This privacy notice (“Notice”) explains why Koramic Investments NV (“Koramic”, “we”, “us”, “our”) processes your personal data when you:

1. visit our website (“Website”, [www.koramic.be]) or social media and contact us by phone, email or other communication channel;
2. doing business with us;
3. apply for a position with us;

and what rights you have in relation to these processing activities.

1.         Use of cookies and similar technologies

When you use our Website, you will notice that we use cookies and similar technologies. Such technologies cause information to be placed on your device or collect information that was already on your device. In principle, the cookies we use are all necessary for the use of our Website and to the extent that personal data are processed, we invoke our legitimate interest to provide a user-friendly Website. This information is only shared with the IT suppliers that help us with our Website and is only kept for the duration of your visit.

However, we also use statistical cookies placed by Google (Analytics Tools & Solutions for Your Business – Google Analytics). Limited, pseudonymised personal data, such as part of your IP address, will be shared with Google. For this, we ask for your consent. You can withdraw your consent at any time. To do so, it suffices to delete the Google Analytics cookies. In any case, the cookies will remain stored on your device for 1 year. You also enjoy all applicable rights regarding the processing of your personal data as further explained in this Notice.

2.         Who is responsible and for what?

1. Koramic Investments NV, a company incorporated under Belgian law, having its registered office at 8500 Kortrijk, Belgium, Kapel ter Bede(Kor) 84, registered under no. 0405.371.512, VAT number BE0405.371.512, at the RPR in Ghent, Kortrijk division, is responsible for the processing of your personal data as described in this Notice.
2. If you have any questions about the processing of your personal data as described herein or the contents of this Notice, please contact us by e-mail at privacy@koramic.be
3. We reserve the right to amend, supplement or revise this Notice in our sole discretion and from time to time. We will notify you of such amendments, additions or revisions via the Website before such amendments, additions or revisions become effective. If we rely on your consent to process your personal data, to the extent the amendments, additions or revisions relate to processing based on your consent, you will be explicitly asked to consent with the amended, supplemented or revised Notification before the amendments, additions or revisions apply to our processing of your personal data.
4. Regardless of your capacity under this Notice (website visitor or social media page, job applicant, customer or supplier), we will always process your personal data for the following purposes:
   1. to prepare and execute business transactions such as mergers, acquisitions or demergers, for which we rely on our legitimate interest to enter into such transactions;
   2. to comply with legal obligations;
   3. to comply with any reasonable request from authorised officers or representatives of the police, judicial authorities, government agencies or bodies, including competent data protection authorities, for which we invoke our legal obligations;
   4. to transfer your personal data to the police or judicial authorities on Koramic’s initiative in the event of reasonable suspicion of an illegal act or offence on your part, or to use it in legal proceedings or other forms of dispute resolution by way of evidence, for which we invoke our legitimate interest to defend our interests.

3.         You visit our Website or social media pages or contact us by phone, e-mail or other communication channel

1. Every time you visit our Website, we collect technical information related to the device you use, such as your IP address and browser type.

Such information is also collected when you visit our social media pages, but then the social media service provider is responsible for this collection. Please visit the privacy notices of these social media providers for more information on how they process your personal data.

This personal data will be kept for a maximum of six months.

2. When you contact us by phone, e-mail or other communication channel, we collect:
   1. the basic identity data you provide to us, such as name, e-mail address, postal address, phone number, company you work for, your job title;
   2. the content of your communication and the technical information of your communication (the person with whom we communicate from our side, the date and time, etc.).
   3. your preferences regarding the receipt of our e-mail communications;
   4. any other personal data you provide to us.
3. We receive all the above personal data directly from you.
4. Koramic processes your personal data when you communicate with us by phone, email or any other communication channel for the following purposes:
   1. answer your questions, requests or other communications;
   2. provide you with information on our products, services and activities;
   3. keep our website, social media pages, company, employees, assets and information safe;
   4. make statistical analyses on the use of our communication channels;
   5. improve our services or business processes or develop new products or services.

For all the above purposes, we rely on our legitimate interest to process your personal data to conduct normal business communications and communicate about our services and activities, to understand how our communication channels are used and to develop us as a company.

Your personal data will be kept for as long as necessary and useful in the light of the communication carried out.

4.         You do business with us

1. In addition to interactions we may have with you as a result of your use of our website, social media pages or communication via email, phone, fax or chat, we also receive personal data directly from you or the company you work for when you do business with us. This includes the following data:
   1. Your basic identity data such as name, e-mail address, postal address, phone number, company you work for, your job title;
   2. the content of your communication and the technical information of your communication itself (the person communicating from our side, the date and time, etc;)
   3. payment- and invoice-related data.
2. Koramic processes your personal data in order to:
   1. process orders;
   2. normal relationship management;
   3. carry out normal internal management reporting activities.

For the first purpose, we process your personal data because it is necessary to come to an agreement with you and execute that agreement. If you represent a business, we rely on our legitimate interest to process the contact details of the people representing our business relations. For the other two purposes, the processing is based on our legitimate interest to engage in normal business operations and relationship follow-up. Your personal data will be kept for the entire duration of the business relationship and for ten years after it ends.

5.         You apply for a position with us

1. When you apply for a job via e-mail, we collect and process the following categories of personal data:
   1. your basic identity data (e.g. name, e-mail address, postal address);
   2. The content of your communication and the technical details of the communication itself (which of us you correspond with, the date, time, etc.);
   3. any attachments you send us, such as your CV and all the contents of your CV.
2. Koramic processes your personal data in order to:
   1. process your application;
   2. inviting you for an interview, if necessary;
   3. to possibly enter into an employment contract;
   4. To establish a recruitment reserve.

For the first three purposes, we process your personal data because it is necessary to reach an agreement with you. If you are not retained and do not wish to be included in the recruitment reserve, we will keep your personal data for six months for evidential purposes and it will then be deleted. If you are withheld, the employee data retention periods will apply.

For the latter purpose, we will ask for your consent, which you may withdraw at any time. If you consent, we will keep your personal data in our recruitment reserve for one year.

6.         Recipients of personal data

1. We will share your personal data within the Koramic group to which we belong, as well as with our service providers (e.g. IT service providers, legal advisers, accountants, banks, insurers, etc.). and with public authorities to the extent necessary for the purposes set out above. In any case, we guarantee that your personal data will be processed by the entities within our group in accordance with this Notice.
2. If you use our social media pages, your personal data will also be processed by social media service providers. More information on how they process your personal data can be found in their respective notices, as explained above.
3. In principle, your personal data is not transferred outside the European Economic Area. Should this nevertheless happen, we take the necessary measures such as the European Commission’s Standard Contractual Clauses to ensure that your personal data is protected outside the European Economic Area as well.

7.         Quality guarantees

1. Koramic will only process those personal data necessary for the purposes listed in the Notification.
2. Koramic will take appropriate technical and organisational measures to protect your personal data against unauthorised access or theft and against accidental loss, alteration or destruction. Only the staff of Koramic, its affiliated companies or its external processors who need to know about your confidential data have access to this data and are subject to strict confidentiality obligations. However, you understand that safety and security are only best-efforts obligations that can never be guaranteed.

8.         Your rights

1. Right of access – You have the right to request access to any personal data processed by us that relates to you. To grant this request, you must explain which data you want access to. We reserve the right to charge an administrative fee for multiple consecutive access requests that are clearly made due to inconvenience or damage to us.
2. Right to correction – You have the right to request that your personal data that is incorrect be corrected free of charge. If a request for correction is made, it should be accompanied by proof of the erroneous nature of the data for which correction is requested.
3. Right to erasure – You have the right to request that your personal data be deleted if it is no longer necessary in light of the purposes described above or if the processing would be considered unlawful. However, you should note that we will weigh a deletion request:
   1. against our overriding interests or those of a third party to the extent permitted by law;
   2. against legal or regulatory obligations or government or court orders that may conflict with such removal.

Instead of deletion, you can also request that we restrict the processing of your personal data if (a) you contest the accuracy of those data, (b) the processing is unlawful or (c) the data are no longer necessary for the purposes outlined above, but you need them to defend yourself in legal proceedings.

4. Right to oppose – You have the right to oppose the processing of personal data, but you must explain the serious and legitimate reasons related to your specific circumstances that justify such an opposition. This explanation is not necessary when you oppose the processing of your personal data for direct marketing purposes.
5. Right to data portability – You have the right to request a copy of the personal data you have provided in a structured, commonly used, machine-readable format.
6. How to exercise your rights – If you wish to make a request to exercise one or more of the rights listed above, please send an email to privacy@koramic.be for all matters relating to data subjects’ rights. An e-mail requesting to exercise a right should not be interpreted as consent to the processing of your personal data beyond what is necessary to process your request.

Such a request must clearly state the right you wish to exercise and the reasons for doing so, if required by law. It should also be dated, signed and accompanied by a digitally scanned copy of your valid ID card proving your identity. We ask this to prevent unauthorised persons from abusing your rights.

We will immediately inform you of the receipt of this request. If the request proves to be valid, we will notify you as soon as reasonably possible and no later than thirty (30) days after receipt of the request.

If you have a complaint about our processing of your personal data, you can always contact us at the e-mail address mentioned in the first paragraph of this article. If you are not satisfied with our response, you can complain to the competent data protection authority, namely the Belgian Data Protection Authority (https://www.gegevensbeschermingsautoriteit.be).