RENTABOX / GIELEN NV

1. Identity of the Data Controller

RENTABOX / GIELEN NV attaches great importance to your privacy and processes your personal data in

compliance with applicable privacy legislation, in particular the General Data Protection

Data Protection (GDPR – Regulation EU 2016/679) and the Belgian law of 30 July

2018 on the protection of natural persons with regard to the processing of

personal data.

In this privacy statement we explain which personal data we collect, why we do that

doing, on what legal basis this happens and how we handle this.

Company name: GIELEN NV (trading under the name RENTABOX)

Enterprise number (CBE): BE 0436.860.977]

Registered office: WITTEBRUGSTRAAT 5, 3800 SINT-TRUIDEN

Contact & Privacy questions: in **@******ox.be | Phone: 0475 677722

2. General Principles of Data Processing

RENTABOX / GIELEN NV applies the following principles when processing your

data:

•We process personal data exclusively for specified, explicitly described and

legitimate purposes.

•We do not process more data than is strictly necessary for the intended purposes

(data minimization).

•This privacy statement can be permanently consulted via our website, where you can manage your preferences regarding

can manage with regard to data collection (such as cookies).

3. Data Collection, Purposes and Retention Periods

RENTABOX / GIELEN NV collects and processes your personal data in the following situations:

3.1 When requesting a quote

Data processed: Full name, e-mail address, postal address and telephone number.

Purpose of processing: Preparing and sending the requested quote and recording

contact about this. Legal basis: Taking pre-contractual measures at your request (Article 6.1.b GDPR).

Retention period: Your data is kept for a maximum of 1 year after the quote request, as

potential customers often inform themselves in advance and only proceed to rent after a few months.

3.2 When concluding and executing a rental agreement

Data processed: Name, contact details (address, e-mail, phone number),

identification data and payment data (such as account number and direct debit information).

Purpose of processing: Contract management, service provision, invoicing, debtor management and

accounting.

Legal basis: Performance of the contract (Art. 6.1.b GDPR) and legal tax obligation

(Art. 6.1.c GDPR).

Retention period: Tax and accounting data are legally required to be kept for 10 years

in accordance with the Belgian VAT Code and the Code of Companies and Associations.

[Adjusted from 7 to 10 years in accordance with Belgian legislation]

3.3 When visiting our website (Google Analytics & Cookies)

Data processed: IP address (anonymized), click behavior, browser type and visit statistics.

Purpose of processing: Gaining insight into website usage and optimizing the

user experience.

Legal basis: Explicit consent via the cookie banner on the website (Art. 6.1.a GDPR) for

analytical cookies.

Explanation: Cookies from Google Analytics are placed via our website. RENTABOX /

GIELEN NV has configured Google Analytics in a privacy-friendly manner. More information about the processing

by Google can be found in Google's privacy policy.

3.4 Camera surveillance (In accordance with the Belgian Camera Act of 21 March 2007)

Data processed: Camera images of persons present on and around the premises and in the

buildings of RENTABOX / GIELEN NV.

Purpose of processing: Security of persons, goods and property of RENTABOX /

GIELEN NV and its customers, crime prevention and gathering evidence in the event of incidents.

Legal basis: Legitimate interest for the security of property and persons (Art.

6.1.f GDPR) and in accordance with the Belgian Camera Act of 21 March 2007.

Legal formalities: The presence of visible cameras is clearly indicated with

the legally prescribed pictogram. The camera system complies with the

legal obligations registered with the police services (via aangiftecamera.be).

Retention period: In accordance with the Belgian Camera Act, camera images are kept for a maximum of 30 days

retained. Afterwards they are automatically overwritten, unless there is an incident or offense

determined. In that case, the images are stored longer as long as this is necessary for the

handling of the dispute or criminal investigation.

Access & Third Parties: Camera footage can be made available within the legal frameworks

provided to the police and judiciary in the context of a criminal investigation or report of a

criminal offense. 4. Provision of Data to Third Parties (Processors)

RENTABOX / GIELEN NV does not sell your data to third parties. We provide your data

exclusively to third parties when this is necessary for the execution of our agreement or to

to comply with a legal obligation.

We use the following categories of processors:

•IT and cloud providers (DaaS / hosting services) for the secure storage of our administration.

•Bookkeeper / accountant for maintaining the legally required accounting and tax

declarations.

•Government and judicial authorities if we are legally obliged to do so (such as the tax authorities or police).

With processors who process personal data on our behalf (such as IT suppliers and

accountant), we conclude a Data Processing Agreement (DPA) to

guarantee the same level of security and confidentiality of your data.

5. Security of Your Data

RENTABOX / GIELEN NV takes appropriate technical and organizational measures to protect your

to protect personal data against loss, unauthorized access, disclosure or any

other form of unlawful processing.

6. Your Rights as a Data Subject

Under the GDPR, as a data subject you have extensive rights regarding the processing

of your personal data:

• Right of access and copy: You have the right to obtain confirmation as to whether or not

processing of your personal data and to receive a free copy thereof.

• Right to rectification: You have the right to have incorrect or incomplete personal data corrected

correct or supplement.

• Right to erasure ('Right to be forgotten'): In certain cases you have

the right to request the deletion of your data (e.g., when the data are no longer necessary

are necessary for the purpose).

• Right to restriction of processing: You can request to restrict the processing of your

temporarily freeze data processing.

• Right to data portability: You have the right to receive your data in

to receive in a structured, commonly used and machine-readable format to transfer

to another party.

• Right to object: You have the right to object to processing based on

on our legitimate interest.

• Right to withdraw consent: For processing based on your

consent (such as analytical cookies), you have the right at all times to withdraw this consent

withdraw.

To exercise any of these rights, you can send a written request to

in **@******ox.be . We will respond to your request within 1 month. 7. Complaints Procedure & Supervisory Authority

If you have a complaint about the way RENTABOX / GIELEN NV handles your

handles personal data, we kindly request that you contact us first via

in **@******ox.be .

You also always have the right to lodge a complaint with the Belgian

data protection authority:

Data Protection Authority (GBA)

Drukpersstraat 35, 1000 Brussels

Telephone: +32 (0)2 274 48 00

E-mail: co *****@*****ba.be

Website: www.gegevensbeschermingsautoriteit.be