Crossmark privacy statement

1. Who is responsible for your data?

Crossmark BV is the controller responsible for the processing of personal data described in this statement.

Crossmark BV
Rijmenamseweg 21, 2820 Bonheiden, Belgium
Company number: BE 0479.875.826
Email: info@crossmark.be
Telephone: +32 (0)15 52 80 62

Do you have a question about your privacy or would you like to exercise one of your rights? Send an email to info@crossmark.be.

Crossmark sometimes processes personal data on behalf of a client, for example when building or managing a website, digital platform or campaign. In that case, the client determines the purposes for which the data is used and Crossmark acts as the processor. The client’s privacy statement then applies to the processing concerned.

2. Which personal data do we process?

The data we process depends on your relationship with Crossmark and on what you share with us.

When you contact us or request a quote

We may process your name, company name, job title, email address, telephone number and the content of your enquiry. If you request a quote, this may also include information about your project, schedule and budget.

We use this data to respond to your enquiry, assess your request, schedule a meeting, prepare a proposal or quote and take steps before entering into a contract.

The legal basis is your request to take preparatory steps with a view to entering into a possible contract. For general business communications, we may also rely on our legitimate interest in responding to enquiries properly and managing our relationships.

When you are a client, supplier or professional contact

We may process identification and contact details, professional information, arrangements, quotes, contracts, correspondence, project information, delivered files and information about orders, deliveries and payments.

We use this data to perform our arrangements and contracts, plan and follow up projects, communicate with you, manage purchases, deliveries and payments, provide support, maintain our business records and protect our rights if a dispute arises.

We do this because it is necessary to perform a contract, comply with legal obligations or on the basis of our legitimate interest in sound business operations and the protection of our rights.

For invoicing and accounting

We process the data needed for quotes, orders, invoices, payments and accounting. This may include your name, company name, address, company number, VAT number, bank details and payment information.

We do this to perform our contract and comply with our accounting, tax and other legal obligations.

When you visit our website

Our systems may process technical data such as your IP address, the type of browser and device you use, your operating system, the pages you visit, the time and duration of your visit, the page or website from which you arrived and technical log and security data.

We use this data to operate and secure the website, detect errors and prevent misuse. For this purpose, we rely on our legitimate interest in providing a secure and properly functioning website.

For non-essential cookies and similar technologies, for example for audience measurement, embedded media or marketing, we first ask for your consent. More information about the cookies, providers, purposes and retention periods is provided in our separate cookie policy. You can also adjust or withdraw your choice there.

When we send you news or other business information

If you subscribe to news or updates, we process your name, email address, preferences and information about your subscription. We do this on the basis of your consent. You can unsubscribe at any time via the link in the message or by emailing us.

In certain cases, we may inform existing clients or professional contacts about services related to a previous collaboration. We rely on our legitimate interest in maintaining our business relationships, to the extent permitted by law. You can always object to direct marketing. Once you do, we will no longer send you such messages.

When you apply for a position with us

If you apply for a position, we may process your contact details, CV, cover letter, portfolio, work experience, education details and other information you share with us.

We use this data to assess your application, communicate with you and, where applicable, prepare a contract. With your consent, we may retain your data for longer for future vacancies.

Data from other sources

We sometimes receive professional contact details through a colleague, client, supplier, partner, public register, company website or professional network. We use such data only when it is relevant to a specific business relationship or enquiry. Where required, we will inform you accordingly.

3. Which data would we rather not receive?

Please do not send us sensitive personal data if it is not necessary for your enquiry or project. Examples include medical information, political opinions, religious beliefs, biometric data or information about criminal offences.

Crossmark’s website and services are not specifically directed at children. We do not knowingly collect personal data from children without a valid legal basis or the required consent.

4. Are you required to share your data with us?

In many cases, you choose which data you share with us. Some information is necessary to answer your enquiry, prepare a quote, perform a contract or comply with a legal obligation. If you do not provide this data, we may not be able to handle your request or assignment.

5. Who do we share personal data with?

• We do not sell your personal data. We share personal data only when this is necessary for one of the purposes described in this statement.
• Employees and professionals: employees and permanent or temporary professionals who work for Crossmark.
• Technical suppliers: suppliers of hosting, email, cloud storage, IT management, security, backups, forms, scheduling, project management, analytics or communication services.
• Administrative service providers: accountants, banks, insurers and other parties that support our administration.
• Delivery partners: printers, producers, carriers and other partners that need data to carry out an assignment.
• Professional advisers: for example, lawyers or auditors.
• Competent authorities: government services, supervisory authorities, courts or police services where required by law.
• Parties involved in a business transfer: an acquirer or adviser involved in a possible restructuring, merger or transfer of activities.

Suppliers that process personal data on our behalf receive only the data they need. Where required by law, we set out their obligations in a data processing agreement.

6. Is data processed outside the European Economic Area?

Where possible, we choose processing within the European Economic Area. Some digital suppliers may process data in countries outside the European Economic Area.

If this happens, we ensure that there is a valid basis for the transfer and appropriate safeguards. This may, for example, be an adequacy decision by the European Commission or an agreement containing standard contractual clauses approved by the European Commission. You can contact us if you would like more information about the safeguards that apply in a specific case.

7. How long do we retain your data?

We do not retain personal data for longer than necessary for the purpose for which we collected it. In doing so, we take account of statutory retention obligations, the duration of our collaboration and the period during which legal claims may arise.

• Contact enquiries and unsuccessful quote requests: up to two years after the last substantive contact.
• Client, supplier and project data: during the collaboration and afterwards for as long as necessary to follow up the contract, comply with legal obligations or address possible claims.
• Invoices and accounting records: ten years from 1 January of the year following the issue or closing of the document, or longer if required by a specific legal rule.
• Newsletters and direct marketing: until you withdraw your consent, unsubscribe or object. We may then retain your email address on a limited suppression list to respect your choice.
• Technical and security logs: in principle, for no longer than twelve months, unless the data is needed for longer to investigate an incident, misuse or technical problem.
• Job applications: up to six months after the end of the recruitment procedure. With your consent, we may retain your data in a recruitment pool for up to two years.
• Data that Crossmark processes for a client: in accordance with the arrangements made with that client.

If data is needed for an ongoing dispute, investigation or legal obligation, we may retain it for longer. We will then delete or anonymise it.

8. How do we secure your data?

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure. We restrict access to people and suppliers who need the data for their work and expect them to treat it confidentially.

No system is completely risk-free. If a security incident occurs, we investigate it and take the measures required by law.

9. What rights do you have?

Subject to the conditions of data protection law, you have several rights.

• Access: you can ask which personal data we process about you and receive a copy.
• Rectification: you can have inaccurate or incomplete data corrected.
• Erasure: you can ask us to delete your data.
• Restriction: you can ask us to temporarily restrict the use of your data.
• Objection: you can object to processing based on our legitimate interest. You can always object to direct marketing.
• Data portability: you can receive the data you provided to us in a usable digital format or have it transferred, where the right to data portability applies.
• Withdrawal of consent: you can withdraw your consent at any time. This does not affect the lawfulness of processing before your withdrawal.
• Lodging a complaint: you can lodge a complaint with a supervisory authority.

Crossmark does not make decisions that produce legal or similarly significant effects for you based solely on automated processing.

Would you like to exercise a right? Email info@crossmark.be and clearly describe your request. We may ask for additional information where necessary to verify your identity. In principle, we will respond to your request within one month. In the case of a complex request or a large number of requests, this period may be extended as permitted by law. We will let you know if this is the case.

10. Lodging a complaint

We prefer to resolve questions or complaints with you first. You also have the right to lodge a complaint with the Belgian Data Protection Authority.

Belgian Data Protection Authority
Rue de la Presse 35, 1000 Brussels
Website: www.dataprotectionauthority.be

You can also contact the supervisory authority of the country where you live or work.

11. Links and services from other parties

Our website may contain links, videos, maps, social media or other content from external parties. If you use such a service, that party may process personal data independently. Please also read that party’s privacy statement. Crossmark is not responsible for how independent external parties handle your data.

12. Changes to this privacy statement

Our operations, website and suppliers may change. We may therefore update this privacy statement. The most recent version is always available on our website. At the top, we indicate when the statement was last updated.

If there is a significant change, we will inform you through an appropriate channel.