Privacy statement

Oak Pharma

 

1. Introduction

1.1 General

The platform professional.oakpharma.eu (hereinafter referred to as the "Platform") and the websites www.oakpharma.eu, www.quercus.eu and www.oakorganic.eu (hereinafter referred to as the "Website") are provided by Oak Pharma (hereinafter referred to as "we" and "us").

Any person using our Platform (hereinafter: the "Registered User") and the Website (hereinafter: the "Visitor") almost inevitably discloses certain personal data. This personal data constitutes information that allows us to identify you as a natural person, whether or not we actually do so. You are identifiable as soon as it is possible to create a direct or indirect link between one or more personal data and you as a natural person. The Registered User and the Visitor are also referred to as "you/your" in this Privacy Statement.

We use and process your personal data in accordance with the General Data Protection Regulation ("GDPR") and other relevant legal provisions. Any reference in this Privacy Statement to the GDPR is a reference to the Regulation of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

Through this Privacy Statement, you are informed of the processing activities we may carry out with your personal data.

This Privacy Statement applies when we act as a data controller for the processing of personal data of our Platform and the Website, in other words, when we determine the purposes and means of the processing of such personal data.

 

Please read this Privacy Statement carefully and make sure you understand it.

 

1.2 What are personal data?

Personal data is defined in the GDPR as "any information relating to an identifiable person who can be identified, directly or indirectly." Personal data, in simpler terms, is any information about you that allows you to be identified. Personal data refers to obvious information, such as your name and contact details, as well as less obvious information, such as identification numbers, electronic location data and other online identifiers.

 

1.3 Changes

We may update this policy from time to time by posting a new version on our Website. This may be necessary, for example, if the law changes, or if we change things in a way that affects the protection of personal data. We recommend that you check this page occasionally to ensure that you are happy with any changes to this Privacy Statement.

2. Contact details

Our Platform and Website are offered and operated by Oak Pharma. We are registered in Belgium under registration number 0655.792.749 and our registered office is located at Siemenslaan 11, 8020 OOSTKAMP.  

You can contact us:

1. by mail, to the mailing address listed above;
2. via the contact form on our Website;
3. by telephone, at +32 50 68 13 90; or
4. by email, using info@oakpharma.be.

 

3. What personal data are processed and how are they used?

3.1 Information processing

Depending on the capacity in which you visit or use our Website and Platform, we may collect and process the following personal data.

 

1. Visitors

Categories of personal data of Visitors	Processing purpose	Legitimate basis	Retention period (*)
Technical Data   IP address; geographical location; browser type and version; operating system; reference source; duration of your visit, page views and website navigation paths, as well as information about the timing, frequency and pattern of your use of the service.	The source of the technical data is the use of non-essential cookies.   The technical data can be processed for the purpose of analysing/improving the use of the Website and Platform.	Consent	See Cookie Statement.
	The source of the technical data are the use of necessary cookies.	Our legitimate interests, so that the Website and Platform function technically in accordance with necessary cookies as referred to in our Cookie Statement.
Communication data   First name and surname; Company name; Telephone of mobile phone number; E-mail address.	The source of the communication data is the information you provide us when you contact us. The communication data may be processed for the purpose of this communication with you and record keeping.	Our legitimate interest, to be able to respond to requests, questions or comments or to contact you for any queries (e.g. when you contact us by phone or email).	The data will be kept for 3 years after the response.
Newsletter data (direct marketing):   First name and surname; E-mail address.	The source of the newsletter data is the information you provide to us when you subscribe to the newsletter.   The newsletter data is processed to send you newsletters from our Platform and Website, for which you have given your consent. You may unsubscribe at any time by clicking on the "unsubscribe" link in the respective email or by any other action described therein.	Consent.	Your data will be processed until you unsubscribe.

 

2. Registered users

Categories of personal data of Registered Users	Processing purpose	Legitimate basis	Retention period (*)
Technical Data IP address; geographical location; browser type and version; operating system; reference source; duration of your visit, page views and website navigation paths, as well as information about the timing, frequency and pattern of your use of the service.	The source of the technical data is the use of non-essential cookies.   The technical data can be processed for the purpose of analysing/improving the use of the Website and Platform.	Consent	See Cookie Statement.
	The source of the technical data are the use of necessary cookies.	Our legitimate interests, so that the Website and Platform function technically in accordance with necessary cookies as referred to in our Cookie Statement.
Account data   First name and surname; Company name; Address; Telephone or mobile phone number; Customer number; VAT number; E-mail address; Login data (e-mail address as user name and pseudonymised password); Account status ("Pending”, “Active” or “Blocked”).	The source of the account data is the information you provide when creating your account. The account data may be processed in order to enable and control your use of our Platform.	Consent Execution of a contract between you and us At your request, taking steps to enter into such a contract	The data is kept for a period of 3 years after the last login.
Communication data   First name and surname; Company name; Telephone of mobile phone number; E-mail address.	The source of the communication data is the information you provide us when you contact us. The communication data may be processed for the purpose of this communication with you and record keeping.	Our legitimate interest, to be able to respond to requests, questions or comments or to contact you for any queries (e.g. when you contact us by phone or email).	The data will be kept for 3 years after the response.
Newsletter data (direct marketing):   First name and surname; E-mail address.	The source of the newsletter data is the information you provide to us when you subscribe to the newsletter.   The newsletter data is processed to send you newsletters from our Platform and Website, for which you have given your consent. You may unsubscribe at any time by clicking on the "unsubscribe" link in the respective email or by any other action described therein.	Consent.	Your data will be processed until you unsubscribe.

 

In addition, we may process your personal data when this is necessary to comply with a legal obligation to which we are subject (such as tax legislation). Without prejudice to the above, we may keep your personal data when this would be necessary for the establishment, exercise or defence of legal claims, whether in legal proceedings or in administrative or extrajudicial proceedings. The legal basis for this processing is our legitimate interests, namely the protection and exercise of our legal rights.

In addition, we may keep personal data (internally), in particular account and communication data, from banned members (Registered Users) who have seriously damaged our trust and failed to comply with our rules of conduct set out in our Terms of Use. We base this on our legitimate interest: prevention of fraud, criminal offences and misconduct. The list is kept indefinitely and is only accessible to a very limited group of people within our company.

 

3.2 Processors

A processor is a natural or legal person who processes personal data at our request or on our behalf. We may sometimes contract with this party to provide certain products and/or services. In other words: We use processors because it is necessary for the provision of services. In this case, we will enter into a written agreement with the processor whereby the security of your personal data is guaranteed by the processor. The processor will always act in accordance with our instructions.

We use the following categories of processors:

• Companies we have engaged for marketing purposes;
• Companies we have engaged for ICT -technical support and hosting purposes;
• Companies we have engaged for administrative purposes (e.g., CRM system);
• Companies we have engaged for logistics purposes (e.g., order picking, delivery, etc.);
• Companies we have engaged for analytical purposes.

 

4. Providing your personal data to third parties

We will not share your personal data with third parties (other than processors) for any purpose, subject to the exceptions below.

In some circumstances, we may be required by law to share certain personal data, including yours, if we are involved in legal proceedings or to comply with legal obligations, a court order or the instructions of a governmental authority.

 

5. International transfer (outside EEA) of your personal data

We may store or transfer some or all of your personal data in countries that are not part of the European Economic Area (the "EEA" consists of all EU member states, plus Norway, Iceland and Liechtenstein). These are known as "third countries" and may have less stringent data protection laws than those in the EEA. This means that we take extra steps to ensure that your personal data is treated as safely and securely as it is in the EEA. We will therefore only transfer your personal data in accordance with Chapter V of the GDPR.

 

6. Your rights

Some rights are complex and not all details are included here. Therefore, please read the relevant provisions and guidelines of supervisory authorities for a full explanation of these rights.

You may exercise your rights with respect to your personal data by written notification to us. See Chapter 2 for contact information.

We will respond to your request within one month of receipt. Normally, we strive to provide a complete response within that time. However, in some cases, especially if your request is more complex, more time may be required, up to a maximum of three months from the date we receive your request. You will be kept fully informed of progress.

 

6.1 The right to inspect

You have the right to confirm whether or not we are processing your personal data and, where we are doing so, to access the personal data, together with certain additional information. This additional information includes details of the purpose of the processing, the relevant categories of personal data and the recipients of the personal data. Provided that the rights and freedoms of others are not affected, we will provide you with a copy of your personal data. The first copy will be provided free of charge, but additional copies may be provided for a reasonable fee.

 

6.2 The right to correction

You have the right to have inaccurate personal data about you corrected and, taking into account the purposes of the processing, to have incomplete personal data about you completed.

 

6.3 The right to erasure (“right to be forgotten”)

In some circumstances, you have the right to have your personal data deleted without undue delay. These circumstances include:

• the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
• you withdraw your consent to processing based on consent;
• you object to the processing under certain rules of applicable data protection law (the GDPR);
• the processing is for direct marketing purposes;
• the personal data has been unlawfully processed; and
• the personal data must be deleted in order to comply with a legal obligation incumbent upon us.

However, there are exclusions to the right to erasure. The general exclusions include where processing is necessary:

• for the exercise of the right to freedom of expression and information;
• for compliance with a legal obligation; or
• for the establishment, exercise or defence of legal claims.

 

6.4 The right to restrict processing

In some circumstances, you have the right to restrict the processing of your personal data. These circumstances are: you dispute the accuracy of the personal data; the processing is unlawful, but you oppose its erasure; we no longer need the personal data for our processing, but you need personal data for the establishment, exercise or defence of legal claims; and you have objected to the processing, pending verification of that objection.

If processing is restricted on this basis, we may continue to store your personal data. However, we will only process them in other ways: with your consent; for the establishment, exercise or defence of legal claims; for the protection of the rights of another natural or legal person; or for reasons of substantial public interest.

 

6.5 The right to object to the processing

You have the right to object to our processing of your personal data for reasons relating to your particular situation, but only to the extent that the legal basis for the processing is that the processing is necessary for the purposes of the legitimate interests pursued by us or a third party. If you raise such an objection, we will cease processing the personal data unless we can demonstrate that there are compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms, or that the processing is for the establishment, exercise or defence of legal claims.

In addition, you have the right to object to our processing of your personal data for direct marketing purposes (including profiling for direct marketing purposes). If you object, we will cease processing your personal data for this purpose.

Furthermore, you have the right to object to our processing of your personal data for scientific or historical research purposes or statistical purposes for reasons relating to your particular situation, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

 

6.6 The right to data portability

To the extent that the legal basis for our processing of your personal data is based on:

1. consent; or
2. that the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract, or
3. such processing is carried out by automated means,

you have the right to receive your personal data from us in a structured, commonly used and machine-readable format.

However, this right does not apply where doing so would compromise the rights and freedoms of others.

 

6.7 The right to lodge a complaint with a supervisory authority

If you believe that our processing of your personal data is in breach of the General Data Protection Regulation (GDPR), you have the right to lodge a complaint with a supervisory authority responsible for data protection. In Belgium, the supervisory authority is the Data Protection Authority (GBA). Data subjects from other Member States have the right to lodge a complaint with their own national supervisory authority. For an overview of the contact details of these authorities, click on this link.

 

Data Protection Authority (GBA)
Drukpersstraat 35, 1000 Brussels
+32 (0)2 274 48 00
contact@apd-gba.be
https://www.gegevensbeschermingsautoriteit.be

 

6.8 The right to withdraw your consent

To the extent that the legal basis for our processing of your personal data is consent, you have the right to withdraw such consent at any time. Revocation does not affect the lawfulness of the processing before the revocation.