1. What is the purpose of the confidentiality policy and who does it concern?

For the purposes of its business activity, BEM'S collects and processes personal data. The processing of such data is subject to regulations on the protection of personal data and, in particular, to the General Data Protection Regulation (the "GDPR").

To this end, we are committed to protecting your privacy and ensuring the confidentiality of your personal data.

This Privacy Policy governs the manner in which we collect, use, store and transfer information that we collect from our customers, suppliers and users of the website (www. probems.be), or from our prospective customers. This privacy policy applies to the website and all products and services offered by BEM'S.

By means of this policy, we inform you, as a customer, prospective customer acting as a natural person, agent or representative of a customer, supplier or prospective customer (hereinafter referred to as "you"), about how we use your personal data and about your rights in relation to the use of said data.

This policy supplements the information you receive when you interact with us and informs you of your rights in relation to the use of this data.

2. Who processes your personal data?

BEM'S is the legal entity responsible for processing your data ("we" or "us").

SA BEM'S is a company incorporated under Belgian law and registered with the Banque Carrefour des Entreprises (BCE) under number 0450.159.578. Its registered office is at Avenue Zénobe Gramme 19, 1300 Wavre (Belgium).

3. What data about you do we process and for what purposes?

We may collect personal information in various ways, in particular when you visit our site, create a customer account on the website, place an order, request support, or when you communicate data to us during a contact with you.

3.1. Customer account management

Context and purpose. We offer an online service enabling the creation of customer accounts reserved for professionals for the management of pre-orders or online orders. The creation and management of these customer accounts involves the use of personal data. We also process the data associated with this account to ensure access, security and operation.

Categories of data used. We use data in the following categories:

• Identification details (surname, first name) ;
• Contact details (e-mail and postal addresses, telephone numbers);
• Professional status and professional identification details (company number (BCE, SIRET, etc.) / VAT) ;
• Sector of activity ;
• Delivery details (delivery address) ;
• Billing data (billing details) ;
• Data relating to electronic services (user IDs, passwords, connection data, electronic communications data, etc.).

Legal basis. Data is processed insofar as it is necessary for the performance of a contract concluded with you or to respond to a request from you prior to the conclusion of a contract (article 6, 1, b) of the RGPD). When, in the course of our activities, data concerning persons other than those who subscribe to the contract is provided to us (agent or contact person within a company), we consider that we have a legitimate interest in using this data in order to follow up the request or to perform a contract (article 6, 1, f) of the RGPD).

3.2. Managing our contracts and customer database

Context and purposes. We collect your data to build up our customer and contract database, which enables us to centrally manage the various contracts we conclude with you and to monitor our commercial relations with you. We use the data for the negotiation, conclusion and performance of the contract, as well as support and after-sales service for our customers.

Categories of data used. We use data in the following categories:

• Identification details (surname, first names, customer number, etc.) ;
• Data relating to position or mandate within a company ;
• Contact data (e-mail and postal addresses, telephone numbers, language of contact, etc.);
• Financial identification data (bank account number, banking institution, etc.) ;
• Financial data (amount and use of credit line, etc.)
• Professional identification details (company number (BCE, SIRET ...) / VAT) ;
• Data relating to purchases and services subscribed to ;
• Data generated by the performance of the contract ;
• Delivery details (delivery address, proof of delivery, etc.);
• Invoicing and payment data (date of payment, direct debit, currency, legal entity for invoicing, existence of third-party financing, etc.).

Payment details are collected for the sole purpose of being passed on to the payment service provider you select as part of the purchase process. We do not store them.

Legal basis. Data is processed insofar as it is necessary for the performance of a contract concluded with you or to respond to a request from you prior to the conclusion of a contract (article 6, 1, b) of the RGPD). When, in the course of our activities, data concerning persons other than those who subscribe to the contract is provided to us (agent or contact person within a company), we consider that we have a legitimate interest in using this data in order to follow up the request or to perform a contract (article 6, 1, f) of the RGPD).

3.3. Follow-up on contacts

Context and purposes. We allow users of our website to contact us by e-mail.

Categories of data used. The information you provide will be used by our internal departments to respond to your request.

Legal basis. We consider that we have a legitimate interest in processing this information in order to be able to respond to the request made to us (Article 6, 1, f) of the GDPR).

Where the purpose of contacting you is to enter into a contract with us, your data will be used as described in section B.

3.4. Customer prospecting

Context and purposes. We collect and use data about you relating to purchases and services subscribed to as well as your needs and interests for our products in the medium or longer term in order to establish or maintain a commercial relationship over time.

This data may relate to potential and existing customers. The data is obtained from publicly accessible sources or provided during a commercial contact (for example, a business card handed out at a trade fair, or an interview with one of our employees). Where appropriate, it is combined with data we already have in our customer database.

Categories of data used. We use data in the following categories:

• Identification data (surname, first names, title, customer number, etc.) ;
• Data relating to position or mandate within a company ;
• Contact details (e-mail and postal addresses, telephone numbers, etc.);
• Professional identification details (ECB/VAT number) ;
• Business sector data ;
• Data relating to purchases and services subscribed to ;
• Data generated by the performance of the contract ;
• Data relating to contacts and discussions we have with you concerning your needs.

Legal basis. We believe that we have a legitimate interest in using your data to be able to identify our customers' needs and contract opportunities in the medium and longer term (article 6, 1, f) of the RGPD).

3.5. Evaluation and continuous improvement of our activities

Context and purposes. The information you provide us when you contact us as part of an after-sales or support service helps us to respond more effectively to your requests and continually improve our offer.

Categories of data used. We may use information provided by post, e-mail or telephone which falls into the following categories:

• - Identification data (surname, first names, customer number, etc.) ;
• - Data relating to position or mandate within a company ;
• - Contact details (e-mail and postal addresses, telephone numbers, etc.);
• - Professional identification details (company number (BCE, SIRET ...) / VAT) ;
• - Data relating to purchases and services subscribed to ;
• - Data collected during contact with you.

Legal basis. We believe we have a legitimate interest in being able to collect and use information about the suitability and quality of our product offering and to enable our suppliers to be able to do the same about their products that you have acquired through us (Article 6, 1, f) of the GDPR).

3.6. Promoting and developing our business

(1) Sending commercial communications

We use customer data for the purposes of sending marketing communications to our customers about our offers and news (including our newsletter). We consider that it is in our legitimate interest to be able to send communications about our activities to people who have expressed an interest in acquiring our products (article 6, 1, f) of the RGPD). You may at any time object to receiving such mailings by contacting us as explained in section 8 or by unsubscribing from mailings.

(2) Statistical analysis

We also use data relating to our customers and contracts concluded to carry out global data analyses. We consider that we have a legitimate interest in being able to develop a better understanding of the sectors in which we are active through the analysis of the data that we possess and that relates to our activities (article 6, 1, f) of the RGPD). We do not carry out individual profiling of our customers.

3.7. Managing our tax and accounting obligations

Context and purposes. Data concerning you may also appear in our accounting documents (invoices, account statements, bank statements, etc.).

Categories of data. We use data in the following categories:

• Identification data (surname, first names, title, customer number, etc.) ;
• Data relating to position or mandate within a company ;
• Contact details (e-mail address, postal address, etc.) ;
• Financial identification data (bank account number, etc.) ;
• Professional identification details (ECB/VAT number) ;
• Billing and payment data.

Legal basis: This data is processed in order to meet our accounting and tax obligations (article 6, 1, c) of the RGPD).

3.8. Managing rights, complaints and disputes and defending our interests

Context, objectives and legal basis.

- In the event of a complaint or dispute, the data of customers or our suppliers is processed to ensure its management and follow-up. We consider that we have a legitimate interest in being able to process this data in this context (Article 6, 1, f) of the GDPR). This may also concern debt recovery.

- In addition, to comply with the requirements of the General Data Protection Regulation (GDPR), we may need to process your data. This is particularly the case if you exercise your rights (see section on this below), if we have to manage security incidents that affect your data or if we have to respond to a request from a competent supervisory authority under the GDPR (article 6, 1, c) of the GDPR).

Categories of data. We may potentially process all data concerning you that is relevant to a dispute or complaint. In addition to the data in our possession, we may be provided with data contained in the files of third parties (lawyers, bailiffs, etc.) or we may collect and use publicly available data (judicial reorganisation, bankruptcy, etc.).

4. How long do we keep your data?

The data retention period is determined according to the following criteria:

• The duration of our commercial relationship with the customer (for customer relationship management),
• The operational need to retain data in order to fulfil orders addressed to us or to respond to requests addressed to us;
• The legal obligation to retain data (e.g. for accounting and tax purposes);
• The legal period during which we may be held liable;
• The need to retain data in order to defend our interests for the duration of the dispute and, where applicable, the proceedings (in the event of a dispute or complaint).

Customer accounts are kept for as long as the commercial relationship lasts. They are deleted in the event of inactivity, 3 years after the last order.

5. Are your details passed on to third parties?

Data relevant to the contract may be passed on internally and to third parties for the purposes of fulfilling the contract.

We may share your personal information with third parties in the following situations:

• For the purposes of fulfilling a contract, when we use external service providers to deliver products;
• To suppliers of third-party products or services where this is necessary for the performance of the contract (or credit insurance for customers with a credit line, third-party payment services, after-sales service, etc.);
• To our service providers who act on our behalf and on our instructions for office applications (email management, file processing, collaborative tools, etc.), IT applications (emailing, ticketing support, etc.) or for the technical management of our website and our ERP;
• To the tax authorities to meet our tax obligations;
• When we use the services of external advisors or players (for example, our accountancy office, our banking institutions, a lawyer, a bailiff, a debt collection agency, etc.), your data may be communicated to them for the purposes of providing the services entrusted to them;
• Where this is required in response to a request from a public authority;
• In the event of a dispute, the data may be communicated to third parties (legal advisers/lawyers, insurers, courts and judicial bodies, national supervisory authorities).

6. How do we manage the protection of your data in our information systems?

As "Data Controller", we ensure that all service providers with whom we work implement appropriate security measures to protect your data from unauthorised access, alteration, disclosure or destruction.

For our IT needs, we use service or application providers operating within the European Union to store your data. We use an office cloud service which guarantees that the data processed in these applications is stored within the European Union. These service providers only act on our instructions and are required to comply with strict European data protection laws.

In all cases, we are committed to maintaining a high level of protection for your personal data, wherever it is held.

7. What are your rights?

Data protection regulations give you rights, including those summarised below, but which are subject to limits and/or conditions defined in the regulations:

• The right to request information on the processing of your data;
• The right to request access to your data (obtain a copy);
• The right to request rectification (for example, if you believe the data is inaccurate or out of date) or deletion (for example, because the data is no longer relevant);
• The right to object to the processing of your data in certain cases, in particular when the data is used for canvassing purposes;
• The right to request that the processing of personal data be restricted;
• The right to portability of processed data provided as part of a contract.
• The right to withdraw consent in the future.

8. How can you exercise your rights?

You can contact us by e-mail to exercise these rights or if you have any questions about the protection of your data: [email protected].

In this case, we will process your data to respond to your request in accordance with our legal obligations and will keep proof of the follow-up to your request for the statutory limitation period.

We may ask you to prove your identity by providing us with documentary evidence before processing your request.

You can obtain information from the authority that monitors compliance with the GDPR (the Data Protection Authority). In addition, you have the right to appeal to the courts and to the Data Protection Authority if you believe that the use of your data does not comply with the regulations or that your rights have not been respected.

9. Use of data specific to the website

9.1. Cookies

Our website uses cookies to collect information about your online browsing.

You can manage these cookies using your browser's cookie management and settings module.

For more information on our cookies policy, please see our cookies notice.

9.2. Protection of traffic linked to our website

We use the services of Cloudflare, Inc, 101 Townsend Street, San Francisco, CA 94107, United States, to optimise and secure traffic linked to our website.

Traffic between your browser and our website is analysed to detect any malicious attacks from the Internet. This helps to improve the security and speed of our website. When using Cloudflare, cookies or other technologies are used by Cloudflare to recognise visits to our website. The use of this service implies that traffic data of users of our website (including IP addresses and data on traffic to our websites) are processed.

The legal basis for processing your personal data in this context is Article 6(1)(f) of the GDPR, as we are pursuing a legitimate interest in ensuring the security and optimal operation of our website.

We have activated the regionalisation of processing tool so that data is processed within the European Union. However, as it cannot be ruled out that the IP addresses of visitors to our website are transmitted to Cloudflare from the USA when using Cloudflare's services, EU standard contractual clauses have also been agreed with the service provider to ensure a sufficient level of data protection. For more information on Cloudflare's privacy policy, please visit https://www.cloudflare.com/fr-fr/trust-hub/gdpr/

10. Changes to this privacy policy

We reserve the right to update this Privacy Policy at any time.

We encourage you to consult this page regularly to stay informed about how we use personal information.

Consent to the use of cookies.

We use cookies to ensure that our website functions properly. In order to obtain your valid consent for the use and storage of cookies in the browser you use to access our website and to properly document this, we use a consent management platform: CookieFirst. This technology is provided by Digital Data Solutions BV, Plantage Middenlaan 42a, 1018 DH, Amsterdam, The Netherlands. Website: https://cookiefirst.com referred to as CookieFirst.

When you access our website, a connection is established with the CookieFirst server to give us the opportunity to obtain valid consent from you for the use of certain cookies. CookieFirst then stores a cookie in your browser so that only those cookies to which you have consented can be activated and properly documented. The processed data is stored until the predefined storage period expires or until you request that the data be deleted. Certain mandatory legal retention periods may apply notwithstanding the above.

CookieFirst is used to obtain the legally required consent for the use of cookies. The legal basis for this is Article 6(1)(c) of the General Data Protection Regulation (GDPR).

Data processing agreement

We have concluded a data processing agreement with CookieFirst. This is a contract required by the Data Protection Act, which guarantees that the data of visitors to our website is only processed in accordance with our instructions and in compliance with the GDPR.

Server log files

Our website and CookieFirst automatically collect and store information in so-called server log files, which your browser automatically transmits to us. The following data is collected:

• Your consent status or withdrawal of consent.
• Your anonymous IP address
• Information about your browser
• Information about your device
• The date and time of your visit to our website
• The URL of the web page where you registered or updated your consent preferences
• The approximate location of the user who has registered their consent preferences.
• a universal unique identifier (UUID) of the website visitor who clicked on the cookie banner.