Privacy policy

1.1 PICKLES is part of Groupe Choux de Bruxelles SA and attaches great importance to protecting the privacy and personal data of visitors to and users of its website (the “Users”).

1.2 This privacy policy (the “Policy”) explains what personal data are collected through www.pickles.brussels (the “Website”), why and on what legal basis they are processed, with whom they may be shared, how long they are retained, and what rights data subjects may exercise.

1.3 Personal data are processed in accordance with Regulation (EU) 2016/679 of 27 April 2016, the General Data Protection Regulation (the “GDPR”), the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, and all other applicable data protection and electronic communications legislation.

1.4 This Policy applies to the Website and to the services offered by PICKLES through it (the “Services”). It does not apply to third-party websites or services to which the Website may provide links. Those third parties process personal data in accordance with their own privacy policies and are responsible for their own processing activities.

1.5 PICKLES may amend this Policy when its processing activities or the applicable legislation change. The latest version will be published on the Website. Where a change materially affects the processing of personal data, data subjects will be informed in advance by appropriate means.

1.6 Certain Services, such as requesting a quotation, making a booking or order, registering for an activity, or submitting an enquiry, require certain personal data. If a User does not provide the requested data, PICKLES may be unable to process or fulfil the relevant request or Service.

2.1 The controller responsible for the processing activities described in this Policy is:

Groupe Choux de Bruxelles SA
Boulevard Louis Schmidt 1
1040 Brussels
Belgium
Company number: 0840.411.958
Email: privacy@chou.be

2.2 The company has not appointed a data protection officer (DPO), as it considers that it does not fall within the mandatory designation criteria set out in Article 37 of the GDPR. Any questions about this Policy, the processing of personal data, or the exercise of data protection rights may be sent to privacy@chou.be or to the postal address above, for the attention of the Legal Department.

3.1 Data provided by the User

When a User visits the Website, completes a form, requests a quotation, subscribes to a newsletter, contacts PICKLES, or communicates through social media linked to PICKLES, the following categories of data may be processed:

> identification data, such as first name and surname
> contact details, such as email address, telephone number, and postal address
> date of birth, where necessary for the relevant Service
> information relating to enquiries, bookings, orders, events, and preferences
> billing information
> payment and bank details necessary to provide the Service, such as account number, IBAN, and BIC/SWIFT
> communications between the User and PICKLES
> data required to verify the User’s identity, prevent fraud, or ensure compliance with the applicable terms
> other information voluntarily provided by the User for a clearly defined purpose

These data may be recorded and managed in the customer relationship management system used by PICKLES, including Odoo, for the purposes described in Section 4.

3.2 Data collected automatically

When a User visits the Website, the servers and technical tools used may automatically record certain data, such as:

> IP address
> date and time of the visit
> pages visited and duration of the visit
> browser, device, platform, and operating system type
> the referring website or search engine and the search terms used
> technical log, security, location, and traffic data

Where this information makes a person directly or indirectly identifiable, it is treated as personal data. It may be used to ensure the security and proper technical operation of the Website, compile statistics, and improve the Website and the Services.

3.3 Cookies and similar technologies

The Website may use cookies and similar technologies. A cookie is a small text file that is stored on or accessed from a User’s device when they visit a website.

Strictly necessary cookies may be used without prior consent where they are essential for the operation or security of the Website, the transmission of a communication, or the provision of a feature expressly requested by the User. Analytics, advertising, and social media cookies that are not strictly necessary are used only after the User has given prior consent.

Users may change their choices or withdraw their consent at any time through the cookie settings available on the Website. Refusing or withdrawing consent must be as easy as giving it. The withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Depending on the features that are actually enabled, the Website may use third-party services such as Facebook, Instagram, LinkedIn, YouTube, Google Analytics, and Metricool. When these services are enabled, their providers may receive certain technical data, including the IP address, and may use cookies or similar technologies. If the User is signed in to a social network, the relevant provider may be able to associate the visit with the User’s profile.

The cookies actually used, their providers, purposes, duration, and any related data transfers must be detailed in the cookie management tool or cookie policy available on the Website.

PICKLES processes personal data only for specified purposes and on a valid legal basis. Depending on the processing activity concerned, processing is based on the performance of a contract or steps taken before entering into a contract, compliance with a legal obligation, the legitimate interests of PICKLES or a third party, or the data subject’s consent.

4.1 Performance of a contract or pre-contractual steps

PICKLES may process personal data to:

> respond to requests for information or quotations and to booking or order requests
> organise, provide, and follow up on the requested Services
> communicate with the User about an enquiry, contract, or Service
> manage payments, invoicing, and customer administration
> handle complaints, support requests, and after-sales service

4.2 Compliance with legal obligations

PICKLES may process and retain personal data to comply with its legal obligations, including those relating to accounting, taxation, consumer protection, fraud prevention, and cooperation with competent public authorities.

4.3 Legitimate interests

Provided that the data subject’s interests or fundamental rights and freedoms do not override those interests, PICKLES may process personal data to:

> secure the Website, systems, communications, and Services
> prevent and detect fraud, misuse, and unlawful activity
> analyse and improve the performance, operation, and usability of the Website and Services
> protect the business and its legal rights and interests
> inform existing customers about its own similar products or services where permitted by law, with an easy and free means of opting out

4.4 Consent

Where consent is required by law, PICKLES may process personal data to:

> send newsletters, offers, and promotional communications
> use cookies and similar technologies that are not strictly necessary
> disclose data to third parties for their own marketing purposes
> organise competitions, promotional activities, surveys, or other optional initiatives

The data subject may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before it was withdrawn.

PICKLES sends electronic marketing communications where there is a valid legal basis for doing so. Recipients may unsubscribe at any time, free of charge, by using the unsubscribe link included in each electronic communication or by sending an unambiguous request to privacy@chou.be.

Where personal data are processed for direct marketing purposes, the data subject may object at any time and without giving reasons. Following such an objection, the personal data will no longer be processed for those purposes.

6.1 PICKLES treats personal data as confidential. Within Groupe Choux de Bruxelles SA, personal data are accessible only to those who need them to perform their duties. Those persons are subject to appropriate confidentiality obligations.

6.2 To the extent necessary for the purposes described in Section 4, personal data may be disclosed to the following categories of recipients:

> companies belonging to Groupe Choux de Bruxelles
> IT, hosting, CRM, security, analytics, communications, and marketing service providers
> payment, accounting, and invoicing service providers
> restaurants, event venues, suppliers, subcontractors, and other operational partners involved in providing the requested Service
> professional advisers, such as lawyers, accountants, and insurers
> competent administrative, regulatory, supervisory, or judicial authorities where required by law
> other third parties where the data subject has given valid prior consent

6.3 Service providers that process personal data on behalf of PICKLES may use those data only in accordance with documented instructions and for the agreed purposes. They must implement appropriate technical and organisational measures and ensure the confidentiality of the data.

6.4 Where personal data are transferred outside the European Economic Area to a country that is not covered by an adequacy decision, PICKLES ensures that the transfer is based on a valid transfer mechanism and subject to appropriate safeguards, such as the standard contractual clauses approved by the European Commission, supplemented by additional measures where necessary. Information about the applicable safeguards may be requested from privacy@chou.be.

PICKLES retains personal data only for as long as necessary for the purposes for which they were collected. The applicable retention period is determined according to the following criteria:

> the duration of the customer relationship, enquiry, or contract
> the time required to provide the relevant Service and complete the related administrative follow-up
> applicable statutory retention and limitation periods, including those relating to accounting and tax records
> the need to establish, exercise, or defend legal claims
> where processing is based on consent, the duration of that consent and any subsequent withdrawal

At the end of the applicable period, the data are deleted or irreversibly anonymised unless continued retention is required or permitted by law.

PICKLES implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, or alteration, unauthorised disclosure or access, and any other form of unlawful processing. These measures take account of the nature of the data, the context of the processing, and the risks involved. They are reviewed and updated where necessary.

Access to personal data is restricted to authorised persons who require it to perform their duties. Those persons are subject to confidentiality obligations.

Subject to the conditions and limitations laid down in the GDPR, every data subject has the following rights:

> the right to be informed about the processing of their personal data
> the right to access their personal data and receive a copy
> the right to have inaccurate data corrected and incomplete data completed
> the right to request erasure of their personal data
> the right to request restriction of processing
> the right to object to processing based on legitimate interests or carried out for direct marketing purposes
> the right to receive data they have provided in a structured, commonly used, and machine-readable format and, where technically feasible, to have those data transmitted to another controller
> the right to withdraw consent at any time
> the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them, subject to the exceptions provided by law

Requests may be sent to privacy@chou.be or by post to Groupe Choux de Bruxelles SA, for the attention of the Legal Department, Boulevard Louis Schmidt 1, 1040 Brussels, Belgium. A request must contain sufficient information to identify the data subject and understand the scope of the request.

PICKLES will request additional information necessary to verify identity only where it has reasonable doubts about the requester’s identity. A copy of an identity document is therefore not routinely required.

PICKLES will normally respond within one month of receiving the request. Where a request is complex or numerous requests have been made, this period may be extended by up to two further months. The data subject will be informed of the extension and the reasons for it within one month of receipt of the request.

The exercise of these rights is generally free of charge. Where a request is manifestly unfounded or excessive, PICKLES may, within the limits of the GDPR, charge a reasonable fee or refuse to act on the request.

The data subject may also lodge a complaint with the Belgian Data Protection Authority:

Belgian Data Protection Authority
Rue de la Presse 35 / Drukpersstraat 35
1000 Brussels
Belgium
www.dataprotectionauthority.be

This does not affect the right to seek a judicial remedy.

The Website and Services are primarily intended for adults and persons with full legal capacity. Minors may provide personal data only with the authorisation or involvement of their legal representative where required by applicable law. If PICKLES becomes aware that a minor’s personal data have been collected without a valid legal basis, PICKLES will take appropriate steps to delete them.