ARTICLE 1 - Privacy policy

VACAL BV, with its registered office at Poezelhoek 15, 8560 Gullegem, Belgium, and company number 0457.052.221,

Hereinafter referred to as: “VACAL BV”,

Hereby sets out its privacy policy as follows:

VACAL BV processes personal data in the performance of the assignment entrusted to it by the customer, as well as when contacted via the website (www.vacal.be) or its contact form. It does so either as a controller or as a processor, depending on the specific circumstances.

VACAL BV acts as the controller when personal data is processed for its own purposes and it determines the means of processing. When processing personal data on behalf of the customer, VACAL BV acts as a processor.

VACAL BV recognises the importance of secure and lawful processing of personal data. Both VACAL BV and its customers acknowledge that all processing will be carried out in accordance with applicable national legislation, including the Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, and Regulation (EU) 2016/679 (GDPR), which came into effect on 25 May 2018. VACAL BV commits to updating this privacy policy in line with any substantial changes in the law.

This privacy policy and any updates are available at all times on VACAL BV’s website.​

ARTICLE 2 - Definitions

For the purposes of this privacy policy, the following terms shall be understood as follows:

GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC. Commonly known as the General Data Protection Regulation (GDPR).

Personal data: any information relating to an identified or identifiable natural person, such as a name, email address, location data, an online identifier, or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural, or social identity.

Data subject: the identified or identifiable natural person to whom the personal data relates.

Consent: any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which they, through a statement or a clear affirmative action, signify agreement to the processing of their personal data.

Processor: a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the data controller.

Processing: any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Controller: a natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Data breach: any breach of security that accidentally or unlawfully leads to the destruction, loss, alteration, or unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

ARTICLE 3 - Scope of privacy policy

1. Contractual relationships

The current privacy policy applies to the contractual relationship between VACAL BV and the customer or data subject and remains in force for the entire duration of the assignment. Deviations from this policy are only permitted if required by law or with the explicit or implicit consent of both parties. Significant changes will be clearly communicated on the website. ​

By accessing the VACAL BV website (www.vacal.be) and/or submitting the contact form, the data subject acknowledges that they have read this privacy policy and agree to the processing of their personal data in line with the nature and scope of their request (Art. 6.1.a and 6.1.b GDPR).

VACAL BV does not guarantee the completeness, accuracy, or current nature of the information provided on its website, nor the content of third-party websites to which it may refer.

2. Processing of personal data

VACAL BV guarantees that personal data is collected and processed transparently and solely for specific, clearly defined, and legitimate purposes. All processing is limited to what is necessary for the purposes pursued. VACAL BV ensures that personal data is recorded accurately and kept up to date where necessary.

In the context of its services, VACAL BV may collect personal data including, but not limited to: surname, first name, email address, physical address (including geolocation), telephone number, and any other personal information voluntarily provided by the customer or data subject when submitting a request for information or services. VACAL BV does not process any personal data that qualifies as sensitive or falls under the special categories of personal data as defined in the GDPR. ​

Personal data will not be retained longer than necessary to achieve the purpose of the processing or to comply with legal obligations.

ARTICLE 4 - Legal grounds for processing

By using the services of VACAL BV or filling in the contact form on the website and transferring personal data, the customer acknowledges and accepts that this data may be processed (Art. 6.1.b GDPR). However, the customer and/or the data subject remains the owner of the data provided.

For personal data that VACAL BV receives from the customer as the controller and that is used for marketing purposes and customer management, VACAL BV relies on the legal basis of legitimate interest consisting of the situation in which the data subject is a customer of VACAL BV as a result of placing an order (Art. 6.1.b and 6.1.f GDPR), or on explicitly obtained consent (Art. 6.1.a GDPR).

The customer, in their capacity as the data subject, has the option at all times to modify or withdraw the consent given, insofar as the processing of this data is based solely on their consent.

ARTICLE 5 - Purposes of processing

VACAL BV processes personal data for the following purposes:

Type of personal data

Purpose

Last name, first name, address, email address, phone number, and VAT number

Execution of the order (including delivery), accounting purposes (invoicing), compliance with legal obligations (e.g. identity verification)

Last name, first name, address, email address

Providing information about products and services, processing enquiries sent to VACAL BV via email or the website

Last name, first name, address, email address

Direct marketing, targeted promotions, and special offers

Last name, first name, or other personal information

Personalising orders

When you visit the VACAL BV website and, where applicable, use the contact form, certain data may need to be provided to facilitate communication. This information will be used exclusively for internal purposes.

VACAL BV also uses cookies that may record certain details about your visit to the website, including personal data.

Additionally, when services are requested from VACAL BV, the company must have access to certain personal data necessary for the performance of the agreement.

VACAL BV will only use the personal data that is strictly necessary for each processing activity in the context of the service requested.

ARTICLE 6 - Appropriate technical and organisational measures

VACAL BV shall take appropriate technical and organisational measures to ensure the secure processing of personal data, thereby minimising the risk of destruction, loss, unauthorised alteration, or processing. These measures shall take into account industry practices, the state of the art, the nature, scope, context of the processing, its purposes, and the potential risks to the rights and freedoms of data subjects. Upon written request, VACAL BV will provide detailed information regarding the security policy it applies. ​

ARTICLE 7 - Subcontractors and processors

VACAL BV engages sub-processors, including, but not limited to, external courier services, which process personal data on behalf of and under the supervision of VACAL BV. These processing activities are strictly limited to what is necessary for the execution of the relevant assignment.

VACAL BV ensures that the processors it appoints, including its employees and subcontractors, process personal data in accordance with the applicable legislation. They are required, either contractually or otherwise, to implement appropriate technical and organisational security measures based on Article 28 of the GDPR.

Employees and sub-processors of VACAL BV have contractually committed to maintaining the confidentiality of personal data.

Each sub-processor independently determines how personal data is processed, taking into account the risks associated with its area of expertise. In the absence of such expertise, VACAL BV, as the data controller, cannot be held liable for any unlawful processing resulting from an incorrect assessment by the sub-processor. VACAL BV therefore accepts no liability for data loss or corruption, data theft, viruses, or other attacks on the IT systems and (cloud) servers of the sub-processor. ​

ARTICLE 8 - Transfer of personal data to third parties

Except for employees and sub-processors involved in the provision of services, VACAL BV will not share personal data with third parties, unless expressly authorised by the data subject, required by judicial authorities, or mandated by law. In the latter case, VACAL BV will promptly inform the data subject of the request made by the relevant authorities and/or government bodies.

ARTICLE 9 - Data processing within the European Union

VACAL BV endeavours to limit the transfer and processing of personal data to countries within the European Economic Area or to countries that provide an adequate level of protection, equivalent to the level guaranteed under the GDPR and this privacy policy. This is assessed in light of the intended processing, the scope, and category of the personal data involved, the destination country, and the applicable legal framework in that country. Should personal data be processed outside the European Economic Area, VACAL BV will, upon written request, provide further explanation to the data subject. ​

ARTICLE 10 - Rights of the data subject

In accordance with the GDPR (Articles 12 to 22), data subjects have the following rights concerning their personal data: the right of access, the right to rectification and/or completion, the right to restrict processing, the right to data portability, the right to erasure (“the right to be forgotten”), and the right to object.

Questions regarding the collection and processing of personal data or requests to exercise your rights may be submitted in writing, with justification, to VACAL BV by email to info@vacal.be or by post to Poezelhoek 15, 8560 Gullegem, Belgium. VACAL BV will process each request without delay and respond within 30 days. In certain cases, VACAL BV has the right to extend this period by two months, in which case VACAL BV will notify the data subject within 30 days of receiving the request (Art. 12.3 GDPR). ​

ARTICLE 11 - Retention period for personal data

VACAL BV ensures that personal data is not retained longer than necessary for the purpose for which it was collected, except for accounting documents and data related to liability claims, which may be retained for a longer period as required by applicable law. Other data that may be necessary for adequate after-sales service or future services will, wherever possible, be stored in an anonymised form to prevent identification of individuals, and only for as long as necessary. ​

When the retention of personal data is no longer required, it will be securely deleted or destroyed, or made available to the data subject.

ARTICLE 12 - Measures in the event of a data breach

VACAL BV takes appropriate measures to prevent data loss. However, in the event of such an incident, VACAL BV undertakes to notify the Data Protection Authority within the statutory time limits, where required. This notification obligation applies only in cases where the data breach is large-scale or has a significant impact on data security.

If the data breach presents a high risk to the rights and freedoms of the affected individuals, VACAL BV will also notify those individuals without undue delay.

VACAL BV will fully cooperate with the competent authorities by providing all necessary information and taking steps to mitigate the consequences of the data breach.

ARTICLE 13 - Other provisions

VACAL BV guarantees appropriate support to data subjects in fulfilling their obligations, except where the requested information is confidential or cannot be disclosed due to legal constraints. The person responsible for the processing of personal data at VACAL BV is Mr Bart De Langhe (info@vacal.be). For more information about the processing of personal data, you may also contact the Data Protection Authority at Drukpersstraat 35, 1000 Brussels, Belgium (T +32 2 274 48 00) or visit www.dataprotectionauthority.be. ​

If any provision of this privacy policy is found to be invalid, it shall be interpreted in accordance with the GDPR. The invalidity of one provision shall not affect the validity of the remaining provisions. In the event of any conflict between this privacy policy and the agreement between VACAL BV and the customer or data subject, the provisions of the agreement shall prevail.

VACAL BV reserves the right to amend this privacy policy as necessary to comply with its rights and obligations under the GDPR. Substantial changes will always be announced on the website. It is advisable to consult the website regularly to stay informed of any updates.

This privacy policy is governed exclusively by Belgian law. Only the courts of the judicial district in which VACAL BV’s registered office is located shall have jurisdiction over disputes arising from this policy.

VACAL BV's privacy policy was last updated on 20/08/2025.