Privacy & Cookies

1    Privacy Statement
1.1  General

To protect your privacy, we endeavour to comply at all times with current Belgian
and European legislation on the protection of privacy.
With this Privacy Statement, we, Equicty NV, Oude Wervikstraat 48, B-8980 Beselare, Belgium
(“Equicty”) wish to inform you about how we collect and process personal data.
This Privacy Statement applies, among other things, to our (i) website (the “website”),
(ii) mobile application (the “app”) and (iii) platform (the “platform”).
By creating a (demo) account on the website, you accept our Privacy Statement.

Please read this Privacy Statement in conjunction with Equicty’s Cookie Policy (see
below).

1.2 Type of personal data and method of collection
Below is an overview of the personal data that we process:
§ Surname
§ First name
§ Gender
§ Email address
§ Telephone number (fixed/mobile)
§ VAT number (for quotations)
§ Username
§ Password
§ Communication with Equicty
We collect your personal data when you use the Equicty website and services via
the platform and/or the app. In addition, we process information such as (i) which
parts of the website, app and platform you visit, (ii) which browsers you use, and (iii)
your IP address. This data enables us to compile statistics about the use of our
services. We may also obtain personal data via third parties (e.g. commercial
partners) or via third party posts or chatbox messages on our social media channels
(Facebook, Instagram, LinkedIn, etc.).

1.3 Use of persona data
Equicty uses your personal data (i) to provide you with products and/or services (via
app, website and platform) (ii) to contact you for customer management purposes,
(iii) to keep you up to date with our products and activities, (iv) for marketing and
statistical purposes and (iv) for content analysis purposes with a view to improving
our product and service offering.
If you choose not to share certain data with us, we may not be able to deliver the
products and/or services you requested and therefore be unable to fulfil the
proposed agreement with you.

1.4 Disclosure of personal data to third parties
Equicty will not disclose your personal data to third parties unless (i) we have your
consent, or (ii) this is strictly necessary to provide or optimise our services (such as, for
example, maintenance works, processing of payments, database management).
We endeavour to work with third parties that maintain a level of security and
confidentiality of your personal data that is consistent with the provisions of our
Privacy Statement.
In addition, Equicty may have to disclose your personal data to competent
authorities when required to do so under law or by judicial procedure, or to
safeguard and protect Equicty’s rights and interests.

1.5 Storage of personal data
Personal data will not be retained for longer than is necessary for the purposes for
which they are processed and for compliance with our legal obligations.
During processing, your personal data may be stored in the following locations:
§ Website builder
§ CRM system
§ Mailing systems
§ Chat platform
§ Mailbox system
The IT and cloud infrastructure used by Equicty for the storage of your personal data
is located within the EU.

1.6 Your privacy rights
In accordance with the applicable privacy legislation, you have the right at any time
to request access to, rectification or erasure of your personal data, to object to, or
restrict, the purposes for which your personal data is processed on certain grounds.
You may also, at any time, request an (electronic) copy of your data and ask us to
transfer your data to another controller. If we have asked for your consent to use
your data for a particular purpose, you may withdraw that consent at any time.
If you wish to exercise any of these rights or have any questions about this Privacy
Statement, you can contact us via privacy@equicty.com or at the above mentioned
postal address. You may be required to provide proof of identity in that case.
Any complaints about this Privacy Statement may also be submitted to the Privacy
Commission.

1.7 Measures to protect personal data
Equicty takes appropriate technical and organisational security
measures to protect personal data from misuse, loss, unauthorised access and other
unwanted processing. Although these measures conform to the applicable security
standards, Equicty can never guarantee a perfect level of security, for example,
when transmitting data over the internet. Moreover, as a user you are yourself
responsible for the security of your data: ensure adequate security of your own IT
infrastructure and never disclose data relating e.g. to your (demo) account to third
parties.

1.8 Third party websites
Equicty’s website may contain hyperlinks to third party websites. Please be aware
that Equicty is not responsible for the privacy policy or practices of those third party
websites.

1.9 Privacy Statement Update
To ensure you have the latest version of this Privacy Statement, we encourage you to
check this page at regular intervals.

2 Cookie Policy
What are cookies and how do they work?
Equicty uses cookies or similar techniques, which enable us to collect technical
information about your visit to, and use of, our website. We do this to improve the
management of our website and to optimise the services we provide to you and to
enhance your user experience when you revisit the website. Cookies are small text
files stored on the hard drive of your device to allow us to identify your device when
you use the website (e.g. login data, language settings, etc.). You may block and/or
disable the use of cookies through your internet browser settings (see below).
However, you may then not be able to use certain functions of our website.

2.1 What types of cookies do we use?
Equicty uses the following cookies for the website/platform:
Strictly necessary cookies: these cookies are required for the proper functioning of
the website/platform.
§ Functional cookies: these cookies are used to save your preferences and to
enhance the functionality of the website and the platform.
§ Performance analysis cookies: these cookies are used to enhance the
performance of the website and the platform. They are essential for a better
user experience. Equicty uses Google Analytics, a web analysis service
provided by Google Inc. Google Analytics that helps us analyse the use of
cookies. This allows us to gain a better insight into the behaviour of our users,
which is essential for the functioning and the improvement of the
website/platform.
§ Third party cookies: Equicty uses social media to communicate with the
public. Channels we use include Facebook, Instagram and LinkedIn. These
channels may also use cookies. The use of certain of those cookies may
require your consent. However, Equicty has no control over these cookies. For
further information about cookies, please read the cookie policy of the
relevant media.

2.2 How to disable cookies
You can reject or manage the installation of cookies through your browser settings.
You can also, at any time, remove previously installed cookies from your computer or
mobile device. The way to disable cookies on the most commonly used browsers
can be found at the following website.
Details on each browser type (e.g. Internet Explorer, Mozilla Firefox, Chrome, Safari,
etc.) can also be found on the cookie policy pages of the browser websites.

2.3 Cookie Policy Update
To ensure you have the latest version of this Cookie Policy, we encourage you to
check this page at regular intervals.

3. Equicty Data Processing Addendum

This Data Processing Addendum (“Addendum”) supplements the Terms of Service & privacy policy, located at terms and conditions & privacy and cookie-policy (the “Agreement”), between the Client identified in the signature block below (“Client”) and Equicty NV (“Company”), is dated the later of (i) May 25, 2018 or (ii) the date of last signature of a party below, and is hereby incorporated by reference into the Agreement. All capitalized terms not otherwise defined in this Addendum will have the meaning given to them in the Agreement. In the event of any inconsistency or conflict between this Addendum and the Agreement, this Addendum will govern. Client and Company agree as follows:

1. Processing of Personal Information. In connection with providing the services under the Agreement (“Services”), Company will be Processing (as defined below) Personal Information on behalf of Client. “Personal Information” means information that relates, directly or indirectly, to an identified or identifiable person (a “Data Subject”), which may include names, email addresses, postal addresses, or online identifiers, that Client provides or submits in connection with using the Services. Specific categories of Personal Information that Company will Process in connection with the Agreement are set forth in Schedule 1 (Scope of Processing). As between Client and Company, all Personal Information is the sole and exclusive property of Client. “Process” or “Processing” means any operation or set of operations which is performed on Personal Information, whether or not by automated means, such as the access, collection, use, storage, disclosure, dissemination, combination, recording, organization, structuring, adaption, alteration, copying, transfer, retrieval, consultation, disposal, restriction, erasure and/or destruction of Personal Information.
   
2. Company and Client Responsibilities. The parties acknowledge and agree that: (a) Company is a processor of Personal Information under Applicable Law (defined below); (b) Client is a controller of Personal Information under Applicable Law; and (c) each party will comply with the obligations applicable to it under Applicable Law with respect to the Processing of Personal Information.
   
3. Company Responsibilities. As part of the Services, Company will use commercially reasonable efforts to:
   • Process Personal Information solely in accordance with Client’s documented instructions;
   • Process Personal Information in accordance with laws, rules, and regulations that apply to Company’s provision, and Client’s use, of the Services, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”,and collectively, “Applicable Law”);
   • except as strictly required for the provision of the Services, not disclose or otherwise make available any Personal Information to any third party without, unless prohibited by Applicable Law, obtaining Client’s prior consent to the disclosure;
   • amend, correct, or erase Personal Information at Client’s written request and provide a means for Client to update and make accurate Personal Information Processed by Company;
   • notify Client of any third party request (by a Data Subject or otherwise) to (i) restrict the Processing of Personal Information; (ii) port Personal Information to a third party; or (iii) access, rectify, or erase Personal Information. Company will use commercially reasonable efforts to assist Client, at Client’s reasonable written request, in complying with Client’s obligations to respond to requests and complaints directed to Client with respect to Personal Information Processed by Company;
   • at the reasonable written request of Client, cooperate and assist Client in conducting a data protection impact assessment;
   • ensure that Company personnel Processing Personal Information are subject to obligations of confidentiality; and
   • keep all Personal Information compartmentalized or otherwise logically distinct from other information of Company or its personnel, suppliers, customers or other third parties; and
   • provide commercially reasonable assistance to Client in responding to requests from any applicable data protection regulators in the European Union related to compliance with Applicable Law.

Company will use commercially reasonable efforts to inform Client if Company becomes aware or reasonably suspects that Client’s instructions regarding the Processing of Personal Information may
breach any Applicable Law. Company, however, is under no obligation to conduct a comprehensive legal review or to follow any instructions prohibited by Applicable Law. Client shall bear all additional costs incurred by Company as a result of any additional or alternate instructions, not part of the Services, unless the instruction is necessary to comply with statutory requirements applicable to Company.

4. Subcontractors. Company will not engage another processor to Process Client’s Personal
   Information without authorization from Client. Company will be responsible to Client for any
   material failure of such processor to fulfill Company’s data protection obligations as set forth in this
   Agreement. Client hereby provides its general written authorization for Company’s use of
   subcontractors to Process Personal Information on behalf of Client, including those identified at
   privacy and cookie policy (sub processors), which may be updated from time to time by Company. Client consents to any such updates.
   
5. Data Transfers. Any transfers of Personal Information to jurisdictions outside of the EU/EEA, to the extent such transfers are required for the provision of the Services, shall be made in accordance with data transfer mechanisms which are compliant with Applicable Law.
   
6. Security Safeguards. Company will use commercially reasonable efforts to implement and maintain
   appropriate technical and organizational measures consistent with industry standards to protect
   and ensure the confidentiality and integrity of Personal Information.
   
7. Records and Audits. Company will keep at its normal place of business records of its Processing of
   Client Personal Information. At Client’s reasonable request,
   Company will use commercially reasonable efforts to make available to Client such records and
   information as is necessary to demonstrate its compliance with Applicable Law with respect to
   Personal Information and allow Client or an independent third party to conduct an audit to verify
   such compliance. Any such audit will be conducted (a) on reasonable advance written notice to
   Company; (b) no more than once per year; (c) during Company’s standard business hours; and (d) in such a manner to minimize disruption to Company’s operations. Any information provided by
   Company in connection with such audit must be protected as Company’s confidential information
   subject to a separate non-disclosure agreement entered into between Company and the recipient of such information before such audit. Client will bear the costs of such audit.
   
8. Security Breach. If Company has notice of any actual or potential Security
   Breach (defined below), Company will take commercially reasonable efforts to, without undue
   delay: (a) notify Client of the Security Breach; (b) help Client investigate, remediate, and take any necessary action regarding the Security Breach and any dispute, inquiry, investigation, or claim concerning the Security Breach; and (c) provide Client with assurance that such Security Breach will not recur. “Security Breach” means any unauthorized access to Company owned or controlled networks or systems where Personal Information resides or any misuse or unlawful or accidental loss, destruction, alteration, or unauthorized Processing of Personal Information under Company’s possession or control. This obligations in this Section do not apply to incidents that are caused by Client or Client’s personnel or users.
   
9. Return or Destruction of Personal Information. Upon written request by Client or when Company is no longer required to Process Personal Information to fulfill its obligations under the Agreement,
   Company will use commercially reasonable efforts to (a) cease all use of Personal Information; and
   (b) return all Personal Information to Client or, at Client’s option, destroy all Personal Information
   and all copies thereof, except to the extent that Company is required under Applicable Law to keep
   a copy of Personal Information for a specified period of time.
   
10. DISCLAIMER. COMPANY MAKES NO REPRESENTATION OR WARRANTY THAT THIS ADDENDUM IS LEGALLY SUFFICIENT TO MEET CLIENT’S NEEDS UNDER APPLICABLE LAW, INCLUDING THE GDPR. COMPANY EXPRESSLY DISCLAIMS ALL REPRESENTATIONS OR WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, THROUGH A COURSE OF DEALING, OR OTHERWISE THAT THIS ADDENDUM WILL COMPLY WITH OR SATISFY ANY OF CLIENT’S OBLIGATIONS UNDER APPLICABLE LAW, INCLUDING THE GDPR. CLIENT FULLY UNDERSTANDS THAT IT IS SOLELY RESPONSIBLE FOR COMPLYING WITH ALL OF ITS OBLIGATIONS IMPOSED BY APPLICABLE LAW.

SCHEDULE 1

Scope of Processing

Subject Matter of Processing: The context for the Processing of Personal Information is Company’s provision of Services under the Agreement.

Duration of Processing: The Processing will begin on the effective date of the Agreement and will end upon expiration or termination of the Agreement.

Nature and Purpose of Processing: Company specializes in the development of business software services for equestrian centers, horse riding clubs, horse studbooks and any horse business related companies. Client, as a client of Company, uses the Services to process Personal Information of its customers or contacts, suppliers and their employees for business management purposes. Company stores the Personal Information on its servers and processes only for the purposes of, and in accordance with, the instructions of Client and does not make any decisions itself as to the use, updating, or deletion of Personal Information.

Types of Personal Information: The Personal Information concerns the following categories of data: contact details including name, address, telephone or mobile number, fax number and email address; age and/or date of birth; personal bank account details; details of goods and/or services which customers/potential customer have purchased or inquired about; IP address; place of employment; occupation; personal interests; and other Personal Information collected and provided by Client in connection with Client’s use of the Services.

Categories of Data Subjects: The Personal Information transferred concerns the following categories of data subjects: customers and prospective customers of Client, contacts, suppliers and employees determined by Client in connection with Client’s use of the Services.