Privacy policy

1. Who are we?

1.1. CBS Group as the Data Controller

With this privacy statement (hereinafter referred to as the “Privacy Statement”), we would like to inform you about why and how your personal data is collected and processed by CBS, which consists of all CBS entities (hereinafter referred to as “we” or “CBS”). Your personal data is collected and stored centrally within CBS Beton NV.

The Belgian units of CBS do not consider each other as third parties and process all your personal data in accordance with this Privacy Statement.

Our contact details can be found in section 10 of this Privacy Statement.

We are responsible for the processing of the personal data that we request and use. As the data controller, we take measures to ensure that you:

• remain informed about our processing of your personal data and your rights;
• retain control over the personal data we process;
• can exercise your rights regarding your personal data. Further information about your rights can be found in section 9 of this Privacy Statement.

1.2. Data Protection Officer

We have also appointed a Data Protection Officer. This is an expert in personal data protection who provides an additional guarantee for the proper processing of your personal data by us.

You can contact the Data Protection Officer through the channels specified in section 10 of this Privacy Statement.

2. What data do we collect about you?

2.1. Personal Data

By “personal data,” we mean any information relating to an identifiable living person. This may include data concerning you and/or your representatives, your staff, your freelancers, and/or your directors (hereinafter collectively referred to as “you” or “your”).

If we receive personal data about your representatives, your staff, your freelancers, and/or your directors, you must inform them about the existence and content of this Privacy Statement, including our obligations, their rights, and how they can exercise those rights. We specifically collect:

• from our existing customers: identification and contact details (name, first name, gender, email address, telephone number, etc.), indicated areas of interest, and certain financial data (bank account number, etc.);

• from prospects: identification and contact details (name, first name, gender, email address, telephone number, etc.), indicated areas of interest, etc. This data is necessary and will be used for the purposes stated in section 3 of this Privacy Statement.

Our websites also use “cookies.” These are small pieces of information stored by the browser on your computer that allow us to retain certain information about the users of our website (e.g., preferred language, duration of your visit to the page, etc.). They help to tailor the website to your needs, preferences, and ease of use.

A. What are cookies?

We use cookies when you open our emails and/or when you visit our websites. Cookies are pieces of information stored on your own computer or mobile device and are typically used to optimize the user experience of websites and applications. There are various types of cookies categorized by origin, function, and lifespan. For a comprehensive overview, you can visit websites like www.allaboutcookies.org. CBS uses cookies to:

• improve the use and functionalities of its websites;
• analyze how users utilize our websites and applications and create statistics.

B. What types of cookies do we use?

• Necessary cookies: These cookies enable browsing on our websites and the use of their functions (e.g., privacy settings).
• Functional cookies: This type of cookie enables the proper functioning of our websites.

We do not collect or process any personal data from minors or so-called sensitive data, namely:

• personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership;
• genetic or biometric data (e.g., facial and fingerprint data);
• data concerning health;
• data concerning sex life or sexual orientation. If such sensitive data is provided to us, we will not use it and will delete it.

3.Why do we need your data?


3.3. Because it is necessary for the functioning of the company
This purpose is based on what is known as “legitimate interest.” In fact, we have a number of legitimate interests that form the basis for processing personal data.

This is done only after an assessment that in each case the balance between our legitimate interests and the possible impact on your privacy is not disrupted.

If you have objections to this processing, you can exercise your right to object as mentioned in section 9.3 of this Privacy Statement.

Personal data is processed in various situations:

• Personal data may serve as evidence (archive);
• Personal data may be used to document your participation and/or attendance at our events;
• Personal data may be used to provide the information you have requested;
• Personal data may be used to establish, exercise, defend, and secure the rights of CBS or possibly of persons it represents, for
  example, in the event of a legal dispute;
• Personal data may be used for the management, risk management, and control of our organization, for managing risks, for risk
  management functions and inspections, for complaint management, and for internal and external audits;
• The personal data held by the Belgian units of CBS may be summarized and used for central or efficient customer management as
  well as for creating more detailed customer or prospect profiles in order to communicate with you more effectively;
• Personal data may be used to support and simplify the acquisition, use, and termination of services by the customer, for example,
  to avoid you having to fill out information you have already provided again or to prevent you from having to go through a complete
  identification process again if you wish to become a customer of another unit of CBS. For example, identification data may be
  shared with the units of CBS to facilitate identification within these other units.

4 What is the legal basis for processing your personal data?

4.1. General
Your personal data may only be lawfully used and processed by us if one of the following conditions is met:

• The use of your personal data is necessary to fulfill a contract you have entered into with us or to take the necessary steps at your
  request to facilitate the conclusion of a contract. The purposes of processing mentioned in section 3.1 of this Privacy Statement are
  based on this foundation.

• We have your explicit and voluntary consent to use your personal data for a specific purpose. For example, we will ask for your
  consent to contact you for marketing purposes, as mentioned in section 3.2 of this Privacy Statement, if you do not yet have a
  customer relationship with us.

• The use of your personal data is necessary to safeguard our legitimate interests, provided that these interests and rights outweigh
  your interests and rights. We base the processing necessary for the functioning of our business on our legitimate interest, as
  mentioned in section 3.3 of this Privacy Statement, and to communicate with our existing customers for marketing purposes, as
  mentioned in section 3.2 of this Privacy Statement.

• We may be legally obliged to process certain data, particularly to disclose it to the relevant authorities.

5 With whom do we share your personal data?

• Only our employees and independent partners who actually need to access your data to fulfill their tasks have access to your data.
  These individuals act under our supervision and responsibility.
• We also engage external service providers who carry out specific processing on our behalf to offer you our products and services, such
  as IT services (including legal, financial, accounting, and other similar services). Since these third parties have access to personal data in
  the context of the services requested by us, we have taken technical, organizational, and contractual measures to ensure that your
  personal data is only processed and used for the purposes mentioned in section 3 of this Privacy Statement.
• Credit institutions, collection agencies, and legal service providers, as well as our partners with whom we collaborate for a specific
  action (e.g., in cooperation with partner networks). In any case, CBS takes measures to ensure the confidentiality of your personal data
  and protect it from unauthorized disclosure.
• CBS will not make your personal data publicly accessible.
• Your personal data may only be shared with regulatory authorities, tax authorities, and investigative authorities if we are legally
  obligated to do so.

6 Where are the data stored and processed?

Your data will not be transferred outside the EU, and in any case, we ensure that the legal minimum requirements and security standards are always met. If we plan for your data to be stored and processed outside the EU, we will expressly inform you and ensure that the same level of protection as within the EU is applied.

Except in these cases, your personal data will never be disclosed or made accessible to third parties and will be used solely for our own purposes. Other companies cannot use your data, for example, to send you advertisements.

7 How long do we store your personal data?

We only store your data as long as necessary for the purposes for which it is used, as mentioned in section 3 of this Privacy Statement (e.g., to fulfill a contract, to send requested information, etc.). Any exceptions or clarifications to this principle are explicitly listed under the various purposes mentioned in section 3 of this Privacy Statement.

The necessity of data retention may vary depending on the type of data and the purpose of processing, which can lead to different retention periods.

We consider the following criteria to determine retention periods:

• How long is the personal data required to provide the requested services?
• Have we established and communicated a specific retention period?
• Have we obtained your consent for an extended retention period?
• Do we have a legal, contractual, or similar obligation to retain the data?

Once your data is no longer needed and there are no legal retention obligations, no legitimate interests, or contractual obligations, we will permanently delete it or, if that is not possible, anonymize it in our systems.

However, your personal data will be stored and used as long as necessary to comply with our legal obligations, resolve disputes, or enforce our agreements.

8 How do we secure your personal data?

We are committed to protecting your personal data and your privacy. Our employees are trained in handling confidential information. For each project involving the processing of personal data, we first conduct a security and privacy assessment that prioritizes your interests. We collaborate with experts specializing in the security of our network, infrastructure, and information systems. Additionally, we use various technical measures to protect your personal data against unauthorized access, misuse, as well as loss or theft, such as password protection, disk encryption software, firewalls, antivirus programs, and access controls for our employees.

In the event of a data breach that negatively impacts your personal data, you will be personally informed as a customer in accordance with the provisions of the data protection law.

The number of employees in our company who have access to your personal data is limited, and they are carefully selected. Access to your personal data is granted only to the extent that this information is necessary for the proper fulfillment of their tasks.

9 What rights do you have?

9.1. Right to access, rectification, erasure, data portability, and objection

9.1.1. Right to access your personal data
You have the right to access your personal data that we process at any time. In this context, we will provide you with a copy of this personal data free of charge.

9.1.2. Right to rectify your personal data
You have the right to have inaccurate, incomplete, inappropriate, or outdated personal data corrected or deleted at any time.

9.1.3. Right to withdraw your consent
If the processing is based on your explicit consent, you have the right to withdraw that consent at any time.

Please note that withdrawing your consent for certain processing of your personal data may result in you no longer receiving information or being unable to benefit from certain activities or services we offer.

9.1.4. Right to object to certain processing
For processing activities based on legitimate interest, as mentioned in section 3.3, you have the right to object to this processing.

9.1.5. Right to erasure of your personal data
You have the right to request the deletion of your personal data. You may ask us to stop using your personal data if you no longer wish to have a relationship with CBS.

However, we may retain personal data that is necessary for evidentiary purposes. This right to erasure also allows you to ask us at any time to cease processing your personal data that is based on your consent or our legitimate interest. However, due to our legitimate interests, we may continue to process your personal data after weighing your interests against ours, unless you choose to terminate your relationship with us.

9.1.6. Right to data portability
You have the right to receive the personal data you provided to us in a structured, commonly used, and machine-readable format, so you can keep it for personal (or future) purposes, or have that personal data transmitted directly to another controller, where technically feasible for us.

However, data protection law provides for certain restrictions on this right, so it does not apply to all data.

9.1.7. Right to restrict certain processing
You may request that we restrict the processing of your personal data in one of the following cases:

• If you contest the accuracy of the personal data, you may request a restriction on processing for a period that allows us to verify the accuracy of the personal data.
• If the processing is unlawful and you oppose the deletion of the personal data and instead request a restriction on its use.
• If we no longer need your personal data for the purposes mentioned in section 3, but you still need it to establish, exercise, or defend a legal claim.
• If you have lodged an objection against a processing activity, this will be suspended until we determine whether CBS’s legitimate reasons outweigh your own.

If you have received the right to restrict processing, we will no longer process the relevant personal data, except to store it.

9.2. Right to object to direct marketing
As mentioned in section 3.2 of this Privacy Statement, we use your personal data to send you commercial information, advertising, or personalized offers (via direct marketing or email newsletters). You have the right to object to this processing if you no longer wish to receive such communications by using the designated options in each email you receive from us. In this case, we will no longer process your data for direct marketing purposes. Your request will be processed as quickly as possible.

Once you have exercised your right to object, you may, if you wish, authorize direct marketing activities again through the same channels.

Please note that exercising your right to object does not prevent us from contacting you for other reasons, including for contractual fulfillment, in accordance with this Privacy Statement.

9.3. How can you exercise your rights?
To exercise the above rights, you can send a written request in the following ways:

By email: info@cbs-beton.com
By post to the following address: CBS, Attn: Data Protection Officer, Hooiemeersstraat 8, 8710 Wielsbeke
Please clearly indicate when exercising your rights which right you wish to invoke and against which processing you wish to object or which consent you wish to withdraw. Be as specific as possible when exercising your rights.

10 How can you ask questions or file complaints?

If you have questions or complaints about our processing of your personal data, about exercising your rights, or about this Privacy Statement, you can contact us through the following channels:

By email: info@cbs-beton.com
By post to the following address: CBS, Attn: Data Protection Officer, Hooiemeersstraat 8, 8710 Wielsbeke
By phone: +32 56 61 75 39

If you are not satisfied with our response, or if you have comments regarding the exercise of your rights or believe that our processing of your personal data does not comply with legal requirements, you can file a complaint with the Belgian Data Protection Authority, formerly known as the Privacy Commission. All information can be found at https://www.privacycommission.be.

11 Changes to this Privacy Statement

This Privacy Statement may be amended or supplemented as we deem necessary.

If significant changes are made to this Privacy Statement, the date of the policy update will be changed, and we will also inform you and provide you with a copy of the updated policy.

We also recommend that you regularly consult this Privacy Statement to stay informed about how we process and protect your personal data.