PRIVACY POLICY

1. WHO WE ARE

The data controller of www.departax.com (the “Website”) is Arimar sprlu, a company registered at 48 rue de Viville, B-6700 Arlon Belgium, with VAT nr BE0463.171.931, email info@departax.com (the “Company”).

2. GENERAL INFORMATION

In the process of operating the Website, the Company will collect certain information including personal data (“personal data”) which are provided by the users of the Website directly (e.g. first name, family name, residence address, email address, telephone number, date of birth, etc) or indirectly (e.g. IP address).

We will process personal data for the following purposes, based on the legal grounds indicated for each of them.

We also mention if the process if currently in use or not.

2.1. Browsing the website. Use of cookies (currently in use)

When you are visiting the Website, we may use cookies to collect technical information that could identify you, such as the IP address, the type of internet browser used for navigating the Website, your operating system, domain name or domain host through which you are browsing the Website.

The main purpose of using cookies is to help you have a better navigation experience and for advertising purposes, to offer you content tailored to your interests and preferences. As such, insofar you have consented to the use of cookies, we will use cookies to offer you a personalized and relevant experience of browsing the Website and to understand how you interact with our advertising content.

2.2. Processing the sale of products/services (currently in use)

For the purchase of products and services, both from the Company and its contractual partners, we will process the following personal data: name, language preference, gender, nationality, email address, address, date and place of birth, identification and passport number, identity document details, phone number, IP address, payment preference, bank and credit card details, purchase description, purchase date, purchase amount, login name and password, point of last European Union exit, date of departure from European Union, flight number, flight destination, as described below.

2.3. Invoicing and management of payments (currently in use)

In the context of purchasing of products and services, we process personal data in order to achieve the following purposes: issuing invoices, making payments or refunds, managing cash transactions. We will collect personal data such as: name, language preference, gender, nationality, email address, address, date and place of birth, identification and passport number, identity document details, phone number, IP address, payment preference, bank and credit card details, purchase description, purchase date, purchase amount, login name and password, point of last European Union exit, date of departure from European Union, flight number, flight destination.

2.4. Data processing of the representatives of the contractual partners involved in the execution of the contracts with the Company and/or the representatives of the public authorities (currently in use)

If you are the contact person of the partners, potential partners, or public authorities with whom the Company interacts in the course of the contracts, the Company processes your personal data as follows:

· To initiate or develop the contractual relationship between the Company and partners or potential partners;

· To initiate or develop the relations between the Company and the representatives of the public authorities with whom the Company interacts during current activities.

The processing of your data for this purpose is based on the legitimate interest of the Company to initiate and conduct contractual relations and/or with public authorities in conducting the Company's activity in the context of offering the Company's products and services. The refusal to provide data for this purpose may have therefore the Company's inability to carry out its activity.

2.5. Answering your questions, requests or complaints (currently in use)

We will process your personal data, such as name, email address, telephone number and any other information or details you may provide the Company with in the correspondence, in order to communicate with you regarding the progress of the purchased goods or services (managing orders, payments, returns, refunds, delays, cancellations, complaints), depending on the communication channel you are contacting the Company.

2.6. Direct marketing communications (currently in use)

We may process personal data to inform you about our products and services, promotional offers and for newsletter subscription. As a general rule, such personal data will be processed for direct marketing purposes only based on your consent and by using the communication channels (email, etc) you agreed with upon providing your consent. However, insofar you have provided us with your email address on the occasion of purchasing a product or service from us, we may use the email address, in compliance with the legal provisions in force allowing us to present you commercial communications regarding similar products or services, based on our legitimate interest in this respect; in such a case, upon obtaining the email address from you and subsequently, for each marketing message we may send you, we will provide you with the option to oppose to such utilization of the email address by unsubscribing.

2.7. Surveys, customers satisfaction studies and feedback from customers (currently in use)

We will process your personal data when you decide to participate to our surveys or market studies, customer satisfaction inquiries or when you provide feedback on our products and services. Such personal data will be processed for the above purpose only based on your consent, also having in view our legitimate interest to help us understand the customers’ needs and expectations about our products and services. Your participation to such surveys or market studies is voluntary.
Therefore, it is your choice to decide whether to offer us personal data (such as name, information regarding your preferences, payment and shopping habits or other personal data that you may offer to provide), by filling-in participation forms on the Website or similar forms as provided by the respective surveys or studies.

2.8. Referral program (currently not in use)

We will process your personal data in case a user of the Services has communicated your email address to us regarding the user’s participation to our referral program. The participation of the user to such referral programs is voluntary. Therefore, it is the user’s choice to decide whether to offer us your personal data, by filling-in email addresses on the Website during a purchase of Cards.

We may process personal data to inform you about our products and services, promotional offers and for newsletter subscription, based on our legitimate interest in this respect; in such a case, for each marketing message we may send you, we will provide you with the option to oppose to such utilization of the email address by unsubscribing.

2.9. Automated decision making and automated profiling (currently not in use)

The personal data referred to herein are subject to automated decision making, including profiling. The logic involved by the processing is to improve the experience of purchasing with the Company and to developing the services portfolio of the Company, as described below.

3. WHO DO WE DISCLOSE YOUR PERSONAL DATA TO?

For reaching the purposes described above, the Company uses the services of various contractual partners. Some of them are authorized persons, such as the issuers of gift cards, operating in or outside the European Union, and your personal data may be provided to them to be used within the limits of their obligations to the Company. The personal data we disclose to the persons empowered by us are limited to the minimum personal information that is required to provide these services (beneficiary’s card number, the purchase amount, the date and currency of the transaction) and we ask them not to use the personal data for any other purpose. We make every effort to ensure that all the entities we work with store your personal data safely and securely.

Some of these are third parties who are not intended to process the data but may have access to it upon fulfilling their tasks or interacting with the Company, such as technical maintenance companies, financial or legal auditors, operating in or outside the European Union.

The personal data indicated above may also be made available or submitted to third parties in the following situations:

(i) public authorities, auditors or institutions competent to exercise inspections on the Company’s business or assets, which ask the Company to provide information, by the latter’s legal obligations. Such public authorities or institutions may be the police and regulatory authorities, border police;

(ii) to comply with a legal requirement or to protect the rights and assets of our Company or other entities or people, such as courts of law;

(iii) to third-party purchasers, insofar the business of the Company would be (totally or partially) transferred and the subjects’ data would be part of the assets representing the object of the transaction.

Further on, for the processing purposes set out above, we may share your personal data with our sister companies, that will comply with the Company's instructions regarding the processing of your personal data.

The persons and entities we may share personal data with are the following:

a) For the purpose of browsing the Website and the purposes related to the use of cookies, we may send personal data to analysts and search engines providers, for them to perform website maintenance services for the Website;

b) To answer your questions, requests or complaints, we may share your personal data to call center services providers;

c) For organizing and managing the promotional campaigns, as well as to analyze their effectiveness, we may send your personal data to advertising and marketing agencies, digital and social media agencies;

d) For direct marketing communications, we may send personal data to advertising and marketing agencies performing the communication on our behalf;

e) For conducting surveys, market studies, customer satisfaction inquiries or for obtaining our customers’ feedback on our products and services, we may share personal data to providers of survey, market studies, or customer inquiries services.

4. TRANSFER OF PERSONAL DATA ABROAD

In the context of the operations described above, your personal data may be transferred abroad to countries in or outside the European Union (“EU”).

We hereby inform you that any transfer performed by the Company in or out of an EU member state will observe the legal requirements laid down by the GDPR. Some of the personal data listed in the Privacy Policy are transferred to countries that do not provide adequate protection for personal data processing, but only to countries where you choose to purchase Cards in.
Regarding transfers to countries that do not provide adequate protection for the processing of personal data, the Company will use the following mechanisms for ensuring the safeguards required by the GDPR: standard clauses obtainable by sending an email to the Company.

5. HOW LONG WE STORE YOUR PERSONAL DATA

We will store your personal data only for the period of time necessary to achieve the processing purposes set out above, also by respecting the legal requirements in force. In case the Company will ascertain that it has a legitimate interest or a legal obligation to further process your personal data for other purposes, you will be properly informed on this. After the duration of the processing indicated above expires and the Company no longer has legal or legitimate reasons to process your personal data, the data will be deleted in accordance with the Company’s procedures, which may involve archiving, anonymizing, destroying them.

6. PROCESSING OF DATA OF CHILDREN UNDER THE AGE OF 18

All personal data processing presented in this Policy refers exclusively to persons that are at least 18 years old. The use of the Website and the Services is forbidden to children under this age. In case such processing occurs, despite our reasonable efforts to prevent it, the Company will cease it upon noticing the fact that the users are under 18 years.

7. SECURITY OF THE DATA PROCESSING

The Company hereby informs you that it constantly evaluates and upgrades the security measures implemented as to ensure a secure and safe personal data processing.

8. REFUSAL OF THE PROCESSING AND CONSEQUENCES THEREOF

The personal data provided under purposes 2.2, 2.3, 2.4 and 2.5 represent a contractual obligation and the data subject has to provide the personal data in order to receive the solicited services, as well as to meet the requirements addressed by it. In case the data subject does not provide the data for the above-mentioned purpose, the Company will be unable to carry out the activities for the aforementioned purposes.

9. RIGHTS OF THE DATA SUBJECTS

Within the context of the processing of your personal data, you have the following rights:

• The right of access to the processed personal data: you have the right to obtain a confirmation whether or not your personal data are being processed, and, if affirmative, to have access to the type of personal data and to the conditions of processing, by addressing a request in this respect to the data controller;
• The right to request the rectification or erasure of personal data: you have the possibility to request, by sending a request in this respect to the data controller, the rectification of inaccurate personal data, the supplementation of incomplete data or the erasure of your personal data in case:

(i) the data are no longer needed for their original purpose (and no new lawful purpose exists),

(ii) the legal basis for the processing is the data subject's consent, the data subject withdraws that consent, and no other legal ground exists,

(iii) the data subject exercises the right to object and the controller has no overriding grounds for continuing the processing,

(iv) the data have been processed unlawfully,

(v) erasure is necessary for compliance with Belgian or EU laws, or

(vi) the data were collected in connection with the informational society services offered to children (if appropriate), where specific requirements regarding consent are applicable;

• The right to request the restriction of processing: you have the right to obtain the restriction of processing in cases where:

(i) you consider that the processed personal data are inaccurate, for a period enabling the controller to verify the accuracy of the personal data;

(ii) the processing is unlawful, however you do not want us to erase your personal data, but to restrict the use of data;

(iii) in case the data controller no longer needs your personal data for the above-mentioned purposes, but you are requiring the data for establishing, exercising or defending a legal claim, or

(iv) you have objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject;

• The right to withdraw your consent for processing, when the processing is based on consent, without affecting the lawfulness of processing undertaken until that moment;
• The right to object to the data processing on grounds relating to your particular situation, when the processing is based on legitimate interest and to object at any moment to the data processing for direct marketing purposes, including profiling;
• The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly affects the data subject in a significant manner;
• The right to data portability, meaning the right to receive your personal data, which you provided to the data controller in a structured, commonly used and machine-readable format and the right to transfer those data to another controller, if the processing is based on your consent or the unfolding of a contract and is undertaken by using automatic means;
• The right to file a complaint with the Data Protection Authority (www.privacycommission.be) and the right to address to the competent courts of law.

The exercising of the above rights may be performed at any time. For using these rights, we invite you to send an email to the Company.

Also, in case you wish to withdraw your consent given for direct marketing purposes you have the possibility to use the “unsubscribe” option provided to you in every marketing communication.

10. CHANGES TO THE PRIVACY POLICY

The Privacy Policy may be changed and updated by the Company from time to time as it could become necessary. The Company will notify you of any material or substantive changes to the Privacy Policy and will ensure that the notification is made in ways which ensure that you acknowledge them, for example by use of the email address that you have provided to us, or any other appropriate means that ensure effective communication.

11. CONTACT

You may address any question regarding this document to the Data Protection Officer by sending an email to the Company.

Version dated 1 January 2019, to be reviewed for 1 January 2020.