1. Who is responsible for your personal data?

D+TB BV, with registered office at Transportcentrum LAR K21, 8930 Menen, Belgium, company number 0461.922.116, attaches great importance to the protection of personal data and processes such data in accordance with applicable data protection legislation, including Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), and Belgian data protection legislation.

For processing activities for which D+TB itself determines the purposes and essential means, D+TB acts as the data controller.

You can contact D+TB with any questions about this privacy notice or the processing of your personal data at:

D+TB BV
Transportcentrum LAR K21
8930 Menen
Belgium
E-mail: info@d-tb.be

2. When does this privacy notice apply?

This privacy notice relates to personal data processed by D+TB as data controller in connection with, among other things:

• its relationships with customers, prospects, suppliers and other business partners;
• customs, excise, tax, freight forwarding, logistics and related services;
• advisory and consultancy services;
• customer, supplier and file administration;
• invoicing, payments and debt collection;
• communications by e-mail, telephone, Microsoft Teams or other communication channels;
• the use of its website and digital applications;
• the security and proper functioning of its IT systems and services;
• complaints, audits, disputes and administrative or judicial proceedings.

For certain processing activities, D+TB may also act as a data processor, in particular where it processes personal data exclusively on behalf of and in accordance with the instructions of a customer, for example in connection with certain software or other services.

Where D+TB acts as a processor, the relevant customer in principle determines the purpose of the processing and acts as the data controller. The processing is then governed by the applicable agreement and the provisions included therein in accordance with Article 28 GDPR.

Whether a party acts as controller or processor is always determined by the parties’ actual role in the relevant processing activity.

3. What personal data does D+TB process?

Depending on the nature of the relationship, assignment or service, D+TB may process, among other things, the following personal data:

• first name, surname and other identification data;
• address, e-mail address, telephone number and other contact details;
• professional information, such as job title, employer, department and business contact details;
• information relating to companies with which a person is associated;
• information concerning powers of representation, mandates, powers of attorney and functions;
• information from or contained in identity documents, insofar as such processing is necessary and legally permitted;
• financial information, including bank account, payment and invoicing details;
• information relating to commercial and financial transactions;
• customs, excise, tax, transport and logistics data;
• information contained in invoices, packing lists, transport documents, customs declarations, certificates, authorisations and other file documents;
• information concerning vehicles, consignments or goods where such information relates to a natural person;
• communications and correspondence, including e-mails, letters, telephone contacts and Microsoft Teams communications;
• information concerning assignments, files, declarations, audits, requests, objections, appeals and disputes;
• user, access, log and technical data relating to IT systems and digital applications;
• IP addresses and other technical data that may be processed when our website or systems are used.

D+TB requests or retains a copy of an identity document only where this is necessary for the relevant purpose and legally permitted. Processing is limited to the data necessary for that purpose.

D+TB does not aim to systematically collect special categories of personal data within the meaning of Article 9 GDPR. If such data nevertheless necessarily appear in a file, they are processed only where a valid legal basis exists.

4. From whom does D+TB obtain personal data?

D+TB obtains personal data both directly and indirectly.

Personal data may, among other things, be obtained:

• from the data subject;
• from D+TB’s customer or principal;
• from the data subject’s employer or principal;
• from directors, employees or representatives of customers and suppliers;
• from suppliers, manufacturers, sellers and buyers;
• from carriers, freight forwarders, agents, terminal operators, warehousing companies and other parties in a commercial or logistics chain;
• from professional advisers;
• from customs, tax and other public authorities;
• through electronic customs and government platforms;
• from public registers, official databases and other lawfully accessible sources;
• through D+TB’s website, software and information systems.

Where personal data have not been obtained directly from the data subject, D+TB provides the information referred to in Article 14 GDPR where and insofar as the GDPR requires this and no statutory exception applies.

5. Why does D+TB process personal data and on what legal basis?

D+TB processes personal data only where a valid legal basis exists.

5.1 Performance of contracts and pre-contractual measures

Where a natural person is personally a party to an agreement, personal data may be processed for the following purposes:

• responding to enquiries;
• preparing and handling quotations;
• accepting and performing assignments;
• communicating about the services;
• providing services or software;
• invoicing and payment;
• providing services and support.

The legal basis is then the performance of the contract or taking steps at the request of the data subject prior to entering into the contract.

5.2 Legal and regulatory obligations

D+TB processes personal data where this is necessary to comply with legal or regulatory obligations to which it is subject, including obligations relating to:

• customs;
• excise duties;
• VAT and taxation;
• accounting;
• administrative audits;
• authorisations and approvals;
• sanctions, prohibitions and restrictions;
• trade and product regulations;
• security and fraud prevention;
• statutory documentation and retention obligations.

In such cases, the legal basis is compliance with a legal obligation.

5.3 Legitimate interests

D+TB may process personal data on the basis of its legitimate interests or those of a third party, provided that the interests or fundamental rights and freedoms of the data subject do not override those interests.

This may include, among other things:

• maintaining efficient customer and business administration;
• communicating with employees and representatives of customers, suppliers and other business partners;
• managing and improving services;
• IT, network and information security;
• access management and logging;
• preventing, detecting and investigating errors, misuse and fraud;
• debtor management and debt collection;
• internal controls and quality monitoring;
• documenting and demonstrating the proper performance of assignments;
• handling and defending complaints;
• establishing, exercising or defending legal claims;
• defending D+TB, its directors, employees and auxiliaries against claims or allegations of liability.

5.4 Consent

Where processing is based on consent, for example for certain non-essential cookies or certain electronic marketing communications where consent is legally required, that consent may always be withdrawn for the future.

Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.

6. Is providing personal data mandatory?

In certain cases, providing personal data is necessary:

• to enter into or perform an agreement;
• to handle a requested assignment;
• because the data are required by law or regulation;
• to complete a customs, tax or other administrative formality;
• to verify a person’s identity or authority to represent another person or entity.

If the necessary data are not provided, D+TB may be unable to accept or perform an assignment or complete a particular formality.

7. Customs, excise and related services

In connection with customs, excise, tax and related services, D+TB may process personal data and disclose them to the competent public authorities where this is necessary to perform an assignment or comply with legal obligations.

This may include data necessary for:

• customs declarations;
• excise formalities;
• import, export and transit formalities;
• authorisations;
• inspections and audits;
• origin formalities;
• sanitary or phytosanitary formalities;
• trade measures;
• prohibitions and restrictions;
• refunds, objections or administrative appeals.

The personal data required depend on the goods, transaction, customs procedure and applicable legislation concerned.

8. To whom does D+TB disclose personal data?

D+TB discloses personal data only where this is necessary and lawful for the relevant purpose.

Depending on the processing concerned, personal data may be disclosed, among others, to:

• Belgian, foreign and European customs authorities;
• tax and excise authorities;
• sanitary, phytosanitary and other competent authorities;
• inspection, supervisory and enforcement authorities;
• other public authorities where legally required or necessary;
• carriers, freight forwarders, terminal operators, warehousing companies, agents and other parties necessary for the performance of an assignment;
• banks and payment service providers;
• insurers;
• accountants, lawyers, bailiffs, experts and other professional advisers;
• IT, hosting, cloud, communications, security and software providers;
• subcontractors and auxiliaries;
• courts, arbitral tribunals and competent authorities in the event of disputes or proceedings.

Microsoft

D+TB uses Microsoft 365, Exchange Online, Outlook and Microsoft Teams for, among other things, e-mail, calendar and communication functionality, collaboration, online meetings and other business processes.

In this context, personal data may be processed by Microsoft as part of the services it provides to D+TB and in accordance with Microsoft’s applicable contractual and data protection terms.

D+TB also uses IT, hosting, cloud, security, software and website service providers which, depending on their role and the services concerned, may process personal data as part of the services they provide to D+TB.

D+TB ensures that service providers processing personal data for it are engaged in accordance with applicable data protection legislation and that, where required, appropriate contractual safeguards are put in place.

9. Transfers outside the European Economic Area

D+TB uses IT, cloud, communications and other service providers whose services may, in certain circumstances, result in personal data being processed or transferred outside the European Economic Area (“EEA”), or being accessible from outside the EEA.

Microsoft 365

For European customers of various Microsoft 365 services, Microsoft provides an EU Data Boundary under which customer data and certain other personal data are, to a significant extent, stored and processed within the European Union and EFTA.

However, this does not mean that all processing takes place exclusively within the EEA without exception. Microsoft documents situations in which data may still leave the EU Data Boundary or be accessible from outside it, including:

• for certain global technical and operational processes;
• in connection with external or cross-border Teams communications;
• where users initiate communications with persons outside the EU Data Boundary;
• for certain support, security or service activities;
• for certain directory, network, diagnostic or pseudonymised data.

Where personal data are transferred to a country outside the EEA, D+TB ensures that there is a valid transfer mechanism in accordance with Chapter V GDPR, such as:

• an adequacy decision by the European Commission; or
• appropriate safeguards, including the Standard Contractual Clauses approved by the European Commission.

Microsoft regulates data protection and international transfers, among other things, in its current Microsoft Products and Services Data Protection Addendum.

Further information about the applicable safeguards and, where applicable, a copy thereof may be requested from D+TB at info@d-tb.be.

10. How long does D+TB retain personal data?

D+TB does not retain personal data for longer than necessary for the purposes for which they are processed.

The specific retention period is determined taking into account, among other things:

• the duration of the customer or business relationship;
• the nature of the relevant assignment or file;
• statutory and regulatory retention obligations;
• tax and accounting retention periods;
• customs and administrative audit and recovery periods;
• applicable limitation and expiry periods;
• the need to be able to demonstrate the performance of an assignment or compliance with legal obligations;
• security and fraud-prevention purposes.

Documents and personal data forming part of a commercial, accounting, tax, customs or administrative file may be retained for the applicable statutory retention periods.

Where an audit, investigation, objection, appeal, liability claim or judicial or administrative proceeding is pending or can reasonably be anticipated, the relevant data may be retained for longer for as long as this is necessary to establish, exercise or defend legal rights and claims.

This also applies insofar as retention is necessary to defend D+TB, its directors, employees or auxiliaries against claims or allegations of liability.

The data are subsequently deleted or anonymised when further identification is no longer necessary or justified.

11. Security of personal data

D+TB takes appropriate technical and organisational measures to protect personal data against, among other things:

• unauthorised access;
• unlawful processing;
• accidental loss;
• destruction;
• damage;
• unauthorised alteration;
• unauthorised disclosure.

The measures are tailored to the nature, scope, context and purposes of the processing and the risks associated with it.

D+TB also expects its service providers to apply appropriate security measures when processing personal data.

12. Website and cookies

When the website is used, technical data may be processed, including IP addresses, session data, log data and data obtained through cookies or similar technologies.

Strictly necessary cookies may be used for the proper and secure functioning of the website.

Non-essential cookies and similar technologies are used only after the required prior consent has been obtained.

For a detailed overview of:

• the cookies and other technologies used;
• their providers;
• their purposes;
• their retention periods;
• the applicable cookie category;
• and how consent can be given, refused or withdrawn,

please refer to D+TB’s separate cookie notice.

13. Automated decision-making

D+TB does not make decisions based solely on automated processing, including profiling, which produce legal effects concerning a data subject or similarly significantly affect that person.

If D+TB were to introduce such processing in the future, the data subject would be informed in accordance with the GDPR.

14. What rights do you have?

Depending on the processing concerned and the applicable legal conditions, you have, among other things:

• the right to information about the processing of your personal data;
• the right of access to your personal data;
• the right to rectification of inaccurate personal data;
• the right to have incomplete personal data completed;
• the right to erasure where the statutory conditions are met;
• the right to restriction of processing;
• the right to data portability, insofar as the statutory conditions are met;
• the right to object to processing based on a legitimate interest;
• the right to object at any time to direct marketing;
• the right to withdraw consent where processing is based on consent;
• the rights granted by the GDPR in relation to decision-making based solely on automated processing, where such processing takes place.

These rights are not absolute.

For example, D+TB may be required or entitled to continue retaining certain personal data where:

• a statutory retention obligation applies;
• the data are necessary for an ongoing assignment;
• an audit or proceeding is pending;
• or retention is necessary for the establishment, exercise or defence of legal claims.

You may exercise your rights by contacting: info@d-tb.be.

D+TB may request additional information where reasonably necessary to verify the identity of the requester. No more information will be requested than is necessary for that purpose.

15. Direct marketing

Insofar as D+TB uses personal data for direct marketing purposes, this is done only on a valid legal basis and in accordance with the applicable rules on electronic communications.

You may object at any time and free of charge to the processing of your personal data for direct marketing purposes.

Where processing is based on consent, you may withdraw that consent at any time.

16. Complaints

If you have questions or complaints about how D+TB processes your personal data, you may first contact us at: info@d-tb.be.

You also have the right to lodge a complaint with the competent supervisory authority.

For Belgium:

Data Protection Authority
Rue de la Presse 35
1000 Brussels
Belgium

contact@apd-gba.be

Lodging a complaint does not affect any other administrative or judicial remedies.

17. Changes to this privacy notice

D+TB may amend this privacy notice where:

• its activities or services change;
• the way in which personal data are processed changes;
• new IT systems or service providers are used;
• or applicable laws or regulations change.

The most recent version is published on the website and states the date of the latest update.

Where a change has material consequences for an existing processing activity, D+TB will provide additional information where and insofar as required by the GDPR.

Liability

The information on this website is provided for general information purposes only. Although D+TB takes reasonable care to ensure that it is accurate and up to date, it cannot be guaranteed that all information is complete, accurate or current at all times.

The information on this website does not constitute individual customs, tax, legal or other professional advice and must not be regarded as such. The assessment of a specific situation requires a separate assignment and assessment.

To the extent permitted by applicable law, D+TB is not liable for damage arising solely from the use of or reliance on general information provided on this website.

The website may contain references or links to third-party websites or services. D+TB has no control over their content or operation and is not responsible for them.