Privacy Policy

Table of content

1. A few key concepts
2. Who is responsible for processing your personal data?
3. What kind of personal data do we process?
4. When do we collect this data?
5. What is the purpose of personal data processing
   1. Legal and regulatory obligations
   2. Fulfilment of contract or enforcement of pre-contractual measures
   3. Legitimate interests
   4. Consent
6. Which circumstances can Spreds use your personal data for commercial prospection?
7. Cookie policy
8. Who has access to the personal data that we gather?
9. How long is this data kept?
10. What rights can you exercise concerning your personal data processing?
    1. The right to access and correct
    2. The right to delete data
    3. The right to limit data processing
    4. The right of data portability
    5. The right to withdraw your consent
    6. The right to object
11. Who should you contact to exercise your personal data right?
12. Who sould be contacted in case of dispute/conflict?

1. A few key concepts

This statement gives information about the “processing” of your “personal data” by the “person in charge of processing”.

“Personal data” is any information about a physical identified or identifiable person. It can be a last name, first name, phone number but also a picture, navigational habits on a website, etc. as long as that information is related to a physical person.

“Processing” is any operation linked to personal data. Processing covers all aspects linked to the gathering, recording, managing, structuring, saving, adapting or modifying, extracting, consulting, usage, communication by transmission, publication or any other form of provision, linking or interconnection, limitation, removal or deletion of data.

The “person in charge of processing” is the person or entity that determines the purpose and technical resources used in relation to personal data.

2. Who is responsible for processing your personal data?

The person in charge of processing your personal data is Spreds SA, a limited liability company incorporated in Belgium, registered in “register 2 of corporate entities” (RPM Nivelles) under VAT number BE 837.496.614, with the head office located in Rue des Colonies 11, 1000 Brussels, Belgium.

3. What kind of personal data do we process?

When you visit our Website, the personal data that is collected and processed by Spreds can either be information that you share directly and voluntarily, for example contact details when filling in a form, or data gathered automatically through your navigation on our website (IP address, website sessions,…).

If you choose to become a Member, other personal data will be collected and processed by Spreds. For example, your contact info (address, phone number, email address,…), data related to your identity or personal situation (last name, first name, date of birth, sex,…), data related to your Account and Transactions linked to your account, or other data linked to your website usage.

We do not process sensitive personal data such as information regarding health, ethnic or cultural background, political opinions, religion or beliefs, union membership or sexual orientation, nor do we process data relative to criminal convictions or offenses.

4. When do we collect this data?

We collect your personal data under the following circumstances:

• when you become a Member or when a Member shares your personal data with us;
• when you contact us through one of our communication channels;
• when you log into our Website;
• when you fill in one of our forms or sign a contract.

5. What is the purpose of personal data processing

We use your personal data:

• to comply with all legal provisions or regulations that apply to us;
• within the framework of the fulfilment of the contract or when taking precontractual measures;
• for reasons related to the legitimate interest of Spreds, while preserving a balance between that legitimate interest and your right to privacy; or
• after receiving your consent.

When data processing is justified in relation to the compliance with a legal provision or regulation, or the fulfilment of a contract or pre-contractual measures that you have requested, you will be required to provide some personal information. You can of course refuse to provide such information, but in that case, be aware that you will not be able to take full advantage of all our services.

5.1. Legal and regulatory obligations

In many instances, Spreds is legally required to process your data. For example, as an entity subjected to the regulations on the prevention of money laundering and financing of terrorism, we are required to obtain some information from you and have to verify and store it. Spreds could 5 also be required to process your data in order to respond to legitimate requests from public, tax (Belgian and non-Belgian), prudential or judiciary authorities. Certain regulations require that data be stored and archived during a legal period of time.

5.2. Fulfilment of contract or enforcement of pre-contractual measures

When you become a Member, we are required to process your personal data in order for you to finalise the contract and benefit from all the services and features restricted to our Members.

5.3. Legitimate interests

In compliance with the current legislation, Spreds can also process your personal data to serve its own legitimate interests. In that case, we ensure a balance between those legitimate interests and the respect of your personal rights, including your right to protection of private life.

Within this context, your personal data can be processed to:

• improve the features and the user friendliness of our Website, but also the private and secured spaces reserved for our Members;
• make market studies and statistical analyses;
• retain evidence;
• preserve our rights in case of litigation;
• promote our products and services as well as those of the Companies in which our Members have invested (see below);
• improve the quality of our services.

5.4. Consent

In some instances, we are required by law to get your specific consent before sending you commercial information by phone, email or text message. In that case, we will process your data to this end only after getting your consent.

6. Which circumstances can Spreds use your personal data for commercial prospection?

As a company, Spreds has a legitimate interest in informing you about its products or services. Also, in order to reinforce its attractiveness with other companies, Spreds has a legitimate interest in transferring the personal data of its Members to enable those companies to contact them. Within that framework, we might use or transfer your personal data, and particularly your contact details in order to share some commercial information with you

Specifically, this means that you could be contacted in the following cases:

• regarding products in which you have shown an interest (for example by signing up to an info session);
• when Spreds launches new products or services;
• when you have started the sign-up process in order to open an Account but have not finished the entire process;
• regarding the products or services offered by the Companies.

Within the context of this prospection, we can contact you through traditional means of communication such as phone or regular mail. We will use these methods only if you have not exercised your right to object to the use of your commercial data for direct marketing purposes, as mentioned above.

We can also contact you through email or text message as long as you have agreed to it.

7. Cookie policy

We use cookies (small data files stored in your computer) on our Website in order to boost its performance, to enable it to remember your preferences and to give information that we find relevant or useful to you.

For more information on the use of cookies and the ways to disable them, we invite you to read the Spreds Policy regarding the use of cookies, which can be found on the following page https://www.spreds.com/en/cookies.

8. Who has access to the personal data that we gather?

Your personal data can be consulted by our team members who need it to do their jobs

In some cases, personal data can also be transferred to other people or entities, such as:

• our subcontractors Microsoft, Google, Scalingo, Scaleway, MailChimp, Mailgun, Mollie, and AppSignal. In that case, we see to it that these third-parties can only access the personal data needed to fulfill their objectives. We also make sure that these third-parties use your data in a secured and confidential way, and respect our specific instructions.
• to the Companies that have projects on our platform and in which our Members have invested, so these companies can communicate with their indirect investors;
• to public and controlling authorities, and to legal authorities when required by law;
• to court bailiffs or lawyers in case of litigation;
• to on-line operators and to social media operators for advertising purposes.

9. How long is this data kept?

Your personal data is stored for a period that depends on the objective of data processing and legal requirements. Your personal data can be deleted earlier if you exercise your right to delete data as explained below.

Generally speaking, data is kept (i) as far as Members are concerned, during the entire relationship with Spreds, and during the storage period required by legal and tax regulations (in theory 10 years, with some exceptions) and (ii) regarding other individuals, for a maximum of 5 years, starting with the last contact with said individual.

Past this period, personal data is either anonymised or deleted.

For more details, please see our Cookie Policy on https://www.spreds.com/en/cookies

10. What rights can you exercise concerning your personal data processing?

10.1. The right to access and correct

You have the right to access your personal data. Spreds can provide you with:

• the categories of personal data processed;
• the purpose of collecting your data;
• the kinds of recipients we send your data to;
• the conservation period of your data;
• the logic behind the possible automated processing of your personal data;
• the sources through which we collected your personal data (if not collected directly from you).

If you notice that your data is incomplete or inaccurate, you can ask us to correct them.

10.2. The right to delete data

In certain cases, the law allows you to delete personal data.

For example, if the purpose of the data collection is no longer valid, thus making the data unnecessary (for example, if you shared your information with us in order to participate in an event which has come to an end), if the processing of your data is exclusively based on your consent and you decide to revoke it or you object to the processing of your data (if we do not have legitimate reasons that prevail).

Spreds can however keep your personal data if it is necessary for the ascertation, the exercise or the defense of its rights in court or for the compliance by Spreds with its legal obligations. Spreds will be bound to the storage period required by different legislations, including the case when data is linked to transactions that you have made, or data collected as part of our obligations in the fight against money laundering or the financing of terrorism.

10.3. The right to limit data processing

This right to object enables you to ask us for a temporary blocking of your data in certain cases defined by law: Spreds will no longer be able to process the data in question during a specific period of time.

This blocking can be asked:

• when the data in question is inaccurate, incomplete, ambiguous, outdated, during the time it will take us to verify the accuracy of your data;
• when its collection, usage, transfer or storage is prohibited;
• when the data is no longer necessary to the purpose of data processing;
• during the necessary period needed for Spreds to rule on the validity of exercising a right to object.

If you have made use of this right, we will be able to keep your data but won’t be able to use it, except if you give us your consent, or for the ascertainment, exercise or defense of our rights (or those of another person).

10.4. The right of data portability

Thanks to this right, you can ask us to transfer your data to yourself or directly to another person in charge of data processing when this is technically possible for Spreds. This right concerns only the data you shared with Spreds and that is processed automatically based on the contract or on your consent.

10.5. The right to withdraw your consent

When your data processing is based on your consent, you have, at any moment, the right to withdraw this consent. This withdrawal will not question the legality of the processing during the period preceding your withdrawal.

10.6. The right to object

You always have the right to object without explanation and without cost, to the use of your data for prospection purposes. In that case, your data will no longer be used to this end.

Furthermore, you also have the right to object to any personal data processing based on your legitimate interest. However, we will not follow up on your request if our legitimate interest prevails on yours or if the processing of your data is required for the ascertainment, exercise or defense of our rights in court.

11. Who should you contact to exercise your personal data right?

You can exercise the rights mentioned above by contacting us:

• By mail: Rue des Colonies 11, 1000 Brussels, Belgium
• By email: info@spreds.com

Members can also object to the use of their personal data for direct marketing purposes by modifying their preferences in their secured space on the Website: https://www.spreds.com/en/profile

12. Who sould be contacted in case of dispute/conflict?

In case of conflict regarding the processing of your personal data, you can submit a mediation request to the Data Protection Authority (previously known as the Privacy Protection Commission) at the following address:

Rue de la Presse 35
1000 Brussels
Phone : +32 2 274 48 00
www.privacycommission.be