Privacy Policy Samenaankoop app

The following information is intended to give you an overview of the processing of your personal data as part of the installation and use of the mobile application "Samenaankoop" (hereinafter app), and your rights under data protection law.

1. Who is responsible for the data processing and who can I contact?

The responsible authority is:

Samenaankoop KU Leuven vzw
Willem de Croylaan 54
3001 Heverlee
Contact: Peter Bleukx, Managing Director Samenaankoop KU Leuven vzw
Peter.Bleukx@kuleuven.be
Willem de Croylaan 54
3001 Heverlee

2. What sources and data do we use?

In connection with the installation and use of the app, we collect, process and use the data below. This will allow us to improve the features of our app in the future.

If you use the app, we collect, process and use the following data for the above purposes in order to fulfil our contractual obligations within the meaning of Art. 6 (1) (b) of the GDPR or on the basis of legitimate interests within the meaning of Art. 6 (1) (f) of the GDPR (i.e. interest in the analysis, optimisation and cost-effective operation of our app):

• a) Personal Data: In order to use the features of the app, you must be logged into the app with your Samenaankoop account. However, these personal data will not be used or passed on to third parties. The installation and use of the app are registered by Samenaankoop and only used anonymously for statistical reporting
• b) Usage data: The use of the app results in us collecting and storing anonymous data on its use purely for statistical reporting and optimisation of its features
• c) Location data: If you have given the app access to the location feature of your mobile device, the app uses these data to send push notifications about partner suppliers in the immediate vicinity of that location. The location is only used locally on the device, it is never passed on to Samenaankoop or third parties, nor is it stored. The app uses the GPS module of the mobile device for location data.
  
  Personal data and usage data are only used in anonymised form for market research and the production of anonymous statistics.

3. Why do we process your data (purpose of the processing) and on what legal basis?

We process personal data in accordance with the provisions of the General Data Protection Regulation (GDPR).

a) For compliance with contractual obligations (Article 6 (1) (b) of the GDPR)

The primary purpose of data processing is to provide the services and features of our app.

b) In the context of balancing interests (Article 6 (1) (f) of the GDPR)

If necessary, we will process your data in a way that goes beyond what is required for the actual implementation of the contract. We do this to protect our legitimate interests or those of a third party, for example

• to ensure IT security,
• for the management and further development of our app.

c) Consent for location data

We ask your explicit permission for the use of location data. These data are only processed internally by the app. No location data are transmitted to the central back office of Samenaankoop or to third parties, nor does the app store these data.

4. Who gets my data?

Apart from the processing described above, your personal data will only be passed on with your express permission to the partner supplier for whom you have given your express permission.

Within Samenaankoop, access to your data is only granted to those who need it to fulfil our contractual and legal obligations.

5. Will data be transferred to a third country or to an international organisation?

Data are only transferred to locations in countries outside the European Union (so-called third countries) with your express consent and only to the extent that

• this is necessary to carry out your orders,
• this is required by law,
• for the processing of order data.

If third-country service providers are used, they are obliged to comply with the level of data protection in Europe. If necessary, Samenaankoop will make the necessary arrangements with the relevant party (parties).

6. How long is my personal information kept?

Personal data required for accounting purposes must be kept for a minimum of ten years (legal obligation). So if a customer stops using the services offered by Samenaankoop, the necessary data will still be kept in the accounts for the next ten financial years.

Personal data from the operational database are anonymised two years after the transaction to which they relate. After this period, these data can only be used anonymously for statistical purposes and policy support.

When a customer stops using Samenaankoop services, their data may still exist in our backups after the retention period. The data in the backups will not be used by Samenaankoop. In the event that these backups are restored, for example following a technical malfunction, all data older than two years will immediately be re-anonymised.

Samenaankoop uses the personal data in the accounts only for the necessary accounting and administrative tasks. Only anonymised data are used for statistical reporting.

7. What data protection rights do I have?

Each person involved has

• the right to information under Article 15 of the GDPR
• the right to rectification under Article 16 of the GDPR
• the right to erasure under Article 17 of the GDPR
• the right to restriction of processing under Article 18 of the GDPR
• the right to object pursuant to Article 21 of the GDPR as well as the right to data transfer pursuant to Article 20 of the GDPR
• With regard to the right to information and the right to erasure, the restrictions of §§ 34 and 35 GDPR apply accordingly. In addition, there is a right of ​​recourse to a competent data protection supervisory authority (Section 77 GDPR in conjunction with § 19 GDPR).

You may withdraw your consent to the processing of personal data at any time. Please note that the withdrawal is only valid in the future. The above has no effect on any processing that took place prior to the revocation.

In the first instance, the customer may exercise the aforementioned rights by contacting the data controller (section 1).

Complaints can also be lodged to the Data Protection Authority:
https://www.dataprotectionauthority.be/citizen/actions/lodge-a-complaint

8. Am I obliged to provide data?

You can only use the app after registering and activating an account on www.samenaankoop.org.
You must, in the process, provide the minimum information necessary for identification. In addition, the postcode and year of birth are requested for anonymous statistical data processing.

Additional personal data can be requested if they are necessary for a specific transaction, e.g. the home address in the context of a delivery.

9. To what extent is there an automated decision-making process?

We do not use fully automated decision-making in accordance with Article 22 of the GDPR.

10. Specific privacy policy for payment services

We use third-party services to provide payment services to you. We ourselves do not share any personal data with this payment service:

• Mollie: Mollie B.V. Keizersgracht 126, 1015 CW Amsterdam, The Netherlands