Privacy Notice

This privacy notice (“Notice”) explains why VITALO INTERNATIONAL NV (“Vitalo”, “we”, “us”, “our”) processes your personal data when you:

  1. visit our website (“Website”, www.vitalo.net) or our social media pages and contact us by telephone, email or any other communication channel;
  2. do business with us;
  3. apply for a job with us;

and which rights you have in relation to this processing.

1. USE OF COOKIES AND SIMILAR TECHNOLOGIES

When you use our Website, you will notice that we use cookies and similar technologies. Such technologies place information on your device or collect information already stored on your device.

A complete overview of the cookies we use, stating for each cookie its purpose, the party placing it, the personal data concerned and its lifespan, is set out in our cookie policy, available on our Website.

2. WHO IS RESPONSIBLE AND FOR WHAT?

2.1 Vitalo International NV, a company incorporated under Belgian law, is the controller for the processing of your personal data as described in this Notice.

2.2 Our full identification and contact details are: Vitalo International NV, with registered office at Bruggesteenweg 7, 8760 Meulebeke (Belgium), registered with the Crossroads Bank for Enterprises under company number BE 0439.592.518, telephone number +32 51 48 00 48.

2.3 If you have any questions about the processing of your personal data as described herein, or about the content of this Notice, you can contact us by email at info@vitalo.net.

2.4 We reserve the right to amend, supplement or entirely revise this Notice at our own discretion and from time to time. We will inform you of such amendments, supplements or revisions via the Website before they take effect. Where we rely on your consent for the processing of your personal data, you will be expressly asked, to the extent that the amendments, supplements or revisions concern processing based on your consent, to consent to the amended, supplemented or revised Notice before those amendments, supplements or revisions apply to our processing of your personal data.

2.5 Irrespective of your capacity under this Notice (visitor of the website or social media page, job applicant, customer or supplier), we will always process your personal data for the following purposes:

  1. to prepare and carry out corporate transactions such as mergers, acquisitions or demergers, for which we rely on our legitimate interest in entering into such transactions;
  2. to comply with legal obligations;
  3. to comply with any reasonable request from competent officials or representatives of the police, judicial authorities, government agencies or bodies, including the competent data protection authorities, for which we rely on our legal obligations;
  4. to transfer your personal data at the initiative of Vitalo to the police or judicial authorities in the event of a reasonable suspicion of an unlawful act or offence on your part, or to use them as evidence in legal proceedings or other forms of dispute resolution, for which we rely on our legitimate interest in defending our interests.

2.6 Where the processing of your personal data is required by law or is necessary in order to enter into or perform an agreement with you, the provision of those data is a statutory or contractual requirement. If you do not provide them, we will not be able to enter into or perform that agreement, to handle your request or to process your job application.

2.7 We do not take decisions producing legal effects concerning you or similarly significantly affecting you which are based solely on automated processing, including profiling.

2.8 We do not seek to collect special categories of personal data within the meaning of Article 9 GDPR, nor personal data relating to criminal convictions and offences within the meaning of Article 10 GDPR and Article 10 of the Act of 30 July 2018, unless we are legally obliged or authorised to do so. We ask you not to communicate such data to us on your own initiative.

2.9 We keep a record of our processing activities in accordance with Article 30 GDPR and, where a type of processing is likely to result in a high risk to your rights and freedoms, we carry out a data protection impact assessment in accordance with Article 35 GDPR and the list of the Belgian Data Protection Authority adopted under Article 35(4) GDPR.

3. YOU VISIT OUR WEBSITE OR SOCIAL MEDIA PAGES OR CONTACT US BY TELEPHONE, EMAIL OR ANY OTHER COMMUNICATION CHANNEL

3.1 Each time you visit our Website, we collect technical information relating to the device you use, such as your IP address and browser type.

Such information is also collected when you visit our social media pages, but in that case the social media service provider is responsible for this collection. Please consult the privacy notices of those social media providers for more information on how they process your personal data.

These personal data are retained for a maximum of six months.

Where we operate a page on a social media platform, we and the provider of that platform may act as joint controllers within the meaning of Article 26 GDPR for the processing of the visitor statistics generated in connection with that page. The essential content of that arrangement is made available by the platform provider, and you may exercise the rights set out in this Notice against each of the joint controllers.

  1. When you contact us by telephone, email or any other communication channel, we collect:
    • the basic identification data you provide to us, such as name, email address, postal address, telephone number, the company you work for and your function;
    • the content of your communication and the technical information of your communication (the person with whom we communicate on our side, the date and time, etc.)
    • your preferences regarding the receipt of our email communications;
    • any other personal data you provide to us.
  2. We receive all of the above personal data directly from you.
  3. Vitalo processes your personal data when you communicate with us by telephone, email or any other communication channel for the following purposes:
    • to answer your questions, requests or other communications;
    • to provide you with information about our products, services and activities;
    • to keep our website, social media pages, business, employees, business assets and information secure;
    • to carry out statistical analyses on the use of our communication channels;
    • to improve our services or business processes or to develop new products or services.

For all of the above purposes, we rely on our legitimate interest in processing your personal data in order to conduct normal business communications and to communicate about our services and activities, to understand how our communication channels are used and to develop as a company.

Your personal data will be retained for as long as this is necessary and useful in the light of the communication conducted.

Where we send you electronic direct marketing, we do so only after your prior, free and informed consent, or, where you are already a customer and the communication concerns similar products or services of our own, on the basis of Article XII.13 of the Code of Economic Law and the Royal Decree of 4 April 2003 regulating the sending of advertising by electronic mail. Every message contains a simple and free-of-charge means of unsubscribing, and you may object to direct marketing at any time and without giving reasons.

4. YOU DO BUSINESS WITH US

4.1 In addition to interactions we may have with you as a result of your use of our website, social media pages or communication by email, telephone, fax or chat, we also receive personal data directly from you or from the company you work for when you do business with us. This concerns the following data:

  1. your basic identification data such as name, email address, postal address, telephone number, the company you work for and your function;
  2. the content of your communication and the technical information of the communication itself (the person communicating on our side, the date and time, etc.);
  3. payment and invoicing-related data.

4.2 Vitalo processes your personal data in order to:

  1. process orders;
  2. conduct normal commercial relationship management;
  3. carry out normal internal management reporting activities.

For the first purpose, we process your personal data because this is necessary in order to enter into an agreement with you and to perform that agreement. If you represent a company, we rely on our legitimate interest in processing the contact details of the persons who represent our business relations. For the other two purposes, the processing is based on our legitimate interest in conducting normal business operations and relationship follow-up. Your personal data will be retained for the entire duration of the business relationship and for up to ten years after it ends.

Payment and invoicing data are retained for the periods imposed by tax and accounting law, being in principle ten years as from 1 January of the year following the financial year concerned, and seven years for the books and supporting documents referred to in Articles III.86 and III.88 of the Code of Economic Law. The retention of contractual data for ten years after the end of the business relationship corresponds to the limitation period for personal actions laid down in Article 2262bis, § 1, first paragraph, of the former Civil Code.

5. YOU APPLY FOR A JOB WITH US

5.1 When you apply for a job by email, we collect and process the following categories of personal data:

  1. your basic identification data (e.g. name, email address, postal address);
  2. the content of your communication and the technical details of the communication itself (with whom on our side you correspond, the date, time, etc.);
  3. any attachments you send us, such as your CV and all the content of your CV.

5.2 Vitalo processes your personal data in order to:

  1. process your job application;
  2. possibly invite you for an interview;
  3. possibly conclude an employment agreement;
  4. build a recruitment reserve.

For the first three purposes, we process your personal data because this is necessary in order to enter into an agreement with you. If your application is not retained and you do not wish to be included in the recruitment reserve, we will keep your personal data for six months for evidentiary purposes, after which they will be erased. If your application is retained, the retention periods for employee data apply.

For the last purpose, we will ask for your consent, which you may withdraw at any time. If you give consent, we will retain your personal data for one year in our recruitment reserve.

In accordance with Articles 11 and 12 of Collective Bargaining Agreement No. 38 of 6 December 1983 concerning the recruitment and selection of employees, we process only data which are relevant in view of the nature and the conditions of performance of the position, we respect your private life throughout the selection procedure and all information concerning you is treated confidentially. We do not process extracts from the criminal record unless the law provides that the position may be held only by a person who has not been convicted of certain offences, and we do not consult your social media profiles in order to collect information relating to your private life.

6. RECIPIENTS OF PERSONAL DATA

6.1 We share your personal data within the Vitalo group of which we are part, as well as with our service providers (e.g. IT service providers, legal advisers, accountants, banks, insurers, etc.) and with government authorities, in so far as this is necessary for the purposes mentioned above. In any event, we guarantee that your personal data will be processed by the entities within our group in accordance with this Notice.

6.2 If you use our social media pages, your personal data will also be processed by social media service providers. More information on how they process your personal data can be found in their respective notices, as explained above.

6.3 In principle, your personal data are not transferred outside the European Economic Area. Should this nevertheless occur, we will take the necessary measures to ensure that your personal data are also protected outside the European Economic Area.

6.4 Where we engage a processor, we conclude a written processing agreement with that processor which meets the requirements of Article 28(3) GDPR, and the processor acts only on our documented instructions.

7. QUALITY GUARANTEES

7.1 Vitalo will only process those personal data which are necessary for the purposes listed in the Notice.

7.2 Vitalo will take appropriate technical and organisational measures to protect your personal data against unauthorised access or theft and against accidental loss, alteration or destruction. Only staff of Vitalo, its affiliated companies or its external processors who need to be aware of your confidential data have access to these data and are subject to strict confidentiality obligations. You understand, however, that safety and security are only best-efforts obligations which can never be guaranteed.

7.3 In the event of a personal data breach, we will notify the Belgian Data Protection Authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to your rights and freedoms. Where the breach is likely to result in a high risk to your rights and freedoms, we will also inform you without undue delay. We document every breach in an internal register.

8. YOUR RIGHTS

8.1 Right of access – You have the right to request access to all personal data relating to you that we process. In order for us to be able to honour this request, you must explain to which data you wish to have access. We reserve the right to charge an administrative fee for multiple successive access requests which are clearly submitted to cause nuisance or harm to us.

8.2 Right to rectification – You have the right to request that your personal data which are inaccurate be corrected free of charge. If a request for rectification is submitted, that request must be accompanied by evidence of the inaccurate nature of the data for which rectification is requested.

8.3 Right to erasure – You have the right to request that your personal data be erased if they are no longer necessary in the light of the purposes described above or if the processing would be unlawful. You should, however, take into account that we will weigh a request for erasure:

  1. against our compelling interests or those of a third party, in so far as permitted by law;
  2. against legal or regulatory obligations or administrative or judicial orders which may conflict with such erasure.

Instead of erasure, you may also request that we restrict the processing of your personal data where (a) you contest the accuracy of those data, (b) the processing is unlawful or (c) the data are no longer necessary for the purposes outlined above, but you need them in order to defend yourself in legal proceedings.

8.4 Right to object – You have the right to object to the processing of personal data, but you must set out the serious and legitimate grounds relating to your particular situation which justify such objection. This explanation is not required where you object to the processing of your personal data for direct marketing purposes.

8.5 Right to data portability – You have the right to request a copy of the personal data you have provided, in a structured, commonly used, machine-readable format.

8.6 Right to withdraw consent – Where the processing is based on your consent, you have the right to withdraw that consent at any time, in the same easy manner in which it was given. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal.

8.7 How to exercise your rights – If you wish to submit a request to exercise one or more of the rights mentioned above, you can send an email to info@vitalo.net for all matters relating to data subjects’ rights. An email requesting the exercise of a right may not be interpreted as consent to the processing of your personal data going beyond what is necessary for handling your request.

Such a request must clearly indicate which right you wish to exercise and the reasons for doing so, where this is required by law. It must also be dated and signed and be accompanied by a digitally scanned copy of your valid identity card proving your identity. We ask for this in order to prevent unauthorised persons from abusing your rights.

We ask for proof of your identity only where we have reasonable doubts concerning the identity of the person making the request. Where you send us a copy of your identity card, you may mask your photograph and your national register number, the use of which is subject to the Act of 8 August 1983 organising a National Register of natural persons. We do not retain that copy for longer than is necessary to verify your identity.

We will immediately notify you of receipt of this request. If the request proves to be valid, we will inform you thereof as soon as reasonably possible and at the latest thirty (30) days after receipt of the request.

We provide information on the action taken on your request without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case we will inform you of the extension and of the reasons for the delay within one month of receipt of the request. The handling of your request is free of charge; only where requests are manifestly unfounded or excessive, in particular because of their repetitive character, may we charge a reasonable fee or refuse to act, in which case we bear the burden of demonstrating that character.

If you have a complaint about our processing of your personal data, you can always contact us at the email address mentioned in the first paragraph of this article. If you are not satisfied with our reply, you can lodge a complaint with the competent data protection authority, namely the Belgian Data Protection Authority (https://www.gegevensbeschermingsautoriteit.be).

The Belgian Data Protection Authority can be contacted at Rue de la Presse 35, 1000 Brussels, +32 (0)2 274 48 00, contact@apd-gba.be. Independently of any complaint, you may also bring proceedings before the Belgian courts, including the action for an injunction before the President of the Court of First Instance provided for in Articles 209 et seq. of the Act of 30 July 2018, and you have the right to obtain compensation for any damage suffered as a result of an infringement of the GDPR.

This Notice was last updated on 3 September 2026.