your privacy and data is one of our top priorities. We want to be transparent about how we process your personal data when you visit and/or use our website or app, and about the measures we take to protect your privacy. For further information on this subject, please consult our privacy statement.

1. Who are we and what is our role?

1.1. Identity and contact details

Outspot is marketed and managed by Confinity SA. We are registered with Banque Carrefour des Entreprises under company number 0897.991.257 (hereinafter referred to as Outspot or we/us).

You can contact us using the following:

Address: Dorp 16, 9830 Sint-Martens-Latem (Belgium)

E-mail: privacy@outspot.be

1.2. Controller

Outspot is responsible for processing your personal data when you visit and/or use our website. According to the GDPR, this makes us the Controller of your personal data, meaning that Outspot (possibly in collaboration with others) establishes the purposes and methods used to process your personal data.

2. Definitions

For the purposes of this Privacy Statement, personal data means any information relating to an identified or identifiable natural person (the data subject). An identifiable natural person is somebody who can be identified, directly or indirectly, particularly by referring to an identifier such as a name, ID document number, location data, an online identifier or one or more factors characterising their physical, physiological, genetic, psychological, economic, cultural or social identity. This is otherwise defined as any information which could be used to identify somebody. This includes, for example, their surname, forename, date of birth, telephone number, e-mail address or IP address. 

The term data processing is very broad and covers the collecting, recording, organising, storing, updating, modifying, retrieving, consulting, using, disseminating, combining, archiving and erasure of data, and more.

3. What personal data is processed, why is this done and on what legal basis? 

Use this table to check the following information: 

• Column 1: the categories of personal data we process (Categories of Personal Data). 

• Column 2: why we do it (Aims). 

• Column 3: the legal basis in Article 6 of the GDPR that the processing activity is based on (Legal Basis), and

• Column 4: how long we process your personal data for (processing period or Retention period).

We process personal data that you send us directly, for example when you create an account on our website, contact us or use our services. We may also process personal data that we have not obtained directly from you, for example data sent to us by third parties. This table lists the sources that we may get personal data about you from.

4. Minors

We do not intend to collect personal data from persons under the age of 16. Minors are not authorised to send us personal data or to give their consent without the authorisation of a parent or guardian.

5. Your rights

To give you greater control over the processing of your personal data, you may exercise certain rights, including those listed in Articles 15-22 of the GDPR. 

5.1. Right of access

You reserve the right to ask us whether or not we are processing your personal data at any time and to access this personal data and to receive further information.

This additional information includes:

• details of the purposes of the personal data processing.

• identity of the Controller. 

• the recipients or categories of recipients.

• the retention period or, if this is not possible, the criteria for determining this period.

• your privacy rights.

• the right to file a complaint with the supervisory authority.

• the source of the personal data if we obtain it from a third party.

• the existence of automated decision-making.

If we are unable to grant you access to your personal data (for example due to legal obligations), we will let you know why this is not possible.

Provided that the rights and freedoms of others are not affected, we will provide you with a copy of your personal data in a readable format. The first copy is supplied free of charge, but additional copies can be supplied for a reasonable fee.

5.2. Right to correction

You reserve the right to rectify inaccurate personal data belonging to you and given the purposes of the personal data processing, to have any incomplete personal data belonging to you completed.

5.3. Right to erasure (right to be forgotten)

In certain cases, you may ask us to delete your personal data. However, be aware that we will no longer be able to offer you further services. Your right to be forgotten is not absolute. We reserve the right to retain your personal data if this is necessary, inter alia, to execute the contract, comply with a legal obligation or to establish, exercise or defend legal claims. We will give you more details when we respond to your request.

5.4. Right to limit processing

In certain cases, you have the right to limit the processing of your personal data, including: 

• you dispute the accuracy of the personal data;

• personal data processing is unlawful, but you object to its erasure;

• we no longer need the personal data for our processing, but you need the personal data to establish, exercise or defend legal claims and, 

• you have objected to personal data processing, pending verification of your objection.

If processing is limited on this basis, we may continue to retain your personal data. However, we will only process them in the following cases: with your consent, to establish, exercise or defend legal claims, to protect the rights of another natural or legal person, or for important reasons of general interest.

5.5. Right to object to personal data processing

Depending on your particular situation, you may object to the processing of your personal data if it is in our legitimate interest or to perform a task in the public interest. In this case, we will stop processing your personal data, unless we can demonstrate compelling legitimate grounds to do so which override your wishes, or if the processing of personal data is connected with the establishment, exercise or defence of legal claims.

5.6. Right to data portability

When the legal basis for our processing of your personal data is:

(a) consent or

(b) personal data processing is necessary to execute a contract that you have entered into, or to take steps at your request before entering into a contract, and such processing automated, you reserve the right to receive your personal data from us in a structured, commonly-used and machine-readable format. Where technically possible, we will transfer your personal data directly to the new controller. However, this right does not apply when it compromises the rights and freedoms of others.

5.7. Right not to be subject to automated decision-making

You reserve the right to not be subject to decisions made solely on the basis of automated data processing which significantly affect you or have legal consequences, made without substantial human intervention.

You cannot exercise this right in three situations:

1. if automated decision-making is permitted by law (for example, to prevent tax fraud)

2. if the decision is based on the explicit consent of the data subject, or

3. if automated decision-making is necessary to conclude or execute a contract (please note that we always assess on a case-by-case basis whether there are less privacy-invasive methods of terminating or executing the agreement).

5.8. Right to withdraw consent

Where your personal data is processed on the basis of your consent, you may withdraw this consent at any time by simply requesting this. Remember that withdrawing consent does not affect the lawfulness of any processing carried out beforehand.

6. Exercising your rights

To exercise these rights, you can contact us using the details given in section 1 About us - Contact details. We generally respond to your request to exercise your rights within one month of receiving it. However, if your request is complex, we may extend this deadline by two months after informing you. We will inform you within one month of receiving your request if an extension is necessary. 

The law requires us to verify your identity when you exercise your rights. For this, we will send an e-mail to the e-mail address registered on our website, asking you to confirm the request. If this is not possible, we will ask you to attach a copy of the front of your identity card. To do this, we ask you to hide the national registration number and the photo on your identity card. In any event, we will only process your ID card details to verify your identity and will not store or record them on our systems.

You may exercise all these rights free of charge, unless your request is manifestly unfounded or excessive (for example because of its repetitive nature). In this case, we have the right to charge you a reasonable fee or to refuse to process your request.

7. Retention of your personal data

We will retain your personal data for as long as is necessary to achieve the intended purpose. Remember that many (legal) retention periods mean that personal data must be stored. If there is no obligation to retain data, it will be systematically wiped once the purpose for which it was collected has been achieved. 

We may also retain personal data if you have given us permission to do so or if we need it for legal proceedings. In the latter case, we must use certain personal data as proof. To this end, we retain certain personal data in compliance with the statutory limitation period, which can be up to 30 years. The usual limitation period for personal legal actions is 10 years.

8. Categories of recipients

Within our organisation, we guarantee that your personal data is only accessible to those who need it to fulfil their contractual and legal obligations. 

We will only pass on your personal data to third parties in compliance with the law or if you have given your consent. In some cases, our employees are assisted by external service providers in carrying out their tasks.

Please note that if you choose to share your information, including personal data, with us through our business partners' liaison services, this privacy statement and our business partners' privacy policy and/or privacy statements may also apply to you. We have no control over how our commercial partners possibly collect and/or process your information on their own websites and/or platforms.

In particular, we identify the following (categories of) recipients:

1. Commercial partners offering their products/services on our website.

2. Partners for the online recruitment process.

3. The payment service providers we use for payment purposes.

4. Outlook for processing and managing e-mail and other data.

5. The transport companies we use to deliver your purchases.

6. Companies we may hire for marketing purposes.

7. Companies we can engage for technical support and hosting of information and communication technologies (ICT).

8. Companies we may work with for administrative purposes (e.g. CRM).

9. Companies or software that we may use to maintain and process billing data for accounting purposes.

10. Companies we may hire for communication purposes.

11. Companies that we may engage for logistics purposes (logistics partners).

12. Companies we may hire for analysis purposes.

13. Governments or regulatory authorities when requested in the context of compliance with a judgment or decree, legislation, regulation, standard or legal procedure.

14. If all or part of Outspot's assets are acquired by a third party, the personal data it retains about its customers may form part of the transferred assets.

9. International transfer of your personal data outside the European Economic Area (EEA)

In principle, we will not transfer your personal data to processors or data controllers located in countries outside the EEA, unless we are legally authorised to do so, you have given your consent, or if this is necessary for our services.

If such transfers are necessary, we take the necessary steps to ensure that your personal data is highly protected and that all transfers of personal data outside the EEA are lawful.

10. Security

The security of your personal data is extremely important to us. We have taken reasonable and appropriate technical and organisational security measures to protect your personal data as far as possible against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. We always store your personal data in a safe place so that third parties cannot access it.

Unfortunately, the transmission of information over the Internet is not totally secure. Although we do our best to protect your personal data, we cannot guarantee the security of personal data transmitted to us over the Internet. Any transfer of personal data is done at your own risk. When we transfer or receive your data on our website, we always use technologies that offer a high level of security.

11. Complaints

We do our best to protect your personal data. If you have a complaint about the way we process your personal data, you can contact us (see About us), and we will respond as quickly as possible.

You can also file a complaint with the data protection supervisory authority. The authority supervising our organisation is the Data Protection Authority, whose contact details are:

Website:

https://www.autoriteprotectiondonnees.be/

Contact details:

Data Protection Authority (DPA)

Drukpersstraat 35, 1000 Brussels

+32 (0)2 274 48 00

contact@apd-gba.be

12. Any questions?

Please contact us by e-mail (see About us) section. We will be delighted to answer any questions you may have.

13. Changes

In response to feedback or changes to our processing activities, we may amend this privacy statement from time to time. We therefore invite you to regularly consult the latest version on our website.

Last modified on: 2024-09-30