Statement regarding personal data processing

The purpose of the following statement is to explain how Spreds gathers, uses and keeps personal data related to its members (physical persons) and to any physical person in contact with Spreds, including potential clients and any physical person visiting the website https://www.spreds.com/en (the “Website”). This statement aims to help you understand Spreds practices with regard to personal data protection and to help you make informed decisions when using our website or services.

For Spreds, data protection and respect for private life are essential values. This statement will regularly be updated in order to be adapted to new technologies, market practices and client needs. The most recent version is available on the Spreds website.

Data processing must comply with the Belgian law of 25 May 2018, the European regulation n°2016/679 of 27 April 2016 on data protection, called “GDPR”, or any other legislative act modifying them. You can get more information on data protection on the website of the Data Protection Authority privacycommission.be.

In this statement, undefined words starting with an uppercase letter are defined in Spreds general conditions, which can be found at https://www.spreds.com/en/general-terms-and-conditions.

Table of content
  1. A few key concepts
  2. Who is responsible for processing your personal data?
  3. What kind of personal data do we process?
  4. When do we collect this data?
  5. What is the purpose of personal data processing
    1. Legal and regulatory obligations
    2. Fulfilment of contract or enforcement of pre-contractual measures
    3. Legitimate interests
    4. Consent
  6. Which circumstances can Spreds use your personal data for commercial prospection?
  7. Cookie policy
  8. Who has access to the personal data that we gather?
  9. How long is this data kept?
  10. What rights can you exercise concerning your personal data processing?
    1. The right to access and correct
    2. The right to delete data
    3. The right to limit data processing
    4. The right of data portability
    5. The right to withdraw your consent
    6. The right to object
  11. Who should you contact to exercise your personal data right?
  12. Who sould be contacted in case of dispute/conflict?
1. A few key concepts

This statement gives information about the “processing” of your “personal data” by the “person in charge of processing”.

“Personal data” is any information about a physical identified or identifiable person. It can be a last name, first name, phone number but also a picture, navigational habits on a website, etc. as long as that information is related to a physical person.

“Processing” is any operation linked to personal data. Processing covers all aspects linked to the gathering, recording, managing, structuring, saving, adapting or modifying, extracting, consulting, usage, communication by transmission, publication or any other form of provision, linking or interconnection, limitation, removal or deletion of data.

The “person in charge of processing” is the person or entity that determines the purpose and technical resources used in relation to personal data.

2. Who is responsible for processing your personal data?

The person in charge of processing your personal data is Spreds S.A., a limited liability company incorporated in Belgium, registered in “register 2 of corporate entities” (RPM Nivelles) under VAT number BE 837.496.614, with the head office located in B-1000 Brussels, Place Sainte Gudule 5.

3. What kind of personal data do we process?

When you visit our Website, the personal data that is collected and processed by Spreds can either be information that you share directly and voluntarily, for example contact details when filling in a form, or data gathered automatically through your navigation on our website (IP address, website sessions,…).

If you choose to become a Member, other personal data will be collected and processed by Spreds. For example, your contact info (address, phone number, email address,…), data related to your identity or personal situation (last name, first name, date of birth, sex,…), data related to your Account and Transactions linked to your account, or other data linked to your website usage.

We do not process sensitive personal data such as information regarding health, ethnic or cultural background, political opinions, religion or beliefs, union membership or sexual orientation, nor do we process data relative to criminal convictions or offenses.

4. When do we collect this data?

We collect your personal data under the following circumstances:

5. What is the purpose of personal data processing

We use your personal data:

When data processing is justified in relation to the compliance with a legal provision or regulation, or the fulfilment of a contract or pre-contractual measures that you have requested, you will be required to provide some personal information. You can of course refuse to provide such information, but in that case, be aware that you will not be able to take full advantage of all our services.

5.1. Legal and regulatory obligations

In many instances, Spreds is legally required to process your data. For example, as an entity subjected to the regulations on the prevention of money laundering and financing of terrorism, we are required to obtain some information from you and have to verify and store it. Spreds could 5 also be required to process your data in order to respond to legitimate requests from public, tax (Belgian and non-Belgian), prudential or judiciary authorities. Certain regulations require that data be stored and archived during a legal period of time.

5.2. Fulfilment of contract or enforcement of pre-contractual measures

When you become a Member, we are required to process your personal data in order for you to finalise the contract and benefit from all the services and features restricted to our Members.

5.3. Legitimate interests

In compliance with the current legislation, Spreds can also process your personal data to serve its own legitimate interests. In that case, we ensure a balance between those legitimate interests and the respect of your personal rights, including your right to protection of private life.

Within this context, your personal data can be processed to:

5.4. Consent

In some instances, we are required by law to get your specific consent before sending you commercial information by phone, email or text message. In that case, we will process your data to this end only after getting your consent.

6. Which circumstances can Spreds use your personal data for commercial prospection?

As a company, Spreds has a legitimate interest in informing you about its products or services. Also, in order to reinforce its attractiveness with other companies, Spreds has a legitimate interest in transferring the personal data of its Members to enable those companies to contact them. Within that framework, we might use or transfer your personal data, and particularly your contact details in order to share some commercial information with you

Specifically, this means that you could be contacted in the following cases:

Within the context of this prospection, we can contact you through traditional means of communication such as phone or regular mail. We will use these methods only if you have not exercised your right to object to the use of your commercial data for direct marketing purposes, as mentioned above.

We can also contact you through email or text message as long as you have agreed to it.

7. Cookie policy

We use cookies (small data files stored in your computer) on our Website in order to boost its performance, to enable it to remember your preferences and to give information that we find relevant or useful to you.

For more information on the use of cookies and the ways to disable them, we invite you to read the Spreds Policy regarding the use of cookies, which can be found on the following page https://www.spreds.com/en/cookies.

8. Who has access to the personal data that we gather?

Your personal data can be consulted by our team members who need it to do their jobs

In some cases, personal data can also be transferred to other people or entities, such as:

9. How long is this data kept?

Your personal data is stored for a period that depends on the objective of data processing and legal requirements. Your personal data can be deleted earlier if you exercise your right to delete data as explained below.

Generally speaking, data is kept (i) as far as Members are concerned, during the entire relationship with Spreds, and during the storage period required by legal and tax regulations (in theory 10 years, with some exceptions) and (ii) regarding other individuals, for a maximum of 5 years, starting with the last contact with said individual.

Past this period, personal data is either anonymised or deleted.

For more details, please see our Cookie Policy on https://www.spreds.com/en/cookies

10. What rights can you exercise concerning your personal data processing?
10.1. The right to access and correct

You have the right to access your personal data. Spreds can provide you with:

If you notice that your data is incomplete or inaccurate, you can ask us to correct them.

10.2. The right to delete data

In certain cases, the law allows you to delete personal data.

For example, if the purpose of the data collection is no longer valid, thus making the data unnecessary (for example, if you shared your information with us in order to participate in an event which has come to an end), if the processing of your data is exclusively based on your consent and you decide to revoke it or you object to the processing of your data (if we do not have legitimate reasons that prevail).

Spreds can however keep your personal data if it is necessary for the ascertation, the exercise or the defense of its rights in court or for the compliance by Spreds with its legal obligations. Spreds will be bound to the storage period required by different legislations, including the case when data is linked to transactions that you have made, or data collected as part of our obligations in the fight against money laundering or the financing of terrorism.

10.3. The right to limit data processing

This right to object enables you to ask us for a temporary blocking of your data in certain cases defined by law: Spreds will no longer be able to process the data in question during a specific period of time.

This blocking can be asked:

If you have made use of this right, we will be able to keep your data but won’t be able to use it, except if you give us your consent, or for the ascertainment, exercise or defense of our rights (or those of another person).

10.4. The right of data portability

Thanks to this right, you can ask us to transfer your data to yourself or directly to another person in charge of data processing when this is technically possible for Spreds. This right concerns only the data you shared with Spreds and that is processed automatically based on the contract or on your consent.

10.5. The right to withdraw your consent

When your data processing is based on your consent, you have, at any moment, the right to withdraw this consent. This withdrawal will not question the legality of the processing during the period preceding your withdrawal.

10.6. The right to object

You always have the right to object without explanation and without cost, to the use of your data for prospection purposes. In that case, your data will no longer be used to this end.

Furthermore, you also have the right to object to any personal data processing based on your legitimate interest. However, we will not follow up on your request if our legitimate interest prevails on yours or if the processing of your data is required for the ascertainment, exercise or defense of our rights in court.

11. Who should you contact to exercise your personal data right?

You can exercise the rights mentioned above by contacting us:

Members can also object to the use of their personal data for direct marketing purposes by modifying their preferences in their secured space on the Website: https://www.spreds.com/en/profile

12. Who sould be contacted in case of dispute/conflict?

In case of conflict regarding the processing of your personal data, you can submit a mediation request to the Data Protection Authority (previously known as the Privacy Protection Commission) at the following address:

Rue de la Presse 35
1000 Brussels
Phone : +32 2 274 48 00
www.privacycommission.be