The purpose of this statement is to provide you with clear and transparent information about how we process your personal data. By “personal data,” we mean any information that can be used to identify you, either directly or indirectly. The “processing” of your personal data covers any operation or set of operations performed on such data, including, but not limited to, collection, storage, use, updating, or deletion. This statement specifically concerns the processing of personal data that we collect through the various forms on our website, which are provided to us by the data subject (customer, supplier, employee, etc.), and/or through documents made available to us, and/or through publicly accessible sources such as the ECB, the national registry, or websites.
We also collect certain data through the use of cookies and similar technologies. For more information on this subject, please see our Cookie Policy.

Table of Contents

• Who are we?
• Why do we process your personal data, and on what legal basis?
• With whom do we share your personal data?
• How long do we retain your personal data?
• What are your rights, and how can you exercise them?
• Where can you file a complaint?
• Note Regarding Children
• Applicable Law

Who are we?

We are EUROPAL-PACKAGING SA, with our registered office located at 5 Avenue Anne Frank, 7700 Mouscron, BCE 0467.257.413, info@europal-packaging.com, tel. 056/78.25.80.
What data do we store, for what purpose, and on what legal basis do we process your personal data?
The categories of personal data that may be processed include, in particular: last name, first name (or first names), address information (such as street name, house number, P.O. box, ZIP code, municipality/city, country, etc.), contact information (e.g., email address, phone number, fax number, or cell phone number), gender, date of birth, national identification number, ID card number, place of birth, shipping address, bank account number, professional category/job title, as well as the company registration number (BCE) and/or VAT number.
We process the data you share with us via these forms—primarily your contact information—solely to respond to your requests. In each of our forms, we specify the information you are required to provide so that we can process your request. You are therefore free to choose whether or not to provide data that is not marked as required.
When the personal data provided to us is not based on your explicit consent, it is necessary for the performance of a contract to which we are a party and/or to comply with legal obligations to which we, our clients, our suppliers, or our employees are subject.
All personal data that we receive and process in the course of our business activities is used exclusively for professional purposes and is processed lawfully, fairly, and transparently.

With whom do we share your personal data?

As a general rule, we strive to avoid sharing your personal data with third parties. We therefore only share your data with third parties when it is necessary to respond to your requests, with parties who must necessarily have access to this data in order to properly perform the contract to which we are parties, and/or when required by law.
When we transfer your personal data to a third-party processor, we limit that processor’s access to only the data it needs to perform its tasks. Furthermore, we require each of our processors to comply with data protection laws at all times.
We also ensure that the necessary measures are taken (for example, by imposing certain contractual obligations) to guarantee an adequate level of protection for your personal data when our processor processes your data in a country that does not offer the same level of protection as the European Union.

How long do we retain your personal data?

We do not retain your personal data any longer than is necessary for the purposes for which it was collected, unless a legal obligation requires us to retain it for a longer period.
Personal data is retained for at least the duration of the applicable legal retention periods for accounting purposes.
Personal data is stored using appropriate security measures that comply with generally accepted standards for a company of our size operating in our industry.

What are your rights, and how can you exercise them?

In accordance with the legislation on the protection of personal data, and provided that your request meets the legal requirements—including the presentation of valid proof of identity—you may at any time ask us to confirm that we are processing your personal data and to obtain a copy of all the data we hold about you (“right of access”). You may also access your personal data and request its correction if it is inaccurate or incomplete (“right to rectification”), request its deletion (“right to erasure” or “right to be forgotten”), restrict its processing (“right to restriction of processing”), or object to its processing when it is carried out for marketing purposes (“right to object”).
You also have the right to receive your personal data in a structured, commonly used, and machine-readable format for your own use or to transmit it to another data controller (“right to data portability”).

Where can you file a complaint?

You may submit any complaint regarding how we process your personal data to our data controller:
Europal-Packaging SA
5 Avenue Anne Frank
7700 Mouscron (Belgium)
VAT BE 0467.257.413
Email: info@europal-packaging.com
You may also file a complaint with the Belgian Data Protection Authority.

Note Regarding Children

This website and the services offered on it are not intended for individuals under the age of 16.
In accordance with Article 12 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, please find below the text of Articles 15 through 22, as well as Article 34, of the aforementioned Regulation.

Article 15 (Right of Access by the Data Subject):
“The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, to access such data as well as the following information: the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data have been or will be disclosed, including recipients located in third countries or international organizations, the planned retention period for the personal data or, where this is not possible, the criteria used to determine that period, the existence of the right to request the rectification or erasure of personal data, or the restriction of processing of personal data concerning them, as well as the right to object to such processing, the right to lodge a complaint with a supervisory authority, where the personal data are not collected from the data subject, any available information regarding the source of the data, as well as the existence of automated decision-making, including profiling as referred to in Article 22, paragraphs 1 and 4, and, at least in such cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
Where personal data are transferred to a third country or to an international organization, the data subject has the right to be informed of the appropriate safeguards provided for in Article 46 regarding that transfer.
The data controller shall provide a copy of the personal data undergoing processing. For any additional copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject submits the request electronically and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic format.
The right to obtain a copy shall not infringe upon the rights and freedoms of others.”

Article 16 (Right to Rectification):
“The data subject has the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, in particular by providing a supplementary statement.”

Article 17 (Right to erasure (“right to be forgotten”):
“The data subject has the right to obtain from the controller the erasure, as soon as possible, of personal data concerning him or her. The data controller is required to erase such data without undue delay when one of the following grounds applies: the personal data are no longer necessary in light of the purposes for which they were collected or processed; the data subject withdraws the consent on which the processing is based and there is no other legal basis for the processing; the data subject objects to the processing pursuant to Article 21(1), and there are no compelling legitimate grounds for the processing, or objects to the processing pursuant to Article 21(2); the personal data has been unlawfully processed; the personal data must be erased to comply with a legal obligation under Union law or the law of the Member State to which the controller is subject; the personal data was collected in connection with the provision of information society services referred to in Article 8(1).
Where the controller has made the personal data public and is required to erase it, the controller shall, taking into account available technology and the cost of implementation, take reasonable measures, including technical measures, to inform controllers processing such data that the data subject has requested the erasure of any links to, or copies or replicas of, that data.
The right to erasure does not apply, however, where the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation to which the controller is subject under Union or Member State law, for the performance of a task carried out in the public interest or in the exercise of official authority, for reasons of public interest in the area of public health, for archiving purposes in the public interest, for scientific or historical research purposes, or for statistical purposes, where the exercise of this right is likely to render impossible or seriously impair the achievement of the purposes of the processing, or for the establishment, exercise, or defense of legal claims.”

Article 18 (Right to Restriction of Processing):
“The data subject has the right to obtain from the controller the restriction of processing where one of the following applies: where the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the data; when the processing is unlawful and the data subject objects to the erasure of the personal data and requests, instead, the restriction of their use; when the controller no longer needs the personal data for the purposes of the processing but they are still necessary for the data subject for the establishment, exercise, or defense of legal claims; or where the data subject has objected to the processing pursuant to Article 21(1), pending verification of whether the legitimate grounds of the controller override those of the data subject.
Where processing has been restricted, the personal data, with the exception of their storage, may be processed only with the consent of the data subject, or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for important reasons of public interest of the Union or of a Member State.
Any person who has obtained a restriction on processing shall be informed by the controller before such restriction is lifted.”

Article 19 (Obligation to notify regarding the rectification or erasure of personal data or the restriction of processing):
“The controller shall notify each recipient to whom the personal data have been disclosed of any rectification or erasure of personal data or any restriction of processing carried out in accordance with Article 16, Article 17(1), and Article 18, unless such notification proves impossible or would involve a disproportionate effort. The controller shall provide the data subject with information about these recipients upon request.”

Article 20 (Right to Data Portability):
“The data subject has the right to receive the personal data concerning him or her that he or she has provided to a data controller, in a structured, commonly used, and machine-readable format. The data subject also has the right to transmit those data to another controller without hindrance from the controller to whom the data were provided, where the processing is based on consent pursuant to Article 6(1)(a), or Article 9(2)(a), or on a contract pursuant to Article 6(1)(b), and the processing is carried out by automated means.
In exercising their right to data portability, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible.
The exercise of this right is without prejudice to Article 17 concerning the right to erasure. This right does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.
The exercise of the right to data portability must not infringe upon the rights and freedoms of others.
Section 4 – Right to Object and Automated Individual Decision-Making.”

Article 21 (Right to Object):
“The data subject has the right, at any time, on grounds relating to his or her particular situation, to object to the processing of personal data concerning him or her based on Article 6(1)(e) or (f), including profiling based on those provisions. The controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or that the processing is necessary for the establishment, exercise, or defense of legal claims.
When personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him or her for such purposes, including profiling to the extent that it is related to such direct marketing.
When the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for those purposes.
The right referred to above shall be explicitly brought to the data subject’s attention no later than at the time of the first contact and shall be presented clearly, separately from any other information.
In the context of the use of information society services and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.
“Where personal data are processed for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1), the data subject has the right, on grounds relating to his or her particular situation, to object to the processing of such data, unless such processing is necessary for the performance of a task carried out in the public interest.”

Article 22 (Automated Individual Decision-Making, Including Profiling):
“The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning him or her or similarly significantly affects him or her.
This provision does not apply where the decision is necessary for the conclusion or performance of a contract between the data subject and a data controller, where it is authorized by Union law or the law of a Member State applicable to the data controller and provides for appropriate measures to safeguard the rights, freedoms, and legitimate interests of the data subject, or when it is based on the explicit consent of the data subject.
In cases where the decision is based on a contract or on the explicit consent of the data subject, the controller shall implement appropriate measures to protect the data subject’s rights, freedoms, and legitimate interests, including the right to obtain human intervention from the controller, to express his or her point of view, and to contest the decision.
The decisions referred to above may not be based on special categories of personal data referred to in Article 9(1), unless Article 9(2)(a) or (g) applies and appropriate measures have been taken to protect the data subject’s legitimate interests. “
Article 34 (Notification of a personal data breach to the data subject):
“Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall notify the data subject of the breach as soon as possible.
This notification shall describe, in clear and plain language, the nature of the personal data breach and shall contain at least the information and measures referred to in Article 33(3)(b), (c), and (d).
Notification to the data subject is not required where the controller has implemented appropriate technical and organizational protection measures, and those measures have been applied to the data affected by the breach, in particular those that render the data unintelligible to any unauthorized person, such as encryption; when the controller has subsequently taken measures ensuring that the high risk to the rights and freedoms of data subjects is no longer likely to materialize; or when such notification would require a disproportionate effort. In such cases, a public notice or a similar measure that informs the data subjects just as effectively shall be implemented.
If the controller has not notified the data subject of the breach, the supervisory authority may, after assessing the likelihood that the breach will result in a high risk, require such notification or determine that one of the conditions justifying the absence of notification is met.”