Privacy statement

1. Who is responsible?

KIOZ NV, Wortegemseweg 82, 8790 Waregem, Belgium, enterprise number BE 0773.634.485, is the controller of your personal data (article 4 GDPR). You can reach us at hello@kioz.be.

2. What do we do with your data?

Per form: which data, why, on what legal basis and how long we keep it.

• Contact form (kioz.be). Name, company, e-mail address, phone number, your answers to the questions in the form and your message. Purpose: answer your question and prepare a possible quote. Legal basis: our legitimate interest in answering business enquiries, or steps you ask for before a contract. Retention: 2 years after our last contact.
• Booking an appointment (kioz.be). Name, e-mail address, phone number (sometimes optional), postcode, your message, the chosen days, time, format and subject of the appointment. Purpose: plan your appointment. Legal basis: steps you ask for before a contract, and our legitimate interest in organising appointments. Retention: 2 years after our last contact.
• Roof check (energy.kioz.be). Company name, contact person, e-mail address, phone number, address of the building, roof area, annual consumption and your remark. Purpose: answer your request. Legal basis: steps you ask for before a contract. Retention: 2 years after our last contact.
• Request and brochure (storage.kioz.be). Company name, e-mail address, phone number (optional), your answer to the question in the form, whether you already have solar panels (yes or no), whether you already have a battery (yes or no), your estimated surplus (optional), and for the brochure your name and the chosen leaflet. Purpose: follow up your request and let you download the brochure. Legal basis: our legitimate interest in following up interested companies. Retention: 2 years after our last contact.
• Newsletter (all sites). E-mail address, the language of the site and proof of your consent (time of sign-up). Purpose: send you our newsletter. You confirm your sign-up by e-mail (double opt-in): we only send newsletters after you click the link in that mail, and every newsletter contains an unsubscribe link. Legal basis: your consent, which you can withdraw at any time. Retention: until you unsubscribe.
• Technical data. When you open a page, our hosting provider sees your IP address and the page requested in its log files. Purpose: serve and secure the website. Legal basis: our legitimate interest. We do not use this data to track you. Retention: 30 days. Images of projects, team and news load from our content system (admin.kioz.be): it also receives your IP address and standard request data and keeps them for up to 30 days for security and troubleshooting.
• Visit statistics (all sites). Only if you click "Accept" in the cookie bar do we use Google Analytics 4 (Google Ireland Limited) to count how many people visit our sites and which pages they read. Purpose: improving our websites. Basis: your consent, which you can withdraw at any time through "Cookie settings" at the bottom of any page. Retention: 14 months. See the cookie statement.
• Google Maps (kioz.be/en/projects). The map only loads once you click "Load map". From then on your browser connects to Google, which processes your data for its own purposes. Legal basis: your click (consent). See Google's privacy policy.

You are never obliged to give us data. Without the requested fields we cannot handle your question or appointment.

3. Who do we share your data with?

We do not sell your data. We only share it with parties that work on our behalf (processors), with whom we have agreements on protecting it:

• Google Ireland Limited (Ireland). Processes the Google Analytics visit statistics, only if you give your consent.
• Netlify, Inc. (United States). Hosting of the websites. It sees your IP address and the requested page in its log files. Netlify does not process the forms.
• Hetzner Online GmbH (Germany). Hosting of our own admin system (Payload, admin.kioz.be), via Armain, on a server in the EU (Germany). We store the submissions of all forms and the newsletter sign-ups there. It also receives your IP address when images of projects, team and news load.
• Amazon Web Services EMEA SARL (Luxembourg). Sends our e-mails through Amazon SES in the EU region Ireland: the notification to us with your submission and the newsletter confirmation mail. It processes your e-mail address and the content of those mails only on our behalf.
• Our e-mail system. We answer you from our own mailbox at Google Workspace (Google Ireland Limited).
• Armain. Builds and maintains the websites and has admin access for that.

The admin system for form submissions, news, projects and team runs on a server in Germany (Hetzner, Nuremberg).

4. Transfers outside the European Economic Area

Netlify is based in the United States. Amazon Web Services EMEA SARL is a Luxembourg company within a US group; our e-mails are processed in the EU region Ireland, but transfer to the United States, for example for technical support, cannot be fully excluded. Netlify and Amazon Web Services are certified under the EU-US Data Privacy Framework, for which the European Commission has decided that it provides adequate protection. In addition, the European Commission's standard contractual clauses apply in the data processing agreements with both. Google (Maps) works under its own terms, but only if you load the map yourself. For Google Analytics, only after your consent, Google Ireland Limited may pass data on to Google LLC in the United States. Google LLC is certified under the EU-US Data Privacy Framework; in addition, the standard contractual clauses in Google's data processing terms apply. If the Data Privacy Framework is withdrawn, we rely on those clauses.

5. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection. Where you gave consent, such as for the newsletter, you can withdraw it at any time: e-mail hello@kioz.be and we will unsubscribe you. That does not affect what we lawfully processed before. You can also object at any time to processing based on our legitimate interest. To exercise your rights, e-mail us; we may ask you to prove your identity. We reply within one month. You withdraw your consent for cookies through "Cookie settings" at the bottom of any page.

6. No automated decisions

We make no decisions about you based solely on automated processing or profiling.

7. Complaints

Not happy with how we handle your data? Talk to us first. You can also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, www.gegevensbeschermingsautoriteit.be.

8. Cookies and changes

What our websites store in your browser is in the cookie statement. If we change this privacy statement, you will see a new version and date above.