Privacy Policy

1. Introduction

Duvel Moortgat may process your personal data in various situations, in particular when:

  • you visit one of its websites or social media profile,
  • you make a purchase at the shop or on the webshop,
  • you subscribe to the newsletter,
  • you visit its sites and offices,
  • you participate in an event that it organizes or of which it is a commercial partner,
  • you participate in a contest that it organizes,
  • you represent (or are) a supplier, a customer (bars, restaurants, etc.), or a business partner,
  • you are applying for a position.

With this policy, Duvel Moortgat wishes to specify the rules and principles that it applies in the processing of your personal data.

“Processing” means any operation or set of operations applied to personal data, regardless of the process used (such as collection, recording, organization, structuring, storage, adaptation or modification, consultation, use, dissemination, etc.).

This policy complies with European regulations on the protection of personal data, and in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, the “GDPR”).

2. Data Controller

Duvel Moortgat, with registered office at Breendonk-Dorp 58, 2870 Puurs, registered in the register of legal entities in Antwerp, county of Mechelen, under company number 0400.764.903, is data controller within the meaning of the GDPR.

3. Categories of personal data processed

The categories of personal data that may be processed by Duvel Moortgat are as follows:

Categories Non-exhaustive list of examples
Identification Information Surname, first name, date of birth, languages, postal address, email address, telephone number, photos / videos, …
Navigation information IP address, page(s) viewed, how often, at what time,…
Financial Information Account number, payment method, banking institution, remuneration, …
Working Life Information Position, place of work, studies, training, career path, etc.
Private Life Information Participation in an event or competition, orders on the webshop, visits to the brewery, etc.
Correspondence Emails, letters, online forms, …

Duvel Moortgat processes only personal data that is adequate, relevant and necessary for the purposes for which it is processed, and ensures that it is accurate and, if necessary, updated.

4. Purposes and legal bases

The processing of personal data is carried out for various legitimate purposes listed in the table in Appendix 1, which specifies the legal basis on which each of these purposes is based.

5. Categories of recipients

Duvel Moortgat may use subcontractors for the processing of certain data, such as data storage, data management and data analysis providers. Duvel requires them to comply with all applicable laws and regulations concerning data protection and privacy, including the GDPR. A contract is always concluded between Duvel Moortgat and each subcontractor for this purpose.

In view of the international organization of Duvel Moortgat’s activities, personal data may be transferred to group entities and subcontractors located in a country of the European Union or outside the European Union. In the event of a transfer to a country outside the European Union, special measures are put in place to ensure the protection and security of this data.

6. Security of the processing of your data

Duvel Moortgat takes appropriate technical and organizational measures to ensure adequate security of personal data and its protection against unauthorized or unlawful processing, as well as against unintentional loss, destruction and damage. The subcontractors used by Duvel for the processing of personal data provide sufficient guarantees as to the implementation of these measures.

7. How long we store your data

Duvel Moortgat retains personal data for no longer than is necessary for each purpose. For more details, you can consult the table in Appendix 1.

8. Rights of Data Subjects

Data subjects have the right, under the conditions set out in the GDPR, to:

  • request from Duvel Moortgat access to the personal data concerning them, their rectification or deletion, or a restriction of their processing;
  • receive their personal data in a structured, commonly used and machine-readable format,
  • transmit this data to another controller without hindrance from Duvel Moortgat;
  • object to the processing of personal data concerning them;
  • lodge a complaint with a supervisory authority if they consider that the processing of personal data concerning them constitutes a violation of the GDPR.

9. Do you have any questions?

If you have any questions about this Privacy Policy or your rights, you can send a request for information via the following link:

https://login.mission-rgpd.com/moovapps/easysite/workplace/demande-droit?token=UkhWMlpXdz0%3D&lg=en

ANNEX 1

Purposes and sub-purposes Legal basis Data concerned Retention period

Recruitment Management

Receive and analyze applications/CVs

Contact Candidates

Arrange interviews

Negotiate terms

Legitimate interest (to recruit staff for the company)

Identity information

Financial Information

Private Life Information

Working Life Information

Correspondence

As a general rule, for a maximum period of 2 years from the end of the recruitment period

Management of customers (bars, restaurants, etc.), suppliers and business partners

Negotiate contracts with contact persons

Monitor contracts and ensure compliance

Negotiation/performance of a contract

Identity information

Financial Information

Working Life Information

Correspondence

As a general rule, for a maximum period of 5 years from the end of the negotiation period/contract

Accounting management

Management of invoices and other accounting documents

Legal Obligation

Identity information

Financial Information

Working Life Information

As a general rule, for a period of 7 years

Pre-Litigation & Litigation Management

Management of pre-litigation and litigation with customers, suppliers, business partners, consumers, etc.

Legitimate interest (to defend the interests of the company)

Identity information

Financial Information

Private Life Information

Working Life Information

Correspondence

As a general rule, for a maximum period of 5 years from the end of the (pre)litigation

Website Management

Follow up on requests submitted via the contact form

Performance of a contract

Identity information

Private Life Information

Working Life Information

Correspondence

As a general rule, for the period necessary to process the request and maximum for 5 years after

Manage strictly necessary and functional cookies

Performance of a contract

Navigation information

See cookie policy

Manage optional cookies (marketing and statistics)

Consent

Navigation information

See cookie policy

Shops management (online and physical)

Track orders

Follow up on claims/special requests

Performance of a contract

Identity information

Financial Information

Private Life Information

Correspondence

As a general rule, for the period necessary to process the order and maximum for 5 years after

If the data subject has created an account: for as long as the data subject does not delete this account

Brewery tour Management

Register bookings

Organize visits

Survey satisfaction

Legitimate interest (to promote the company and products)

Identity information

Financial Information

Private Life Information

Correspondence

As a general rule, during the period necessary for the organization of the visit and maximum for 5 years after

If the data subject has created an account: for as long as the data subject does not delete this account

Events and Activations Management

Register participants

Ensure that things are running smoothly

Survey satisfaction

Legitimate interest (to promote the company and products)

Identity information

Private Life Information

Correspondence

As a general rule, for the period necessary for the organization of the event/activation and maximum for 5 years after

Security Management

Ensure the security of company buildings and assets through video surveillance

Legitimate interest (to ensure security)

Identity information

As a general rule, for 1 month from the date of the video

Online Contest Management & Activations

Notify the winner and send them the prize

Performance of a contract

Identity information

Private Life Information

Correspondence

As a general rule, for the period necessary for the organization of the competition/activation and maximum for 5 years after

Communication Management

Send the newsletter for products/services that are not similar to products/services already ordered

Consent

Identity information

For the duration of the consent

Send the newsletter for products/services similar to products/services already ordered

Legitimate interest (to promote the company’s news)

Identity information

As long as the person does not object to the processing

Communicate about new products in the company (e.g. a new beer, a new partnership, etc.)

Legitimate interest (to promote the company’s news)

Identity information

Working Life Information

For the website: lifetime of the website or post

For social media: lifetime of the account or post

Share visual content (photos/videos)

Performance of a contract when it is the subject of a contract

Legitimate interest (to share content with which the company is actively associated) in the cases referred to in Article 9.2 (e) of the GDPR

Consent in other cases

Identity information

During the term of the contract or consent, and not more than:

For the website: lifetime of the website or post

For social media: lifetime of the account or post

Interact with followers on social media

Legitimate interest (to promote the company’s news)

Identity information

Private Life Information

Correspondence

During the lifetime of the account

Management of personal data

Dealing with data subject requests

Legal obligation (GDPR)

Identity information

Correspondence

As a general rule, for the period necessary to process the request and for a maximum of 5 years after

Generate aggregated statistics

Legitimate interest (to understand customers and consumers)

Identity information

Navigation information

Private Life Information

Working Life Information

As a general rule, deletion when the data subject has not had any further interactions with the company for a period of at least 6 months