Personal Data Protection Policy

---

01. General information

Freedelity is an IT solutions and services company, providing support for the collection, updating and management of certain personal data (hereinafter “Data”).

By centralizing Data and keeping it updated, Freedelity helps its clients to meet their legal obligation to rectify incorrect personal data and keep it up to date.

Freedelity clients (hereinafter “Clients”) are primarily major retail chains and other companies seeking to develop relationships with and personalized services for their customers (you) while meeting all regulatory requirements in terms of Data protection and processing. Freedelity Clients may also be companies that specialize in the analysis and processing of personal data for marketing purposes, to verify or improve the quality of personal data, or to conduct market research.
Every Freedelity Client is also the data controller for certain processes and certain personal data. Freedelity can intervene with some types of processing as the data controller for your Data, and with other types of processing as the Clients’ data processor.

Freedelity Clients’ personal data protection policies also explain how Freedelity Clients process your Data. We recommend reviewing their individual documentation for this purpose.

Freedelity places the highest importance on protecting your Data in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as well as the Belgian Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

The purpose of this personal data protection policy is to explain how your Data is collected, used, stored, protected and made available to our Clients and to you.

You can access your Data at any time, and manage both its content and its use (management of consents and preferences), through the www.myfreedelity.com portal or the mobile application MyFreedelity. Freedelity provides you with direct, complete and immediate control over how your Data is used by each Client and by Freedelity, and/or allows you to view your rewards and benefits with each of our Clients.

If you have any concerns, questions or problems concerning the manner in which we use your Data, please contact our Data Protection Officer (DPO): dpo@freedelity.be

---

02. Why do we process your Data?

Freedelity collects personal data for several purposes. The processing purposes as determined by Freedelity are founded on specific legal bases.

These legal bases are as follows:

1. We obtain your consent to collect some of your personal Data.
2. We also carry out certain types of processing that are required in order to fulfill the contract that you enter into by using the MyFreedelity portal or application.
3. Lastly, we carry out certain types of processing that are necessary for our legitimate interest.

Please see section five of this data protection policy for further details.

---

03. How is your Data collected?

Your Data is collected:

1. By our Clients
1. by reading your eID card via an eID reader, a kiosk on Clients’ business premises or another type of terminal, filling out a form, or placing an order on an ecommerce website. For people without a Belgian eID card, or those who prefer not to use their eID cards, the same Data can be entered manually on a kiosk screen, either by you or by Freedelity Client personnel based on the information you provide to them.
2. via a direct transfer of Data from our Clients.
2. By Freedelity, via the MyFreedelity platform or application, or any other method that Freedelity may implement, including cookies (or other technical methods with a similar effect) integrated into emails and other digital interfaces.
3. By Freedelity, through saving the Data you provide to us as part of your voluntary registration for the Freedelity data management program (“Freedelity File”) set up by Freedelity.

---

04. Which Data do we collect and use?

Freedelity processes your Data as the data controller for the purposes and on the legal bases described in section 5 of this policy. This personal Data is categorized as follows:

1. Identification Data: last name, first name(s), gender, place and date of birth, nationality, home address, ID card number, city in which the ID card was issued, validity date of the ID card, and the history of this data
2. Contact Data: your email address, home/mobile phone number and the history of this data
3. Personal life: lifestyle habits, behavioral data, family situation, language preferences
4. Economic and financial Data: revenue, financial situation, bank data
5. Login Data: IP addresses, logs, login identification (username and password), date on which your profile was created, information concerning the sending of the email confirming your Freedelity File registration, the date of your last visits to the MyFreedelity portal and application
6. Localization Data: movement, GPS data, geographic coordinates, zone/street/address/building/street section coding and geomarketing type
7. Internet: cookies, tracers, browsing data, audience measurement, behavior related to email use
8. Other categories of data: returned mail and undelivered emails
9. Data from authentic sources

On the MyFreedelity portal and mobile application, you can access other information specific to your interactions with each Client (for example, receipt details or purchase and communication history). Freedelity doesn’t process this data for its own use, but for the use of its Clients. This means that Freedelity acts as a data processor. As such, we respect current regulations in terms of data protection, and, specifically, we can help you with exercising the rights you have as the data subject. You will find more information about this data, this processing and their purposes in the personal data protection policies of the Clients in question.

---

05. Why and how is the Data utilized?

We process your Data in order to manage the Freedelity File.






If you use our MyFreedelity portal or application, we process your data for the following purposes:






We also process your data as part of our marketing strategy, for the following purposes:






In addition, we hold a PSD2 license. Your bank has the right to transmit your economic and financial Data to authorized third parties such as our company so that payment services can be provided to you.

From that point on, if you choose to share your economic and financial Data with us, we will process your Data for the following purposes:

---

06. Data transfers

Your Data may be transferred to third parties, namely:

1. Authorized personnel at Freedelity
2. Freedelity Clients
3. Freedelity data processors

Additionally, and as mentioned in the purpose table, your data may be used to improve the accuracy and quality of other companies' consumer files, including through the use of companies specializing in database management. For this purpose, your data is currently also being transferred to:

1. EDM Belgium (Heizel Esplanade Heysel PB 27, B-1020 Bruxelles - You can find more information regarding the processing of personal data by EDM Belgium on https://edmmedia.be/privacy-statement) ;
2. Black Tiger Belgium SA (Allée de la Recherche 65, 1070 Bruxelles - You can find more information regarding the processing of personal data by Black Tiger Belgium on https://rgpd.blacktigerbelgium.tech).

All of these parties must follow the applicable regulations in terms of data protection, particularly your rights as a data subject, and they must respect the contractual provisions that exist to ensure a high level of security.

Certain public authorities have the right to review or request part of your Data. We are obliged to cooperate in such cases.

---

07. Direct marketing

We process your personal Data for various processing purposes related to marketing. For more information about these purposes and their legal bases, please see section five of this policy.

We offer our Clients direct marketing services (promotion of their brand, invitations to events, notifications of offers, announcements of sales or discounts, etc.), for example, by carrying out socioeconomic segmentation, geolocalization, inferring additional Data or adding statistical elements.

This processing of your Data for marketing purposes can be done by regular mail, email, phone, text message or through the MyFreedelity application or portal.

You can manage your related preferences directly via the MyFreedelity application or portal.

You can object to the processing of your Data for prospecting purposes at any time.

For more information about exercising your rights, please see section 10 of this policy.

---

08. How long do we store your Data? 

The retention period for your Data varies, depending on the reasons for processing determined by Freedelity.

For management of the Freedelity File, the retention period is initiated by an “activity.” The Data is then considered “activated.”

1. Making a purchase from one of our Clients, or a registration or update of your Data at your request or through the update interfaces provided by our Clients
2. Reading the data on your eID card, or updating your Data via a kiosk or an application at one of our Clients’ locations
3. Using the MyFreedelity portal or application
4. Opening an email sent through our platform
5. Using/contacting our support service

---

09. How do we safeguard your personal data?

Your Data is stored on secure servers in accordance with state of the art and technology standards. When we work with other parties, such as our subcontractors, we require the same level of security from them.

Appropriate security measures, verified by the relevant independent agencies, have been implemented in compliance with the relevant provisions of the applicable European Regulation on this subject and adhering to best practices, in order to avoid any destruction, loss, alteration, unauthorized disclosure of or access to your personal data.

However, despite the many safeguards implemented by Freedelity, we can never fully guarantee the safety and security of your data.

---

10. Where do we store your data?

The Data is stored on secure servers located within the European Union or other locations that offer a sufficient and appropriate level of data protection, in accordance with the recommendations of the European Commission or legislation, so that the level of protection of natural persons required by the General Data Protection Regulation is never compromised.

---

11. What’s the best way to contact us to exercise your rights?

You have the following rights:

The right of access

You have the right to receive confirmation that the Data concerning you is being processed by Freedelity, to ask us about the Data we have about you, and to receive a copy of your Data.

The right to rectification

You have the right to rectify your Data if it is incorrect, and to complete any of your Data that is incomplete.

The right to object

You have the right to object to any use of your Data when the processing is based on our legitimate interest.

The right to limit processing

You can ask us to limit processing of your Data, in accordance with the applicable legislation regarding Data protection.

The right to be forgotten or to erasure

You have the right to ask us to delete your Data, if you find yourself in the conditions specified in the applicable Data protection legislation, unless we are required by law to retain certain data.

The right to withdraw your consent

You have the right to withdraw your consent to any processing carried out based on that consent, at any time, without justification and without the withdrawal calling into question the legality of any processing carried out while your consent was still active.

The right to Data portability

You can ask to receive your Data in a machine-readable format, or ask that your Data be transferred to another data controller of your choice. For intellectual property purposes, you will receive an unstructured (flat) file containing your Data.

If you choose to exercise your Data use rights, you may do so at any time by logging into your personal space on the MyFreedelity portal or mobile application.

If you haven’t requested access to the MyFreedelity portal or application, email privacy@myfreedelity.com and attach a proof of your identity to your request. You can also mail your request, along with proof of your identity, to Freedelity SA, Rue du Bosquet 8, bte 6, 1400 Nivelles, Belgium. Make sure you clearly state the right you wish to exercise.

Please note that Freedelity also acts as a data processor for some of its Clients. As such, you may be able to see certain data on the MyFreedelity portal or application that is not processed by Freedelity as the data controller, but as the data processor (for example, purchase receipts, purchase history analyses, etc.). If requests to exercise one of your Data rights are received, Freedelity may respond to those requests, in compliance with the processing agreement entered into between Freedelity and its Clients, acting as data controllers, as well as the General Data Protection Regulation. Freedelity may also pass your request on to the Client, so that the two can work together to satisfy the request.

In addition, when you use the MyFreedelity portal or application to exercise control over the processing of your Data by Clients, Freedelity automatically transmits your instructions to the Client. It is the Client’s responsibility to implement the instructions in its own systems (by deleting your Data from its systems, for example), in accordance with the Client’s own personal data processing policy. In this situation, Freedelity only acts as an intermediary, centralizing the information, ensuring transparency and allowing you to transmit instructions to Clients.

Any complaints about Freedelity’s processing of your Data can be addressed to the Belgian Data Protection Authority at: Autorité de protection des données, rue de la Presse 35, 1000 Bruxelles, Belgium / +32 (0)2 274 48 00 / contact@apd-gba.be.

---

12. Updates to this Policy

Our solutions and services are constantly evolving to continue providing you with the best possible support and service. That’s why we make regular changes to this Personal Data Protection Policy, to ensure that it reflects our current Data processing practices. We do our best to draw your attention to these changes. Nonetheless, we ask that you consult the Personal Data Protection Policy regularly. In other words, it is also your responsibility to keep yourself informed about any changes.

The most recent modifications to this Personal Data Protection Policy were made on 17th december 2021.