Privacy Policy

PRIVACY POLICY OF THE MEDIAHUIS GROUP

Version 1.0 modified on 22 May 2018

1. INTRODUCTION

Below you will find the privacy policy of the Mediahuis Group (hereinafter “Mediahuis” or “we”). This policy concerns the processing of personal data relating to natural persons, i.e. personal data on all websites, through all (mobile) apps and all services of the different entities within the Mediahuis Group.

This policy is not applicable to the processing of personal data relating to legal persons.

This policy is divided into three parts:

The different controllers within the Mediahuis Group

• General information regarding the processing of personal data by all entities within the Mediahuis Group

• Specific information regarding the processing of personal data by each entity within het Mediahuis Group

This privacy policy does not affect, and should be read together with, the other applicable policies and agreements of the entities of the Mediahuis Group:

Cookies policy
• General subscription conditions
• User conditions
• Code for telephone competitions
• Ad hoc competition rules
Agreement for the use of Service on or through Mediahuis Domains by Users and Registered Users

DEFINITIONS

Within this policy, it is necessary to use a number of technical terms. That is why we provide a brief overview of the definitions and frequently used terms in this section.

Service: news, promotions, functionality for a better user experience, (mobile) apps, recommended content or personalised advertisements that a Mediahuis Entity provides or makes available on or through a Mediahuis Domain. For an overview of the Services per Mediahuis Domain, see the definitions of Mediahuis Entity.

Mediahuis Domain: a website or a(n) (mobile) application offered or operated by a Mediahuis Entity.

Mediahuis Group: the whole of Mediahuis Entities.

Mediahuis Entity: the legal person within the Mediahuis Group who offers/supplies a Service – the different Mediahuis Entities are to be found in section 2.

2. THE DIFFERENT CONTROLLERS WITHIN THE MEDIAHUIS GROUP

Below you will find an overview of the different entities within the Mediahuis Group. Each entity acts as a controller of your personal data if they provide their respective Service to you. Mediahuis Entities

3. GENERAL INFORMATION REGARDING THE PROCESSING OF PERSONAL DATA BY ALL ENTITIES OF THE MEDIAHUIS GROUP

3.1 What are the purposes and legal basis for the processing of your personal data?

Each of the abovementioned entities of the Mediahuis Group processes personal data for specific purposes. The Mediahuis Entity always acts on the basis of a processing ground as is required by law. A processing ground is a legal basis which allows for the use of personal data. Examples of processing grounds are: consent, execution of an agreement, legal obligation and legitimate interest, etc.

The purposes and legal basis for the processing of your personal data differ depending upon the Service. You can find more information regarding the applicable purposes and legal basis in specific information regarding the processing of personal data by each entity within the Mediahuis Group. Mediahuis Entities

3.2 Which personal data is processed by the entities of the Mediahuis Group?

Each of the abovementioned Mediahuis Entities processes the personal data you provided to them in the context of the supply of a Service.

Each Mediahuis Entity that processes your personal data, may also receive your personal data from another Mediahuis Entity.

In order to validate, complete and correct the quality of our data records, a Mediahuis Entity may receive personal data (name, address, domicile) from external service providers such as Bisnode Belgium NV (Researchdreef 65, 1070 Anderlecht, www.bisnodeenu.be) [LINK]. Example: if you have moved, we correct your address in order to be able to continue the supply of the Services.

3.3 How can you contact the data protection officer (DPO)?

A data protection officer (DPO) is appointed for all processing operations by the aforementioned entities of the Mediahuis Group.

You may always contact him with all questions or complaints in relation to any processing operation of personal data by one of the abovementioned entities of the Mediahuis Group. Contact the DPO

3.4 Who receives your personal data?

Each of the abovementioned entities of the Mediahuis Group may transfer your personal data to:

• subcontractors who work on its behalf and its account (processors),
• its employees in the context of the exercise of their function,
• another entity within the Mediahuis Group,
• persons that are interested in an advertisement that you placed (e.g. vroom.be, zimmo.be, jobat.be),
• advertising partners in the context of the supply of recommended content and personalised advertisements,

We also ensure that registered data cannot be combined with click behavior. Thanks to the use of a data management platform, click behavior is only passed on in the form of derived target groups and interests (e.g. man of 18-34 and sports enthusiast) without underlying registered data.

• social media by which you login or interact at our Services,
• external service providers such as Bisnode Belgium NV (Researchdreef 65, 1070 Anderlecht, www.bisnodeenu.be) for validation, linking, supplementation or correction of your personal data,
• commercial partners of a Mediahuis Entity, if you have consented thereto,
• third parties in the context of discussions, investigations and negotiations in connection with a cooperation or corporate transaction (acquisition, merger, sale of a branch, joint venture, etc.) and with the professional advisors of the parties concerned (lawyers, consultants, etc.),
• judicial, police or administrative authorities if required by the law or circumstances.

Mediahuis ensures that these recipients only have access to personal data that are strictly necessary for the processing.

For certain processing, there are specific recipients of your personal data. The recipients are each time mentioned below in specific information regarding the processing of personal data for each entity within the Mediahuis Group. Mediahuis Entities

3.5 Does the Mediahuis Group transfer your personal data to countries outside the European Economic Area?

The European Economic Area (EEA) includes all countries of the European Union and Norway, Liechtenstein and Iceland. The European legislation requires additional safeguards if a Mediahuis Entity transfers personal data to other countries situated outside the EEA. The European legislator imposes appropriate safeguards to controllers to assure that such countries maintain the same level of protection with regard to your personal data.

A Mediahuis Entity shall transfer your personal data to recipients outside the European Economic Area for certain processing. In such a case, the Mediahuis Entity shall warrant that the transfer is covered by the appropriate safeguards, including an adequacy decision of the European Commission, the Model Clauses of the European Commission or the EU-US privacy shield.

You may always consult the data protection officer (DPO) to have access to the appropriate safeguards provided by the Mediahuis Entity.

3.6 Which rights do you have as data subject?

Subject to the terms and conditions provided for by the applicable law, you may always contact Mediahuis for the exercise of the following rights:

• You have a right of access to your personal data. This allows you to verify which personal data a Mediahuis Entity processes.

• You always have the right to have your personal data corrected. This allows you to rectify or correct, inaccurate or incorrect personal data a Mediahuis Entity processes.

• You have the right to have your personal data erased. This allows you to permanently delete personal data which a Mediahuis Entity processes. A Mediahuis Entity is not always obliged to delete your personal data at your request – this right only applies in the situations and to the extent provided for by law.

• You have the right to limit the processing of personal data related to you. This allows you to freeze the use of your personal data by a Mediahuis Entity, without deleting it. A Mediahuis Entity is not always obliged to limit your personal data at your request – this right only applies in the situations and to the extent provided for by law.

• You have the right to object to a processing of your personal data. This allows you to object to the further processing operations by a Mediahuis Entity of your personal data. A Mediahuis Entity is not always obliged to uphold your objection.

• You always have the right to withdraw your consent whenever the processing of your personal data takes place on the basis of your consent.

• You always have the right to object to the processing of your personal data for direct marketing purposes.

• You have the right to data portability. This allows you to easily move, copy or transfer your personal data from one controller to another. This right may only be exercised whenever the processing takes place on the basis of an agreement with you.

For all processing operations mentioned in this privacy policy, you may exercise your rights by contacting the DPO. Contact the DPO

3.7 Do you wish to file a complaint with the supervising authority?

You are entitled to file a complaint by the supervising authority:

• For Services offered by Mediahuis Limburg BV, Limburgvac BV and WijNederland BV, this is: Autoriteit Persoonsgegevens, att. the complaints coordinator, Box 93374, 2509 AJ The Hague, The Netherlands, https://autoriteitpersoonsgegevens.nl/nl
• For all other Services it is: Data Protection Authority, Drukpersstraat 35, 1000 Brussels, Belgium, commission@privacycommission.be, www.privacycommission.be, tel: +32 2 427 48 00.

3.8 Interaction through social media

If you use one of the Services of a Mediahuis Entity or visit them through your account on social media (e.g. login through your facebook account) or interact on our social media channels or through buttons or other techniques, the Mediahuis Entity may seize personal data hereof which is publicly shared through the website of the social network such as information on the public profile, list of friends, your use of social network sites, and your e-mail address.

The use of or interaction with social media is subject to the social media channel’s own rules – no Mediahuis Entity has any influence on this. Consult the user terms and the privacy policy of the concerned social media network to understand how such networks deal with your personal data.

4. SPECIFIC INFORMATION REGARDING THE PROCESSING OF PERSONAL DATA BY EACH ENTITY OF THE MEDIAHUIS GROUP

Below you can verify the different processing operations within the Mediahuis Group. Each time it is indicated by which entity within the Mediahuis Group the processing is done.

4.1 You contact us for a question, a request for information or a complaint

If you contact an entity of the Mediahuis Group for a question, a request for information or a complaint, the Mediahuis Entity processes your personal data on the basis of its legitimate interest to answer or help you.

Each entity of the Mediahuis Group which is mentioned above, processes your personal data as a controller for this purpose if you contact it.

Each Mediahuis Entity keeps your personal data for a term of maximum 5 years after the completion of your question, request for information or complaint.

For more general information regarding such processing (what are the contact details of the data protection officer and the supervising authority, who are the recipients of your personal data, what are your rights, does Mediahuis share your personal data with countries outside the EEA, etc.), please refer to General information regarding the processing of personal data by all entities of the Mediahuis Group. Mediahuis Entities

4.2 You take part in a market research

If a Mediahuis Entity contacts you in the context of a market research, it does so on the basis of consent. You are always entitled to withdraw your consent.

Each Mediahuis Entity that carries out market research keeps your personal data for a term of maximum 3 years after the end of the research.

For more general information regarding such processing (what are the contact details of the data protection officer and the supervising authority, who are the recipients of your personal data, what are your rights, does Mediahuis share your personal data with countries outside the EEA, etc.), please refer to General information regarding the processing of personal data by all entities of the Mediahuis Group. Mediahuis Entities

4.3 You are a business customer for one of the Services (B2B)

If a Mediahuis Entity provides a Service to you as a business customer (B2B), it processes your personal data in the context of its client administration (creation and management of the account, supply, invoicing, etc.) on the basis of the necessity to execute the agreement.

Each Mediahuis Entity which processes your personal data in the context of its client administration keeps your personal data for a term of maximum 10 years after the end of the client relation.

For more general information regarding such processing (what are the contact details of the data protection officer and the supervising authority, who are the recipients of your personal data, what are your rights, does Mediahuis share your personal data with countries outside the EEA, etc.), please refer to General information regarding the processing of personal data by all entities of the Mediahuis Group. Mediahuis Entities

4.4 You are a client-consumer of one of the Services (B2C)

If a Mediahuis Entity provides a Service to you as client-consumer (B2C), it processes your personal data in the context of its client administration (creation and management of the account, supply, invoicing, etc.) on the basis of the necessity to execute the agreement.

Each Mediahuis Entity who processes your personal data in the context of its client administration keeps your personal data for a term of maximum 10 years after the end of the client relation.

For more general information regarding such processing (what are the contact details of the data protection officer and the supervising authority, who are the recipients of your personal data, what are your rights, does Mediahuis share your personal data with countries outside the EEA, etc.), please refer to General information regarding the processing of personal data by all entities of the Mediahuis Group. Mediahuis Entities

4.5 You use Jobat as a jobseeker

If you use Jobat as jobseeker, Mediahuis NV processes your personal data for labour placement (matching your profile as job seeker with vacancies of employers) on the basis of:

• the executing of an agreement with you (CV upload, sharing value fit, etc.),
• your approval (subscription job event, sending job related e-mails),
• its legitimate interest (possibility for employers to provide comments to CV’s)
• the law (decree of 10 December 2010 regarding private labour placement). You are always entitled to withdraw your consent.

Besides the recipients mentioned in the General information regarding the processing of personal data by all Mediahuis Entities, Mediahuis NV shares your personal data with employees who purchase its Jobat service, though only to the extent that you allow this.

Mediahuis keeps your personal data for a period of maximum 10 years after inactivity or closure of your Jobat account.

For more general information regarding such processing (what are the contact details of the data protection officer and the supervising authority, who are the addressees of your personal data, what are your rights, does Mediahuis share your personal data with countries outside the EEA, etc.), please refer to General information regarding the processing of personal data by all entities of the Mediahuis Group. Mediahuis Entities

4.6 You participate in a competition or promotional action

If you participate in a competition or promotional action of a Mediahuis Entity, such entity processes your personal data for the management of the competition/action and the designation of the winner on the basis of its legitimate interest. The processing of your personal data is necessary to manage the competition or action and to contact the winners to hand over the price

Participation in a competition or promotional action may be subject to competition rules or action terms.

Each Mediahuis Entity that processes your personal data for the management of the competition/action and the designation of the winner keeps your personal data for a period of maximum 10 years after the end of the competition or action.

For more general information regarding such processing (what are the contact details of the data protection officer and the supervising authority, who are the recipients of your personal data, what are your rights, does Mediahuis share your personal data with countries outside the EEA, etc.), please refer to General information regarding the processing of personal data by all entities of the Mediahuis Group. Mediahuis Entities

4.7 You receive commercial information about Services of a Mediahuis Entity

When you receive commercial information about Services of a Mediahuis Entity, that entity processes your personal data for direct marketing purposes based on

• your consent (if you do not have a relationship with this Mediahuis Entity) or

• its legitimate interest (if you do not have a relationship with this Mediahuis Entity, e.g. you are a customer or a partner, or you participate in a competition or promotional action).

You have the right to withdraw your consent at any time.

You have the right at any time to object to the further receipt of commercial information about Services of a Mediahuis Entity. You can exercise this right by changing the settings of your account or by contacting the Mediahuis Entities.

Each Mediahuis Entity that processes your personal data for marketing purposes keeps the data for a term of maximum 10 years after the end of the relationship with Mediahuis (if you have a relationship with Mediahuis) or for a term of maximum 10 years after inactivity (if you do not have a relationship with Mediahuis).

For more general information regarding such processing (what are the contact details of the data protection officer and the supervising authority, who are the recipients of your personal data, what are your rights, does Mediahuis share your personal data with countries outside the EEA, etc.), please refer to General information regarding the processing of personal data by all entities of the Mediahuis Group. Mediahuis Entities

4.8 You receive commercial information about products or services from partners of a Mediahuis Entity

When you receive commercial information of products or services from a partner of a Mediahuis Entity, that entity processes your personal data for direct marketing purposes based on your consent. You have the right to withdraw your consent at any time.

You have the right at any time to object to the further receipt of information about products and services from partners of Mediahuis. You can exercise this right by changing the settings of your account or by contacting the Mediahuis Entities.

Each Mediahuis Enitity that processes your personal data for direct marketing purposes, keeps the data for a term of maximum 3 years after the last receipt of commercial information from partners of Mediahuis.

For more general information regarding such processing (what are the contact details of the data protection officer and the supervising authority, who are the recipients of your personal data, what are your rights, does Mediahuis share your personal data with countries outside the EEA, etc.), please refer to General information regarding the processing of personal data by all entities of the Mediahuis Group. Mediahuis Entities

4.9 You are visiting Mediahuis Entity

If you are a visitor of a Mediahuis Entity, each Mediahuis entity processes your personal data, in the context of visitor management based on its legitimate interests (e.g. guided tour for schools,
a meeting with a Mediahuis business contact, inspection of the archive, etc.).

Each Mediahuis Entity keeps your personal data for a term of maximum 1 year after your last visit.

For more general information regarding such processing (what are the contact details of the data protection officer and the supervising authority, who are the recipients of your personal data, what are your rights, does Mediahuis share your personal data with countries outside the EEA, etc.), please refer to General information regarding the processing of personal data by all entities of the Mediahuis Group. Mediahuis Entities

4.10 You are a supplier of a Mediahuis Entity

If you supply products or services to a Mediahuis Entity, this Mediahuis Entity processes your personal data in the context of supplier management based on the necessity to perform the agreement with you.

Mediahuis keeps your personal data for a term of maximum 10 years as of the last delivery.

For more general information regarding such processing (what are the contact details of the data protection officer and the supervising authority, who are the recipients of your personal data, what are your rights, does Mediahuis share your personal data with countries outside the EEA, etc.), please refer to General information regarding the processing of personal data by all entities of the Mediahuis Group. Mediahuis Entities

4.11 You apply for a job at a Mediahuis Entity

If you apply for a job at one of the Mediahuis Entities, this Mediahuis Entity processes your personal data for:

• The management and evaluation of the job applications in the context of a pre-contractual relationship,
• Maintaining a recruitment reserve list based on its legitimate interest.

Each Mediahuis Entity keeps your personal data for a term of maximum 5 years after the application procedure has been completed.

For more general information regarding such processing (what are the contact details of the data protection officer and the supervising authority, who are the recipients of your personal data, what are your rights, does Mediahuis share your personal data with countries outside the EEA, etc.), please refer to General information regarding the processing of personal data by all entities of the Mediahuis Group. Mediahuis Entities

4.12 In any case

If a Mediahuis Entity processes your personal data for one of the aforementioned purposes, that entity processes your personal data as well for:

• The detection, prevention of and fight against fraud and abuse based on its legitimate interest. Less fraud and abuse benefits the Mediahuis Entity, its customers and its suppliers,
• Dispute management based on its legitimate interest, as Mediahuis must be able to safeguard and defend its rights,
• The analysis and the improvement of the Services based on its legitimate interests. For this reason, the Services may be improved to better fit your needs and preferences.

Each Mediahuis Entity keeps your personal data for a term of maximum 10 years after your personal data became inactive.

For more general information regarding such processing (what are the contact details of the data protection officer and the supervising authority, who are the recipients of your personal data, what are your rights, does Mediahuis share your personal data with countries outside the EEA, etc.), please refer to General information regarding the processing of personal data by all entities of the Mediahuis Group. Mediahuis Entities