PRIVACY POLICY

1. Definitions

Personal data
Any information about an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

SUR+
Sur+ Comm.V., with registered office at 9831 Sint-Martens-Latem, Klapstraat 133, registered in the Crossroads Bank for Enterprises under number 0705.979.361, RPR Ghent, Ghent Division;
E-mail: info@maisondelhistoire.com

Processing
Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Webshop
The publicly available webshop application to be found at https://www.maisondelhistoire.com/shop..

2. Object

This Privacy Policy sets out the terms and conditions applicable to the processing of personal data that you communicate to SUR+.

3. What personal data does SUR+ hold?

The following personal data is maintained:

▪ Identification data (name, address, phone number, etc.);
▪ Electronic identification data (IP addresses, etc.);
▪ Electronic localisation data (GSM, GPS, etc.);
▪ Financial data;
▪ Information from social media services offered by third parties.

We do not process sensitive personal data.

4. For what purposes are your personal data used?

Your personal data is held for the following purposes:

▪ Entry into and performance of an agreement;
▪ Relationship management (customers (CRM) and/or suppliers);
▪ Handling payments;
▪ Sending our newsletters and advertising messages (if any);
Website
E-commerce
Direct marketing

SUR+ offers you the option of creating an account and logging in to place the order with the Webshop via the following social media services provided by third parties:

Facebook
Instagram
Google+

If you decide to register through or otherwise provide SUR+ with access to a social media service offered by a third party, SUR+ may collect Personal Data already associated with your account on that social media service, such as your name, your e-mail address, your activities or your contact list associated with that account.

SUR+ will process such data in a manner consistent with this Privacy Policy.

5. What does SUR+ do with your personal data?

SUR+ takes the protection of your privacy and personal data seriously.

It therefore already undertook all the initiatives it considers necessary to be in line with the privacy legislation in force, in particular the Belgian Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data (hereinafter the "Privacy Law") and the General Data Protection Regulation (hereinafter the “GDPR").

SUR+ undertakes to follow this legal framework and, where necessary, to take additional measures and implement adjustments pursuant to its updates.

The personal data requested by SUR+ are therefore always limited to those we consider necessary and sufficient for the proper performance of our activities.

We strive to ensure that the personal data we process is correct and updated in case of change.

Your data will always be kept for a well-defined period of time, based on our activities and/or the legal requirements SUR+ has to comply with.

Finally, we guarantee adequate protection (including by means of encryption) against unauthorised or unlawful processing and against accidental loss, destruction or damage of your personal data, depending on the available technology and the sensitivity of the data concerned.

6. Lawfulness of processing (Opt-In)

6.1. SUR+ will only process your personal data if
(i) you grant your consent to that effect in respect of one or more of the specific purposes set out above,
(ii) if the processing of your personal data is necessary for the performance of the activities you request SUR+ to perform (processing in the context of the performance of an agreement),
(iii) if the processing is necessary to comply with a legal obligation incumbent on SUR+, or
(iv) if SUR+ can invoke a legitimate interest to that effect, except where such interests are overridden by your interests or fundamental rights and freedoms.

For purposes of direct marketing, SUR+ will always seek your express consent before using your personal data. Notwithstanding your consent, you have the right to object to the processing of your personal data for direct marketing purposes at any time.

6.2. If you have changed your mind after opting in, you may withdraw your consent to the further processing of your personal data at any time by contacting us at info@maisondelhistoire.com or by sending your request to the following address:

SUR+ Comm.V.
Klapstraat 133
9831 Deurle (Sint-Martens-Latem)

7. Your rights

7.1. General
SUR+ is committed to transparency regarding the processing of your personal data. When SUR+ processes your personal data, you may ask us to be informed about it in a concise and clear manner. Where appropriate, you have the right to ask SUR+ for access to, rectification or erasure of your personal data, or to restrict the processing concerning you. You can also object to the processing of your personal data, and have a right to data portability.

7.2. Right of access
Where we process personal data about you, you have the right to access this data and may also request the following information from us:

▪ the purposes of the processing;
▪ the categories of personal data concerned;
▪ the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
▪ if possible, the period for which the personal data are expected to be stored, or if that is not possible, the criteria for determining that period;
▪ where we did not obtain your personal data directly from you, the information available on the source of your personal data;

If you request more than one copy, we reserve the right to charge an administrative fee to that effect.

7.3. Right to rectification
Should you find that personal data processed by us are incorrect or incomplete, you may request us to make the necessary corrections or additions.

7.4. Right to be forgotten
You have the right to require SUR+ to delete the personal data we process about you, but only in one of the following cases:

▪ Your personal data are no longer needed for the purposes for which they were collected or otherwise processed by SUR+;
▪ You withdraw your consent to process your personal data and no other legal basis exists for SUR+ to process your personal data;
▪ You object to the processing of your personal data because of a situation specific to you, except where SUR+ invokes compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
▪ Your personal data has been unlawfully processed;
▪ Your personal data must be deleted to comply with a legal obligation incumbent on SUR+.

7.5. Right to restriction of processing
In certain cases, you may request SUR+ to restrict the processing of your personal data, in particular:

▪ If you dispute the accuracy of your personal data, for a period enabling SUR+ to verify the accuracy of your personal data;
▪ The processing is unlawful but you do not wish your personal data to be erased;
▪ SUR+ no longer needs your personal data for processing purposes, but you yourself need them for the establishment, exercise or defence of legal claims;
▪ You object to the processing of your personal data because of a situation specific to you, pending the answer to the question of whether SUR+'s legitimate grounds override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims. Restricting your personal data has the effect of marking it by SUR+ with the aim of restricting its processing in the future.

7.6. Right to portability of your personal data
In certain cases, you have the right to obtain the personal data concerning you that you have provided to SUR+ in a structured, common and machine-readable form, and you have the right to transfer that data to another controller.

These cases are as follows:

1. The processing of personal data is based on your consent, or the processing is necessary for the performance of the agreement;
2. Processing is carried out through automated processes.

Both the aforementioned conditions must be met. If this is not the case, you are not entitled to portability.

Finally, the right to portability should not affect the rights and freedoms of others (e.g. if the data concerns more than one data subject). SUR+ reserves the right to refuse portability if it considers that doing so would infringe the rights and freedoms of others.

8. Security of your personal data

8.1. Taking into account the current technology, implementation costs, as well as the nature, scope, context, purposes of processing and the risks to your rights and freedoms that vary in their likelihood and seriousness, SUR+ shall ensure that it has put in place the necessary security measures, and make regular updates thereto, in order to guarantee a level of security appropriate to the risk.

Where relevant, measures taken by SUR+ may include:

▪ the pseudonymisation and encryption of your personal data;
▪ the ability to ensure, on an ongoing basis, the confidentiality, integrity and availability of its processing systems and operations;
▪ the ability to restore the availability of, and access to, personal data in a timely manner in the event of an incident;
▪ establishment of a procedure to test, assess and evaluate the effectiveness of technical and organisational measures to secure processing at regular intervals.

8.2. SUR+ guarantees that it has also taken adequate measures to ensure that any natural person who obtains access to your personal data under SUR+'s authority only processes them on SUR+'s instructions, unless he/she would be obliged to do so under a statutory provision.

9. Notification of infringements

9.1. SUR+ is required by law to report a breach relating to your personal data to the supervisory authority without unreasonable delay and, if possible, no later than 72 hours after becoming aware of it.

For Belgium, this supervisory authority is the Data Protection Authority (hereinafter "Authority"):
Data Protection Authority
Drukpersstraat 35, 1000 Brussel
+32 (0)2 274 48 00
+32 (0)2 274 48 35
contact@apd-gba.be

The Authority's offices are not open to the public. However, you can request a telephone appointment via e-mail or by phone.
The Authority can be reached by phone every day between 8.30 am and 12 noon.

The Authority is an independent body that oversees the protection of privacy in the processing of personal data.

9.2. Where appropriate, and where the breach is likely to pose a high risk to your rights and freedoms, SUR+ undertakes to also notify you of the breach of your personal data unless one of the following conditions is met:

▪ SUR+ has taken appropriate technical and organisational protection measures that render your personal data unintelligible to unauthorised persons (encryption, pseudonymisation, etc.) and these measures have been applied to your personal data to which the breach relates;
▪ the communication would require disproportionate efforts. In that case, SUR+ will instead make a public announcement or similar measure based on which you will be informed to the same effects.

10. Third-party processing

10.1. SUR+ may use the services of third parties for the proper performance of its activities. In that connection, SUR+ guarantees that it has entered into a personal data processing agreement with its direct subcontractors (hereinafter referred to as "Processing Agreement"), at least having obtained from that third party the written guarantee that it will at all times act in accordance with the applicable privacy legislation, in particular the Privacy Law and the GDPR.

Through a Processing Agreement, these third parties undertake, when processing your personal data in the context of an assignment outsourced to them by SUR+, to act in full compliance with the applicable privacy legislation, in particular the Privacy Law and the GDPR.

10.2. SUR+ may use certain third-party service providers that have their own privacy policies regarding the information we are required to provide to them for your purchase-related transactions, e.g. payment gateways and other payment transaction processors.

Where appropriate, we encourage you to read the privacy policies of these service providers to understand how your personal data is handled by them.

Keep in mind especially that some providers may be located in a jurisdiction other than Belgium or the European Union or may have facilities there. If you choose to proceed with a transaction involving the services of a third-party service provider, your information may potentially be subject to the laws of the jurisdiction(s) in which that service provider or its facilities are located.

10.3. Your Personal Data may be transferred outside the European Economic Area (the "EEA"). They may also be processed by staff working for SUR+ outside the EEA.

Some of these transfers will be to countries or organisations that have signed up to protection frameworks approved by the European Commission and have data protection measures that are equal or substantially equivalent to those in the EEA. For other transfers, appropriate or suitable safeguards will be applied in accordance with applicable data protection legislation. For the avoidance of doubt, safeguards may include model contractual clauses approved by the European Commission.

11. Changes

SUR+ reserves the right to modify this Privacy Policy without prior individual notice. Therefore, please review this policy regularly.

12. Complaints and comments

12.1. If you have a complaint or comment about this Privacy Policy or the processing of your personal data, or if you notice a breach in the processing of your personal data, please contact SUR+ in the first instance.

This can be done by sending an e-mail to info@maisondelhistoire.com or by sending your complaint to the following address:

SUR+ Comm.V.
Klapstraat 133
9831 Deurle (Sint-Martens-Latem)

SUR+ undertakes to deal with your complaint as a matter of urgency, but shall decide at its discretion on the merits of the case.

12.2. If you wish, you can also address your complaint to the Authority:
Data Protection Authority
Drukpersstraat 35, 1000 Brussel
+32 (0)2 274 48 00
+32 (0)2 274 48 35
contact@apd-gba.be

13. Applicable law and competent court

13.1. Applicable law
This Privacy Policy is subject to Belgian law.

13.2. Competent court
The courts of the judicial district of Ghent, Ghent section are competent to receive any dispute arising between SUR+ and the data subject whose personal data are processed by or on behalf of SUR+. The privacy policy is drafted in Dutch. The translation into other languages is for information purposes only. In the event of any discrepancy between the versions, the Dutch version shall prevail.