PRIVACY POLICY OF MEDIAHUIS

If you participate in a competition, promotional action or event of a Mediahuis Entity, then such an entity processes your personal data for the management of the competition/action/event and, where appropriate, the designation of the winner on the basis of the contract with you. The processing of your personal data is necessary to manage the competition or action, to organise the event and to contact the winners to hand over the prize.

Participation in a competition, promotional action or event may be subject to competition rules or action or subscribing terms.

Additional recipients: companies or organisations with which the Mediahuis Entity would cooperate for the organisations of the competition, promotional action or event.

Retention period: up to 10 years after the end of the competition, promotional action or event.

When you participate in a survey or market research, the Mediahuis Entity concerned processes your personal data on the basis of your consent. You are always entitled to withdraw your consent.

Additional recipients:

• • • • Companies or organisations with which the Mediahuis Entity would collaborate to conduct the survey or market research;

Retention period: up to a maximum of 3 years after the end of the market research or survey.

If you contact a Mediahuis Entity regarding a question, a request for information or a complaint, then that Mediahuis Entity processes your personal data to take pre-contractual measures at your request so as to answer or help you.

Additional recipients: /

Retention period: up to 10 years after your question, request for information or the answer to your complaint has been made.

A Mediahuis Entity may process your data for direct marketing purposes, in particular:

• • • • To send you the newsletter of the webshop of a Mediahuis Domain. This happens on the basis of your consent.
      • To provide you with commercial information about the Mediahuis Entity with which you have a relationship (e.g. you are a Registered User, you are participating in a competition or promotional action of that Mediahuis Entity, etc.) based on our legitimate interest in keeping you informed of our activities. If you give us consent through your privacy preferences in your account, then we may use Registered Data (e.g. your gender, age and zip code, current subscriptions, etc.) to more accurately deliver our information to you. We combine this Registered Data with Click Behaviour, where available, to best understand your interests. You can change your selection at any time within your account.
  • • • To send you other commercial information (from other Mediahuis Entities or partners). This action will only happen on the basis of your consent. To be clear: Mediahuis receives the commercial information from the partner and then decides who to send it to. The partners are not informed of this and, in the case of partner emails, these partners do not receive any information about you.

You always have the right to withdraw your consent. You can do this via your account page or by contacting the Mediahuis Entity from which you received this information.

Additional recipients: /

Retention period: up to 10 years after the end of the relationship with the Mediahuis Entity that sends you commercial information.

4.6.1 Targeted Advertisements that we show in partnership with Ads&Data

In the context of a cooperation between several partners, the Mediahuis Entities, each process your personal data separately with Ads&Data (Harensesteenweg 226, 1800 Vilvoorde, Belgium, ECB: 0809.309.701) as joint controllers.

Ads&Data? This is an organisation that ensures cooperation between Belgian providers of advertising space that jointly build target groups for advertisements and show personalised advertisements on digital media and television.

The categories of personal data that these Mediahuis Entities and Ads&Data collect and use for the purposes are: Registered Data and Click Behaviour.

The collaboration includes, among other things, that, subject to your consent, these Mediahuis Entities will collect and communicate such personal data to Ads&Data in an encrypted form. Due to this encryption, Ads&Data will not be able to identify you directly. Ads&Data will then use this data to build a personalised advertising profile (e.g. sports fans). Ads&Data uses this to automatically display, with the help of service providers, targeted advertisements on the Mediahuis Domains of these Mediahuis Entities.

More specifically, this means that these Mediahuis Entities each separately process your personal data with Ads&Data for the following purposes and on the basis of the following legal grounds:

• • • • • To create personalised online advertising profiles, based on your consent.
        • For selecting personalised advertisements, based on your consent.
        • To measure advertising performance, based on your consent.

You can withdraw your consent for the above-mentioned purposes at any time in the footer of the page or in the settings of your account.

For these purposes, these Mediahuis Entities will communicate your personal data to Ads&Data in its capacity as the joint controller who will process your personal data to create an advertising profile.

Ads&Data shares your advertising profile with:

• • • • • Processors who process data on our behalf (e.g. IT companies);
        • advertisers who wish to use Ads&Data’s services to display advertising on our websites and applications.

Ads&Data also shares an identification number from your browser with platforms that offer support services for selecting and displaying targeted advertisements. An overview of these platforms can be found here.

Some recipients may be located in countries outside the Economic European Area (EEA). If your encrypted data is transferred to them, then this transfer is covered by appropriate safeguards, including European Commission model clauses, to continue to guarantee an adequate level of protection. You can always ask the DPO for access to the appropriate safeguards.

Ads&Data continuously updates and stores your personal data for a maximum of 13 months.

As a data subject, you have various rights. These are explained later in this privacy policy. You can exercise all these rights regarding both the Mediahuis Entity and Ads&Data, but the Mediahuis DPO acts as a central point of contact.

>4.6.2 Job-related Targeted Advertisements that we show in partnership with HORS

The Mediahuis Entities, HORS BV and Mediahuis NV, work together as joint controllers to show you job-related Targeted Advertisements on Mediahuis Domains.

HORS? That is the abbreviation for House of Recruitment Solutions. This is the Mediahuis Entity that provides Jobat’s services.

The categories of personal data that Mediahuis NV and HORS collect and use for the purposes are: Registered Data (age, postcode, gender, email address and certain information from your CV) and Click Behaviour.

This cooperation implies that, with your consent, Mediahuis NV and HORS will collect personal data on their Mediahuis Domains. Mediahuis NV will transmit the data it collects to HORS in an encrypted form. Due to the encryption, HORS will not be able to identify you directly. HORS then uses this data to build a personalised advertising profile and segments (e.g. whether there is an interest in IT jobs). HORS uses this to show targeted advertisements in an automated way on the Mediahuis Domains of these Mediahuis Entities, with the help of service providers.

Specifically, this means that Mediahuis NV and HORS process your personal data for the following purposes and on the basis of the following legal grounds:

• • • • • To create personalised online advertising profiles, based on your consent.
        • For selecting personalised advertisements, based on your consent.
        • To measure advertising performance, based on your consent.

You can withdraw your consent for the above-mentioned purposes at any time in the footer of the page or in the settings of your account.

For these purposes, the Mediahuis Entities will communicate your personal data to HORS as the joint data controller who will then process them to create an advertising profile.

HORS will share your advertising profile with

• • • • • Processors.

HORS also shares an identification number from your browser with platforms that provide support services for selecting and displaying targeted advertisements. You can find a list of these platforms here.

Some recipients may be located in countries outside the Economic European Area (EEA). If your encrypted data is transferred to them, then this transfer is covered by appropriate safeguards, including the European Commission model provisions, to continue to guarantee an adequate level of protection. You can always ask the DPO for access to the appropriate safeguards.

HORS constantly updates your personal data. Click Behaviour will be kept for a maximum of 13 months. Registered Data will be retained in accordance with the retention period set out in section 4.3.

As a data subject, you have various rights. We will explain these rights later in this privacy policy. You can exercise these rights regarding both the Mediahuis Entity and HORS.

If you are a visitor to a Mediahuis Entity, then each Mediahuis Entity processes your personal data, in the context of visitor management based on its legitimate interests (e.g. guided tours for schools, a meeting with a Mediahuis business contact, inspection of the archive, etc.).

Additional recipients: /

Retention period: up to 1 year after your last visit.

If you supply products or services to a Mediahuis Entity, then this Mediahuis Entity processes your personal data in the context of supplier management based on the need to perform the agreement with you.

Additional recipients: /

Retention period: up to 10 years after the last delivery.

If you apply for a job at one of the Mediahuis Entities, then this Mediahuis Entity processes your personal data for:

• • • • The management and evaluation of the application in the context of the pre-contractual relationship;
  • • • Maintaining a recruitment reserve list based on its legitimate interest. Our justified interest consists of contacting you later for a job opportunity if there is no vacancy immediately available. If you do not wish to be included in the recruitment reserve list, then you can always object to this.

For these processing purposes, we may receive personal data from: the recruitment agency. This concerns the following categories of personal data: contact details, CV, work history, diplomas, training, references and other relevant information for the application.

Additional recipients:

• • • • Contracting agencies;
      • Previous employers (to verify references provided).

Retention period: each Mediahuis Entity will retain your personal data for up to 5 years after the application process has ended.

If a Mediahuis Entity processes your personal data for one of the purposes set out above, then that entity processes your personal data as well for the following purposes:

• • • • the detection of, prevention of and fight against fraud and abuse based on its legitimate interest. Less fraud and abuse benefits the Mediahuis Entity, its customers and its suppliers.

Additional recipients:

• • • • judicial, police or administrative authorities if the law or the circumstances require it;
      • professional advisers (lawyers, consultants, etc.).

Retention period: up to 10 years after the establishment of the facts of fraud or abuse, unless the detection or fight would take longer.

• • • • dispute management based on the law of 30 July 2018 (art. 10§1,1°) and our legitimate interest, as each Mediahuis Entity must be able to safeguard and defend its rights.

Additional recipients:

• • • • judicial, police or administrative authorities if the law or the circumstances require it;
      • professional advisers (lawyers, consultants, etc.).

Retention period: up to 10 years after the end of the dispute, unless the management of a specific dispute requires personal data to be kept for a longer period.

• • • • company law transactions and co-operations: personal data may always be processed in the context of discussions, investigations, evaluations, negotiations and implementing measures in connection with a cooperation or corporate transaction (acquisition, merger, sale of shares or assets, joint venture, etc.) by a Mediahuis Entity. This is done based on our legitimate interest to i) enable the legal entities contemplating such an operation to become acquainted with each other’s personal data and ii) for the merger or acquisition to actually take place.

Additional recipients:

• • • • third parties with whom a corporate transaction or cooperation is envisaged;
      • professional advisers to the parties concerned (lawyers, consultants, etc.);
      • judicial, police or administrative authorities if required by law or circumstances.

Retention period: up to 10 years after the termination of the corporate transaction or cooperation.