At Cake NV, a Belgian company duly organized under the laws of Belgium, having its registered office at Hendrik Van Veldekesingel 150/23, 3500 Hasselt, Belgium and registered in the legal entities registered under the business registration number 0723.581.891 (hereinafter referred to as Cake, ‘we’ or ‘us’) we are committed to maintaining the accuracy, confidentiality and security of personal data.
If you request information from us or if you are interested in partnering with Cake, we need to process some of your personal data. This is necessary to inter alia enter into an agreement with you and to grant you access to the Partner Portal. In this commercial partnership relation, we are acting as a ‘data controller’. This means that we determine the purposes and means of the processing of your personal data.
We want to assure you that your personal data will be handled by us in a safe and confidential manner, in compliance with the existing and applicable legal provisions concerning the protection of personal data, including the Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the ‘GDPR’) and the national implementing legislation.
1. Clarification of terms used
A natural person shall be deemed ‘identifiable’ if he or she can be identified on a direct or indirect basis, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Hence, all information on the basis whereof a natural person can be identified must be taken into account. I.e.: amongst others the person’s name, date of birth, address, telephone number, e-mail address and IP-address are taken into account.
The term ‘processing’ has a broad scope and inter alia refers to the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.
2. When do we collect your personal data?
The moments on which we collect your personal data include:
- when we respond to a request for information;
- when we approach you as a (potential) commercial partner;
- when you decide to enter into an agreement with us;
- when you show your interest to our services and the Partner Portal;
- when you contact us in any other way.
3. What personal data do we process, why and on which legal basis?
The schedule below provides an overview of: (i) the categories of personal data which are processed by us, (ii) why such personal data is being processed (the ‘purposes’) and (iii) on which legal basis such processing takes place.
We guarantee that the processing of personal data shall only take place for one or more specific purposes. Furthermore, there is always a demonstrable legal basis for every processing of personal data, which you will find in the column ‘legal basis’. For your information, the specified legal bases have the following meaning:
- ‘Consent’: you have given your consent for the processing of personal data for one or more specific purposes;
- ‘Performance of a contract’: the processing of the personal data is necessary for the performance of a contract to which you are a contracting party, or in order to take steps at your request prior to entering into a contract;
- ‘Legitimate interest’: the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data;
- ‘Legal obligation’: the processing is necessary for the compliance with a legal obligation to which the controller is subject.
|Categories of personal data||Purposes||Legal basis|
|Identification – and contact details: surname and name contact person, address, company registration number, e-mail address, telephone number, activity, brand structure, point of sale informationFinancial details: payment details, invoicesAdditional information you provide to us||(i) Negotiating and conclusion of an agreement(ii) Execution of the contract (including invoicing)(iii) To protect and safeguard our rights||Performance of a contractPerformance of a contractLegitimate interest (protection of our interests)|
|Identification – and contact details: surname and name contact person, telephone number, address, email address||(i) To contact you to provide you information regarding Cake, the Partner Portal, or to obtain information in this regard(ii) Provision of trainings and/or configuration services (at your request)||Performance of a contractPerformance of a contract|
|Identification – and contact details: company name, company registration number, activityFinancial details: payment details, invoicesDetails of your customers||To comply with legal, regulatory and administrative obligations||Legal obligation|
|Identification – and contact details: surname and name contact person, address, company registration number, e-mail address, telephone number, activity, brand structure, point of sale information||For reward programs and campaigns||Legitimate interest|
4. Your privacy rights
In order to give you more control regarding the processing of personal data, you have various rights at your disposal. These rights are inter alia discussed and provided in articles 15-22 GDPR.
You have the following rights:
1) Right of access to the processed personal data (art. 15 GDPR):
You have the right to obtain our confirmation as to whether or not your personal data is being processed, and, where that is the case, to obtain access to the personal data.
In the event that we cannot provide you access to the personal data (for example in the event of a legal obligation to restrict the data subject from access to such information), we shall inform you of the reasons of such an inability.
Furthermore, you can also request a copy of the personal data undergoing processing free of charge. Please note however, that we are entitled to charge a reasonable fee based on administrative costs for each additional copy you request.
2) The right to be forgotten or to request erasure of personal data (art. 17 GDPR)
In certain instances, you may request us to erase your personal data. Be aware however that under such circumstance, we will not be able to provide you with our services any longer. Furthermore, we ask you to bear in mind that the ‘right to be forgotten’ is not an absolute right. We shall have the right to continue to store your personal data, inter alia, in the following cases: (i) where such storage is necessary for the performance of a contract to which you are a contracting party, (ii) where such storage is necessary for compliance with a legal obligation, or (iii) where such storage is necessary for the establishment, exercise or defence of legal claims. We shall inform you of the reasons for the storage of your personal data in our response to your request of erasure.
3) The right to rectification (art. 16 GDPR):
In the event that your personal data are inaccurate, dated or incomplete, you can request us to rectify or complete your personal data.
4) The right to data portability (art. 20 GDPR):
Under certain conditions, you shall also have the right to request us to transmit the personal data you provided us with and for which you have given us your consent, to another controller. We shall transmit such personal data directly to the new controller in so far as the conditions are fulfilled and to the extent such transmission is technically feasible.
5) Right to restriction of processing (art. 18 GDPR):
You shall have the right to obtain the restriction of processing if one of the following applies:
- you contest the accuracy of the personal data (in such an event the use of the personal data shall be limited for a period enabling us to verify the accuracy of the personal data);
- the processing of the personal data is unlawful;
- we no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims;
- pending the verification whether the legitimate grounds for the processing of the personal data override those of the data subject, you may request us to limit the usage of the personal data.
6) The right to object (art. 21 GDPR):
You have the right to object, on grounds relating to your particular situation, the processing of your personal data in case that such processing is done for the performance of a task carried out in the public interest or for the purposes of the legitimate interests pursued by us. In such an event, we shall no longer process the personal data unless (i) there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or (ii) the processing of the personal data is done for the establishment, exercise or defence of legal claims.
7) The right to withdraw your consent (art. 7 AVG):
Where the processing of personal data is based on consent, you shall have the right to withdraw such consent at any time through a simple request.
8) The exercise of your rights
To exercise the rights listed above, you can contact us via e-mail on the following e-mail address: firstname.lastname@example.org. In order to verify your identity, we ask you to attach a copy of the front side of you ID-card to your e-mail.
All rights can be exercised free of charge, unless your request is manifestly unfounded or disproportionate (for example: due to the repetitive character of your request). In such cases, we have the right to charge you with a proportional fee or to refuse to adhere to your request.
5. Transfer of personal data to third parties
Your personal data shall only be transferred to third parties in conformity with the legal provisions in that regard, to group companies, when you have provided us with your consent to do so, or when such transfer is necessary to ensure the provision of our services (on the basis of our legitimate interests).
No personal data shall be transferred to third parties under any other circumstances, unless we are obligated to do so on the basis of compulsory legal or regulatory provisions (e.g.: the transfer of personal data to external bodies or authorities, such as law enforcement authorities).
6. Categories of recipients
We ensure that your personal data shall only be accessible within our company, or associated companies, to those persons who require access to the personal data in order to comply with the contractual and legal obligations.
In some circumstances, our employees and staff are assisted by external service providers in the execution of their tasks. In order to protect your personal data, we have concluded an agreement with all such external service providers in order to guarantee the safe, respectful and cautious management and administration of your personal data.
7. Transfer of personal data to third countries
Your personal data shall only be transferred or disclosed to processors or controllers in third countries in so far as we are legally authorised to do so.
In so far as such disclosure or transfer is necessary, we shall take appropriate measures to ensure that your personal data shall be significantly protected and that all disclosures or transfers of personal data outside of the EEA take place in a lawful and legitimate manner. In the event that a disclosure or transfer takes place to a country outside of the EEA, for which the European Commission has not determined that this country does not maintain an equivalent level of protection of the personal data, such disclosure or transfer shall always be subject to contractual or other legally binding instruments which under the terms and conditions for the transfer of personal data to third countries, such as the approved standard terms and provisions for the transfer of personal data to third countries as established by the European Commission.
8. Protection of your personal data
We have taken all reasonable and suitable technical and organizational measures in order to protect your personal data against accidental or unlawful destruction, loss, alteration, and to prevent unauthorised disclosure of, or access to, personal data.
As such, we store your personal data on a secured place on our server in order to ensure that third parties shall not have access to your personal data. We also implemented the principle of “least privilege” so that only authorized users have access to our information systems and data (through policies and standards about access control).
9. Storage of personal data
We store your personal data for the period of time necessary for achieving the purpose for which such personal data is processed (for the performance of our agreement). Please note that we must take into account a number of (legal) storage periods (time limits) which oblige us to continue to store your personal data. In the event that no obligation or duty to store the personal data exists, the personal data shall be erased and destroyed on a routine basis once the purpose for which the personal data is collected has been achieved.
Furthermore, we may store your personal data if you have given us your consent to do so or where such storage is necessary for the establishment, exercise or defence of legal claims. In this last instance, certain personal data shall be used for evidence purposes. Such personal data shall therefore be stored in line with the legal prescription period, which can amount up to a period of thirty years; the usual, habitual prescription period regarding personal legal claims amounts up to a period of ten years.
We aim to take all necessary measures in order to guarantee the protection of your personal data. Should you have a complaint regarding the manner in which your personal data is processed, please feel free to contact our Data Protection Officer (DPO) by sending an email to email@example.com. We shall try to live up to your expectations and meet your concerns as soon as practically possible.
You may also file your complaint to the supervisory authority for personal data protection. The authority assigned to supervise our organization is the Data Protection Authority (https://www.dataprotectionauthority.be/).
Data Protection Authority
Rue de la Presse 35, 1000 Brussels
+32 (0)2 274 48 00
+32 (0)2 274 48 35
11. Do you have any further questions?
Should you have questions about your privacy, your rights, or about the way we process your data, please feel free to contact our Data Protection Officer (DPO) by sending an email to firstname.lastname@example.org.
For any other question, you may contact us via e-mail on the following e-mail address: email@example.com. We are happy to be of any further assistance.