ElmediX Privacy Statement

Version 1.0, dated March 28, 2023

Introduction to the company

This Privacy Statement is provided on behalf of ElmediX, Esperantolaan 4, 3001 Leuven, Belgium, company number: 0612 999 418 (hereinafter referred to as “us”, “we” and “our”);   there are no other joint controllers with respect to personal data collected under this Privacy Statement.  This Privacy Statement does not apply to personal data that we may collect in the context of your employment or other working relationship with ElmediX.   .  This privacy statement explains how we collect and use your personal data in connection with:

• Your use of our website(s) (Online Visitor);
• Our employee recruitment processes (Applicant);
• Purchasing and potential purchasing matters (supplier/supplier).

Why we use your personal data
Below is a description of how we may use Personal Data when you:

Online visitor In order to be able to send
you  newsletters, we ask for your e-mail address and reason for interest in our company. If you receive our newsletters, we can use your online click behaviour to personalise our newsletter and website for you. After you have signed up to receive newsletters, we register this as permission to receive these newsletters. You have the option to withdraw your consent at any time.  If you contact us via the online form, we will store your full name and e-mail address. By submitting this contact form, you give us your consent to contact you by e-mail. We will only use this information to respond to the question you have asked or to provide you with the requested information.

Applicants We use the personal data of applicants for recruitment and selection purposes. Unless required by law, ElmediX will not provide this data to other persons or bodies, which do not belong to us, without the prior consent of the applicant. The applicants’ data will be deleted no later than four weeks after the end of the application procedure, unless the personal data are kept with the applicant’s consent for one year after the end of the application procedure with a view to any future vacancies.

Suppliers/vendors
To ensure that our contractual agreements are fulfilled and to carry out due diligence screenings.

Information we collect
We may collect your personal data. “Personal data” means any information relating to an identified or identifiable natural person. Depending on how you interact with us, personal data may include:

• Contact details, such as name, address, telephone number or e-mail address;
• Financial information, such as bank account number or billing address;
• Demographic information, such as zip code;
• Recruitment information, such as resume, work history and qualifications;
• Online identifiers, such as IP addresses;
• Information to identify you, such as a passport or identity card if we are required to do so by local law;
• Any other information you provide to us that can be used to identify you.

We collect personal data from:

• You directly;
• Cookies and automated technologies, such as when you visit our websites;

Legal basis for the   processing of your personal data The   processing of personal data
by us is based on a legal basis as set out in the GDPR. We may and will only process your personal data in specific circumstances:

• with your consent;
• where there is a contractual obligation;
• to comply with a legal obligation under EU or national law; If our processing is based on a legal obligation or is necessary for the performance of an agreement we enter into with you and you do not provide us with the necessary personal data, we may not be able to provide our service or fulfil our obligations to you.
• for the legitimate interests of our organisation, but only after you have assessed that the fundamental rights and freedoms of you as an individual, whose data we process, are not seriously affected (i.e. to inform customers about our similar (new) products or services or to carry out the application process).

We may share your personal data with third parties who provide database, server, maintenance, security, marketing, IT or other similar services to us (hereinafter referred to as “processors”). If we grant access to your data, we will enter into a ‘processing agreement’ that obliges the third parties to keep your data confidential and instructs these parties to process the data only on our behalf. In addition, we may disclose your personal information if such disclosure is required by law or in response to a legal request. We will not sell your personal data to third parties.

Transfer of data outside the EEA
ElmediX is committed to complying with this Privacy Statement and European data protection law with respect to information transferred outside the European Economic Area (EEA). The laws in other countries outside the EEA may not be as strict as the laws in Europe. That is why we have taken measures to protect your privacy and fundamental rights when your personal data is transferred outside the EEA and other countries where adequacy decisions of the European Commission do not apply. This means that we use appropriate safeguards, such as standard contractual clauses and secure transfer protocols to ensure adequate protection. When personal data collected by us is transferred outside the European Economic Area (EEA), detailed information is provided at the time your personal data is obtained.

How long do we keep your Personal Data
We will retain your Personal Data for as long as necessary to achieve the purpose for which we collected it, including any legal requirements. To determine the retention period we consider

• Whether a legal obligation applies;
• Whether retention is advisable given our legal position (such as for statutes of limitations, lawsuits or regulatory investigations);
• If you are a website user, we refer to our cookie statement which you can find on our website(s);
• The length of time we have an ongoing relationship with you and provide our services to you (for example, as long as you subscribe to one of our newsletters);
• If we have not had meaningful contact with you, we will  delete your data unless the law or relevant regulators require us to keep it for a longer period of time.

Security and protection of your Personal Data
We implement appropriate technical and organizational measures to ensure that the Personal Data we process is protected from unauthorized access, use, disclosure, alteration or destruction, in accordance with applicable laws and regulations. Unfortunately, it cannot be guaranteed that a data transfer or storage system is completely secure and we cannot guarantee the security of Personal Data. If you believe that your Personal Data is no longer secure, please let us know by using the contact details below.

Your rights and choices
You have the following rights in relation to your personal data:

• Right to access information about how we process your personal data, including the categories of personal data we process, recipients of your personal data and purposes for our processing.
• Right to rectification of inaccurate Personal Data relating to you, as well as, taking into account the purposes of the processing, the right to have incomplete personal data completed.
• Right to erasure (deletion) of Personal Data relating to you when: (a) the Personal Data is no longer necessary in connection with the purposes for which it was collected or otherwise processed; (b) you withdraw your consent and there are no other legal grounds for the processing; (c) you exercise your right to object (see below) and there are no compelling legitimate grounds for the processing; (d) the Personal Data has been processed unlawfully; or (e) the Personal Data must be erased in order to comply with a legal obligation applicable to us.
• Right to restriction of processing (e. data will be blocked for normal processing but not erased) where: (a) you dispute the accuracy of the Personal Data, for a period that allows us to verify its accuracy; (b) the processing is unlawful and you oppose the erasure of the Personal Data and request the restriction of its use instead; (c) we no longer need the Personal Data for the purposes of the processing, but it is required by you for the establishment, exercise or defence of legal claims; (d) you exercise your right to object (see below) pending verification that our legitimate grounds outweigh yours.
• Where the processing is based on your consent, the right to withdraw consent at any time, without affecting the lawfulness of the processing prior to such withdrawal. Please note that even after you have chosen to withdraw your consent, we may continue to process your personal data in some limited circumstances.
• Where the processing is based on your consent or on a contract, the right to data portability, e. the right to obtain a copy of the data relating to you in a structured, commonly used and machine-readable format and the right to transmit that data from us to another controller without hindrance.
• Right to object to the processing of Personal Data on the basis of our legitimate interests, provided that there are no compelling legitimate grounds for the processing that would outweigh your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

If you wish to exercise any of your rights above, please contact us using the information in the “How to Contact Us” section  at the end of this Privacy Statement. We will need a written statement, including a copy of your identity card, to ensure the validity of the request. We may charge you a reasonable fee if you request additional copies of your personal information or make other requests that are manifestly unfounded or excessive. If we are unable to honor your request, or before we charge a fee, we will let you know why. To the extent practically and legally required, we will notify third parties with whom we have shared your Personal Data of any request for correction, deletion and/or restriction of the processing of your Personal Data. Please note that we cannot guarantee that third parties will comply with your requests and we encourage you to contact those third parties directly.  You will receive a response within 30 days.

Please note that if you decide to exercise some of your rights, we may not be able to perform the actions necessary to achieve the purposes set out above or you may not be able to use the services we offer you.

You have the right to lodge a complaint with the Supervisory Authority “The Data Protection Authority” at any time  regarding the processing of your personal data by us.

Please contact privacy@elmedix.com if you have any complaints.

What are cookies and how do we use them
Our website(s) use cookies and other techniques to facilitate their use and provide additional features. A cookie is a text file (small amount of data, which often contains a unique identifier) that the web server copies to your computer. One of the main purposes of cookies is to help you navigate the websites and remember created listings. Thus, saved settings can be recalled on subsequent visits to make it easier for you to use your personalized pages. Our websites use different types of cookies. Some cookies are placed by third-party services that appear on our pages. You can always accept or refuse cookies. If you want to check what type of cookies you accept when you visit our websites, you can view this via the cookie banner. We will show you what type of cookies we use, which cookies we use and why we use them and how you can delete / adjust cookies. Refusing cookies may mean that you cannot fully experience the interactive features of the websites. In particular, it will disable applications that are technically dependent on the use of cookies.

Contact details of the data protection officer
We have appointed a data protection officer. You can reach our Data Protection Officer by e-mail at privacy@elmedix.com.

How to contact us
If you have any questions or concerns about how your data is processed or if you wish to exercise your rights, please do not hesitate to contact us: ElmediX
 at privacy@elmedix.com or you can write to us : ElmediX NV, Dellingstraat 34/1, 2800 Mechelen.

Changes to this Privacy Statement
We may change or update this Privacy Statement from time to time by posting a new privacy statement on this website.