Privacy Policy

1. Introduction

1.1 What is this policy about

This is the data protection policy of ALTIUS BV, having its registered office at 1000 Brussels, Havenlaan – Avenue du Port 86C, box 414, company number 0476.389.071, telephone +32 2 426 1414, fax +32 2 426 20 30 (hereinafter “we”, “us” or “our”) with regard to the processing of data of persons external to our organisation (clients, prospects, commercial contacts, suppliers, visitors to our buildings or website, participants in activities and candidates).

This policy applies only to the processing of data of physical persons, not of legal persons.

The policy may be updated from time to time.

1.2 How do we receive your personal data?

Usually you give us your personal data yourself. Sometimes we receive your contact details via the organisation where you work (your employer, your instructing party, etc.).

In some cases we can also find, update, supplement and improve your contact details via public sources and social networks.

1.3 What is our data processing role?

As a rule, we process your personal data as controller (see section 2 below). In exceptional cases, we can also process your personal data acting as processor (see section 3 below).

1.4 Do we share your personal data outside the European Union?

Our servers are located in Belgium and we will not transfer your personal data to countries outside Belgium or the European Economic Area except (i) at your request, or (ii) to the extent necessary for the institution, exercise or substantiation of a legal claim.

In the context of the use of some software applications, personal data may however be temporarily transferred to countries outside the Economic European Area. In such a case, an adequate level of protection is provided through the use of the European Commission’s Standard Clauses.

1.5 Do you have a question or complaint?

If you have any questions or complaints about the processing of personal data, you can always contact our privacy chief:

ALTIUS BV
To the attention of the Privacy Chief
Havenlaan – Avenue du Port 86C, B414
1000 Brussels
Tel. +32 2 426 1414

privacy@altius.com

You can also always lodge a request or complaint with the supervisory authority of the place where you reside. For Belgium, this is:

Data Protection Authority
Drukpersstraat 35 – Rue de la Presse 35
1000 Brussels

contact@apd-gba.be

Tel. +32 2 247 48 00.

https://www.dataprotectionauthority.be/

2. Our processing of personal data as controller

As a rule, when you entrust personal data to us, we act as controller for the processing of your personal data for different purposes, depending on your relationship with us.

2.1 Different processing depending on your relationship with us

2.1.1 You are a client of ALTIUS

If you are our client or work at/for our client, we process your personal data as controller for the following purposes:

  • Client management (file management, client relationship management, invoicing, recovery, etc.) according to the need to execute a contract concluded with you. Without your personal data, we cannot execute the contract;
  • Representing and/or defending your interests in court on the basis of the need to execute a contract with you. We process personal data relating to criminal convictions and criminal offences on the basis of the Act of 30 July 2018 (art. 10§1,2°);
  • Any mandatory notification based on the need to respect a legal obligation that we must comply with (e.g. anti-money laundering notifications and KYC declarations) ;
  • Direct marketing based on the need to promote our legitimate interest. Our legitimate interest is to better serve you as a client by keeping you informed of our activities and expertise;

We keep your personal data for a maximum of 10 to 30 years after the file is closed, depending on the type of file and the applicable limitation periods.

If you entrust us with personal data of persons other than yourself (contact persons, etc.) in the context of the handling of a file, we assume that you are processing this data legally and that you can communicate it to us.

In order to achieve these purposes, we may share your personal data with:

  • employees, working students, trainee attorneys, attorneys and partners of or affiliated with ALTIUS, insofar as they need your personal data for the performance of their duties;
  • subcontractors who process personal data on our behalf (processors);
  • the bar authorities, in the context of our deontological or legal obligations;
  • courts, lawyers outside ALTIUS, bailiffs, notaries, judicial experts and other judicial actors to the extent necessary for the handling of a file or the institution, exercise or substantiation of a legal claim;
  • independent consultants to the extent necessary for the organisation of ALTIUS, the handling of a file or the institution, exercise or substantiation of a legal claim;
  • judicial, police or administrative authorities, where required by law or to the extent necessary for the handling of a file or the institution, exercise or substantiation of a legal claim;
  • legal assistance insurers when our services are covered by a legal assistance insurance;

2.1.2 You are a prospect of ALTIUS

If you are a potential client, we process your personal data as controller for the following purposes:

  • Prospecting management on the basis of your consent (if you have provided us with your contact details yourself), on the basis of the need to look after our legitimate interest (if we have received your contact details from a third party, e.g. a public source), or on the basis of the need to take pre-contractual measures (if you wish to become a client). Our legitimate interest mentioned above is to identify market opportunities;
  • Direct marketing based on your consent.

You can always withdraw your consent.

We retain your contact details for up to 10 years after you become inactive as a prospect.

In order to achieve these purposes, we may share your personal data with:

  • employees, working students, trainee attorneys, attorneys and partners of or affiliated with ALTIUS, insofar as they need your personal data for the performance of their duties;
  • subcontractors who process personal data on our behalf (processors);

2.1.3 You are a commercial contact of ALTIUS

If we are in contact with you for business purposes other than as a client or prospective client (you are or work for a bailiff, judicial expert, government agency, law firm, etc.), we process your personal data as controller for the following purposes:

  • Communication management on the basis of the need to look after our legitimate interest. Our legitimate interest consists of being able to communicate with legal actors;
  • Defending the interests of clients on the basis of the need to look after our legitimate interest. Our legitimate interest consists in defending the interests of our clients.

We keep your contact details for as long as we are in contact with you.

In order to achieve these purposes, we may share your personal data with:

  • employees, working students, trainee attorneys, attorneys and partners of or affiliated with ALTIUS, insofar as they need your personal data for the performance of their duties;
  • subcontractors who process personal data on our behalf (processors);
  • courts, lawyers outside ALTIUS, bailiffs, notaries, judicial experts and other judicial actors to the extent necessary for the handling of a file or the institution, exercise or substantiation of a legal claim;
  • independent consultants to the extent necessary for the organisation of ALTIUS, the handling of a file or the institution, exercise or substantiation of a legal claim;
  • judicial, police or administrative authorities, where required by law or to the extent necessary for the handling of a file or the institution, exercise or substantiation of a legal claim;
  • legal assistance insurers when our services are covered by a legal assistance policy;

2.1.4 You are a supplier of ALTIUS

If you provide products or services to us (with the exception of the lawyers affiliated with ALTIUS), or if you work at/for one of our products/services suppliers, we process your personal data as controller for supplier management purposes on the basis of the need to execute a contract concluded with you. Without your personal data, we cannot execute the contract.

We keep your personal data for a maximum of 10 years after the last delivery.

In order to achieve this purpose, we may share your personal data with:

  • employees, working students, trainee attorneys, attorneys and partners of or affiliated with ALTIUS, insofar as they need your personal data for the performance of their duties;
  • subcontractors who process personal data on our behalf (processors);

2.1.5 You are a visitor in the offices of ALTIUS

If you visit our offices, we will process your personal data as controller for the following purposes:

  • Visitor management on the basis of the need to look after our legitimate interest. Our legitimate interest consist of being able to guarantee (fire) safety, confidentiality and the organisation of activities/meetings;
  • Direct marketing based on your consent. You can withdraw your consent at any time.

We keep your personal data up to a maximum of 2 years after your last visit.

In order to achieve these purposes, we may share your personal data with:

  • employees, working students, trainee attorneys, attorneys and partners of or affiliated with ALTIUS, insofar as they need your personal data for the performance of their duties;
  • subcontractors who process personal data on our behalf (processors);
  • independent consultants to the extent necessary for the organisation of ALTIUS, the handling of a file or the institution, exercise or substantiation of a legal claim;
  • judicial, police or administrative authorities, where required by law or to the extent necessary for the handling of a file or the institution, exercise or substantiation of a legal claim;

2.1.6 You are a participant in one of ALTIUS’ activities

If you participate in an ALTIUS activity (reception, seminar, webinar, etc.), we will process your personal data as controller for the following purposes:

  • The organisation of the ALTIUS activity based on the execution of the agreement with you, in particular your subscription to our activity;
  • Direct marketing on the basis of the need to look after our legitimate interest. Our legitimate interest is to keep you informed of other ALTIUS activities as well as our expertise in order to serve you even better.

We keep your personal data for up to 10 years after you have become inactive as a contact.

In order to achieve these purposes, we may share your personal data with:

  • employees, working students, trainee attorneys, attorneys and partners of or affiliated with ALTIUS, insofar as they need your personal data for the performance of their duties;
  • subcontractors who process personal data on our behalf (processors);

2.1.7 You are a visitor to ALTIUS’ website

If you visit our website, we process your personal data as controller for the following purposes:

  • To answer your question or request for information in order to take pre-contractual measures at your request;
  • For direct marketing, among other things to keep you informed about ALTIUS’ activities, if you agree;
  • For the placing and reading of cookies, if you agree. You can find more information regarding our use of cookies in the cookie policy.

You can revoke your consent at any time.

In order to achieve these purposes, we may share your personal data with:

  • employees, working students, trainee attorneys, attorneys and partners of or affiliated with ALTIUS, insofar as they need your personal data for the performance of their duties;
  • subcontractors who process personal data on our behalf (processors);
  • the third parties mentioned in the cookie policy;

2.1.8 You are an applicant for a job at ALTIUS

If you apply for a job with us or participate in job fairs, we process your personal data relating to the application as controller for:

  • The handling and evaluation of your application in the context of the taking of pre-contractual measures;
  • Maintaining a recruitment reserve based on the need to look after our legitimate interest. Our legitimate interest consists of contacting you later for a job opportunity if there is no vacancy immediately available. If you do not wish to be included in the recruitment reserve, you can always object to this.

We keep your personal data for a maximum of 10 years after your application (unless you object thereto).

In order to achieve these purposes, we may share your personal data with:

  • employees, working students, trainee attorneys, attorneys and partners of or affiliated with ALTIUS, insofar as they need your personal data for the performance of their duties;
  • subcontractors who process personal data on our behalf (processors);
  • the bar authorities, in the context of our deontological or legal obligations.

2.1.9 You use a legal tech tool provided by ALTIUS

If you want to access a legal tech tool that we provide (eg ALTIUS PREAVIZ), we process your personal data as controller based on the need to perform a contract with you (i.e. to grant you the requested access).

We keep your personal data for a maximum of 10 years after your last use of the legal tech tool.

In order to achieve this purpose, we may share your personal data with:

  • employees, working students, trainee attorneys, attorneys and partners of or affiliated with ALTIUS, insofar as they need your personal data for the performance of their duties;
  • subcontractors who process personal data on our behalf (processors);

This processing does not affect our processing of the personal data you entrust to us as processor when using the legal tech tool – see section 3 below.

2.1.10 In any case: managing fraud, abuse and disputes

In any case, whatever your relationship with us (i.e. if you are a visitor, a client, etc.), we may also process your personal data as controller for the following purposes:

  • Detecting, preventing and combating fraud and abuse on the basis of the need to look after our legitimate interest. Our legitimate interest consists in fighting against fraud and abuse; 
  • Handling of our own disputes on the basis of the Act of 30 July 2018 (art. 10§1,1°) and the need to protect our legitimate interest. Our legitimate interest consists in being able to safeguard our rights in the event of disputes.

In that case, we keep your personal data for a maximum of 10 years, unless the detection, prevention and combating of fraud and abuse, or dispute management, requires the personal data to be kept for a longer period.

In order to achieve these purposes, we may share your personal data with:

  • employees, working students, trainee attorneys, attorneys and partners of or affiliated with ALTIUS, insofar as they need your personal data for the performance of their duties;
  • subcontractors who process personal data on our behalf (processors);
  • the bar authorities, in the context of our deontological or legal obligations;
  • courts, lawyers outside ALTIUS, bailiffs, notaries, judicial experts and other judicial actors to the extent necessary for the handling of a file or the institution, exercise or substantiation of a legal claim;
  • independent consultants to the extent necessary for the organisation of ALTIUS, the handling of a file or the institution, exercise or substantiation of a legal claim;
  • judicial, police or administrative authorities, where required by law or to the extent necessary for the handling of a file or the institution, exercise or substantiation of a legal claim;
  • legal assistance insurers when our services are covered by a legal assistance policy.

2.2 What are your rights towards us acting as controller

When we process your personal data as controller, you have several rights:

  • You always have the right to access your personal data. This allows you to find out which personal data we process about you.
  • You always have the right to correct your personal data. This allows you to correct or complete incorrect or incomplete personal data that we process about you.
  • You have the right of deletion of your personal data. This allows you to permanently delete the personal data we process about you. We are not always obliged to delete your personal data at your request – this right only applies in the cases and to the extent provided for by law.
  • You have the right to limit the processing of personal data relating to you. This allows you to freeze our use of your personal data without deleting it. We are not always obliged to limit the processing of your personal data at your request – this right only applies in the cases and to the extent provided for by law.
  • You have the right to object to the processing of your personal data. This allows you to object to the further processing of your personal data. We are not always obliged to accept your objection – this right only applies if we process your personal data on the basis of our legitimate interest.
  • You always have the right to withdraw your consent when the processing of your personal data takes place on the basis of your consent.
  • You always have the right to object to the processing of your personal data for direct marketing purposes.
  • You have the right to data portability. This allows you to easily transfer, copy or move personal data from one controller to another. This right can only be exercised if the processing is based on your consent or on an agreement concluded with you.

You can exercise your rights by contacting the privacy chief, see point 1.5 above.

3. Our processing of personal data as processor

3.1 Overview of situations in which ALTIUS acts as processor

In exceptional circumstances, you may also entrust personal data to us as processor. The situations in which we exceptionally process personal data as a processor on behalf of the controller, are limited to those exhaustively described here:

Your use of our ALTIUS PREAVIZ app
Nature and purposes of the processingIf you use the ALTIUS PREAVIZ app (available as mobile app through an app store or as web app through our website), you acknowledge that you act as the controller (or that the organization you represent acts as the controller) for personal data that you enter into the app when using it to calculate notice periods and/or severance indemnity in case of dismissal
Type of personal data that are processedGeneral identification data (first and last name)HR and professional data (date of entry into service, job type, salary, benefits in kind, contract end date)
Categories of data subjectsEmployees
Approved SubprocessorsLeyQi BV, established in BelgiumScalingo SAS, established in France
Duration of the processingEntire duration of the agreement on the use of the ALTIUS PREAVIZ app (if such agreement terminates, the data processing agreement shall terminate automatically)

In those situations where we act as processor, this section 3 shall constitute the data processing agreement governing our relationship with you (or the entity you represent) as the controller.

3.2 General

The controller and the processor will, each in their respective capacity, process the personal data in accordance with the data protection legislation to which they are subject.

As a processor, we shall only carry out the processing of personal data in the name and on behalf of the controller.

3.2 Security measures

As a processor, we undertake to implement and comply with the appropriate technical and organisational security measures necessary to protect the personal data in case of accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or non-authorised access to personal data. When determining the appropriate technical and organisational security measures, the processor shall take into account: (i) the state of the art, (ii) the implementation costs related to these measures, (iii) the nature, scope, context and purposes of processing, (iv) the risks involved for the data subjects’ rights and freedoms, in particular in case of accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or non-authorised access to personal data transmitted, stored or otherwise processed, and (v) the probability that the processing shall have an impact on the rights and freedoms of the data subjects.

3.4 Recipients

As a processor, we undertake to implement and comply with the appropriate technical and organisational security measures necessary to protect the personal data in case of accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or non-authorised access to personal data. When determining the appropriate technical and organisational security measures, the processor shall take into account: (i) the state of the art, (ii) the implementation costs related to these measures, (iii) the nature, scope, context and purposes of processing, (iv) the risks involved for the data subjects’ rights and freedoms, in particular in case of accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or non-authorised access to personal data transmitted, stored or otherwise processed, and (v) the probability that the processing shall have an impact on the rights and freedoms of the data subjects.

As a processor, we can grant our employees and agents access to the personal data to the extent they need such access to the personal data in order to allow a proper performance of our obligations as a processor under the data processing agreement. We will inform the concerned employees and agents in writing about the personal data’s confidential character along with the legal and contractual framework of the protection of personal data, and shall impose a contractual confidentiality obligation upon the concerned employees or agents.

The controller hereby agrees with the engagement of the subprocessors listed in section 3.6 below. The controller hereby also gives a general written authorisation to us as processor to engage other subprocessors for processing the personal data on your behalf. We will inform you about such new subprocessors, if any. When we engage subprocessors, we undertake that such subprocessors will be subject to contractual obligations at least equivalent to the ones to which we are subject vis-à-vis the controller under this data processing agreement.

3.5 Obligation to assist

As a processor, we shall, when requested by the controller, communicate to the controller all the information required concerning the processing of personal data and shall transfer to the controller any data subject’s request or question in connection with the (processing of) personal data.

The controller has the right to audit our processing as a processor in order to verify our compliance with applicable obligations. The controller can conduct such audit maximum once a year. The audit can be performed by the controller or an auditor mandated by the controller. The controller will inform us at least 1 month in advance of the day on which the audit will occur. If we would receive during the audit an instruction from the controller that infringes the applicable data protection legislation, we shall immediately inform the controller hereof.

3.6 Termination

When the controller ceases to rely on us as a processor, we shall delete all the personal data entrusted to us as a processor, unless the storage of the personal data is required on the basis of the applicable law.