Privacy policy

Privacy Policy

1. Introduction

This Privacy Policy (the “Policy”) concerns EXOSPEND S.A., having its registered office at 1000 Brussels,Cantersteen 47, Belgium, registered under the number BE 0805.721.491.Hereinafter referred to as “Exospend”, “we” or “us”.

All capitalised terms not defined in this Policy shall have the meaning given to them in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to theProcessing of personal data and on the free movement of such data and repealingDirective 95/46/EC (“General Data Protection Regulation” or “GDPR”).

YourPersonal data and your privacy are protected by Exospend in accordance withBelgian and European regulations on the protection of privacy. Please read thisPolicy very carefully. The following describes not only your rights, but also the way in which you can exercise these rights.

2.Scope

Exospend considers the protection of privacy as being of fundamental importance and would like to enable you, during your interactions with Exospend to retain full control over your personal data.

2.1.Services and platforms operated by Exospend

Exospend operates, owns and/or uses the following platforms and services:

• Exospend Website
• Data Collect
• Exospend App

2.2.Marketing activities of Exospend

Exospend will use your personal data for marketing activities (such as for instance direct marketing or customer profiling) after receiving your consent if necessary. You may at any time withdraw this consent and object to the processing of your personal data for marketing purposes.

You shall object to the processing of your personal data by clicking onthe unsubscribe button.

3.Who processes your personal data and how can you contact Exospend?

Weare responsible for the processing of the personal data you may provide wheninteracting with us.

4.Types of information Exospend may collect from you

Exospendmay collect, store and use certain of your personal information when you visitour website, our platforms, use our app and services or when we performmarketing activities.

Thisinformation may include your names, business names, address, email address andtelephone number, business number, IBANs and other financial details relevantto processing your gift card loads/transactions, or other services provided byExospend.

5.How can we collect your personal data and what do we do with it?

5.1Collection of your personal data

Wemay collect your personal information via cookies or when you :  

• Visit our websites and platform;
• Contact us via an email, via telephone or via our website;
• Complete a voluntary customer satisfaction form;
• Complete a voluntary customer testimonial form;
• Use our services;
• complete a book a demo form;
• complete a sample request form;
• complete the “contact” us form;
• enter your email address to subscribe for the Exospend newsletter and to receive direct marketing messages.

5.2 Actions of Exospend

5.2.1Processing of your personal data

Exospendmay process your personal data this information to:

• provide you with information and/or services that you request from us;
• answer your questions;
• provide you with improved product offerings and client services;
• improve your customer and/or user experience.

5.2.2 Potential sharing of your personal data

Exospendwill only share your personal data in a minimal manner. However, in order tofollow up on your request or action on the platforms and services, Exospend maysometimes need to share personal data with third parties (Processors and/orSub-contractors).

Exospend’sData Processors and Sub-contractors always act under Exospend’s responsibility.If Exospend contracts with Processors or Sub-contractors, this will always bedone in accordance with a Data Processing Agreement that meets the requirementsof the GDPR. Exospend does not rent, sell, or share your personal data withother persons.

Asa member of the Loyaltek Group, we work closely with the Group's othercompanies worldwide. Your personal data may therefore be shared betweenLoyaltek group entities comply with our various legal and regulatoryobligations described above; fulfil our legitimate interests and those of theentities of the Loyaltek Group, which are: managing, preventing, detectingfraud; conducting statistical studies and develop predictive and descriptivemodels for business, security, compliance, risk management and anti-fraudpurposes;enhancing the reliability of certain data about you held by otherGroup entities

Withrecipients outside Loyaltek Group and processors

Inorder to fulfill some of the purposes described in this Privacy Notice, we may,where necessary or provided for in our services, share your personal datawith:processors which perform services on our behalf e.g., IT services,logistics, printing services, telecommunication, debt collection, advisory anddistribution and marketing.banking and commercial partners, independent agents,intermediaries or brokers, financial institutions, counterparties, publicservices, trade repositories with which we have a relationship if suchtransmission is required to allow us to provide you with the services andproducts or execute our contractual obligations or transaction (e.g., banks,correspondent banks, depositaries, custodians, issuers of securities, payingagents, exchange platforms, insurance companies, payment system operators,issuers or payment card intermediaries, mutual guarantee companies or financialguarantee institutions);local or foreign financial, tax, administrative,criminal or judicial authorities, arbitrators or mediators, public authoritiesor institutions (such as the National Bank of Belgium, FSMA, Caisse des dépôtset des Consignations), to which we, or any member of the Loyaltek Group, arerequired to disclose pursuant to:their request;our defence, action orproceeding;complying with a regulation or a recommendation issued from acompetent authority applying to us or any member of the Paynovate; serviceproviders of third-party payment (information on your bank accounts), for thepurposes of providing a payment initiation or account information service thatyou have taken out with them;certain regulated professions such as lawyers,notaries, or auditors when needed under specific circumstances (litigation,audit, etc.) as well as to our insurers or to an actual or proposed purchaserof the companies or businesses of the Loyaltek group;universities and publicand/or private scientific institutions.

Exospendwill use all reasonable efforts to ensure that your personal data is notdisclosed to regional/ national institutions and authorities, unless requiredby law or other regulations.

6.Legal basis on which we process your personal data

Exospendprocesses your personal data based on the following legal grounds :

• The processing of certain of the above-mentioned personal data by us and other information you might disclose, is necessary for the performance of the platforms and of the services we provide. In the event you refuse to provide this personal data, we will not be able to comply with certain obligations(e.g. responding to your questions, processing your demo booking or sample request, etc).
• The consent you provide is always free, and you have the right to withdraw this consent at any time. Withdrawal of consent does not affect the processing of personal data (i) prior to such withdrawal, (ii) based on a legitimate ground for processing personal data, and (iii) in case of a legitimate interest of the processing.
• Legitimate interest as a legal basis for the lawfulness of processing is justified with regard to the personal data to improve your user experience, to improve the services and the products we develop, operate and own. The fact that Exospend processes this personal data also benefits you as a user of our platforms and services and products. A processing of personal data on such ground may not override your fundamental rights.
• The compliance with legal obligations.

7.Transfer of personal data to countries outisde the European Economic Area (EEA)

Inprinciple, Exospend does not transfer your personal data to countries outsidethe EEA. It is, however, possible that Exospend, through its Processors orSub-processors, does transfer your personal data to countries outside the EEA.

Shoulda less strict protection for personal data apply in a specific country thanwithin the EEA, Exospend will then ensure that the same level of protection isachieved (e.g. by concluding an agreement with the Processor located in acountry outside the EEA).

8.Cookies

Pleaserefer to our Cookies Policy available here.

9.How long will Exospend retain your personal data?

Weretain your personal data for as long as necessary for the purposes describedin Section 5 of this Policy, or according to the relevant legislationapplicable.

Forexample, we retain your personal data only as long as necessary having regardto your business relationship with Exospend and, if applicable, the terminationthereof, or as long as required to comply with Exospend’s legal obligations.

Incase of litigation, we may keep your personal data until the litigation isfully resolved. We will then either delete or archive it according toapplicable law.

10.How does Exospend safeguard you personal data?

Exospendhas developed appropriate technical and organisational measures, safeguards andassurances to Process your personal data in accordance with applicable Belgianand European regulations, in particular to protect your personal data againstloss, misuse, or unauthorised alteration.

Exospendmakes all reasonable and appropriate efforts to protect the confidentiality ofyour personal data.

Despitethe technical and organisational measures taken by Exospend, you should beaware that there are always risks associated with sending personal data overthe Internet. The security and protection of your personal data can never befully guaranteed.

11.Your rights in regard to the processing of your persona data

Inas far as provided for in the applicable Belgian and European regulations, youhave the following rights:

Object: You have the right to object at any time to theprocessing of your personal data based on a legitimate interest of Exospend,for example when used for (direct) marketing purposes, for profiling to sendyou targeted advertising, or for sharing your data with third parties or withother entities within the Exospend.

Withdrawal: In cases where you have given your previousconsent for your personal data to be processed, you can withdraw that consentat any moment. This does notaffect the lawfulness of processing based on consent before its withdrawal.

Access: You can request access to or a copy of your personaldata we maintain about you. You may also request information on the purposes ofthe processing, categories of data, categories of recipients, data retentionterms, etc.

Portability: You may have the right to obtain a copy of anypersonal data that we hold about you in our records in a compatible format toallow you to exercise your right to data portability.

Restriction: You have the right to request a restriction of theprocessing of your personal data in the following cases:

• for a period enabling Exospend to verify the accuracy of your personal data in theevent you contest the accuracy of your personal data;
• if the processing is unlawful and you wish to restrict the use of your personaldata rather than deleting it;
• if you wish Exospend to keep your personal data because you need it for yourdefence in the context of legal claims;
• if you have objected to the processing but Exospend needs to check whether it haslegitimate grounds for such processing which may override your own rights.

‍Rectification: You may also have the right to correct inaccurate personal data and to complete incomplete personal data.

Erasure: You may have the right to request the deletion of your personal data in the following cases:

• if your personal data is no longer necessary for the purpose of the dataprocessing;
• if you have withdrawn your consent and there is no other legal ground for theprocessing;
• if you have objected to the data processing and there is no overriding legitimateground for Exospend;
• if the personal data have been unlawfully processed;
• if the personal data must be erased to comply with a legal obligation applicableto Exospend.

Incase of erasure, we will take reasonable steps to inform other Exospendentities which might be involved in the data processing of such erasure.

Ifand to the extent provided for in the applicable Belgian and Europeanregulations, you have the right to file a complaint with the competentsupervisory authority should the Processing of your personal data violate theapplicable regulations. In Belgium where Exospend is incorporated, this is theData Protection Authority (Data Protection Authority, Rue de la Presse 35, 1000Brussels, Belgium, contact@apd-gba.be,www.dataprotectionauthority.be) .

12.Amendments to this policy    

Exospendmay amend this Policy at any time. Any amendments Exospend may make to thisPolicy in the future will be posted on this page and, where appropriate, youmay be notified by email. Amended versions of this Policy take effect ten (10)days after their publication on the platforms and services. Where required theywill always be submitted for approval.

13.Disclosure

Wemay disclose your personal data if this is required by law, or if Exospenddetermines in good faith that such disclosure is required in order:

• to comply with any pending judicial inquiry, judicial order or litigationpertaining to platforms and the services;
• to compel observance of the general terms and conditions of Exospend accepted byyou ;
• to respond to claims against Exospend regarding personal data that violate anyrights of third parties;
• to safeguard the rights, property and safety of Exospend, its employees, users,and the general public.

Exospendmay disclose your personal data to competent police or judicial authorities orother official government authorities if Exospend deems this useful ornecessary, in its sole discretion, for the investigation of fraud, intellectualproperty infringement or any other harmful activity, or if Exospend reasonablysuspects that such activity may expose Exospend or you to any liability.

14.Whow to contact for questions regarding the processins of your personal data?

Exospend has appointed adata protection officer whom you can always contact for questions and concernsabout your privacy and the Processing of your personal data and to exerciseyour rights as mentioned in Section 12. The privacy officer can be reached byemail at : privacy@exospend.com