Privacy Policy

Your privacy is important to us! To ensure you can enjoy our photo service website, we require certain information from you.
This privacy policy explains how H. De Beukelaer nv/sa—the data controller—processes this information and the legal grounds upon which such processing is based. Furthermore, this policy outlines your rights and obligations regarding the processing of your data by H. De Beukelaer nv/sa.
Please read the information below carefully and check this page regularly for updates.
We reserve the right to amend this policy to ensure it remains in line with changes to our business activities or legal requirements.

General

H. De Beukelaer nv/sa complies with the Belgian Act of 8 December 1992 on the protection of privacy in relation to the processing of personal data, as well as the European General Data Protection Regulation (GDPR) of 25 May 2018, which applies to all organizations that store personal data. These regulations set out the rules regarding the collection and subsequent processing of personal data.
H. De Beukelaer nv/sa is committed to adhering to these laws and regulations and ensuring ongoing compliance. H. De Beukelaer nv/sa also pledges to follow the principles and rules established in this policy. This policy has been communicated internally to our staff and is also made available to our customers.

Definitions

• Personal data:
  Any information relating to an identified or identifiable natural person (“the data subject”).

• Processing:
  Any operation or set of operations which is performed on personal data, including, but not limited to, collection, recording, organization, storage, updating, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, as well as blocking, erasure, or destruction of data.

• Controller:
  A natural or legal person, or any other entity, which, alone or jointly with others, determines the purposes and means of the processing of personal data.

• Processor:
  A natural or legal person, or any other entity, that processes personal data on behalf of the controller, under the controller’s instructions and responsibility.

• Third party:
  A natural or legal person, or any other entity, other than the data subject, the controller, the processor, or persons who, under the direct authority of the controller or the processor, are authorized to process the personal data.

H. H. De Beukelaer nv/sa as the data controller

• H. De Beukelaer nv/sa

• Boomsesteenweg 77

• B-2630 Aartselaar

• RPR Antwerp, Antwerp division: 04040.880.077

Based on factors such as the nature of the personal data and the scope of the collection, we are not required to appoint a Data Protection Officer; however, we do have an internal point of contact.

H. De Beukelaer nv/sa and the GDPR (General Data Protection Regulation)

The most significant data protection rules applicable to H. De Beukelaer nv/sa can be summarized as follows:

• Method of processing:
  Personal data may only be processed in accordance with the law and in a proper and diligent manner.

• Purpose limitation:
  Personal data may only be collected for specific, explicitly defined, and legitimate purposes, and may only be further processed for purposes that are compatible with those original objectives.

• Quality:
  Personal data must be relevant to the purposes for which they are used.

In addition, personal data must be accurate, as well as complete and up-to-date.

Transparency:
The data subject(s)—the person(s) whose personal data are being processed—must at the very least be informed of the identity of the data controller and the purpose(s) of the processing.

Security:
Personal data must be protected in an appropriate manner. In this context, the data controller must implement sufficient technical and organisational security measures to protect against the loss, unauthorised access, destruction, use, alteration, or disclosure of personal data.

Accountability:
The data controller is accountable for implementing measures that give effect to the (aforementioned) requirements regarding the protection of personal data. These requirements may be subject to review, taking into account factors such as evolving technologies, market developments, and user behaviour.

Personal Data

H. De Beukelaer nv/sa collects the following data:

• Cookies (see separate Cookie Policy): such as pages visited on the webshop, browsing behavior, and click-through data (in an anonymous manner).

• Upon registration on the website: first name, surname, email address, password.

• When managing your account: first name, surname, email address, password, billing and delivery address, telephone number.

• Your photos: when creating photo-based products or placing an order.

• Your orders.

• When placing an order: first name, surname, email address, billing and delivery address, telephone number.

• When communicating with our customer service: first name, surname, email address, billing and delivery address, telephone number.

Purposes of processing

General purposes

H. De Beukelaer nv/sa collects and processes only such personal data as has been provided by the data subjects themselves for the purpose of the orderly conduct of business operations.
H. De Beukelaer nv/sa processes your personal data for the following purposes, indicating the legal basis for such processing:

• To offer you the option to create an account.
  You can save your photo creations in your account, which are protected by your password. It is therefore important to choose a strong password. You can save your photo creations and continue working on or order them at a later time. When placing an order, you can also load your details from your account by logging in with your email address and password, so that you do not have to manually enter your information every single time (legitimate interest).

• To offer you the option to place orders (legitimate interest).

• To deliver goods and services to you (contractual obligation).

• To manage customer records and organize standard business activities, such as after-sales service and invoicing—for example, using your billing address to prepare an invoice or contacting you via email or telephone (contractual obligation).

• To ensure data security and minimize the risk of misuse—for instance, through IT security measures (legitimate interest).

• H. De Beukelaer nv/sa analyzes your behavior on the website in order to improve the website (legitimate interest).

• Sending newsletters (consent and legitimate interest) – see also “Direct Marketing”.

Direct Marketing

We may use data, without prior consent, to send emails to existing customers—for example, in the context of the sale of a product or service that we provide, which is similar to one we have previously supplied (legitimate interest).
This may also include emails sent to all existing customers regarding a product that is less similar.
We send emails aimed at the sale of our products to potential customers who have explicitly provided their consent by subscribing to our newsletter, even if they have not placed an order (consent).

Transfer to third parties

Your personal data will only be shared with parties carefully selected by H. De Beukelaer nv/sa for the purpose of executing the services for which you have provided consent. These parties are engaged to provide services on behalf of H. De Beukelaer nv/sa—for example, delivery services, printers, newsletter distributors, hosting providers, or online payment platforms. The access these subcontractors have to your personal data is limited to what is strictly necessary for the performance of their assigned tasks. Through a data processing agreement, H. De Beukelaer nv/sa has ensured that these parties will always implement the necessary organizational and technical security measures to protect your personal data, guarantee its strict confidentiality, and uphold your rights regarding this processing—such as the "right to be forgotten." H. De Beukelaer nv/sa will not sell or rent your personal data to anyone.

Legal requirements

In the event of a court order, H. De Beukelaer nv/sa may be required to disclose your personal data to the competent authorities.

Access to and security of personal data

Access to your personal data is restricted to staff members authorized to carry out the aforementioned objectives or perform IT maintenance, as well as personnel from parties contractually bound to H. De Beukelaer nv/sa who are acting under its instructions.

Taking into account the state of the art, the costs of implementation, as well as the nature, scope, context, and purposes of the processing, and the varying risks to the rights and freedoms of individuals—in terms of both likelihood and severity—H. De Beukelaer nv/sa makes every effort to implement appropriate technical and organisational measures to ensure a level of security commensurate with the risk.

Retention period for personal data

We process only the minimum amount of personal data necessary for the purposes stated above. Once this data is no longer required, we will delete it. We retain your data for as long as your account remains active or for as long as is necessary to provide you with services. If you would like to request that we no longer use your data to provide you with services, please contact us; see the section headed “Your rights”. We will retain and use your data to the extent necessary for compliance with our legal obligations, for the resolution of disputes, and for the execution of our agreements.

Your rights

• Right of access

• Right to rectification

• Right to erasure (“right to be forgotten”)

• Right to restriction of processing

• Right to data portability

• Right to withdraw consent

• Right to lodge a complaint

You have the right to access, modify, or correct your personal data, or to object to its use by H. De Beukelaer nv/sa, free of charge and without the need to provide a reason.

You may exercise these rights by sending an email to digitalsupport@photolitto.com or by sending a letter to H. De Beukelaer nv/sa, Boomsesteenweg 77, B-2630 Aartselaar. If you submit a request by letter, please include a copy of an identity document. To protect your privacy, please black out your passport photo, identification number, and card number on this copy.

Certain changes can also be made on the website via your account.

You may unsubscribe from email communications at any time by clicking the relevant link.

If no action is taken regarding your request within one month, we will endeavor to notify you—potentially indicating an extension period if the request is complex—and explain why no action was taken. In such a case, you have the right to lodge a complaint with a supervisory authority and to seek a judicial remedy.

Responsibility

H. De Beukelaer nv/sa is responsible for managing both paper and digital records and ensures that the collection, processing, administration, and storage of personal data are carried out in accordance with the GDPR, the legislation on the protection of privacy, this privacy disclaimer, and other data protection documents in effect within H. De Beukelaer nv/sa.

Filing a complaint

If you are not satisfied with the way your personal data is being handled, you may lodge a complaint with the supervisory authority, the Data Protection Authority (DPA) – Gegevensbeschermingsautoriteit (GBA) – located at Drukpersstraat 35, 1000 Brussels, tel. +32(0)22744878;
contact@apd-gba.be

Version: July 2018, Version 2.0