PRIVACY PROTECTION (GDPR) & COOKIE MANAGEMENT

This Charter is established by Ludovic THIENPONT acting as the representative of the real estate agency BATHIM, registered with the Crossroads Bank for Enterprises under the number: +32 2 733 00 00 (hereinafter referred to as "the data controller"). The purpose of this Charter is to inform individuals contacting the real estate agency BATHIM and visitors to the website hosted at info@bathim.be (hereinafter referred to as the "website") about how data is collected and processed by the data controller. This Charter reflects the data controller’s desire to act with full transparency and in compliance with the Law of December 8, 1992 on the protection of privacy with regard to the processing of personal data, as well as Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (hereinafter referred to as the "General Data Protection Regulation"). The data controller pays special attention to the protection of user privacy and therefore undertakes to take all reasonable precautions necessary to protect the personal data collected from loss, theft, disclosure, or unauthorized use. If the user wishes to respond to any of the practices described below, they may contact the data controller at the postal address or email address specified under the "contact information" section of this Charter.

By contacting or engaging with the real estate agency BATHIM, or by accessing and using the website, the user acknowledges having read the information described below, accepts this Charter, and expressly consents to the data controller collecting and processing their personal data — provided through the website and/or during services offered on the website or at the agency — in accordance with the terms and principles set out in this Charter. The user has the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent given before its withdrawal.

By visiting and using the website, the user expressly consents to the data controller collecting and processing the following personal data, in accordance with the terms and principles described below:

• First name, last name, address, phone and mobile number;
• Email address, if previously provided, for example by sending messages or inquiries via the website, communicating via email, or accessing restricted areas of the website through authentication;
• Information about pages the user has viewed on the website;
• Any information voluntarily submitted, such as through information requests, registrations, or access to restricted sections of the site.

The data controller may also collect non-personal data. These are considered non-personal because they do not directly or indirectly identify an individual. Such data may be used for any purpose, such as improving the website, services, products, or advertising. If non-personal data is combined with personal data in a way that makes user identification possible, it will be treated as personal data until the link to an individual can no longer be made.

The data controller collects personal data through its website and in the context of the services offered by the BATHIM real estate agency.

Personal data is collected and processed only for the purposes mentioned below:

• to ensure the management and control of the execution of the services offered;
• sending and monitoring invoices;
• sending information about real estate properties, products, and services managed or provided by the data controller;
• possibly sending service offers;
• responding to any visitor's questions;
• improving the quality of the website and the services offered by the data controller;
• transmitting information about new properties in the portfolio and/or services of the data controller;
• for direct marketing purposes;
• enabling better identification of the user's interest criteria;
• complying with legal obligations (e.g., Royal Decree 12.07.2007 – right to follow up).

The data controller may be required to carry out processing not yet foreseen in this Charter. In such a case, the data controller will contact the user before reusing their personal data, in order to inform them of the changes and give them the possibility, if applicable, to refuse this reuse.

The data controller only retains personal data for as long as reasonably necessary for the purposes pursued and in accordance with legal and regulatory requirements. At the end of the retention period, the data controller takes all necessary measures to ensure that the personal data is made inaccessible.

Upon a dated and signed written request sent to the data controller at the address indicated in the “contact details” section of this Charter, the user may, after proving their identity (by attaching a copy of their identity card), obtain free written communication or a copy of the personal data concerning them that has been collected. The data controller may require payment of reasonable fees based on administrative costs for any additional copies requested by the user. When the user submits this request electronically, the information is provided in a commonly used electronic format, unless the user requests otherwise. The copy of their data will be provided to the user no later than one month after receipt of the request.

Upon a dated and signed written request sent to the data controller at the address indicated in the “contact details” section of this Charter, the user may, after proving their identity (by attaching a copy of their identity card), obtain free rectification of their personal data that is inaccurate, incomplete or irrelevant, as well as have it completed if it is found to be incomplete, as soon as possible and no later than within one month.

Upon a dated and signed written request sent to the data controller at the address indicated in the “contact details” section of this Charter, the user may at any time, for reasons related to their particular situation and after proving their identity (by attaching a copy of their identity card), object free of charge to the processing of their personal data. The data controller may refuse to implement the user’s right to object where it demonstrates the existence of compelling legitimate grounds for the processing which override the interests or rights and freedoms of the user, or for the establishment, exercise or defense of a right in court. In case of dispute, the user may bring a claim in accordance with the “complaints and claims” section of this Charter. Upon a dated and signed written request sent to the data controller at the address indicated in the “contact details” section of this Charter, the user may at any time and after proving their identity (by attaching a copy of their identity card), object without justification and free of charge to the processing of their personal data concerning them when their data is collected for direct marketing purposes (including profiling). The data controller is required to respond to the user’s request as soon as possible and no later than within one month and to justify their response if they intend not to comply with such a request.

Upon a dated and signed written request sent to the data controller at the address indicated in the “contact details” section of this Charter, the user may, after proving their identity (by attaching a copy of their identity card), obtain restriction of the processing of their personal data in the following cases:

• when the user contests the accuracy of a data and only for as long as the data controller can verify it;
• when, although no longer necessary for the purposes of the processing, the user needs it for the establishment, exercise or defense of their rights in court;
• during the time necessary to examine the validity of an objection request made by the user, in other words the time it takes the data controller to verify the balance of interests between the legitimate interests of the data controller and those of the user.

The data controller will inform the user when the restriction of processing is lifted.

Upon a dated and signed written request sent to the data controller at the address indicated in the “contact details” section of this Charter, the user may, after proving their identity (by attaching a copy of their identity card), obtain erasure of their personal data when one of the following grounds applies:

• the data are no longer necessary for the purposes for which they were collected;
• the user has withdrawn consent for processing their data and there is no other legal basis for processing;
• the personal data must be erased to comply with a legal obligation under Union or Member State law to which the data controller is subject;

However, erasure is not applicable in the following five cases:

• when processing is necessary for exercising the right of freedom of expression and information;
• when processing is necessary to comply with a legal obligation under Union or Member State law to which the data controller is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller;
• when processing is necessary for reasons of public interest in the area of public health;
• when processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, insofar as the right to erasure is likely to render impossible or seriously impair the achievement of the processing objectives;
• when processing is necessary for the establishment, exercise or defense of legal claims.

The data controller is required to respond to the user’s request as soon as possible and no later than within one month and to justify their response if they intend not to comply with such a request.

Upon a dated and signed written request sent to the data controller at the address indicated in the “contact details” section of this Charter and after proving their identity (by attaching a legible copy of their identity card), the user may at any time request to receive their personal data free of charge in a structured, commonly used and machine-readable format, notably to transmit it to another data controller, when:

• the processing is carried out by automated means; and
• the processing is based on the user’s consent or on a contract concluded between the user and the data controller.

Under the same conditions and procedures, the user has the right to obtain from the data controller that the personal data concerning them be transmitted directly to another data controller, provided that this is technically feasible. The right to data portability does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.

Upon written, dated and signed request sent to the data controller at the address indicated under the "contact details" section of this Charter and after proof of identity (by attaching a readable copy of an identity card), the user may at any time request to receive their personal data free of charge in a structured, commonly used and machine-readable format, notably to transmit it to another data controller, when:

• the data processing is carried out by automated means; and
• the processing is based on the user’s consent or on a contract concluded between the user and the data controller.

Under the same conditions and according to the same modalities, the user has the right to obtain from the data controller that the personal data concerning them be transmitted directly to another data controller, insofar as technically possible. The right to data portability does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. Data recipients and disclosure to third parties Recipients of collected and processed data are, in addition to the data controller itself, its employees or other subcontractors, its carefully selected business partners located in Belgium or the European Union, collaborating with the data controller in the commercialization of goods or provision of services. Data will never be disclosed and/or sold to third parties for direct marketing or prospecting purposes. The data controller reserves the right to disclose personal data of the user in the event a law, judicial procedure or order from a public authority makes such disclosure necessary. No transfer of personal data outside the European Union is performed. Use and management of "cookies" General principles. This article provides information regarding the use of cookies on the website. This cookie management policy applies to the website. Cookies are managed by the data controller. The website uses cookies to make navigation more useful and reliable. Some of these cookies are essential for the website’s operation, others improve the user experience. Most web browsers are configured to accept cookies automatically. If the user wishes to customize their management, they must modify their browser settings. More information is available in the "cookie management" section of this policy. By visiting and using the website, the user expressly agrees to the cookie management described below. Definition of cookies. A "cookie" is a data or text file that a website server temporarily or permanently stores on the user's equipment (computer hard drive, tablet, smartphone, or similar device) via their browser. Cookies can also be installed by third parties collaborating with the data controller. Cookies retain certain information such as visitor language preferences or shopping cart contents. Other cookies collect statistics about website users or ensure graphical elements display correctly and applications function properly on the website. Others enable content and/or advertising to be adapted to the user. Use of cookies on the website. The website uses different types of cookies:

• Essential or technical cookies: necessary for the operation of the website, ensuring proper communication and facilitating navigation;
• Statistical or analytical cookies: recognize and count visitors and observe their browsing behavior to improve user navigation;
• Functional cookies: activate specific features to enhance usability and experience, such as remembering language preferences;
• Performance cookies: collect info on how visitors use the website, to evaluate and improve content and performance;
• Advertising or commercial cookies: files that collect visitor profile data, placed or read by third parties cooperating with the data controller to measure ad effectiveness and adapt ads to user interests;
• Tracking cookies: used via Google Analytics to help the data controller measure user interaction anonymously and generate visit statistics. Google acts as a subcontractor. For more info, see Google's privacy policy at http://www.google.nl/intl/en_uk/policies/privacy/.

The data controller may also use cookies and tags to collect info about users’ surfing habits across sites in its advertising network. A tag is an invisible image file tracking user navigation on one or more sites and/or applications. Advertisers may also place commercial cookies during ad delivery. Commercial cookies do not contain personal data. Data collected via commercial cookies and tags are used to measure ad effectiveness and better personalize advertising. Cookie retention periods vary: essential cookies usually kept until browser closure; functional cookies valid for 1 year; performance cookies for 4 years. The data controller authorizes public search engines to visit the website via 'spiders' solely to make access and content searchable, without granting rights to archive the site. This authorization can be revoked anytime. To offer users relevant offers, the data controller may contract with internet advertising agencies authorized to place ads on the site. These agencies may collect info when users visit the site. Cookie management. Most browsers accept cookies automatically but allow customization. If the user does not want the website to place cookies on their device, they can manage or delete them via browser settings or program the browser to notify them when a cookie arrives. To block/manage certain cookies, users can use the links below for their browsers:

• Internet Explorer: http://windows.microsoft.com/en-us/windows-vista/block-or-allow-cookies
• Chrome: https://support.google.com/accounts/answer/61416?hl=en
• Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences
• Safari: http://support.apple.com/kb/PH5042

Users not wishing to accept Google Analytics cookies can indicate this via the cookie message on first visit or by browser settings. To opt out from Google Analytics tracking on all sites, visit: http://tools.google.com/dlpage/gaoptout Disabling some cookies may result in certain site parts being inaccessible or only partially usable.

The data controller implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk related to the processing and the nature of the data to be protected. They take into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the risks to the rights and freedoms of users. The data controller has implemented appropriate security measures to protect against and prevent the loss, misuse, or alteration of information received on the website, and its employees are bound by a strict duty of confidentiality.

Postal communication. If the user provides their postal address to the data controller via the website or directly, their data is stored in the controller’s address file to respond to their request and keep them informed about the goods and services offered by the controller. The user can consult, correct, or request the removal of their data from the controller's file at any time. To do this, they must contact the data controller at the address mentioned under "contact details" in this Charter, making sure to correctly spell their full name and address. The controller commits to removing their data from any shared lists with other companies or organizations. Telephone communication. If the user or visitor provides their phone number to the controller directly, via platforms or the website, they may receive a call from the controller to provide information about goods, services, or upcoming events. If the user no longer wishes to receive such calls, they can contact the data controller at the address under "contact details" in this Charter, specifying their correctly spelled full name and address. The controller commits to removing their data from shared lists with other companies or organizations. If the user provides their mobile number via the website, they may receive messages (SMS/MMS) from the controller necessary to respond to their questions or inform them about online orders. Email communication. If the user provides their email address to the controller directly, through a communication platform (e.g., Immoweb) or via the website, they may receive emails from the controller with information about its goods, services, or upcoming events (for direct marketing purposes). If the user no longer wishes to receive such emails, they can contact the data controller at the address mentioned in the "contact details" section of this Charter, correctly stating their name and address. Robinson list. If the user no longer wishes to receive mailings or phone calls from any company registered on the Robinson list, they can contact the Robinson service of the Belgian Direct Marketing Association:

• www.robinsonlist.be
• Toll-free number: 0800-91 887
• By post: ABMD, Liste Robinson, Buro & Design Center, Esplanade du Heysel B46, 1020 Brussels

The user may file a complaint with the Data Protection Authority at the following address:

• Data Protection Authority
• Rue de la Presse, 35
• 1000 Brussels
• Phone: +32 (0)2 274 48 00
• Fax: +32 (0)2 274 48 35
• Email: contact@apd-gba.be
• Website: https://www.autoriteprotectiondonnees.be

The user may also file a complaint with the court of first instance in their place of residence. For more information on complaints and available remedies, the user is invited to consult the following address of the Data Protection Authority: https://www.autoriteprotectiondonnees.be

For any questions and/or complaints, especially regarding the clarity and accessibility of this Charter, the user may contact the data controller:

• By email: lth@bathim.be
• By mail: BATHIM – 112 Boulevard Brand Whitlock - 1200 Brussels

This Charter is governed by Belgian law. Any dispute related to the interpretation or execution of this Charter shall be subject to Belgian law and the exclusive jurisdiction of the courts of the judicial district of Brussels.

The data controller reserves the right to modify the provisions of this Charter at any time. Modifications will be published with a notice regarding their entry into force. The current version of this Charter is dated 25.05.2018.