Privacy is very important to us. We want to inform our (potential) customers, suppliers and business partners as much as possible, and give them control over what happens with their data. Below you will find our policy on the collection, storage, use, and disclosure of your personal data.
Thermalux would like to stress that it will at any time try to act in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing of the Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as “GDPR”).
1. Scope of application
This privacy statement (hereinafter referred to as the “Privacy Statement”) shall apply to all visits to and use of the website (www.extremis.com), as well as to all (commercial) relationships (and the possible subsequent exchange of information) between Thermalux and its (potential) customers, suppliers and/or business partners.
2. Identity of the controller
Thermalux, with registered office at 2200 Herentals, Lichtaarseweg 14 and registered with the Crossroads Bank for Enterprises under number 0434.625.128 (RLE Ghent, division Ypres) (“Extremis”) is responsible for the processing of your personal data and is therefore qualified as data controller. The data controller is responsible for determining the purpose and the means (the ‘what’, the ‘how’ and the ‘why’) of the processing of personal data.
Extremis can be contacted by:
- telephone: (+32 14233613);
- e-mail:firstname.lastname@example.org; or
- contact form on the website.
Specifically, with regard to this Privacy Statement, instead of the above contact details, the following persons can also be contacted:
Mrs. Lien Sinnesael, email@example.com, Couthoflaan 20b, 8972 Poperinge, Belgium, telephone: +32 57 34 60 20.
3. What personal data do we collect?
3.1. Meaning of personal data
Personal data means all data which makes it possible to identify an individual. This includes, but is not limited to, information such as (user) name, address, e-mail address, telephone number, IP address, information about the business sector, and so on.
The kind of information that is collected depends on the context of your interactions with Thermalux, the method of contact and the information provided by you.
You will find below an overview of the personal data that may be processed by Thermalux.
3.2.1. Collected personal data
The personal data processed by Thermalux is any personal data provided by you to Thermalux when placing an orderor obtaining a quote from Thermalux, by filling in the contact form on the website (www.thermalux.be), when registering for the newsletter of Thermalux, when visiting our offices or exhibition stand, when exchanging a business card or any other form of contact (e.g. by telephone, e-mail or mail) or any personal data that is obtained through any other way, for example through a public source.
The following contact details and identification information can be requested and/or processed in this regard:
- first name;
- e-mail address;
- telephone number (landline/mobile);
- fax number;
- residential address;
- company name;
- company address;
- function and capacity;
- sex; and
3.2.2. Objective and legal basis
These personal data are collected with a view to (potential) customer and supplier management, the processing of orders and deliveries, the preparation of quotes, delivery or order forms, and the general and financial administration of Thermalux. This information may also be used for marketing purposes.
The legal basis for the processing of this personal data is the entering into or the execution of an agreement. Providing Thermalux with the abovementioned personal data is a necessary condition to contact Thermalux and, as the case may be, to conclude an agreement with Thermalux. When you do not provide this information, it is impossible for Thermalux to contact you and thus to enter into an agreement with you.
When the personal data are used solely for the communication between Thermalux (and its employees) and its (potential) customers, the legal basis for this process is the legitimate interest to create high quality customer service and product support.
When the personal data are also used for marketing purposes, such as the registration for a newsletter, the legal basis is either the legitimate interest of Thermalux to inform the existing and potential customers of similar products, or the explicit consent given by you to receive marketing information.
When the personal data are used in the context of visiting our offices, the legal basis is the legitimate interest of Thermalux for security and administrative purposes, more specifically to obtain the knowledge who has visited our premises.
If there would be any processing of special categories of personal data, the legal basis is the explicit consent of the person concerned to process this data for the specified purposes.
3.3. Job applications
3.3.1. Collected personal data
The following personal data can, in addition to the personal data mentioned under point 3.2.1. above, be requested and/or processed by Thermalux in the context of a job application:
- academic curriculum;
- professional experience;
- publications and/or portfolio;
- membership of/participation in professional organizations; and
- professional competences.
3.3.2. Objective and legal basis
In order to be able to process your application, it is imperative that you provide the personal data mentioned above to Thermalux. Failure to provide this information will result in Thermalux not being able to deal with your application.
The legal basis for the processing of this personal data is the performance of a contract as well as the legitimate interest of Thermalux to check the skills and personal characteristics of the concerned job applicant in function of the vacancy.
When the Curriculum Vitae or any other information provided by you to Thermalux would contain special categories of personal information (such as health data, information on the sexual life, political opinions, membership of a trade union…) then the legal basis for the processing is permission from you to process this information.
3.4. Website specific information
3.4.1. Collected personal data
- browser information;
- information on the operating system;
- the external website that refers to Extremis;
- pages on www.thermalux.be that you have visited; and
- date and time on which you have visited the pages on www.thermalux.be
3.4.2. Objective and legal basis
4. Objectives of the processing
The personal data mentioned under point 3 above will be processed by Extremis for the following purposes:
- (potential) customer and supplier management;
- processing of orders and deliveries (preparation of quotes, delivery or order forms);
- general and financial administration of Thermalux;
- communication with the data subject;
- to improve the quality of our service and website;
- marketing purposes, including direct marketing;
- job applications; and
- security purposes.
For each objective, the legal basis for the processing can be one of the following:
- your free consent for the processing of the personal data;
- entering into an agreement or the execution of an agreement;
- compliance with legal obligations, including GDPR; and
- a legitimate interest on the part of Thermalux, in which case we seek a balance between that interest and respect for your privacy.
We collect and use your personal data only for the abovementioned purposes, unless we receive your explicit consent to use your personal data for other purposes or unless the processing is necessary in order to comply with an obligation imposed by a regulation, a law, decree or decision.
5. Retention period
Unless a longer retention period is required or justified to comply with any applicable legal obligation, your data will not be stored longer than necessary for the purposes for which the data were collected, as described in this Privacy Statement under point ‘4. Objectives of the processing'.
6. Categories of recipients of the personal data
The processed personal data are, in accordance with this Privacy Statement, only accessible by the following parties:
- the data controller (Thermalux);
- the data subject (you);
- the data processors, whom, with a view to a specific mandate (e.g. a marketing campaign, IT service providers, commercial agent, distributor, etc.), process on behalf of the controller; and
- other third parties (our trusted partners ensuring our operability).
The abovementioned processors act exclusively under instructions from and on behalf of Extremis. Extremis guarantees the following with regard to the processing of data by these processors:
- Extremis shall close a data processing agreement with these processors in which provisions are stipulated concerning the processing of the personal data in accordance with the obligations imposed by the relevant privacy legislation; and
- the processors can solely use the data for the purposes as determined by Thermalux and in accordance with this Privacy Statement.
Notwithstanding the foregoing, it is possible that Thermalux is obligated to make your personal information public:
- to the competent authorities (i) when Thermalux is obliged to do so on the basis of the law or in the context of judicial proceedings and (ii) in order to protect and defend our rights; and
- when Thermalux or nearly all its assets are acquired by a third party, in which case your personal data will be one of the transferred assets.
7. Rights of data subjects
As a data subject you have a number of rights which you can exercise with regard to your personal data, namely:
- the right of access at the latest one month after receipt of the request: you have the right to verify what we use your processed data for;
- the right to rectification of incorrect data: you can ask for incorrect data to be corrected or for incomplete data to be completed;
- the right to oppose if you do not agree with the way in which we process your personal data;
- the right to data portability: you have the right to receive your personal data in a structured, workable and machine-readable format and pass them on to third parties;
- the right to erasure: under certain conditions you have the right to remove personal information. This request may be refused; and
- the right to restriction of processing.
Moreover, in the event that Thermalux uses your personal data for direct marketing purposes, you always have the right to oppose against this processing via a simple request (i.e. a possibility to ‘opt out’).
Furthermore, when the legal basis for the processing is based on your free consent, you always have the right to withdraw this consent at any time. This can be done through a simple request to Thermalux.
If you wish to exercise any of these rights, we kindly request you to contact us using the contact information described under point 2 of this Privacy Statement.
You can exercise these rights in principle free of charge. In order to do so, you must prove your identity to us in order to prevent any unauthorized disclosure of your personal data. This can be done by, for example, confirming some of your personal data and possibly delivering additional information (such as an order number). Thermalux can also request you to contact us through your usual line of contact (such as the e-mail address you previously contacted us with).
When your request is manifestly unfounded or excessive, we can refuse your request and we may charge a reasonable fee for the administrative costs associated with your request.
In any case, Thermalux will notify you without undue delay and at the latest within a period of one month after receipt of the request of the action taken by Thermalux. If Thermalux deems your request to be too complex or if you have made numerous requests, it is possible that Thermalux will only be able to provide you with our answer within a period of three months after receipt of the request. In such case, we shall notify you of this delay within one month after receipt of the request, together with the reasons of the delay.
8. Transfers to third countries
It is possible that a transfer of personal data to a recipient located in a country outside of the European Economic Area (EEA) is done by Thermalux. Any transfer to a recipient who has his domicile or registered office in a country which is not covered by an adequacy decision, issued by the European Commission, will be governed by the provisions of a transfer agreement, which (i) will contain standard contractual clauses as set out in the ‘Commission Decision of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors establishes in third countries under Directive 95/46/EC of the European Parliament and of the Council’ (Decision 2010/87/EC), or (ii) is based on any other mechanism provided by the GDPR or any other applicable legislation concerning the processing of personal data.
If you so desire, you can always get more information about the country to which the transfer of your personal data takes place and the appropriate measures that have been taken. Please contact us to exercise your right of access to this effect.
We ask that individuals under the age of 13 years do not communicate personal data to Thermalux, unless they have the approval of their parent(s) or guardian(s). If we notice that we have collected the personal information of a person younger than 13 years, we will delete this information as soon as we receive confirmation of the data subject’s age.
If you do not agree with the way Thermalux collects, uses and/or processes your personal data, you can of course contact us.
In addition, you have the possibility to complain to the supervisory authority, which you can contact via the details below:
Data protection authority
Drukpersstraat 35, 1000 Brussels
Tel: +32 (0)2 274 48 00
Fax: +32 (0)2 274 48 35
11. Stay informed of changes
Thermalux may change this Privacy Statement from time to time, for example in response to market trends and new processing activities. We invite you to always consult the latest version of this policy on our website. Of course, we will inform you beforehand through our website(s) of any substantive changes and we ask, when required to do so by law, your prior consent for our (new) processing activities.