Infino respects your privacy

Respect

We recognise that the protection of a data subject's privacy is a basic right of every individual and we will do everything we can to safeguard this right by processing personal data in a correct, open and transparent manner.

Trust

We know that the trust of our customers, employees and other stakeholders in the way we process personal data is crucial for our organisation.

Prevention

We understand that the misuse of personal data can have a major impact on the data subject and will take the necessary measures to safeguard the data subject from any financial, reputational or other damage.

Compliance

We have learned that the law cannot always keep up with rapidly changing technologies and our customers' expectations, so we strive to always be compliant with the spirit of the law and the constantly changing society in a pragmatic way and without inconvenience to our customer.

Infino undertakes to protect your personal data with the greatest possible care, in accordance with the legislation on the protection of personal data. We undertake to apply the obligations arising from this legislation to all our processing operations and to respect your rights in any processing of your personal data.

Through this privacy statement, we wish to inform you about the personal data Infino collects from you, why we collect it and what we do with it.

If you are looking for more information about this legislation, we advise you to consult the website of the data authority.

This privacy statement applies to all personal data that we process within Infino and is applicable to all customers, potential customers and visitors to our websites, applications and buildings. Via this privacy statement, Infino guarantees that you:

• remain informed about the processing of your personal data, either electronically or on paper;
• retain control over the personal data processed by Infino;
• exercise your rights with regard to your personal data

Personal data is any information that allows us to identify a person such as surname, first name, e-mail address, etc. This personal data is the property of the person and may be used by Infino in order to provide its services. We distinguish the following categories within this personal data

Identification information: this enables Infino to identify you in order to offer its services. This category includes names, first names, language preference, family composition, etc.

Contact information: this enables Infino to contact you to deal with questions, offer services and carry out other processes whereby we may need to contact you. This category includes telephone numbers, addresses, e-mail addresses, etc.

Family information: for certain services, it is necessary for Infino to process information about your family composition, such as when calculating child benefits. For this purpose, Infino processes your personal data such as family composition, number of dependents, etc.

Connection information: connection information is all information we collect when you use our digital services such as Infino's website and applications. This enables us to secure the applications and provide the right support for the digital services. This category includes user names, ip address, device information, ...

Financial information: Infino processes financial information to handle its paying services and services where Infino acts as a payer. This category includes account numbers.

Sensitive information: for some services, Infino also collects sensitive personal data such as health and legal information. This information will only be collected for specific purposes for which specific contracts have been drawn up. We will always ask for your explicit permission before processing these data.

Infino always uses the minimum set of personal data necessary to provide a good service. We undertake to process your personal data only in a way that is compatible with the purposes for which they were initially collected. We process your personal data for the following different purposes:

• if we have received your permission to process them
• in the framework of a contractual obligation or in preparation of a contact with us
• if this is necessary for our legal obligations
• if Infino has a legitimate interest in carrying out this processing, whereby Infino's interest and the rights of the data subject are balanced by taking appropriate measures

If we intend to process your personal data for a purpose other than that for which it was initially collected, we will always ask for your explicit consent in advance.

We only process personal data necessary for previously established purposes. The main purposes for processing personal data are:

Provision of services by Infino

In order to be able to offer the requested services, it is necessary for us to collect certain information so that we can provide a correct service. This information will always contain the minimum information necessary to provide the requested service. Which information depends on the service that is purchased.

Managing contacts and interactions with individuals

At each contact with Infino, we will ask for a basic set of data that will allow us to identify and contact you in order to process your requests or provide you with information following a request.

Improving Infino's services

We use your personal data to evaluate our services with the aim of improving them. To this end, we use analysis techniques such as customer surveys, analysing surfing behaviour on our websites and trends on social media.

Conducting sales and marketing campaigns

We use your personal data to conduct various marketing campaigns and sales actions in order to offer Infino's relevant services to customers and potential customers.

Personalisation of Infino's services to its clients

Infino also uses your personal data to optimise its services for its users. To this end, we use personal data in combination with knowledge elements from various studies in order to tailor the service to the user.

Guaranteeing a good and safe service

Infino also processes your personal data within the framework of general security in order to prevent, detect and investigate illegal and suspected abuses in line with our terms and conditions and good service.

Monitoring our performance

Your personal data may also be used for internal reporting purposes in order to steer our policy objectives and offer long-term planning for continuity.

Compliance with legal and sectoral obligations

Infino has a number of legal and sectoral obligations with which we must comply for certain services. In order to fulfil these legal and sectoral obligations, we are required to process certain personal data.

Providing qualitative information and analyses

Infino may also use your personal data within the framework of market analyses and research in order to predict certain market trends and formulate recommendations.

Infino will never pass on and/or sell your personal data to third parties unless

This is necessary for the provision of services

Infino uses subcontractors for some of its services and your personal data may be passed on to such subcontractors. Some examples of these subcontractors are call centres, data centres, etc. These transfers always take place in accordance with clear rules, whereby we can guarantee that your personal data will only be used for the purposes for which we received them and that correct processing will be monitored.

There is a legal obligation

For certain services, Infino is obliged to pass on information to official bodies. This transfer will always be done in accordance with clear guidelines and only in line with the purposes for which we received the data.

For the security of its internal systems

Acerta uses specialised external partners to secure its systems. As part of this cooperation, personal data may be exchanged with this partner. The necessity of exchanging personal data is assessed on a case-by-case basis and only occurs if strictly necessary.

You have given your express consent to do so

If Infino wishes to transfer your data to a third party for which we cannot rely on the above disclosures, we will seek your explicit consent and without such consent will neither sell nor transfer the data to a third party.

As regards international transfers of personal data for processing outside the European Economic Area (EEA), personal data is only transferred to third parties if required or permitted under applicable privacy legislation. We guarantee appropriate safeguards so that your rights are respected outside the EEA at an adequate level of data protection, and also require the recipient of the data to provide appropriate safeguards. Personal data is thus protected in accordance with the level of protection required by European legislation.

In some cases, we use anonymous, aggregated data for commercial purposes or external reporting. This data can never be traced back to a specific individual.

As a data subject, you have the following rights towards Infino. You can exercise these rights by contacting dpo@infino.be. Please always indicate which right you wish to exercise, together with your full name and telephone number. In your request, please also include a copy of the front of your identity card so that we can uniquely identify you in the context of your request. If there is not enough information in the application, additional information may be requested by an Infino employee.

These are basic rights and are free of charge. We will process each application correctly and carefully within one month of receiving all information. This month starts from the moment we have received all relevant information. This period may be extended by two months, taking into account the complexity and number of applications. In the event that the deadline is extended, you will be informed of this, including the reasons for the extension.

Right of inspection: you have the right to request access and inspection of the data we hold on you at Infino. Questions you can ask:

• Does Infino hold personal data about me?
• What does Infino use my personal data for?
• What personal data does Infino have?
• Which parties have access to my personal data?

Right of rectification: you have the right to have your data rectified if it is incorrect and/or incomplete. Adjustment of personal data may be subject to contractual and/or legal restrictions, which means that it is sometimes not possible to adjust the data.

Right to erasure ('right to forget'): you have the right to have your data deleted from our systems. The deletion of personal data is sometimes not possible due to contractual obligations, legal provisions and general interests of our organisation, so this request cannot always be granted. For example, if you still have an active contract with Infino for the payment of child benefits.

Right to restrict processing: you have the right to request that the processing of your data be restricted. In this case, your data will continue to be stored by us, but we will restrict its use. This request can be made if, for example, you believe that the personal data is incorrect or the processing by Infino is unlawful. We are only required to comply with these requests in the cases provided for by the law.

Right to the portability of your data: you have the right to obtain your personal data processed by Infino in a structured, accessible and digital format and/or to transfer this personal data directly to another controller.

Right to lodge a complaint: you have the right to lodge a complaint about the way in which Infino processes your personal data and/or the way in which we exercise your rights. You can do this at the following locations

File a complaint with Infino: Infino has appointed a data protection officer who has an independent role within the organisation and who will handle your complaint in order to find a solution together with you. Contact the data protection officer via dpo@infino.be.

File a complaint with the data protection authority: you have the right to file a complaint with the data protection authority about the way in which Infino processes your personal data and/or implements your rights. To do so, please visit the website of the data protection authority for more information.

Right to withdraw your consent: You have the right to withdraw your consent at any time if your data is processed on the basis of consent. This can be done by using the same route as you have given your rights.

Right to object: you have the right to object to the processing of your personal data, for example, to receiving direct marketing from Infino. This right of objection does not apply to communications within the framework of contractual agreements and/or legal obligations.

Infino has the necessary technical and organisational measures in place to ensure that your personal data is processed correctly and is safe with Infino. In this context, we may not retain personal data any longer than is strictly necessary for the purposes for which we received it or for the execution of a contract or for complying with a legal obligation.

These periods depend on the purpose for which the data is used and the type of service provided, as some aspects are determined by law. The archived data is accessible for a limited period of time. After expiry of the retention period, your personal data will of course be permanently deleted or anonymised.

Infino reserves the right to make changes to its privacy policy. Any material change will be published on this page immediately. We recommend that you consult the privacy policy regularly so that you are always aware of the content of the applicable privacy policy.

This privacy policy was last amended on: 30/06/2020