Privacy Policy
1. Introduction
Duvel Moortgat may process your personal data in various situations, in particular when:
- you visit one of its websites or social media profile,
- you make a purchase at the shop or on the webshop,
- you subscribe to the newsletter,
- you visit its sites and offices,
- you participate in an event that it organizes or of which it is a commercial partner,
- you participate in a contest that it organizes,
- you represent (or are) a supplier, a customer (bars, restaurants, etc.), or a business partner,
- you are applying for a position.
With this policy, Duvel Moortgat wishes to specify the rules and principles that it applies in the processing of your personal data.
«Processing» means any operation or set of operations applied to personal data, regardless of the process used (such as collection, recording, organization, structuring, storage, adaptation or modification, consultation, use, dissemination, etc.).
This policy complies with European regulations on the protection of personal data, and in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, the «GDPR»).
2. Data Controller
Duvel Moortgat, with registered office at Breendonk-Dorp 58, 2870 Puurs, registered in the register of legal entities in Antwerp, county of Mechelen, under company number 0400.764.903, is data controller within the meaning of the GDPR.
3. Categories of personal data processed
The categories of personal data that may be processed by Duvel Moortgat are as follows:
| Categories | Non-exhaustive list of examples |
|---|---|
| Identification Information | Surname, first name, date of birth, languages, postal address, email address, telephone number, photos / videos, … |
| Navigation information | IP address, page(s) viewed, how often, at what time,… |
| Financial Information | Account number, payment method, banking institution, remuneration, … |
| Working Life Information | Position, place of work, studies, training, career path, etc. |
| Private Life Information | Participation in an event or competition, orders on the webshop, visits to the brewery, etc. |
| Correspondence | Emails, letters, online forms, … |
Duvel Moortgat processes only personal data that is adequate, relevant and necessary for the purposes for which it is processed, and ensures that it is accurate and, if necessary, updated.
4. Purposes and legal bases
The processing of personal data is carried out for various legitimate purposes listed in the table in Appendix 1, which specifies the legal basis on which each of these purposes is based.
5. Categories of recipients
Duvel Moortgat may use subcontractors for the processing of certain data, such as data storage, data management and data analysis providers. Duvel requires them to comply with all applicable laws and regulations concerning data protection and privacy, including the GDPR. A contract is always concluded between Duvel Moortgat and each subcontractor for this purpose.
In view of the international organization of Duvel Moortgat’s activities, personal data may be transferred to group entities and subcontractors located in a country of the European Union or outside the European Union. In the event of a transfer to a country outside the European Union, special measures are put in place to ensure the protection and security of this data.
6. Security of the processing of your data
Duvel Moortgat takes appropriate technical and organizational measures to ensure adequate security of personal data and its protection against unauthorized or unlawful processing, as well as against unintentional loss, destruction and damage. The subcontractors used by Duvel for the processing of personal data provide sufficient guarantees as to the implementation of these measures.
7. How long we store your data
Duvel Moortgat retains personal data for no longer than is necessary for each purpose. For more details, you can consult the table in Appendix 1.
8. Rights of Data Subjects
Data subjects have the right, under the conditions set out in the GDPR, to:
- request from Duvel Moortgat access to the personal data concerning them, their rectification or deletion, or a restriction of their processing;
- receive their personal data in a structured, commonly used and machine-readable format,
- transmit this data to another controller without hindrance from Duvel Moortgat;
- object to the processing of personal data concerning them;
- lodge a complaint with a supervisory authority if they consider that the processing of personal data concerning them constitutes a violation of the GDPR.
9. Do you have any questions?
If you have any questions about this Privacy Policy or your rights, you can send a request for information via the following link:
https://login.mission-rgpd.com/moovapps/easysite/workplace/demande-droit?token=UkhWMlpXdz0%3D&lg=en
ANNEX 1
| Purposes and sub-purposes | Legal basis | Data concerned | Retention period |
|---|---|---|---|
|
Recruitment Management Receive and analyze applications/CVs Contact Candidates Arrange interviews Negotiate terms |
Legitimate interest (to recruit staff for the company) |
Identity information Financial Information Private Life Information Working Life Information Correspondence |
As a general rule, for a maximum period of 2 years from the end of the recruitment period |
|
Management of customers (bars, restaurants, etc.), suppliers and business partners Negotiate contracts with contact persons Monitor contracts and ensure compliance |
Negotiation/performance of a contract |
Identity information Financial Information Working Life Information Correspondence |
As a general rule, for a maximum period of 5 years from the end of the negotiation period/contract |
|
Accounting management Management of invoices and other accounting documents |
Legal Obligation |
Identity information Financial Information Working Life Information |
As a general rule, for a period of 7 years |
|
Pre-Litigation & Litigation Management Management of pre-litigation and litigation with customers, suppliers, business partners, consumers, etc. |
Legitimate interest (to defend the interests of the company) |
Identity information Financial Information Private Life Information Working Life Information Correspondence |
As a general rule, for a maximum period of 5 years from the end of the (pre)litigation |
|
Website Management Follow up on requests submitted via the contact form |
Performance of a contract |
Identity information Private Life Information Working Life Information Correspondence |
As a general rule, for the period necessary to process the request and maximum for 5 years after |
|
Manage strictly necessary and functional cookies |
Performance of a contract |
Navigation information |
See cookie policy |
|
Manage optional cookies (marketing and statistics) |
Consent |
Navigation information |
See cookie policy |
|
Shops management (online and physical) Track orders Follow up on claims/special requests |
Performance of a contract |
Identity information Financial Information Private Life Information Correspondence |
As a general rule, for the period necessary to process the order and maximum for 5 years after If the data subject has created an account: for as long as the data subject does not delete this account |
|
Brewery tour Management Register bookings Organize visits Survey satisfaction |
Legitimate interest (to promote the company and products) |
Identity information Financial Information Private Life Information Correspondence |
As a general rule, during the period necessary for the organization of the visit and maximum for 5 years after If the data subject has created an account: for as long as the data subject does not delete this account |
|
Events and Activations Management Register participants Ensure that things are running smoothly Survey satisfaction |
Legitimate interest (to promote the company and products) |
Identity information Private Life Information Correspondence |
As a general rule, for the period necessary for the organization of the event/activation and maximum for 5 years after |
|
Security Management Ensure the security of company buildings and assets through video surveillance |
Legitimate interest (to ensure security) |
Identity information |
As a general rule, for 1 month from the date of the video |
|
Online Contest Management & Activations Notify the winner and send them the prize |
Performance of a contract |
Identity information Private Life Information Correspondence |
As a general rule, for the period necessary for the organization of the competition/activation and maximum for 5 years after |
|
Communication Management Send the newsletter for products/services that are not similar to products/services already ordered |
Consent |
Identity information |
For the duration of the consent |
|
Send the newsletter for products/services similar to products/services already ordered |
Legitimate interest (to promote the company’s news) |
Identity information |
As long as the person does not object to the processing |
|
Communicate about new products in the company (e.g. a new beer, a new partnership, etc.) |
Legitimate interest (to promote the company’s news) |
Identity information Working Life Information |
For the website: lifetime of the website or post For social media: lifetime of the account or post |
|
Share visual content (photos/videos) |
Performance of a contract when it is the subject of a contract Legitimate interest (to share content with which the company is actively associated) in the cases referred to in Article 9.2 (e) of the GDPR Consent in other cases |
Identity information |
During the term of the contract or consent, and not more than: For the website: lifetime of the website or post For social media: lifetime of the account or post |
|
Interact with followers on social media |
Legitimate interest (to promote the company’s news) |
Identity information Private Life Information Correspondence |
During the lifetime of the account |
|
Management of personal data Dealing with data subject requests |
Legal obligation (GDPR) |
Identity information Correspondence |
As a general rule, for the period necessary to process the request and for a maximum of 5 years after |
|
Generate aggregated statistics |
Legitimate interest (to understand customers and consumers) |
Identity information Navigation information Private Life Information Working Life Information |
As a general rule, deletion when the data subject has not had any further interactions with the company for a period of at least 6 months |