PRIVACY POLICY

Publication date: 21 June 2023

YOUR DATA & ORAC: A STORY OF TRUST

At Orac, privacy is very important to us. That is why we process the data of our customers, partners and suppliers and applicants for employment or internships ("your data") in a transparent manner.

Below is our Privacy Policy ("PP") with respect to the collection, retention, use, communication and disclosure of your data during your visits to and use of our website (www.oracdecor.com) and applications, as well as Orac's dealings with its current and future customers, suppliers and/or business partners.

Our PP does not cover any data processing by Orac's independent reseller partners, who are governed by their own privacy policies.

Is anything unclear? Please contact us! To find out how, please refer to the "How to contact us" section.

WHO ARE WE?

"Orac" means Orac NV, one of its sister companies or subsidiaries, with a registered office at Biekorfstraat 32, 8400 Oostende, Belgium and “Banque Carrefour des Entreprises” registration number 0407.323.091 (hereinafter "Orac", to which "we" and "us" also refer).

OUR COMMITMENTS, DECORATIVELY YOURS

At Orac, we are committed to acting in accordance with applicable privacy laws, including the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the "GDPR"). Every day, our employees strive to protect the confidentiality of your data, to respect your rights, and to allow you to control the use of your data at any time.

WHAT IS OUR ROLE IN PROCESSING YOUR DATA?

Unless otherwise stated, Orac acts as the controller for your personal data. The controller determines the purposes and the means of the processing , i.e. what data to collect, why and how to process it.

In some cases, Orac acts jointly with another controller or as a processor, i.e. following the instructions of a controller who himself chooses the purposes and means of processing personal data.

HOW TO CONTACT US

If you no longer want to receive our marketing emails (for products, services or other), please feel free to unsubscribe by clicking on the link at the bottom of the email. Having a problem doing this? Please contact us! Either email [email protected], phone us on +32 (0)59 80 32 52, or write to us by post at Biekorfstraat 32, 8400 Oostende, Belgium.

You can also use these channels if you have any questions about the processing of your data, or its security, or to exercise your rights (see 'Your Rights').

YOUR DATA REMAINS YOUR DATA

At Orac, we believe that you should have control over your data.

If you have an Orac account, you can edit and manage some of your personal data yourself, such as your contact details. We are working to give you control over all of your personal data and communication preferences in your account.

Your profile, order information and design preferences (i.e. the information you give us) are important for us to serve you well. We undertake not to sell or rent this data to third parties.

When we require the assistance of a processor to process your data, the processor will act in accordance with Orac's instructions to carry out one or more specific tasks (such as IT services, marketing, banking, etc.). We will select our Preferred Partners carefully and only if we determine that they are trustworthy.

All our Preferred Partners must act in accordance with the terms of our Data Processing Agreement. They are contractually bound to ensure the confidentiality and security of your data at all times. Our Partners' employees only have access to the data necessary for their tasks and duties. They are prohibited from passing on your data to a third party, reselling it, or using it for purposes other than those we have determined in our agreement.

The same trust rules are applied to the Orac Group entities (our sister companies and subsidiaries), always with the aim of protecting your personal data and respecting your rights.

Finally, in some cases, we are required to transfer certain personal data to third parties to (a) comply with our legal obligations; (b) comply with legal process or regulatory requests; (c) enforce our terms and conditions; (d) protect our rights, privacy, safety or property, and/or those of our affiliates, you or others; and (e) allow us to pursue available remedies or limit the damages we may suffer.

Outside the above situations, we will ask for your permission, if necessary, to use and/or share your data with third parties. You always have the option to refuse.

WHAT PERSONAL DATA DO WE COLLECT AND WHY?

Personal data is data that directly or indirectly identifies an individual.

The information we collect depends on the context of your interaction with Orac, how you contact us and what you choose to share with us.

At Orac, we limit the amount of personal data we collect to the minimum required to provide you with a quality service.

Here are the details of our data processing operations and their legal basis:

When you visit our website

Data processed: the data collected by the cookies you accept on our cookie management console and tracers
Controller: Orac, jointly with advertisers for advertising cookies
Legal basis: consent, legitimate interest for essential cookies

When you contact us

Whether via the contact form, our "Hello Customer" platform or any other means (telephone, email, social media, via a commercial partner)

Data processed: last name, first name, email address, activity (private individual, installer, interior designer, etc.), country and postcode. You can also choose to provide us with your telephone number or your social media profile. We deduce the language you speak from the version of the site you choose.
Controller: Orac
Legal basis: contract

When you ask us to put you in touch with a reseller in your region

Data processed: your contact details (see above). If Orac has a subsidiary in your country, or operates with a Preferred Partner, your data will be transmitted by secure means to so that they can contact you.
If there are no subsidiary of the Orac group or Preferred Partner in your region, your data will not be transmitted. We provide you with the contact details of the reseller in your region so that you can contact them directly. In that case, the Reseller acts as a controller for the actions they subsequently perform on your data.
Controller: Orac
Legal basis: contract

When you subscribe to one or more newsletters or electronic communications

Data processed: email address, activity (private individual, installer, architect, designer, decoration store, other), type of communication desired. We deduce your spoken language from the version of the site you choose.
Controller: Orac
Legal basis: consent

When you create your online Orac account

Data processed: your identification data (last name, first name), your email and language (based on the version of the site chosen). We ask you to choose a personal password to protect access to your account but our teams cannot see it. We store this data in our database and CRM, and create statistics.
Controller: Orac
Legal basis: contract, legitimate interest for statistics and managing the customer relationship

When you ask us for a quote

Data processed: your identification data (last name, first name), your email and language (based on the version of the site chosen), the product(s) chosen to make a quote, your comments (optional), statistics.
Controller: Orac
Legal basis: contract, legitimate interest for statistics

When you order from our webshop or request catalogues and samples

Data processed: your identification data (last name, first name), contact data (email address, delivery address, telephone number in case of delivery problems), the product(s) ordered (products, catalogues, samples, etc.). We deduce the language you speak from the version of the site you choose.
If you are a business customer, we ask for your job title, company name and address, a business telephone number and, if you want an invoice, your VAT number and your billing details. We also keep your order history and statistics.
Controller: Orac. Where independent resellers use the Oracdecor.com interface (e.g. resellers in Mexico, South Africa or Austria), Orac is the initial data controller (via the webshop) who transfers your data to a second data controller, the reseller.
Legal basis: performance of a contract, legitimate interest

When you participate in an Orac survey

Data processed: last name, first name, e-mail, professional profile, type of product or service of interest, rating, language. Optional: your own remarks or comments, feedback.
Controller: Orac
Legal basis: for satisfaction surveys after an order: legitimate interest. For other types of surveys: consent.

When we meet in our offices, at a stand or at an event

Data processed: last name, first name, professional profile, email address. If you share them with us: your telephone number (private and/or business), Orac products or services that may be of interest to you, your consent to receive our marketing communications.
Controller: Orac
Legal basis: pre-contractual measures, consent

When you become an Orac partner or reseller

Data processed: your company name and address, the contact details of a contact person (last name, first name, telephone number, email and job title), your VAT number, your billing details. We also keep a record of our exchanges, orders and statistics.
Controller: Orac
Legal basis: contract, legitimate interest

When you apply for a job, internship or assignment at Orac

Data processed: your contact data, the data you provide in your curriculum vitae and cover letter. If you are invited to interviews and assessments, the data contained in the reports of these.
Controller: Orac, alone or jointly with the recruitment company
Legal basis: pre-contractual measures, legitimate interest. If the data you provide contains sensitive information (such as medical data, criminal records, your state registration number, information about your sexual orientation, political opinions, trade union membership, etc.), then the legal basis for processing is your consent to the processing of that data.

For all processing based on Orac's legitimate interest, we take great care to balance our interest with your privacy.

HOW LONG WILL YOUR DATA BE KEPT?

Retention periods differ depending on the type of processing activity and the purpose for which the personal data was collected.

We do not keep your personal data for longer than is strictly necessary for the purposes for which we collected or received your data.

If you have given us your consent, your data will be retained for as long as your consent remains valid.

If your data has been collected to prepare or perform a contract or other agreement between us, to comply with our legal obligations (such as accounting and tax obligations), or to resolve a dispute, this personal information is retained for the duration of our contractual relationship plus 10 years.

Your personal data may be retained for a longer period if Orac is required to do so by a legal obligation. We may also retain your personal data for a shorter period if you object to the processing of your personal data and there is no longer a legitimate reason to retain it.

Once the retention period has expired, your data is either anonymised or deleted.

DATA TRANSFERS

In order to offer you a quality service, we entrust certain operations to Preferred Partners present in your market.

For example, if you request information or a delivery, your data is transferred to a Preferred Partner who will assist you in your country.

If Orac does not have a Preferred Partner in your country, we will refer you to a Local Reseller. In this specific case, your data will not be transferred, so you are free to choose whether or not to contact them.

In cases where your data is to be transferred to a country outside the European Union ("EU") and the European Economic Area ("EEA"), transfers are done with the utmost care. If the country does not offer a level of data protection corresponding to that of the EU, we systematically add appropriate technical and organisational requirements to the contract between Orac and its Preferred Partners in order to guarantee an equivalent level, in particular via the legal mechanism of the European Commission's Standard Contractual Clauses.

SECURITY AND PRIVACY

Orac has implemented technical and organisational security measures to ensure the confidentiality, integrity and availability of information systems and services that process personal data. These measures include physical and operational security measures, physical and system access controls, confidentiality clauses in our contracts and ongoing training for our staff.

Our employees and third parties engaged by us are required to respect the confidentiality and security of your data.

OUR COOKIE POLICY

What is a cookie?

This is a small text file that is stored on your computer or mobile device by the browser. The cookie is initiated by the server linked to the website you are visiting, or by a third party working with that website. There are different types of cookies that serve different purposes and have different lifespans.

At Orac, we use cookies, tags, scripts and other similar technologies (hereinafter referred to simply as "Cookies") to operate our site and its features, but also, if you agree, for the following purposes:

to provide you with a better user experience,
to allow you to activate social media features (sharing content, watching videos, etc.),
to enable us to analyse the traffic on the site (page views, clicks, access paths, etc.),
to produce statistics,
to show you advertising content that may be of interest to you.

How do you manage your cookie preferences?

When you first visit our website, a cookie banner will offer you the opportunity to set your preferences, i.e. which cookies you accept, with the exception of the cookies that are needed to make the site work. If you do not give your consent, rejected cookies will not be placed on your computer or mobile device.

Please note that deactivating certain cookies may cause some of the website's features to malfunction! For example, some graphics may not be displayed as intended or you may not be able to use certain features of the site.

You can change your preferences in this cookie banner by clicking on "Customize," find an overview of the cookies used by Orac on the "Details" tab, and learn more about cookies in the "About" section.

You can change your choices at any time through the website's management system, by clicking on the icon at the bottom of your screen (example below) and then selecting "Change your consent".

Blocking/deleting cookies from your browser

Another way to manage the installation of cookies on your device is to block or delete them via your browser settings. You can also delete cookies already installed on your computer or mobile device at any time. If you want to disable cookies in this way, change the settings of the browser you are using (Internet Explorer, Google Chrome, Firefox, Safari).

If you use different devices to visit the Orac site, please ensure that your cookie preferences are set on the browser of each device.

Is cookie information passed on to third parties?

It depends on the type of cookie.

First-party cookies (or direct cookies) are handled entirely by Orac and are not transmitted. They are specific to the website or application you are visiting.
Third-party cookies (or indirect cookies) are issued by third parties who offer them during your visit to the Orac website and application. If you accept them, these cookies will pass on some of your data to these third parties, who are sometimes based outside Belgium. This may include, for example, cookies from social media platforms.

In the detailed information about Orac's cookies below, you can find out which cookies are first-party and which are third-party by looking at the "Supplier" column.

How long is the cookie information stored?

Cookies may be stored on your computer or mobile device for different periods of time. For "Session Cookies", the cookie and the information it collects are automatically deleted when you close your browser. "Permanent Cookies" are stored for a longer period of time and can also be used during a subsequent visit to this website.

See the "Expiry" column below or in the cookie selection console for retention periods.

Which cookies does Orac use?

Cookies are available and managed through the management console on the Website.

MORE INFORMATION

Your rights

The GDPR provides you with various rights, such as the right to access your data, the right to rectify, the right to erasure, the right to be forgotten, the right to object to processing, and the right to portability. Some are applicable to all processing of your data, while others depend on the type of processing carried out and the legal basis under which the processing is carried out (contract, legal obligation, consent, legitimate interest, etc.) For more information, visit the website of your Data Protection Authority.

How to exercise your rights

By contacting us in one of the ways described in the "How to contact us?" section. The easiest way is to email us at [email protected].

N.B. To enable us to understand and respond to your request as quickly as possible, please tell us:

the right(s) you wish to exercise, AND
the processing operation(s) affected by your request AND
information enabling us to ensure that you, the applicant, are the data subject for the processing. This can be your Orac customer number, an order number or your full name and address.

Exercising your rights is free of charge, however, in cases of manifestly unfounded or excessive requests, the GDPR provides for the possibility of refusing the request or charging a reasonable fee to cover the administrative costs associated with it.

In any case, we will always inform you of the progress of your application as soon as possible and no later than one month after receipt.

If, despite our best efforts, you feel that your rights have not been respected, you can complain to your Data Protection Authority. Click on the country you are looking for on the world map here.

If you live in Belgium, visit the APD (Belgian Data Protection Authority) website, download the complaint form and return it completed by email or post to Rue de la Presse 35, 1000 Brussels.

For minors

Our products and services are not intended for minors. We therefore ask that people under the age of 16 do not browse or use the features of this site, and do not give us any personal data. If we become aware that we have received data from a minor, we will take reasonable steps to remove that data from our databases and files as soon as possible.

Changes to this PP

Orac may amend this PP from time to time, for example to reflect changes in the market, applicable legislation or to document new processing activities. Should this happen, you will be informed through our usual communication channels and via our website, and the date below the title will be changed.

In any case, please check our website regularly for the latest version of this policy.