Privacy Statement
The protection of your privacy is important to VYVEY & Co We therefore aim to process your personal data in a statutory, honest and transparent manner.
The present Privacy Statement is related to any and all personal data that are collected and processed by VYVEY & Co, having its corporate seat in (2240) Massenhoven at the Herentalsebaan 2, as also by each and every company related to VYVEY & Co in conformity with the Belgian Company Code. The controller for the processing of the personal data is Steven Vyvey. For any and all questions with regard to the protection of personal data you can always call upon Steven Vyvey by post via the aforementioned address or by email via Steven.Vyvey@vyvey-co.be.
In this Privacy Statement we explain what information we collect about you, what we use this information for and to whom we forward the said information. In addition, you can find in the Privacy Statement what rights you have and how you can exercise them. The personal data that we process can be related to you in your capacity of customer of the office but also to you as a business relation of our customers (e.g. In case you are a supplier or customer of our customer). We should, in any case, point you, as the data subject whose personal data are processed, to the following.
Of whom do we collect personal data?
VYVEY & Co collects personal data of natural persons with whom we have, had or intend to have a direct or indirect relationship in the future.
It therefore regards data of our present customers, suppliers, clients and employees but also of potential customers and potential employees.
Why do we collect personal data?
VYVEY & Co collects personal data for the following purposes:
Customer acceptance procedure
As a Chartered Accountant company and as a Certified Public Accountant company we are subject to the anti-money laundering legislation. For the purpose of the said legislation our customers must go through a customer acceptance procedure. For any and all services for which you wish to rely on us, we collect your identification details, e.g. your name, address, telephone number, email address, VAT number and the reading of your identity card.
The said processing is legally based on the statutory obligation vested in us, more specifically the application of the Belgian Act of 18 September 2017 on the prevention of money laundering and the financing of terrorism and on the reduction of the use of cash.
1° For the application of section 26 of the Belgian Act of 18 September 2017 the office must with regard to our clients and their mandatories collect the following personal data: the surname, the first name, the place and date of birth and, to degree possible, the address.
2° For the application of section 25 of the Belgian Act of 18 September 2017 the office must with regard to the ultimate beneficiary of the clients collect the following personal data: the surname, the first name and, to the degree possible, the place and date of birth and the address.
The processing of these personal data is a statutory obligation. Without the said data we cannot proceed with the conclusion of a business relationship (section 33 of the Belgian Act of 18 September 2017 on the prevention of money laundering and the financing of terrorism and on the reduction of the use of cash).
Supply of our services to customers
We also collect personal data in order to be able to supply the requested accounting and tax services to you or to our customers.
For instance we collect socio-demographic data (e.g. your civil status and family situation), financial data (e.g. your income and assets), personal characteristics (e.g. age and gender), living habits (e.g. information about social contacts or accidents), memberships (e.g. of an association or organisation), housing characteristics (e.g. the rent or the expenses), data regarding education and training (e.g. professional training followed and membership of professional organisations), data about profession and employment (e.g. your present employer or data in the context of occupational medicine).
Having regard to our extensive services, the way that we process personal data may vary, depending on the service(s) that the customer relies on. For instance, we process personal data of the customers themselves, of employees of our customer, of directors of the customer, of the employees and customers of a customer during the performance of an audit for a customer, of the customers or suppliers of a customer during the performance of the accounting, of family members of a customer during the consultancy in the context of wealth planning.
The said processing of personal data is required for the implementation of our agreement with our customer.
Financial administration
VYVEY & Co processes personal data in order to be able to maintain its own accounting and invoicing. This regards identification details and billing details.
The said processing is, on the one hand, part of the justified interest of VYVEY & Co, in particular the possibility to keep its accounts and to obtain payment of the services supplied by the same and, on the other hand, VYVEY & Co is subject to a statutory obligation to keep its accounts. This can be obligations vested in the office in respect of the Belgian government, foreign governments or international institutions for the implementation of a statutory or regulatory obligation, for the implementation of a judicial ruling, or in the context of looking after a justified interest, including but not limited to the present and future tax (e.g. VAT listings, VAT records) and national insurance legislation that necessitate us to process personal data in the context of the engagement that was entrusted to us.
The processing of the said personal data is a statutory obligation and without the said data we cannot proceed with the conclusion of a business relationship.
Maintenance of the customer relationship
VYVEY & Co processes personal data to send mailings for our products and services of which we believe that they may be relevant to you.
Sending mailings to our customers is part of our justified interest. It is both in your and in our interest that our customers are kept informed of our activities and new services.
Recruitment purposes
VYVEY & Co collects personal data in view of the recruitment of new employees.
The said processing does, on the one hand, find its legal basis in the consent of the prospective employee and, on the other hand, in our justified interest in recruiting the appropriate candidate for a position.
Security
When you access our office buildings then it may be that you are being filmed. These camera recordings merely serve to secure our office buildings.
It is part of our justified interest to process the said data in the context of the security of our infrastructure, our employees and customers.
Direct marketing
Provided with your consent we collect your contact details in view of sending newsletters, information with regard to activities and other matters that may be of interest to you.
We may also collect so-called ‘special categories’ (article 9 of the GDPR) of personal data, e.g. medical data (in the context of asset planning or other optimisations), The said data are only processed with your express consent.
The types of personal data that we collect may differ depending on the services that we supply to you or to our customer.
With whom do we share your personal data?
Your data are by no means shared with third parties for commercial purposes.
Your personal data within VYVEY & Co
Within VYVEY & Co we handle your personal data very diligently and we only share the data that are required to offer you the best services.
VYVEY & Co took measures to safeguard that personal data that are exchanged or shared within VYVEY & Co are protected.
Your personal data outside VYVEY & Co
In accordance with the above and barring to the degree that the disclosure of personal data to organisations or entities whose intervention as third-party service providers at the expense and under the authority of the controller is required in order to realise the aforementioned purposes, the office shall not disclose, sell, hire or exchange the personal data collected in this context with or to any other organisation or entity, unless you were expressly informed accordingly in advance and you expressed gave consent to the same.
The office relies on “third-party service providers”:
- The office relies on e-accounting software and a thereto-pertaining portal
- The office relies on external employees for the performance of certain duties of specific engagements (company auditor, civil-law notary, lawyer, tax consultant, asset planner)
The office can take any and all measures that are required to ensure good administration of the website and of its information technology system.
The office can forward the personal data at the request of any statutorily competent authority, or even of its own volition if it is in good faith of the opinion that the forwarding of the said information is required to comply with the legislation and regulations, or to defend and/or protect the rights or the assets of the office, of its customers, of its website and/or of you.
Social media applications that we use
On our website we use social media applications. We wish to bring to your attention that any and all personal data that you communicate to these social media applications can be read, collected and used by other users of the said applications. VYVEY & Co has little or no control over the said other users and can therefore not guarantee that any and all social media applications shall comply with this Privacy Statement.
How do we secure your personal data?
VYVEY & Co developed various security measures in order to, where possible, prevent the unauthorised access to the personal data collected in this context, so that your personal data are kept in a secure, correct and up to date manner. Specifically, we try to avoid unauthorised access to or unauthorised adjustment, disclosure or destruction of personal data that are in our possession. To this end the office developed procedures in the area of security and organisation, which are related to both the collection of the said data and their retention.
These procedures are also applicable to any and all processors that the office relies on.
How long do we retain your personal data?
1. Personal data that we must retain pursuant to the Belgian Act of 18 September 2017 (see above “Why do we collect personal data?”.)
This regards the identification data and the copy of the documentary evidence regarding our clients, the internal and external mandatories as well as the ultimate beneficiaries of our clients.
These personal data are, in accordance with section 60 of the Belgian Act of 18 September 2017, retained up to at the latest ten years after the end of the business relationship with the client or to be calculated from the date of an occasional performance.
2. Other personal data
The personal data of the persons other than those mentioned above are only retained during the periods as foreseen in the applicable legislation, e.g. the accounting legislation, the tax legislation and the national insurance legislation.
3. After the expiry of the aforementioned periods the personal data are deleted, unless other applicable legislation foresees a longer retention period.
Your customer dossier is, in any case, not retained for more than 10 years after the termination of our customer relationship.
What rights are you entitled to?
You have various rights regarding the personal data that we process:
The right to access:
You have the right to appoint confirmation that we process personal data about you and to request a copy of the personal data that we retain about you free of charge.
The right to correction:
You have the right to request that we update the personal data that we have about you or that we correct or supplement potentially incorrect personal data.
The right to erasure and restriction:
You have the right to request us to erase your personal data. You hereby acknowledge that in case of a request for erasure of personal data certain data cannot be supplied.
You can request us to restrict the processing of your personal data.
The right to object:
You always have the right to object to the use of your personal data. You should, however, substantiate this.
You can also expressly object to the processing of your personal data for purposes of direct marketing, you do not need to substantiate this.
Right to portability
You have the right to obtain your personal data that are processed by us in a structured, common and machine readable form. You also have the right to have the said data transferred to other controllers for the processing.
Right to revoke your consent:
You always have the right to revoke your consent to the processing of your personal data (on the condition that the processing is based on your consent).
Right to submit a complaint:
You also have the right to submit a complaint to the Belgian Data Protection Authority:
Drukpersstraat 35 – 1000 BRUSSELS
Tel. 02/274.48.00
Fax. 02/274.48.35
contact@apd-gba.be
In this respect we also need to bring section 65 of the Belgian Act on 18 September 2017 to your attention:
“Section 65. The person to whom in pursuance of this Act the processing of the personal data applies is not entitled to the right to access and correction of his data or the right to be forgotten, data portability, or to submit objections or the right not to be profiled or notification of the security defects.
The right of the relevant person to access the personal data that are related to him is exercised indirectly, pursuant to section 13 of the aforementioned Act of 8 December 1992, with the Committee for the Protection of the Personal Privacy, as established pursuant to section 23 of the same Act.
The Committee for the Protection of the Personal Privacy exclusively informs the person who made the request that the necessary verifications were carried out as well as the relevant result in terms of the legitimacy of the processing in question.
The said data can be communicated to the person who made the request when the Committee for the Protection of the Personal Privacy, in association with the CFI and after an opinion of the controller of the processing, on the one hand establishes that the relevant communication is not susceptible to disclosure of the existence of a notification of a suspicion as intended in sections 47 and 54, of the consequences that were given to the same or of the implementation by the CFI or its right to request additional information in pursuance of section 81 and is neither susceptible to prejudice of the objective of preventing WG/FT and, on the other hand, establishes that the relevant data are related to the person who made the request and are kept by submitted entities, the CFI or the supervisory authorities for the purpose of this Act.”
For the application of your rights regarding your personal data you can therefore address the Data Protection Authority.
If you intend to exercise the aforementioned rights then you can address Steven Vyvey. Before complying with your request, we may request submission of proof of identity.
About this Privacy Statement
Our Privacy Statement may change from time to time. Any and all changes shall always be presented on this page.
If you have questions about the processing of your personal data by VYVEY & Co then you can call upon our Data Protection Officer.
