Privacy Policy Website - Cardoen

The protection of your personal data is of utmost importance to DATOS plc (referred to below as ‘Cardoen’). This privacy policy describes the measures we take to ensure the protection of your personal data in accordance with the European General Data Protection Regulation (GDPR). This explanation aims to provide you with clear information about how we take care of your personal data, what personal data we collect from you and why we do this. This privacy policy applies to all services offered by Cardoen, such as newsletters, online reservations, online purchases, maintenance, contact requests via the website, car purchases via our branches, financing requests, insurance requests and promotional offers.

DATOS plc (Cardoen) with its registered office in 2610 Antwerp, registered under the VAT number BE 0425.303.824, is the data controller for the processing of personal data in the various processes and systems applicable or in use within Cardoen.

As data controller, Cardoen takes the necessary technical and organizational measures to protect your personal data. These measures apply to all systems, employees and processes that form part of Cardoen’s information systems.

Cardoen’s activities are specifically focused on offering passenger cars.

‘Personal data’ refers to any information about an identified or identifiable natural person.

Cardoen collects and processes various personal data relating to you when you reserve or purchase a car through our website or one of our branches. If you fill out a contact request on our website, Cardoen will also process your personal data. Likewise, when servicing your car or taking over your old car, Cardoen will process personal data relating to you.

Cardoen processes the data you provide, including the following personal data (this list is not exhaustive):

• Personal identifying data: name, date of birth, address, e-mail, telephone number, mobile number, language, gender, national register number, copy of ID card, copy of driver’s license
• Company data: company name, company address, legal form, company number
• Financial data (if applying for financing): salary information, bank account number
• Technical data: chassis number, number plate, mileage
• Electronic identification data: IP addresses, cookies

The personal data we collect are adequate and relevant for our purposes. We limit our collection of your personal data to the minimum amount required for the purposes for which we process the personal data. Cardoen neither collects nor processes so-called sensitive personal data, such as data relating to your racial or ethnic origin; your political, religious or philosophical beliefs; your life and/or sexual orientation; and your health. Should we ever need to process such data, we will only do so with your explicit consent and for purposes made clear to you in advance, or if such processing is necessary in order to assert a legitimate interest.

Cardoen collects personal and/or company data to offer services and products to potential and existing customers.

Cardoen needs this data to carry out normal business operations and perform services. In accordance with the GDPR, this can be based on:

• A legitimate interest
• A contractual agreement
• A legal obligation to be met by Cardoen
• Consent, if required by the processing
• A vital interest

The personal data will only be used for the following purposes:

• To reserve and/or purchase a car through our website
• To request a quote and/or purchase a car through one of our branches
• To apply for financing when purchasing a car
• To apply for insurance when purchasing a car
• Cardoen takes over your old car
• Billing
• Car maintenance
• When you submit a contact request through the website
• When you contact our customer service (in case of complaints, questions, etc.)
• When you subscribe to newsletters
• The satisfaction survey

This can be done in several ways, including:

• Personal/telephone/e-mail contact, reception desk
• Contact forms on our website
• Open Door Days
• Offers on social media

Your data will be kept for as long as is necessary to provide our services and fulfil our purposes, but no longer than 10 years, after which time the data will be deleted or anonymized. Furthermore, as a data subject you can ask for your data to be deleted earlier, without violating the legal retention periods, also in dispute resolutions.

At no stage does Cardoen sell or rent your data to persons or companies that do not form part of DATOS plc.

Should Cardoen use an external processor (suppliers, partners, subcontractors, etc.), it will always ensure that your data is treated as confidential and used in a secure manner. The external processor will always be contractually bound to Cardoen. For example, processors will never be allowed to use your personal data at their own initiative.

Cardoen will not share your personal data with third parties, except in the following cases:

• You have given us written permission to do so
• We are legally required to do so
• The data is requested as part of a judicial investigation

In order to process your personal data, we grant our employees access to such data. We guarantee a similar level of protection by drawing up a contractual agreement between Cardoen and the employee. Employees are required to use discretion when handling such data and only have access to the data they need to perform their job. Cardoen employees are required to follow our GDPR awareness training and to keep their GDPR knowledge up to date.

The processing of your personal data does not include profiling, and you will not be subject to automated decisions by Cardoen.

Cardoen has a company page on LinkedIn, Facebook, Instagram and YouTube, among others, to inform you about its services, current topics, events, working at Cardoen, etc. You are free to decide whether or not to follow Cardoen through these social media channels.

Your personal data is considered strictly confidential. That is why we take the necessary technical and organizational measures to guarantee the security of your personal data.

Cardoen makes every effort to thoroughly secure its network against unauthorized access and to safeguard the confidentiality of its users’ personal and company data. The Cardoen website uses a reliable SSL Certificate to ensure that your personal data does not fall into the wrong hands. Data encryption during storage, firewalls and suchlike are some of the security measures Cardoen has implemented in its information systems.

As regards the organizational measures, we have a privacy statement and clear responsibilities and competences. The necessary processes and procedures are also in place to implement and monitor this policy with the utmost effectiveness.

As a data subject you have several rights, which are listed in the GDPR and include, among others:

• Right of access and inspection:

You have the right to be informed about your personal data and how we use that data, at any time, free of charge.

• Right of rectification, erasure and restriction:

You have the right to ask us to rectify or complete your personal data at any time. Furthermore, you can ask for your personal data to be deleted, but only if Cardoen no longer needs this personal data for the purposes for which it initially collected it. If legal obligations or administrative or court orders prohibit us from deleting your personal data, we will not be able to comply with your request, but we will of course inform you about this.

You can also ask us to restrict the processing of your personal data.

• Right to object:

You have the right to object, at any time, to the use of your personal data for direct marketing purposes. In such cases, you do not need to give a reason.

• Right to data portability:

You have the right to receive your personal data processed by Cardoen in a structured, commonly used and machine-readable format and/or to transmit that data to other controllers.

• Right to withdraw consent:

Where the processing is based on your prior consent, you have the right to withdraw that consent.

The consent may be withdrawn at any time, without justification and free of charge, by clicking, for example, the unsubscribe link provided for this purpose at the bottom of each promotional e-mail message and/or newsletter.

You should be aware that not all these rights can be easily invoked. In case of a refusal, Cardoen will always give reasons as to why it cannot meet your request.

Furthermore, you can exercise your rights by sending an e-mail to [email protected] or a letter to Attn: Data Protection Officer, 958 Boomsesteenweg, 2610 Antwerp. These rights can be exercised free of charge by submitting a clear request via the above e-mail address. In the request, you must specify the right you wish to invoke, providing the necessary explanations and how we can contact you.

Cardoen has a Data Protection Officer (DPO). The Data Protection Officer assists Cardoen with processing activities involving personal data. We do our utmost to handle your personal data correctly. However, if you are not satisfied with our working method, or if you have questions for our DPO, please contact us at the following e-mail address: [email protected]

You can also lodge a complaint at any time to the Data Protection Authority (DPA):

Data Protection Authority 35 Drukpersstraat, 1000 Brussels Tel: +32 (0)2 274 48 00 E-mail: [email protected]

https://www.gegevensbeschermingsautoriteit.be/burger/acties/klacht-indienen

This privacy statement may be adapted or supplemented by Cardoen as it seems necessary. We therefore encourage you to regularly consult this statement in order to stay informed about how we process and protect your personal data.

This privacy policy was last updated in September 2022.

The Dutch version of the privacy policy website will prevail over versions translated into other languages.