Privacy Policy

Bench BV is a private limited liability company organised under Belgian law, with registered office at Frankrijklei 5/401, 2000 Antwerp, with company number 1040.534.143 and bank account number BE71 0020 3595 9369, reachable via info@bench.be, www.bench.be (hereinafter referred to as "Bench").

Who are we?

This privacy policy (hereinafter the "Privacy Policy") describes certain of our personal data processing activities as a Controller according to the applicable Belgian and European data protection legislation (including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("GDPR"), as well as the related legal and regulatory provisions regarding personal data protection).

If you have any further questions about this Privacy Policy, your privacy and/or the processing of your personal data, please contact us by sending an e-mail to info@bench.be.

What should I know before reading this Privacy Policy?

This Privacy Policy aims to inform you about how Bench collects and processes your personal data, describes your rights and the way in which you can exercise them. Please read this Privacy Policy carefully.

You are typically:

• a visitor of our website (accessible via www.bench.be or any other domain name redirecting the surfer towards this website) ("Website");
• a supplier/service provider of Bench;
• a client to which Bench provides services as described in the General Terms and Conditions (available on the Website or on request);
• a prospective client and/or supplier/service provider with whom Bench is engaging in discussions regarding the provision of services;
• anyone who reaches out to Bench by the contact form on the Website, e-mail, phone, chat, or through social media (such as LinkedIn).

Bench reserves the right to modify this Privacy Policy at any time. Any changes we make will be indicated on the Website and, when proportionate and in line with the significance of the changes, may be notified to you by e-mail or brought under your attention on your next Website visit. Please review this Privacy Policy periodically to stay informed of changes that may affect you.

For which purpose do we process your personal data, on which legal basis and for how long?

Bench processes personal data for the purposes and on the legal basis specified in this section (if and to the extent applicable to your situation). This list may evolve and will be updated as necessary.

Bench processes different types of personal data; this depends on the functionalities you use on our Website and on the personal data you share with us.

Identification and contact details shall include personal data that allows us to identify and contact you, such as name and first name, phone number, e-mail address, company name/address, job title, company registration and VAT number.

Technical information shall include personal data required to use our Website, for the proper functioning of our Website and for analytical purposes, such as:

• technical information about your computer, mobile and other devices used to visit our Website (such as your IP address, what type of device it is, application ID, operating system, crash data, browser type and configuration) — whether we collect some or all of this information often depends on what type of device you are using and its settings;
• geo-location information — precise GPS location from mobile devices is collected only with your permission. Wi-Fi and IP addresses received from your browser or device may be used to determine approximate location;
• information regarding your usage of our Website automatically recorded by our servers (such as website history, logs, date, time, language preferences, frequency, duration of the pages you have viewed); and
• information regarding consent(s) given by you (such as the date and time of your consent, the user agent, IP address, unique device identifiers or user ID).

Responding to requests

Purpose

• To respond to requests (e.g. submitted via the contact form on the Website, e-mail or social media, etc.)

Type of personal data

• Identification and contact details
• Technical information
• Any accompanying message and/or information you share with us via the relevant contact form on our Website or another medium

Legal basis

• Consent

Retention term

• As long as necessary to contact you as part of the performance of the contract (including as long as necessary to answer your request)

Data subject

• Anyone who contacts Bench through the aforementioned methods

Operation of our Website

Purpose

• To use our Website
• To ensure the proper functioning of our Website
• To allow us to keep evidence of particular consents you have provided to us, where relevant
• To protect the security of our systems and of your personal data to our best efforts, e.g. by creating a back-up

Type of personal data

• Technical information

Legal basis

• Legitimate interest

Retention term

• The retention period varies from as long as the duration of a session/Website visit, to as long as necessary for Bench's legitimate interests

Data subject

• Website visitors

Business administration

Purpose

• To manage our client contracts and handle the client's case
• To manage our supplier and service provider contracts
• Communicate and negotiate with prospect clients, suppliers and service providers
• To execute our business administration (e.g. invoicing, tax administration)
• To manage questions/complaints about our services
• To inform clients, supplier/service providers about changes brought to our prices and contractual documents
• To analyse and improve our services based on feedback received

Type of personal data

• Identification and contact details
• Any additional information you share with us (e.g. in relation to the client's case)

Legal basis

• Legitimate interest
• Performance of a contract (or taking steps prior to contract conclusion)

Retention term

• Up to ten (10) years after the expiry or termination of our client relationship
• As long as necessary for Bench's legitimate interest(s)

Data subject

• (Contact persons/personnel of) clients, suppliers, service providers and prospects

Direct marketing

Purpose

• To send promotional e-mails and newsletters to our existing clients and prospects, suppliers and service providers about our services, Christmas cards, invitations for events and other information which we think might interest them

Type of personal data

• Identification and contact details

Legal basis

• Consent
• Legitimate interest (RD 4 April 2003)

Retention term

• Personal data obtained for direct marketing purposes will be deleted as soon as you withdraw your consent

Data subject

• Existing clients and/or prospects, suppliers and service providers

You shall have the right at any time to object to the processing of your personal data for direct marketing purposes, including profiling, to the extent that it is related to such direct marketing, free of charge, by sending an e-mail to info@bench.be.

Recruitment of new personnel

Purpose

• To hire new personnel through the contact form or the designated e-mail address (info@bench.be)

Type of personal data

• Identification and contact details, including your CV
• Any additional information you share with us in relation to your job application

Legal basis

• To take steps at your request prior to entering into a contract
• Legitimate interest

Retention term

• As long as necessary to contact you as part of the hiring process
• As long as necessary for Bench's legitimate interest(s), including business development and HR reasons

Data subject

• Job applicants (Website visitors)

Adherence to our legal obligations and exercise of legal rights

Purpose

• To comply with our legal obligations
• To cooperate with any ongoing judicial investigation, court order or lawsuit, or any other request from an appropriate judicial authority, or its representatives
• To file a report to the police on our own account if we have founded suspicions that the use you make of our services constitutes a legal breach
• To protect our and/or the rights of third parties
• To respond to requests from data subjects

Type of personal data

• Identification and contact details
• Any accompanying message and/or information you have shared with us
• Other types of personal data, depending on the legal obligation concerned

Legal basis

• Legal obligation
• Legitimate interest of defending or enforcing our rights

Retention term

• Up to ten (10) years after the expiry or termination of our relationship
• As long as otherwise required by law

Data subject

• Clients, Website visitors, and any individuals whose personal data is processed in the context of legal obligations or proceedings

Corporate restructuring

Purpose

• To organise Bench's corporate restructuring as the case may be, including any merger or acquisition, fusion, (financial) restructuring, sale of shares/assets, etc.

Where possible, Bench shall aggregate and/or de-identify such personal data prior to sharing.

Type of personal data

• Identification and contact details
• Any accompanying message and/or information you have shared with us
• Other types of personal data, depending on the context

Legal basis

• Legitimate interest

Retention term

• As long as required to carry out the purpose

Data subject

• Clients, suppliers, service providers, Website visitors, prospects

For certain processing purposes, Bench requires your consent. The consent you give is always free and you have the right to withdraw it at any time. You can withdraw your consent by sending an e-mail to info@bench.be. Your withdrawal of consent does not affect the processing of personal data prior to such withdrawal or our processing activities which are based on any other legal basis.

To whom do we send your personal data?

Bench may share your personal data, as required for carrying out the purposes described in the previous section, with:

• third party service providers (such as IT service providers, security providers, payment procurement providers, independent contractors, marketing service providers, or hosting providers);
• counterparties and their (legal) advisors;
• bailiffs, court officials and judges and anyone else working there or being appointed in the context of litigation (e.g. expert, curator);
• Bench's own professional advisers (such as accountants, lawyers or auditors); and
• third parties to whom we intend or choose to sell, transfer or merge (parts of) our shares, business or assets.

In addition, we may disclose your personal data if this is required by law, or if we determine in good faith that such disclosure is required in order to comply with any pending judicial or administrative inquiry, judicial order or litigation and/or to safeguard our rights.

(Sub-)processors of Bench always act under the responsibility of Bench. If Bench engages (sub-)processors, this will always be done in accordance with a data processing agreement that meets the requirements of the GDPR. We require all our (sub-)processors to take appropriate technical and organizational (including security) measures to protect your personal data in line with our policies. We do not allow our (sub-)processors to use your personal data for their own purposes.

Do we transfer your personal data to third countries?

In principle, your personal data will be processed within the European Economic Area ("EEA").

However, Bench might transfer your personal data to third countries located outside the EEA, e.g. if you are located outside the EEA and are visiting our Website from outside the EEA. It is also possible that Bench — through its (sub-)processors — does transfer your personal data to countries outside the EEA. Bench will only transfer your personal data to recipients outside the EEA in accordance with the applicable data protection legislation and subject to appropriate safeguards (e.g. an adequacy decision of the European Commission or contractual guarantees, such as EC standard contractual clauses).

Please contact us if you want further information on the specific mechanism(s) used by us when transferring personal data to recipients established outside of the EEA.

How long will we retain your personal data?

Your personal data will only be processed as long as necessary for the purposes outlined above to be fulfilled, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements, or, if applicable, until the moment you withdraw your consent, or as otherwise indicated above. The withdrawal of your consent may imply that you will not be able to use all or part of our Website.

We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect of our relationship with you or the organisation you work for. Afterwards it is still possible that they can be found in our back-ups or archives, but they will no longer be actively processed in a file.

For more details about the retention periods, you can always send an e-mail to info@bench.be.

What security measures does Bench undertake?

Bench is committed to trying to make sure that your personal data is secure and makes all reasonable and appropriate efforts to protect the confidentiality of your personal data. We have implemented appropriate technical and organizational measures, safeguards and assurances to process your personal data in accordance with the GDPR, in particular to protect your personal data against loss, misuse, or unauthorized alteration or destruction, taking into account the sensitivity of the information we collect, process and store, the industry's best practices and the current state of technology.

Despite the above measures taken by us, you should be aware that there are always risks associated with sending personal data over the internet. The security and protection of your personal data can never be fully guaranteed, nor can we guarantee that unauthorized third parties will never be able to defeat those measures or use your personal data for improper purposes.

What are my rights under GDPR?

You have the following rights under GDPR:

Access right. You have the right to be informed of whether we process your personal data, and if that is the case, to have access to such personal data.

Right of rectification. You have the right to have your inaccurate and/or incomplete personal data corrected.

Right to erase data. You have the right to have your personal data erased, under certain circumstances, namely when one of the following applies:

• if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• if you withdraw your consent on which the processing is based, and there is no other legal ground for the processing;
• if you object to the processing in case the processing is for direct marketing purposes;
• if the personal data have been unlawfully processed; or
• if the personal data have to be erased for compliance with a legal obligation in EU or national law.

In case you submit a request in this regard, we shall consider:

• our interests and those of third parties, which may count more than yours, and
• all legal and regulatory obligations, or court or administrative decisions which may be in contradiction with the erasure of your personal data.

Right to restriction of processing. You have the right to restrict the processing of your personal data, if one of the following applies:

• if you contest the accuracy of the personal data, for a period enabling Bench to verify the accuracy of the personal data;
• if the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead; or
• if Bench no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims;
• if you objected to the processing pending the verification of whether Bench's legitimate interests override yours.

Right to object. You have the right to object to the processing of your personal data where the processing of your personal data is based on points (e) and (f) of Article 6(1) of the GDPR, including profiling based on those provisions. Bench shall no longer process the personal data unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

Right to data portability. You have the right to data portability, i.e. you can obtain from us all the personal data you supplied us in a structured format, currently used and readable by machine, if your personal data is processed by automated means and based on your consent or on a contract concluded with you.

Right to withdraw consent. If the processing of your personal data is based upon your consent, you always have the possibility to withdraw your consent, as mentioned above.

If you wish to exercise one of the aforementioned rights, you may submit a request to us by sending an e-mail to info@bench.be. We shall acknowledge receipt of your request and provide you with more information on action taken on such request without undue delay and in any event within one month of receipt of the request. This period may be extended by two further months where necessary, taking into account the complexity and number of the requests and informing you of the reasons for the delay.

We shall provide such information free of charge. However, if your requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may either:

• charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or
• refuse to act on your request.

How do I contact Bench and how do I file a complaint?

If and to the extent provided for in the applicable data protection legislation, you have the right to lodge a complaint before the competent supervisory authority should the processing of your personal data violate the applicable regulations. In Belgium the competent authority is the Data Protection Authority ("Gegevensbeschermingsautoriteit"/"Autorité de Protection des Données"):

Gegevensbeschermingsautoriteit / Autorité de Protection des Données
Drukpersstraat 35, 1000 Brussel
Tel: +32 (0)2 274 48 00 or e-mail: contact@apd-gba.be

We would, however, appreciate the chance to deal with your concerns before you approach the authority, so please contact us in the first instance at info@bench.be.

Is Bench responsible for third party links on the Website?

We are not responsible for the privacy, information or other practices of third parties, including third parties who operate a website to which our Website contains a link. Including a link on the Website does not mean that we endorse the linked website.

To what extent can I hold Bench liable under this Privacy Policy?

To the maximum extent permitted by applicable law, Bench shall not accept any liability in the following events:

• if Bench has lawfully shared your personal data with a third party (not being its (sub-)processor), it shall not be liable for any subsequent unlawful processing or misuse of that personal data by such third party and any direct or indirect damages resulting therefrom;
• if third parties unlawfully process or use your personal data and Bench has implemented appropriate technical and organizational measures to prevent, to the best of its abilities, such unlawful processing or use (e.g. in the event of hacking or any other cyberattack).

In any case, Bench shall only be liable for damages caused by non-compliance with its specific obligations under the GDPR. Bench shall in no event be liable for any special, incidental, indirect or consequential losses or damages in this regard.

What is the applicable law and competence under this Privacy Policy?

This Privacy Policy shall be governed, interpreted, and implemented in accordance with Belgian law. The Antwerp courts (division Antwerp) are exclusively competent to decide on any dispute that may arise from the interpretation or implementation of this Privacy Policy.