Privacy Statement

Our organization revolves around data, so the security and confidentiality of the personal data we process are of the utmost importance to us. In addition, we want to be clear and transparent about what we do with personal data. You will find all the relevant information in this privacy statement.

What if this privacy statement does not answer all your questions?

In this privacy statement, we try to be as clear as possible. Do you still have a question that has not been answered? You can contact us at privacy@openthebox.com. You can also use this channel to get in touch with our Data Protection Officer (DPO).

Who are "we"?

Whenever you see a reference in this privacy policy to "openthebox", "we" or "us", this refers to the company behind openthebox, Pulsar-IT BV, with its registered office at Havenlaan 86C 309, 1000 Brussels, and with company number 0478.561.772.

We are responsible for processing your data in a correct and lawful manner.

When are your personal data collected and used?

We collect and use your personal data for various purposes, namely when you:

• use our website or communicate with us.
• enter into a contract with us as a customer or supplier.
• apply for one of our job vacancies.
• are involved, as an individual, with an organization whose data can be found on our platform.

Below, we provide additional information for each purpose, such as the data we use and how long we retain that data.

1. When you use our website If you send us a message by email, via a contact form or through other digital communication channels, you expect a reply, and it is in our interest to provide you with that reply. For this purpose, we use the data you have provided to us via the communication channel, such as your name, email address, the message you sent and any other information you provide through that channel.

   When you use our website, we will process data for the following purposes, depending on your choices in the cookie banner:

   1. Analyzing usage and improving the website by collecting information about your use of our website after you have given your consent in the cookie banner.
   2. Detecting and preventing malware, illegal content and conduct, and other forms of abuse. This is a legitimate interest in protecting our website.
   3. Personalizing your experience on the website. To this end, we collect data that allows us to build a profile of your wishes and preferences; we may also match data from other sources with our profile for this purpose. We only carry out this personalization if we receive consent to do so.

   To achieve the purposes mentioned above, we process the following personal data:

   1. Information about the device you use to visit our website, your IP address and information from cookies such as a unique ID (depending on the type of cookie, up to a maximum of 6 months after your visit to the website); see also our cookie policy.
   2. Information about your browsing behavior, such as how long you visit the site and which pages you visit.
   3. Data you have provided in the communication, such as your name, email address, the content of your question, etc. (max. 1 year after your question has been answered)
2. When you enter into a contract with us as a customer or supplier When we enter into a contract with you, as a customer or as a supplier, we will collect and use your personal data
   1. for what is necessary to perform and fulfill our part of the contract.
   2. to conduct our normal business administration (e.g. invoicing and relationship management), for which we rely on our legitimate interest in managing our business in a responsible and professional manner.
   3. to defend ourselves, where necessary, in legal proceedings, in which we have a legitimate interest in defending ourselves.
   4. to inform a third party in the context of a possible merger with, acquisition of/by, or demerger by that third party, even if that third party is located outside the EU, in which case we rely on our legitimate interest in engaging in business transactions.

   The personal data we process for these purposes always concern your basic identity data, such as your name, email address, postal address, telephone number, the company you work for and your job title. We may also process other personal data that you provide to us, depending on our contractual relationship with you. We retain this data for up to 10 years after the expiry of the contract, in line with the statutory limitation period for contractual claims.

3. When you apply for one of our job vacancies When you apply for one of our job vacancies, we will collect and use your personal data to:
   1. assess your application, for which we rely on our legitimate interest in finding a suitable candidate;
   2. defend ourselves in legal proceedings, where it is in our legitimate interest to use your personal data in such proceedings.
   3. keep you in our recruitment reserve for possible future collaborations

   The personal data we process when you apply to us are:

   1. your basic identity data, such as your name, email address, postal address and telephone number.
   2. information you have included in your CV and cover letter.
   3. information you have made publicly available on LinkedIn.

   We retain this data for up to 1 year after your application.

4. When you are involved, as an individual, with an organization whose data can be found on our platform Making personal data available through our platform serves to improve transparency around organizational structures by providing objective and complete information about companies and the persons who represent them. In doing so, we help the users of our platform to find or verify potential business partners, assess credit risks, or check compliance with the rules by companies or individuals. The purposes of the processing are expressly not to facilitate direct marketing or the resale of personal data for direct marketing. For this, we rely on our legitimate interest in making this information available in the context of our activities. Specifically with regard to political mandates, we rely on the exception for information that has manifestly been made public.

   For this purpose, we process the following personal data:

   1. Surname and first name
   2. Information about the exercise of mandates
   3. Geographic address (whether or not complete)
   4. Political opinions (of published mandate holders)
   5. Salary (published remuneration of mandate holders)
   6. Position
   7. Company name
   8. VAT number
   9. Any newspaper articles in which the persons concerned are mentioned

   For this, we apply the following retention periods:

   • Mandates and linked persons: up to 10 years after cessation of the company or the last mandate
   • Exception: addresses of individuals, including sole proprietorships, are deleted within 3 years after the last mention in the sources (see below)
   • a period of 10 years applies.

   These retention periods are linked to the customary retention periods in economic transactions, such as retention periods under Know Your Customer legislation, contractual claims, and the retention period for accounting and tax documents.

   These are, moreover, data of persons/mandate holders who are no longer active. Active entries (in other words, persons who are still economically active and who appear on our platform in that context) are continuously refreshed in line with the synchronization that openthebox carries out to keep its data as up to date as possible.

   Finally, much of the data on our platform is not obtained directly from the data subjects. We use the following public sources:

   • The Crossroads Bank for Enterprises (KBO)
   • the National Bank of Belgium
   • the Belgian Official Gazette (Belgisch Staatsblad)
   • The list of mandates of the Court of Audit
   • The list of political mandates of the Agency for Home Affairs (Agentschap Binnenlands Bestuur).

   In addition, we use newspaper articles from De Tijd, L'Echo, RSS feeds from other publishers and, for certain information (for example, information about foreign establishments of companies), data from other providers of company information. Via this link to our Trust Center you can view an up-to-date list of all our sources.

   Do we process your data on our platform and would you like to exercise your right to object? Contact us at privacy@openthebox.com.

5. When you are a user of our platform We also process data of persons who use our platform to carry out searches. We do this on the basis of our interest in enabling the operation of our platform, securing the platform, monitoring for abuse and making improvements to the platform. If you use the platform as an employee of a customer of openthebox, usage data may be consulted by that customer.

   We process the following data:

   • User data such as login details, IP address, encrypted password
   • History of the use of the platform, such as searches performed and companies consulted

   We retain this data for up to 1 year after the closure of the user account, after which all user data is deleted.

With whom do we share your personal data?

In principle, we do not share your personal data with anyone other than the people who work for us and the suppliers required for the management of our systems and services. Specifically for the information on our platform, we share it with our customers and platform users.

Furthermore, we may share data with government or judicial authorities insofar as we are obliged to send them your personal data (e.g. the tax authorities, the police or law enforcement) and with parties involved in a financial transaction of openthebox in the event of a sale of (parts of) the organization.

We do not transfer your personal data outside the European Economic Area, except where one of our suppliers or partners is established outside the European Economic Area. We will only transfer your personal data outside the EEA after we have taken appropriate measures to protect your personal data when it is transferred (e.g. by means of standard contractual clauses as drawn up by the European Commission).

Your rights regarding the processing of your personal data

The legislation on personal data provides various rights to people whose data is processed. These rights naturally also apply when we process your data. They are the following rights:

• The right to withdraw your consent at any time, if the processing of your data is based on consent.
• The right of access to your personal data, which means that you can ask us to provide you with information about the personal data we hold about you. You can even request a copy of your personal data.
• The right to rectification of inaccurate data.
• The right to have data erased, for example when it is no longer necessary for the purposes described in this privacy statement.
• The right to restrict the processing of certain data.
• The right to data portability when your data is processed on the basis of your consent or in the context of a contract.
• The right to object to the processing of your data.

Finally, you have the right to lodge a complaint with a data protection authority. In Belgium, this is the Data Protection Authority, and you can find other authorities via this link.