Privacy policy

For which purposes do we process your data:

Client management and offering our welfare programmes

What is this about?

We use your data for the purposes of which we informed you when we collected the data to carry out our services, our legitimate interests or because we are required by law.

Pre-contract assessment

Before we offer a service, we process data to handle an application

Processing in the performance of the contract

We collect, store and process your data when necessary to:

• manage the customer relationship;
• create a customer profile;
• provide services;
• prepare and, if necessary, collect invoices;
• answer queries, hold commercial discussions;
• provide technical support.

The basis for this processing is contractual necessity.

Processing to comply with the law

We may also use your personal data to comply with the law such as:

• accounting processing of the transaction according to accounting laws and tax obligations (e.g. preparation of tax certificates).

Various processing in the context of customer management and the provision of our wellness programmes. In addition to the processing listed above, we have a number of additional processing operations that are accessory to this.

We collect, store and process personal data:

• for internal reporting on services and customer relations;
• to evaluate and improve existing services and develop new services.

These processing operations are based on the legitimate interest of B-Tonic and third parties (specifically, as the case may be, to operate as a company, direct marketing).

Statistical processing

In support of B-Tonic’s activities, statistical processing is also carried out, i.e. the processing of personal data to create statistical models.

For these statistical processing operations, B-Tonic reuses personal data obtained in the context of other purposes in accordance with the relevant provisions of the GDPR.

Which personal data do we process:

We process personal data that we receive from you and from third parties. This is information that is relevant to offer wellbeing programmes.

We may process the following personal data:

• identification data (such as your name and date of birth);
• contact data (such as your address, telephone number and e-mail address);
• professional data (profession, sector and size of company);
• bank data for payment processing (such as your account number);
• data required to offer specific services (certain consumption habits, lifestyle, etc.);
• data about your health with your explicit consent;
• data about your use of our websites (via cookies, for example);
• audiovisual data (e.g. video calls or recordings thereof).
• We may obtain information from third parties such as:
  • – your organisation;
  • data brokers (data validation and data enrichment).

How long do we store your personal data:

Personal data is retained in accordance with the following time limits:

• for legal obligations, the statutory retention period applies.
• for other processing operations, the common law limitation period applies.
• for statistical processing operations, no limited retention period applies in accordance with the GDPR.

Supplier management:

What is this about?

If you provide products or services to B-Tonic, we will process your personal data in that context:

• the conclusion and performance of agreements;
• managing relationships with suppliers;
• internal reporting on supplier agreements.

The basis for the processing is contractual necessity on the one hand and legitimate interest of B-Tonic (i.e. freedom of enterprise) for management and internal reporting on the other hand.

Which personal data do we process?

We process the following personal data:

• identification data (such as name and date of birth) of you and/or your staff;
• contact data (such as address, telephone number and e-mail address) of you and/or your staff;
• bank data for payment processing (such as your account number);
• professional data (education, skills, profession and employment);
• evaluations linked to the relationship and performance of agreements;
• audiovisual data (e.g. video conversations or recordings thereof).

Personal data are obtained directly from the data subject and through third parties. External sources of personal data include the organisation where the data subject works, social media (e.g. LinkedIn for professional data), public data sources (CBE) and private data databases with supplier data (data brokers).

How long do we store your personal data?

Personal data will be retained for a period of up to 10 years after the end of the contractual relationship.

Processing for direct marketing purposes:

What is this about?

We may also use your personal data:

• to offer or suggest our services tailored to your personal situation;
• to conduct satisfaction surveys to assess your interest in certain services;
• for internal reporting on marketing activities;
• to notify customers of various promotions;
• to promote brand image to the general public;
• Newsletter/direct mailing such as birthday mails, Christmas wishes, …;
• for processing personal data via the website, including cookies.

The basis for this processing is the legitimate interest of B-Tonic (i.e. being able to function as a company and direct marketing).

If you provide your mobile phone number or e-mail address, that data may be used for direct marketing. For anything outside the legal opt-out (mainly B-Tonic wellness programmes), your prior consent will be requested by B-Tonic.

For the placement of cookies, B-Tonic will seek consent when required by law. More detailed information on cookies can be found in the cookie statement.

Which personal data do we process?

We process the following personal data:

• identification data (such as name and date of birth) of you and/or your staff;
• contact data (such as address, telephone number and e-mail address) of you and/or your staff;
• consumption data (such as purchasing challenges);
• professional data (sector and size of company, function);
• surfing behaviour and interests, as far as the website is concerned.

How long do we store your personal data?

Personal data will be stored for a period of up to 3 years after the last meaningful contact (e.g. a request from the data subject or an ongoing agreement).

The organisation of the enterprise

What is this about?

The operation of B-Tonic presumes a number of processing operations without which B-Tonic cannot or cannot efficiently conduct business. These processing operations may be part of B-Tonic’s legal obligations or considerations of expediency.

Processing to comply with the law

A number of B-Tonic’s internal functions and activities must be organised due to legal obligations:

• compliance with legal and administrative obligations of companies (e.g. tax obligations, accounting obligations, etc.);
• the processing of personal data pursuant to obligations under the GDPR (e.g. follow-up of data subjects’ requests and personal data breach).
• The basis for this processing is legal obligation on the part of B-Tonic.

Various other processing operations

B-Tonic processes personal data in the context of a range of activities specific to welfare service providers and, more generally, to companies:

• possibly at the research stage in the context of corporate activities, including acquisitions,
  enabling the governance, (risk) management and control of the organisation.

The basis for this processing is the legitimate interest of B-Tonic to operate as a company, protection of property and persons, information security).

Which personal data do we process?

We process the following personal data:

• identification data (such as your name and date of birth);
• contact data (such as your address, telephone number and e-mail address);
• professional data (sector and size of company, function);
• bank data for payment processing (such as your account number);
• data needed to offer specific services (certain consumption habits, lifestyle, etc.);
• data about your health with your explicit consent;
  data about your use of our websites (via cookies, for example);
• audiovisual data (e.g. video conversations or recordings thereof).

These personal data are obtained from the data subject themselves or from public and private sources (e.g. CBE, social media, data brokers, companies involved in acquisition activities and their advisers).

How long do we store your personal data?

B-Tonic retains your personal data as follows:

For legal obligations, the statutory retention period applies.

Recipients of your personal data:

In the context of our processing operations, your personal data will be transferred to one or more recipients, depending on the context. The basis for this transfer is parallel to the basis for processing.

The data subject, his relatives, his employer and his mandatees
We provide your personal data to yourself and, under specific circumstances, to one or more of your relatives. This may be the case, for example, when the data subject is a minor beneficiary. In the context of certain welfare programmes, we also provide personal data to your employee.

Passing on your details to other Baloise Group companies
In order to provide you with the best possible services, we may pass on and receive your details to and from other companies within Baloise Group.

Exchange of data with third parties

When required, we may also share relevant additional data with accountants, payment service providers and intermediaries or other third parties lawfully involved in the performance of the service.

When we engage an external service provider to recover debts or unpaid premiums, we may provide your data to them.

External service providers at home and abroad

For the performance of a number of processing operations, we use specialised service providers who perform (partial) tasks and the associated data processing exclusively for and on our behalf (‘processors’).

• ICT (security) service providers, such as data centres, service providers who provide support in setting up, maintaining, testing and improving the security of our ICT systems;
• marketing and communication agencies, such as email campaign applications, service providers that provide mailing campaigns by post;
• providers for audiovisual applications.
  Those service providers are contractually obliged to comply with the purposes of data processing we have established.

Export of personal data

In the context of our processing operations, your personal data may be exported to third countries (i.e. countries outside the European Economic Area). This may, for example, be in the context of implementing a cooperation with a service provider based in that country.

Several countries have an Adequacy Decision of the European Commission, e.g. Switzerland. Such a decision means that the legislation of that country provides suitable data protection.

If the country of destination does not have such an Adequacy Decision, B-Tonic in principle offers sufficient guarantees by using standard contract clauses approved by the European Commission.

You can receive more information about the guarantee mechanisms on the following websites:

• general information;
  https://www.gegevensbeschermingsautoriteit.be/professioneel/thema-s/internationaal-gegevensverkeer;
• Adequacy Decisions by the European Commission (only available in English);
  https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en;
• standard contract clauses approved by the European Commission (only available in English)
  https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en.

Your rights under the GDPR:

The GDPR grants you as an data subject a number of rights, which you may exercise towards us.

What are your rights?

The GDPR grants you a number of rights as a data subject. To facilitate the exercise of those rights, we provide you with background information on those rights and with information how to exercise them. Under certain circumstances, the GDPR places restrictions on those rights.

Right to information

You are entitled to general information about the processing of your personal data. That information is provided through this general privacy notice or through specific privacy notices.

Right to access

If you want to find out whether or not we process personal data about you or want to know which personal data we process about you and want to receive certain information about that processing, you can exercise your right to access. You can also request a copy of your personal data.

Right to rectification

If you find that we process incorrect or incomplete personal data, you may ask us to correct or supplement that personal data.

Right to data erasure

You can ask to delete your personal data in specific cases, e.g. when the retention period for that personal data has expired. However, this right is not absolute. For example, we may still retain personal data to comply with obligations under applicable laws and regulations that require or allow us to retain your data or in the context of legal claims.

Right to restriction

You may ask to restrict the processing of your personal data in accordance with legal conditions. B-Tonic may also decide to restrict processing itself under certain circumstances. Processing of your personal data still remains possible in exceptional cases, e.g. with your consent or in the context of legal proceedings.

Right to withdraw your consent

If you have given consent to process your personal data, you have the right to withdraw that consent at any time by notifying us. The withdrawal of your consent does not affect the data processing that has taken place up to that point on the basis of your consent.

Right to data portability

Where data processing is automated and based on your consent or on an agreement, you may request your personal data from us in a portable format.

Right to object

If processing is based on legitimate interest or public interest, you may object to such processing on grounds specific to your particular situation. In that case, we may still further process your personal data if we can demonstrate compelling legitimate grounds which outweigh your interests or if the processing is related to a legal claim.

You can also inform us at any time that we may not use your personal data for marketing and advertising purposes. Such objection does not prevent the processing of your personal data for other purposes.

Right to complain

You also have the right to complain to the competent supervisor. In Belgium, the competent supervisor is the Data Protection Authority.

If you are dissatisfied with the way we process your personal data or intend to lodge a complaint, we encourage you to first get in touch with our Data Protection Officer to find a quick solution to your problem together.

How can you exercise these rights?

You can exercise your rights by contacting us, preferably our Data Protection Officer through e-mail at gdpr@b-tonic.be.

When exercising your rights, we ask you to be as specific as possible so that your question can be dealt with concretely.

We also point out that your identity must be reasonably verifiable to exercise your rights, in order to avoid someone else exercising them. As a principle, we will use the same methods to identify you and verify your identity as when we collected your data. As such, we will sometimes have to ask you to provide proof of your identity. This applies, for example, if you ask us to do something that requires us to provide you with data, because we do not want to provide your data to another person, or if you ask us to delete important data, because we do not want anyone to be able to ensure that we delete data that you expect us to have.

Restrictions if we cannot identify you

For certain processing operations, e.g. statistical processing, we may have encrypted or pseudonymised personal data that does not allow us to identify you. In that case, in accordance with the GDPR, certain rights do not apply.