Privacy policy

1. Who are we?

Immotheker Finotheker is a financial services company specialising in planning regarding mortgages, insurance, and investments. This Privacy Statement applies to the following parties:

• Any user of the website https://www.immothekerfinotheker.be/ and all its sub-sites (hereinafter "Website") offered by Immotheker Finotheker with its registered office at Vital Decosterstraat 50C, 3000 Leuven (hereinafter "we" or "us" or "Immotheker Finotheker"), with company number 446.728.055. Immotheker Finotheker owns and operates the Website.
• Immotheker Finotheker clients (local offices and local branches)
• Applicants

2. Why do we have a privacy statement?

Due to the nature of our business, we need to process a lot of personal data. To ensure that your data is protected and only used where necessary, we commit ourselves to maintaining the highest standards of privacy, including the new privacy regulation 'GDPR' (General Data Protection Regulation), which came into force on 25 May 2018.

This privacy notice applies both to all information transmitted to us by electronic means and to all information transmitted to our local offices. This information may be collected both through the completion of forms on our Website, and through the information you provide us via email, as well as through information you communicate to us, during a conversation in one of our local offices and branches.

Please note that if you contact us through another electronic medium (such as Facebook or Twitter), the Privacy Statement of those websites will take precedence in case of conflicts with this Privacy Statement.

3. How can you reach us?

For any questions, comments, or other actions regarding our Privacy Statement, please contact Immotheker Finotheker's headquarters at:

• Phone: 016 35 04 04
• E-mail: gdpr@immothekerfinotheker.be
• Address: Vital Decosterstraat 50C, 3000 Leuven, Belgium
• Website: www.immothekerfinotheker.be

4. What information do we collect?

• Contact details such as your first and last name, e-mail address, your phone number, etc.
• Data in your resume and any information that appears during the recruitment process such as your contact details, your education and professional experience, and the information we need to conclude an employment contract such as place and date of birth, address, proof of identity, etc.
• Data related to our customer file, such as customer number, creation date of your file, etc.
• Identification data such as your contact details, gender, national register number, etc.
• Special data such as current health condition, reduced capacity, etc. We treat them with the utmost care, just like your other personal data.
• Data relating to your family situation, such as your marital status, information about children, etc.
• Data relating to your employment situation, such as your occupation, retirement age, etc.
• Financial details such as your salary, tax region, etc.
• Data relating to your current or future loans, insurance, etc.
• We may also collect information about you indirectly, e.g. as a beneficiary of a life insurance policy, spouse, etc.

For more information about the data we collect, please see the data collection overview of this privacy statement or contact us.

5. The valid legal basis for processing your personal data

In order to process your personal data, we ask you, as a prospective or current customer of Immotheker Finotheker, for your consent. For example, the processing of the data you provide to us by filling in the contact form on our Website is based on your consent.

We also need personal information to enter into or execute our contract with you. Your partnership with us will be set out in an agreement whereby we offer you our financial planning services for which we need personal information to enter into and perform this agreement.

Certain personal data is necessary to comply with our legal obligations when processing your data as part of a contract.

Immotheker Finotheker collects your personal data to fulfill its obligations under the following laws:

• Anti-Money Laundering legislation of 18 September 2017;
• Credit Mediation Act of 19 April 2014;
• Insurance Act of 4 April 2014;
• Royal Decree of 14 November 2003 on life insurance activities;
• Royal Decree of 21 February 2014 on rules of conduct and rules for managing conflicts of interest;
• Royal Decree of 18 September 2016 on adequate reports.

6. What do we use your personal data for?

We treat your data for different purposes:

Your contact details and other information you provide to us through forms on our Website:

• "Contact Us" form - to make an appointment and answer your questions;
• The "Free of Cost Info Evening" form - to register and inform you;
• "Interest rate barometer" form - to register and inform you;

We also keep your data for statistical purposes (anonymously).

Data in your resume and the information we collect during the recruitment process:

• The "Vacancies" form and the information we collect during an interview - in order to process your application and contact you, we need certain information;
• Other information as required by law - to enter into an employment contract with you;

Identification details:

• To maintain our relationship with you in the manner you choose

Special data, data on your family situation:

• To draw up a financial plan according to your needs and goals

Data relating to your employment and financial situation:

• To mediate in compliance with applicable credit and insurance legislation regarding credit and insurance

7. How long do we keep your data?

We keep your personal data for a period no longer than what is strictly necessary to achieve the purpose for which it is processed.

Retention periods vary depending on the type of data, contracts, and applicable legal requirements. In general, your data will be kept for 10 years after the end of our contractual relationship. This applies to the following contractual relationships:

• Financial plan focusing on residential planning or concrete project with credit guard.
• Financial plan focusing on savings and investments with plan monitor.
• Financial plan focusing on insurance -not life.

We may store certain information for a longer or shorter extent of time necessary to comply with applicable legal provisions, in particular during the time frame where a dispute might arise in relation to these contracts:

• 10 years after the end of the contractual relationship (the Anti-Money Laundering Act of 18 September 2017).
• 30 years for mediated loans (Credit Mediation Act of 19 April 2014).
• 30 years on the date of termination or expiry in life insurance policies (the law of 4 April 2014 on insurances).
• 5 years after the damage occurred (the law of 4 April 2014 on insurances).
• 5 years from the settlement of the contract or the decision that definitively ends a possible lawsuit (Royal Decree of 14 November 2003 on life insurance activity).

If you provide us with your data by filling in the contact forms on our website but do not attend the appointment, your personal data will be rendered anonymous 1 year after collection.

The data you provide us by filling in the other forms on our Website will be kept for 1 year.

The information you provide us by applying for a job at Immotheker Finotheker will be kept for 1 year. In the case of recruitment, we are obliged to keep your data for the duration of your employment contract and 5 years or more after the end of the contract.

8. Who has access to your data?

We have access to your data when necessary to carry out processing as described above. Your data is stored in our CRM system, to which access is restricted and the necessary technical and organisational measures have been taken to ensure security. Persons with access to the CRM system are bound to confidentiality.

We may share your information with the following parties:

• With our staff for the fulfillment of their job-related tasks.
• With the local offices and branches of Immotheker Finotheker and their staff, for the performance of their tasks. Since Immotheker Finotheker's offices act independently, our franchise agreement contains an annex regarding joint processors' agreement that determines which parties are responsible for a data breach and how your information will be processed.
• With the financial institutions whose loans and insurance we propose/offer to you. We act as a data processor. You can click here for additional information.
• With our affiliates and external service providers who provide services or process data on our behalf, or for data centralisation and/or logistics purposes. They act only as data processors and use your data only under our strict instructions.
• With competent authorities in response to a request for information if we believe disclosure is in accordance with, or otherwise required by, any applicable laws or regulations (notary public, lawyers, etc.).

We will not transfer your data to service providers outside the EEA (European Economic Area) without your explicit consent.

9. What are your rights?

The GDPR provides you with a number of rights that can be invoked under certain conditions. You can find a list hereafter with a brief explanation. As mentioned previously, these rights can be invoked via:

• Phone: 016 35 04 04
• E-mail: info@immothekerfinotheker.be
• Address: Vital Decosterstraat 50C, 3000 Leuven, Belgium
• Website: www.immothekerfinotheker.be

9.1. Right of access

Right of access means first and foremost to inform you about what happens to your data and to describe your rights. In addition, we must provide you with a copy of your personal data upon your request. You will receive a copy upon simple request through one of the above-mentioned channels. Please note that only the first copy is free of charge. To verify the identity of the person requesting access to their data, we will ask for proof of your identity. In case of doubt, we will only take action after confirming your identity.

Subject to your prior agreement, we will send you the information by e-mail, otherwise we will send you the information by post.

It is possible that certain documents contain personal data of other people who enjoy the same protection as you. We, therefore, need to anonymise certain documents, which may take some time. We will always inform you if we cannot comply with the request within a month.

9.2. Right of rectification

Upon simple request, we will update incorrect or incomplete data that we possess. We may contact you to verify data when we suspect that your data is no longer up-to-date. This may imply that we will invite you to read your identity card at one of our offices.

9.3. Right to be forgotten

You have the right to have your data erased. We will deleate your data if you meet one of the below criteria. Your e-mail address and/or phone number and/or address and/or name will be kept on a blacklist so that our system will recognise that you no longer wish to be contacted.

Circumstances where we may delete your data:

• We no longer process or need your data.
• You withdraw your consent for the processing of your data, where the processing was solely based on consent.
• You have invoked your right to object (see 9.7).
• Your data has been unlawfully processed.
• There is a legal obligation to delete the data.
• Your data was collected in relation to the provision of services through our Website

We will notify you if there is a specific situation that this erasure cannot be carried out. Following you can find the reasons for not being able to comply with your request:

• Compliance with a legal obligation or in function of the public interest.
• Archiving, research or statistical purposes in accordance with Article 89 of the GDPR.
• Instituting, exercising or defending legal claims.
• Public health reasons.
• Right to freedom of expression and information prevails.

9.4. Right to restriction of processing

You have the right to restrict the processing of your data at any time. We will stop processing in the event that:

• We are in possession of incorrect data. We will continue processing after checking the accuracy of your data and correcting it.
• When our processing is deemed unlawful and you wish to restrict such processing.
• If we no longer need your data, but the retention is necessary for the pursuit of your legal claims. If you no longer need them for legal claims, they will be deleted.
• You object to the processing of your data (see 9.7) until the question is clarified.

We will inform you of the reasons for lifting the restriction when the restriction on processing no longer has a purpose.

To continue processing your personal data, we need to verify its accuracy or check whether we have other legal grounds for processing. Processing of your personal data will be restricted until the question is clarified. In the event that we decide to continue the processing, we will inform you before lifting the restriction.

9.5. Right of notification

Unless proven impossible or involving a disproportionate effort, we will disclose to any recipient of your personal data, except for the right of access, that you invoked one or more of the above-mentioned rights. We will inform you of those recipients upon your request.

9.6. Right to data portability

All data that you have provided to us, which we process based on consent or on contractual terms, and through automated means, will be sent to you or another data controller (if technically possible) in "readable format" upon request. For example, we may hand over to you a CSV file of your data or transfer it to another party you designate.

9.7. Right to object

Where we process data on the grounds of legitimate interest or for the performance of a task of public interest, you may object to the processing. We will examine your objection and inform you of the results. We may continue to process your personal data only where legal grounds for the processing are present.

If you object to direct marketing, we will stop sending you direct marketing from the moment we receive your request.

10. Can you withdraw your consent?

Yes, at any time you can withdraw your consent to the processing of your data. However, if there is a legal or contractual reason for processing your data, we will still process your data for these grounds. The withdrawal of your consent may not be used to circumvent contractual obligations. The withdrawal of your consent only works for the future and all previous processing is considered legal.

You can withdraw your consent by contacting us at:

• Phone: 016 35 04 04
• E-mail: info@immothekerfinotheker.be
• Address: Vital Decosterstraat 50C, 3000 Leuven, Belgium
• Website: www.immothekerfinotheker.be

11. How can you make a complaint?

If we were unable to handle your request to the best of our ability, you always have the right to lodge a complaint with the Data Protection Authority. You can do this at https://www.gegevensbeschermingsautoriteit.be/.

12. Why do we require you to complete certain fields before you can submit a request?

This will allow us to answer your question quickly and easily. All other information you provide is optional. If you do not fill in the required fields, your question may not be answered (fully).

13. Changes to our policy

This Privacy Statement replaces all previous versions and is applicable from 15/8/2018. We reserve the right to modify and/or update this statement at any time. With the exception of minor changes, we will notify you of any change that has an impact on your situation.