Privacy statement

Who is responsible?

This website belongs to Encima BV, which develops and maintains Citybon. Encima is the controller of the personal data processed through this website.

• Encima BV, Keibergstraat 112, 8820 Torhout, Belgium
• Company number: BE 0478.011.446
• Email: info@encima.com
• Phone: +32 50 23 02 00

This statement only applies to www.citybon.be. On the voucher websites of the municipalities (such as torhoutbon.be or stadenbon.be), you buy vouchers from your local authority. The privacy statement of that website applies there.

Which data do we process?

• Through the contact form: your name, phone number and email address, and the time you sent the form.
• Website statistics, only if you consent: Google Analytics collects data about your visit through Google Tag Manager, such as the pages visited, your device and browser and your region.
• If you email or call us: the data you provide yourself.
• Technical data: as with any website, our hosting provider may record your IP address, browser, the time and the requested page in server logs. This is needed for the security and proper functioning of the website.

We do not use advertising trackers or social media plugins. You can read more about this in our cookie statement.

Why, and on what basis?

• To answer your question and send you a quote. We do this at your request, with a view to a possible contract (Article 6(1)(b) GDPR).
• To follow up a business relationship with your authority or organisation. This is our legitimate interest (Article 6(1)(f) GDPR).
• To secure the website and detect incidents. This is also our legitimate interest (Article 6(1)(f) GDPR).
• To measure how the website is used and improve it. We only do this with your consent (Article 6(1)(a) GDPR).

We do not use your data for newsletters or advertising unless you have given your explicit consent in advance. You can withdraw that consent at any time.

How long do we keep your data?

• We keep data from a contact request for as long as needed to follow up your request, and no longer than two years after our last contact. If a contract follows, we keep the data needed for it for the duration of the contract and for as long as the law requires, for example for accounting.
• Server logs are not kept longer than needed for the security of the website.
• Data in Google Analytics is kept for no longer than 14 months.

Who do we share your data with?

We never sell your data and do not share it with third parties for their own purposes. We do work with service providers that process data on our behalf, such as the hosting provider of this website and our email and IT service provider. We make agreements with them that protect your data. We also disclose data when the law requires us to. If you consent to statistics, Google Ireland Limited processes data for Google Analytics.

Transfers outside Europe

We aim to process your data within the European Economic Area. If a service provider nevertheless processes data outside the European Economic Area, this only happens with appropriate safeguards, such as an adequacy decision or the standard contractual clauses of the European Commission. Google may transfer Google Analytics data to Google LLC in the United States. Google LLC participates in the EU and US Data Privacy Framework.

Security

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Only staff who need the data for their work have access to it.

Your rights

You have the right to:

• access your data;
• have incorrect data corrected;
• have your data erased;
• have the processing restricted;
• receive your data in a common format or have it transferred;
• object to processing based on our legitimate interest;
• withdraw any consent you have given at any time.

Send your request to info@encima.com. We respond within one month. To prevent misuse, we may ask you to confirm your identity.

Filing a complaint

If you are not satisfied with how we handle your data, please let us know first. You can also file a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, +32 2 274 48 00, www.dataprotectionauthority.be.

Changes

We may update this privacy statement, for example when the website or the law changes. The date at the top shows when it was last updated.