Privacy & Data Protection policy

A. General

1. Definitions

1.1
'Data Controller' means the person responsible for the processing of personal data in accordance with art. 1, §4 Privacy Act and art. 4 (7) Privacy Regulation.
1.2
'Website' means the internet website(s) hosted at www.hunchup.be,
1.3
'User', 'Data Subject', 'You' or 'Your' means any natural person who enters personal data on the Website.
1.4
'Third Party' means the natural person or legal entity, the public authority, administration or any other organisation, not being the User, nor the VIGOR Unit, nor the persons that are under the direct control of The VIGOR Unit entitled to process the data.
1.5
'External Service Provider': Service providers which are appointed by The VIGOR Unit to deliver the goods and services. These include for example payment service providers, transport companies, debt companies and e-mail or newsletter senders.
1.6
'Privacy Act' means the Act of 8 December 1992 concerning privacy in relation to the processing of personal data.
1.7
'Privacy Regulation': means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

2. Scope

2.1
This Privacy & Data Protection Policy applies to all personal data processed through the following filing systems or pursuing the following business processes of The VIGOR Unit :
System / business process Applicable
Website
www.hunchup.be
Table 1. Scope of the Privacy & Data Protection Policy
2.2
This Privacy & Data Protection Policy is provided to You in accordance with article 9 et seq. Privacy Act and article 13 et seq. Privacy Regulation.
2.3
The Privacy Statement may be amended without prior notice. It is advisable to view the Privacy Statement on every entry of personal data.

3. Age of the Data Subject

3.1
By entering into this Privacy & Data Protection Policy You expressly declare having the age of 16 or older.
3.2
If art. 3.1 does not apply, Your consent must be given or authorised by Your holder of parental responsibility.

4. Legal basis

4.1
Referrals in this Privacy & Data Protection Policy to the Privacy Act are valid until May 27 th , 2018.
4.2
Referrals in this Privacy & Data Protection Policy to the Privacy Regulation are valid from May 28 th , 2018 and onwards.
4.3
The articles 3, 17 and 19 will come into effect as from May 28th, 2018.

B. About the VIGOR Unit

1. Identity of the VIGOR Unit

1.1
For the purposes of data processing, the following entity must be regarded as the Data Controller in accordance with the Privacy Act and the Privacy Regulation:
  • The VIGOR Unit BVBA
  • with its registered office at Technologiepark 3, 9052 Gent-Zwijnaarde,
  • entered in the K.B.O. under number 0507.979.201

2. Communication with The VIGOR Unit

2.1
You can reach Vigor Unit via

C. Data Processing

1. Processed data

1.1
Depending on the data you provide to the VIGOR Unit, the personal data being processed will consist of:
yes, potentially, if the circumstances occur, - no
Personal data being processed Requirement (art. 8.1) Necessity (art. 8.2) Special cat. (art. 9.1) Consequences of non-provision of data (art. 8.3) Purposes (art. 10.1)
Statutory Contractual Necessary Optional N.A. DSS NIP
Email address COM, SGS, OS, DM, AE
Gender AE
IP-address TR
Parents entrepreneur? AE
Age DPC, AE
Employment status AE
Highest degree of education AE
Area of education AE
Questions to determine the 3 entrepreneurial roles OS, AE, PE

2. Special categories of personal data

2.1
If The VIGOR Unit processes special categories of personal data in accordance with articles 6 and 7 Privacy Act or article 9 Privacy Regulation, this is indicated as in Table 2. Overview of Personal data being processed.

3. Requirement of personal data

3.1
The provision of the personal data mentioned in Table 2. Overview of Personal data being processed is a
  • statutory requirement: data marked as such in the column 'Statutory';
  • contractual requirement: data marked as such in the column 'Contractual'.
3.2
The provision of the personal data mentioned under 6.1 is
  • necessary to enter into a contract: data marked as such in the column 'Necessary';
  • optional to enter into a contract: data marked as such in the column 'Optional';
3.3
The consequences of failure to provide personal data that is an optional requirement are:
  • Diminished sales service (presales or after sale): 'DSS'
  • No individualized proposals or advertisement: 'NIP'

4. Legal basis for data processing

4.1
As a data controller, The VIGOR Unit may only process Your personal data on basis of:
Processing basis Privacy Act Privacy Regulation Identifier
1. Consent (general as well as or for special categories of personal data) 5, a) - 7, §2, a) 6(1) C
2. Precontractual actions and performance of a contract or agreement 5, b) 6(2) A
3. Legal obligation 5, c) 6(3) LO
4. Vital interests of the data subject 5, d) 6(4) VI
5. Public interest or official authority 5, e) 6(5) PI
6. Legitimate interests pursued by the controller or by a Third Party 5, f) 6(6) LIC
Opt-in for direct marketing - - DM
Table 3. Overview of processing basis

5. Purposes of processing

5.1
The VIGOR Unit will process Your personal data for the following purposes:
Processing purpose Identifier Applicable Legal basis Storage Period
Contractual Non-contractual
Academic, artistic or literary expression AE LIC 50 years n.a.
Communication with the data subject COM C, A 15 years after transaction n.a.
Data Privacy compliance DPC LO, LIC session-based session-based
Direct marketing DM C (DM), A till opt-out n.a.
Online services (delivery thereof, incl. precontractual steps and after sales) OS A, LO, LIC 10 years after (last) transaction n.a.
Profiling: entrepreunership PE C
Sale of goods or offline services (delivery thereof, incl. precontractual steps and after sales) SGS A, LO, VI, LIC 10 years after transaction n.a.
Table 4. Overview of Processing purposes
5.2
The lawfulness of the personal data processed by The VIGOR Unit is partially based on purposes of the legitimate interests pursued by The VIGOR Unit or by a Third Party (‘LIC’). These legal interests pursued by The VIGOR Unit or Third Party are:
  • Business management:
    • the right of The VIGOR Unit to keep track of sold products and the identity of the buyer during the period it is legally liable for material and personal damages caused by its products;
    • right of The VIGOR Unit to keep track of sold products and the identity of the buyer during as long as the individual right of action of the data subject are not barred;
  • Data Privacy Compliance
    • the right of The VIGOR Unit to process the age of the data subject, in order to correctly apply the Privacy Regulation;
  • Financial transaction
    • the right of The VIGOR Unit to receive payment for the goods or services he has sold;
  • Geolocalisation:
    • the right of The VIGOR Unit to refuse purchase orders from candidate-buyers living in certain countries or areas;
  • Measuring entrepreneurship of the Datasubject

6. Existence of automated decision-making or profiling

6.1
The Website does process data for purposes of automated decision-making. This processing involves:
  • Profiling entrepreneurship, determine one or more (maximum 3) entrepreneurial roles
6.2
This automated decision-making involves the following the logic:
  • On the basis of the answers on the Hunchup questionnaire an entrepreneurial profile will be determined on one or more of the 3 entrepreneurial roles
6.3
The significance and the envisaged consequences of such processing for the data subject are:
  • The datasubject will receive an automated feedback rapport that gives feedback on his entrepreneurial role(s)

7. Recipients and categories of recipients of the data

7.1
Depending on the purpose of and need for processing, the processed personal data may be made known to the following recipients:
(Category of) Recipients Applicable 2 Condition/purpose Identity of Recipient(s) 3
Data subject You
Data controller The VIGOR Unit, Technologiepark 3, 9052 Gent-Zwijnaarde
Data controller Partena Professional, Kartuizerstraat 45, 1000 Brussel
External service providers
Mailing provider To process mailing activities of The VIGOR Unit BVBA Open Minds BVBA
Website hosting provider To host Your account at our Website and to process your purchase order Open Minds BVBA
Table 5. Categories of Recipients - 2 Idem as under footnote 1 - 3 If know or regular recipient
7.2
The aforementioned recipients will always process the received personal data in accordance with this Privacy Statement.

8. Period of data storage

8.1
When storing your personal data, The VIGOR Unit takes into account multiple data storage periods. The exact storage period for each processing purpose is specified in Table 4. Overview of Processing purposes.

D. Transfers of personal data

1. Location of processing

1.1
Your personal data will be processed at the registered address of The VIGOR Unit (see art. 4) or another location within the European Union.

2. Transfer to third countries or international organisations

2.1
There will be no transfer of your personal data outside the European Union.

3. Appropriate or suitable safeguards for data transfers

3.1
In view of articles 14.1 and 15.1 of this Privacy & Data Protection Policy, there is no need for appropriate or suitable safeguards for data transfers to third countries or international organisations.

E. Your rights as a data subject

1. Access

1.1
The User has the right to information about:
  • the purposes of the processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
  • where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
  • the existence of the right to request from The VIGOR Unit rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
  • the right to lodge a complaint with a supervisory authority;
  • where the personal data are not collected from the data subject, any available information as to their source;
  • if applicable: the existence of automated decision-making, including profiling, and at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

2. Rectification

2.1
The data subject shall have the right to obtain from The VIGOR Unit without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

3. Data portability

3.1
You have the right to receive the personal data which You provided to The VIGOR Unit, in a structured, commonly used and machine-readable format and have the right to transmit those data to another Data Controller without hindrance from The VIGOR Unit, where:
  • the processing is based on
  • Your consent, or
  • The performance of a contract to which You are a party or Your requests prior to entering into a contract, and
  • the processing is carried out by automated means.
3.2
In exercising Your right to data portability pursuant to paragraph 19.1, You shall have the right to have the personal data transmitted directly from one Data Controller to another, where technically feasible.

4. Withdrawal of consent

4.1
You have the right to withdraw Your consent at any time, especially but not limited to the processing of special categories of personal data in accordance with art. 7.1.
4.2
Any withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal nor the lawfulness of processing on another legal basis, as e.g. the performance of a contract to which You are a party.

5. Restriction

5.1
You have the right to obtain from The VIGOR Unit a restriction of processing where one of the following applies:
  • You contest the accuracy of the personal data, for a period enabling The VIGOR Unit to verify the accuracy of the personal data;
  • the processing is unlawful and You oppose to the erasure of the personal data, and You request the restriction of their use instead;
  • The VIGOR Unit no longer needs the personal data for the purposes of the processing, but You require them for the establishment, exercise or defense of legal claims;
  • You object to processing pursuant to article 22.1, pending the verification whether the legitimate grounds of The VIGOR Unit override those of the data subject.
5.2
Where processing has been restricted under paragraph 21.1, such personal data shall, with the exception of storage, only be processed with Your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
5.3
If You would have obtained a restriction of processing pursuant to this article, You shall be informed by The VIGOR Unit before the restriction of processing is lifted.

6. Objection

6.1
Under the circumstances described in article 12, §1, of the Privacy Act and article 21(1) Privacy Regulation, You have the right to object, on grounds relating to Your particular situation, at any time to processing of Your personal data based on purposes of the legitimate interests pursued by The VIGOR Unit or by a Third Party, including profiling based on those provisions.
6.2
The VIGOR Unit shall no longer process the personal data unless The VIGOR Unit demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of You or the establishment, exercise or defence of legal claims.
6.3
Where personal data are processed for direct marketing purposes, You have the right to object at any time to processing of Your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.

7. Erasure ('right to be forgotten')

7.1
You have the right to obtain from The VIGOR Unit the erasure of personal data concerning Yourself without undue delay and The VIGOR Unit shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
  • Your personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • You withdraw Your consent on which the processing is based according to article 20.1, and where there is no other legal ground for the processing;
  • You object to the processing pursuant to article 22.1;
  • Your personal data has been unlawfully processed;
  • Your personal data has to be erased for compliance with a legal obligation in Union or Member State law to which The VIGOR Unit is subject;
  • Your personal data has been collected in relation to the offer of information society services directly to a child.

8. Exercise of rights by the data subject

8.1
To exercise any of the rights stated in this article, the User may contact The VIGOR Unit by means of
  • a postmarked and signed request;
  • an email;
  • a request through our webform.
The communication coordinates of The VIGOR Unit can be found in article 5.1.
8.2
The information will be made known to the User without delay and in all instances not later than one month after receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The VIGOR Unit shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.
8.3
Any communication or any actions taken under articles 17 to 23 shall be provided free of charge. In performance of art. 17.1, The VIGOR Unit shall provide a copy of the personal data undergoing processing, free of charge. For any further copies requested by the data subject, The VIGOR Unit may charge a reasonable fee based on administrative costs.
8.4
Where You make a request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.
8.5
Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, The VIGOR Unit may either:
  • charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or
  • refuse to act on the request.
8.6
Where The VIGOR Unit has reasonable doubts concerning the identity of the natural person making the request referred to in articles 17 to 23, The VIGOR Unit may request the provision of additional information necessary to confirm the identity of the data subject.

F. Cookies

1. Use of Cookies

1.1
Cookies on the Website. For more information on the use of cookies, please see our separate Cookie Policy on Cookie Policy.

G. Complaints

1. Complaint handling by The VIGOR Unit

1.1
If You wish to file a complaint, You can do so through the communication channels provided in art. 5.1.
1.2
The VIGOR Unit shall provide You information on action taken on a request under section E. Your rights as a data subject of this Privacy & Data Protection Policy without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The VIGOR Unit shall inform You of any such extension within one month of receipt of the request, together with the reasons for the delay.
1.3
If The VIGOR Unit does not take action on Your request, The VIGOR Unit shall inform You without delay and at the latest within one month of receipt of Your request, of the reasons for not taking action.

2. Filing a complaint with a supervisory authority

2.1
Without prejudice to any other administrative or judicial remedy, You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of Your habitual residence, place of work or place of the alleged infringement if You consider that the processing of Your personal data infringes this Regulation.
2.2
The supervisory authority of Your habitual residence can be found here: https://secure.edps.europa.eu/EDPSWEB/