PRIVACY POLICY OF CAROLINE BISS

1. Your privacy is important 
2. Your right to privacy 
3. What personal data do we process? 
4. About sharing and storing your personal data
5. Why do we want to process your personal data? 

1. Your privacy is important

Your privacy is important to us. We want to process your personal data in an honest, lawful, correct and transparent way. In this document, our privacy policy, we explain how we process personal data and what personal data we process. The term "Processing" includes, among other things, collecting, recording, organising, storing, updating, changing, retrieving, consulting, using, distributing or making available in any way, merging, combining, archiving, deleting or eventually destroying.
We speak of you as a (future) customer of our company, as a beneficiary or a person of another organisation or company that is in contact with us.

1.1 Preamble
We recommend that you read this document carefully, so that you know why and for what purposes we process your personal data. In addition, you can read about your rights and how you can exercise them.
Our privacy policy may change from time to time. The latest version can be found on our website: https://www.caroline-biss.com.
If you would like more information on the privacy legislation in Belgium, please visit the website of the Privacy Commission www.privacycommission.be.

1.2 Who processes your data? Who are we?
Caroline NV is the parent company of a group of companies that jointly own the Caroline Biss brand, the Caroline Biss retail shops and the online shop. The group operates in Europe with retail shops in Belgium, the Netherlands, GD of Luxembourg and Germany.
This privacy policy applies to all companies within the group, being:
- The public limited company Caroline NV, VAT BE 0400.278.715, RPR (Trade Register) Ghent, Dendermonde branch, Kouterbaan 44, 9280 Lebbeke, Belgium
- The public limited company CETEX NOORD NV, VAT BE 0433.143.897, RPR (Trade Register) Ghent, Dendermonde branch, Kouterbaan 44, 9280 Lebbeke, Belgium
- The public limited company CETEX SUD NV, VAT BE 0560.708.993, RPR (Trade Register) Ghent, Dendermonde branch, Kouterbaan 44, 9280 Lebbeke, Belgium
- The public limited company CETEX LUXEMBOURG SA, RCS (Trade Register) B44919, rue Philippe II, 26, L-Luxembourg, Grand Duchy of Luxembourg
- The private company CETEX NEDERLAND BV, KvK (Trade register) 34120226, P.C. Hooftstraat 113, 1071 BR AMSTERDAM, THE NETHERLANDS

The above companies are jointly responsible for the processing of your personal data, with Caroline NV holding ultimate responsibility for the processing of your personal data and, as such, also being your contact person.
Public limited company Caroline NV, VAT BE 0400.278.715, RPR Ghent, Dendermonde branch
Kouterbaan 44, 9280 Lebbeke, Belgium
When referring to “We”, “Our”, “Caroline Biss” in this policy, we are clearly referring to the above group of companies.

1.3. How can you reach us?
If you have any questions about your privacy or if you want to change your privacy settings or exercise your rights, you can reach us through any of the following contact methods:
• The postal address at the Kouterbaan 44 in Lebbeke, 9280
• By email at our email address privacy@caroline-biss.com

1.4. The leading supervisory authority of Caroline Biss
For the group of Caroline Biss companies, the Belgian supervisory authority is the leading authority:
Data Protection Authority
Drukpersstraat 35, 1000 Brussels
 +32 (0)2 274 48 00 / Contact@apd-gba.be


2. Your right to privacy

You have several rights when it comes to the processing of your personal data. When Caroline Biss asks for your consent, you may withdraw that consent at any time.
We will implement your rights in our systems and procedures at the latest 30 days after we have received your request. If for some reason we are unable to meet this deadline, we will inform you in due time before the expiry of the initial term.

 
2.1 You may access your personal data
You have the right to access the personal data we process about you, the purpose of the processing, where we obtained the data from and who receives the data.
In these cases, you can also learn how long we will retain the data, whether the data is used for automated decision-making purposes and whether we intend to send the data to a country outside the European Union.
We will send you the requested information in writing or electronically within a reasonable period of time.

2.2 You can have your data rectified/completed
It can occur that the data we have of you is not or no longer correct. You can request us at any time to have the incorrect data rectified or the incomplete information completed. Our preference goes to informing us of any these changes through our website.

2.3 Right to erasure
If you think that we are processing your data unlawfully, you can request to have this personal data deleted.
When justified, Caroline Biss may deny this request to delete your personal data. Examples are the legal obligation to retain specific data, or to assert or substantiate a legal claim.

2.4. Right to restrict the processing of personal data
You can ask us to restrict the processing of your personal data if you suspect that the data is incorrect, the processing is unlawful or if you do not agree to the fact that we are processing the data within our legitimate interest (see article 3.3).
We will honour your objection, unless there are compelling reasons not to do so, for example to prevent fraud or defaults on payments.

2.5. Right to object
You have the right to object to the processing of your personal data. Processing is then stopped, unless processing is needed to comply with social and tax legislation, to safeguard the interests of a third party, or to initiate, assert or substantiate a legal claim.

2.6. Right to data portability
You can ask us to transfer the personal data we have received from you to a third party.

2.7. Right to submit a complaint
If you do not agree with our viewpoint, you can contact the Belgian Data Protection Authority. You can also submit any complaints to this authority. The contact details can be found in article 1.4.

2.8. Proof of identity of the requester
You can exercise your data processing rights by submitting a written request:
• by letter sent to the address at the Kouterbaan 44 in Lebbeke, 9280
• by email to our email address: info@caroline-biss.com
Please make sure to be as specific as possible when you want to exercise your rights. It helps us to process your request correctly.
To avoid that a person other than yourself exercises your rights, we want to verify your identity as best as we can. For this reason, your request must always be accompanied by a document proving that the identity of the requester matches your own identity. You can do this by attaching a photocopy of your identity card to the request. Please make sure to first black out any vital information, such as your passport photo and ID card number, to protect your privacy.
We will notify you if we believe the document provided constitutes insufficient proof. We reserve the right to defer processing the request until sufficient proof has been provided.

3. Why do we want to process your personal data?


3.1. Caroline Biss must comply with legal obligations
In certain cases, we are required by law to process your personal data. We have listed the most important obligations for you:
• tax law
• trade law
• we may also be required to disclose personal data to authorities or other third parties, for example, in relation to a legal obligation or in order to perform a task concerning the public interest.

3.2. Caroline Biss must be able to fulfil its contract with you
As our customer, you purchase our fashion items or use our services. To be able to guarantee that our contract and agreement with you is correctly carried out, we need to process and manage these contracts and agreements under sound administrative, accounting and operational conditions.
This also applies if you are a supplier of Caroline Biss. Then, too, we need to respect the contract and must process and manage the supplier contracts under sound administrative, accounting and operational conditions.

3.3. As a company, Caroline Biss must be able to function in its Direct Marketing and communication efforts
As a commercial company, we have a number of legitimate interests that form the basis for the processing of personal data. In doing so, we take care in ensuring there is a sound balance between your right to privacy and the legitimate interests of Caroline Biss. Should you still have objections against the processing of your data on this basis, you can submit your objections to us.
Caroline Biss would like to continue communicating with you, as an existing customer, through our newsletters, catalogue and lookbook. This can be done by answering your specific question whether we know you are interested in the new collection and services. Since our goal is to always offer you better service and better products, and we wish to communicate this with you, we process your personal data for direct marketing purposes in the company's legitimate interest to conduct business. You can access this information in various ways, for instance in our retail shops, by email, by regular mail, by telephone and at events. We choose the most appropriate channel that causes as little inconvenience to you as possible. Should you wish not to receive our commercial communications, you can simply let us know and we will not disturb you any longer. You can do this for all our communication channels or just one of the channels.

3.4. Caroline Biss asks for your consent regarding Direct Marketing and communication
Caroline Biss would like to continue communicating with you, as a new customer from 25 May 2018, through our newsletters, catalogue and lookbook. This can be done by answering your specific question whether we know you are interested in our new collection and services. Since our goal is to always offer you better service and better products, and we wish to communicate this with you, we process your personal data for direct marketing purposes in the company's legitimate interest to conduct business. You can access this information in various ways, for instance in our retail shops, by email, by regular mail, by telephone and at events. We choose the most appropriate channel that causes as little inconvenience to you as possible. Should you wish not to receive our commercial communications, you can simply let us know and we will not disturb you any longer. You can do this for all our communication channels or just one of the channels.
Also for our existing customers (before 25 May 2018), Caroline Biss is working towards approval-based processing. To this end, Caroline Biss adopts a strategy based on integrity and transparent communication, asking you to give your consent for these same goals, during the transition period that runs until 31 December 2021. Should you wish not to receive our commercial communications, you can simply let us know and we will not disturb you any longer. You can do this for all our communication channels or just one of the channels.

3.5. Caroline Biss does not sell your personal data
We do not sell, lease or give your personal data to any third parties for their own use.

4. What personal data do we process?


4.1. What information do we collect from our business customers and for what purposes?

Our business customers are our suppliers, multi-brand retailers and prospects.
Caroline Biss processes the personal data of stakeholders who work for the companies with which it does business. The purpose of processing the data is to provide information about products and services, to maintain business relationships and to properly manage the contracts entered into in terms of financial and operational administration. In order to contact you and identify you, we process the following information to manage the data of our multi-brand customers and suppliers: name, email address, mobile phone number and language, VAT number and financial details.

4.2. What information do we collect from our private customers and for what purposes?
Our private customers buy our fashion products in our retail shops or in our online shop. To be able to identify you as our customer and to communicate with you, we collect the following personal data: last name, first name, address, gender, telephone number, mobile number, language and email address, purchases and payment method.
To keep the purchasing process in our online shop as easy as possible for you, we process so-called “cookies”. These are small files stored on the hard drive of your computer. We use the following cookies:
• Contents of your shopping cart: we save the selected fashion items and sizes.
• The language you selected when you first logged in to the online shop.
You can reject the installation of these cookies by selecting "reject cookies" in the corresponding pop-up screen when you first access the website. If you reject cookies, you may not be able to use certain functions.
Caroline Biss also processes your IP address when you place an order on our website. This personal data allows us to determine the country of origin (to calculate the shipping costs) and to track your location to give you quicker results when you use our store locator.

4.3. Personal data via third parties
We may also process personal data, which is not stored in the database of Caroline Biss, once through third parties. Those companies are responsible for ensuring the personal data concerned is collected lawfully.

4.4. Images from security cameras are temporarily stored
We may use cameras in and around our retail shops. In the case of security cameras, we comply with legal requirements. Buildings with video surveillance are identified by a clearly visible sticker.
Video recordings are stored for a maximum of 15 days. Exceptions:
• if the recorded images can be useful as evidence in a crime or public disturbance.
• to prove damage.
• to identify a perpetrator, a witness or a victim.

5. About sharing and storing your personal data


5.1. With whom do we share your personal data?
We only share your details with persons who have been given explicit authorisation if they need these details to perform their duties. These persons will process your details on the same grounds as we have received them from you.
For the processing of the personal data, we call in the assistance of various processors. These are our subcontractors who carry out personal data processing on our behalf. Caroline Biss only works with processors who guarantee the same technical and operational securities as we do.
In addition, we only share your details if we are required by law or by government order to do so.

5.2. We do not store your details eternally
Caroline Biss uses your personal data with a clear goal in mind. Once this goal has been reached, the data is deleted.
The basic principle for retaining the personal data of our business customers is the legal retention period.
We process the personal data of our private customers up to the moment the customer closes his or her account with Caroline Biss.
The personal data of potentially new multi-brand shops, the prospects, are initially stored for 7 years. Should there have been contact between the prospect and Caroline Biss within this period, a new period of 7 years will commence from this contact.
The personal data of existing multi-brand shops, suppliers, subcontractors, etc. are initially stored for 10 years. Should there have been renewed contact during this period, a new period of 10 years will commence from this contact.