In this article 2 we have set out:

• the general categories of Personal Data that we may process;
• the purposes for which we may process Personal Data;
• and the legal grounds of the processing.

Client data
In relation to providing our products and services we collect and process the identity and contact data of our clients, their personnel and associates. The data may be processed for the purposes of execution of the agreement with our clients, customer care, bookkeeping and direct marketing purposes such as the sending of promotional or commercial information. The legal grounds are the execution of an agreement, the fulfilment of legal and regulatory obligations (e.g. the accounting legislation), our legitimate interest and, in some cases, your consent.

Supplier and subcontractor data
We collect and process identity and contact data of our suppliers and subcontractors, their subcontractors, personnel and associates. The data may be processed for the purposes of execution of the agreement, supplier/subcontractor care and bookkeeping. The legal grounds for this processing are the execution of an agreement, the fulfilment of legal and regulatory obligations (e.g. the accounting legislation) and/or our legitimate interest.

Personnel data
We process Personal Data of our employees in relation to our personnel and our staffing services and our salary administration services. The legal grounds are the execution of an agreement, the fulfilment of legal and regulatory obligations (e.g. the accounting legislation) and/or our legitimate interest.

Data of applicants
We process the identity and contact data, as well as the work history and other data that is usually indicated on a curriculum vitae of applicants when they provide us with this information. The Personal Data is processed to determine whether you qualify for a job with us on the ground of our legitimate interest.

If we wish to retain your Personal Data for a longer period of time after the relevant vacancy has been filled, we will inform you and request your consent to do so.

Other data
In addition to the data of clients, suppliers/subcontractors, employees and applicants, we also process Personal Data of others, such as possible new clients/prospects, useful contacts within our sector, network contacts, etc. This is done via our Website or other channels. The purposes of this processing are in the interest of our activities, direct marketing and public relations. The legal grounds for this processing are our legitimate interest, the execution of an agreement and, in some cases, your explicit consent.

Specifically, we may use the Personal Data we collect for the following purposes:

• to provide you with information about our products and services;
• to provide you with our services and execute any agreements with you;
• to process and respond to any complaints or requests;  
• to help us in evaluating, correcting and improving the Website and any related products or services of us;
• for direct marketing purposes;
• for internal reasons, such as corporate administration and archiving purposes.
  

‍

Collecting Personal Data

Without being exhaustive, Gorilla collects your Personal Data in the following cases:

• when you submit Personal Data via the Website through the contact form provided;
• when you request a demo via the Website through the contact form provided;
• when you subscribe to our newsletter;
• when you enter into an agreement with us;
• when you apply for a position at Gorilla;
• when you call, mail us or correspond
• with us in another way than via the Website.

We can combine the Personal Data we collect via the Website with information which you provide us in another way or which third parties deliver to us.

Retaining and deleting Personal Data

Personal Data will be stored and processed by us for the duration that is required in relation to the purposes of the processing.

Client data and supplier or subcontractor data will be removed from our systems after 7 years after the termination of the agreement involved, except for the Personal Data that we have to store for a longer duration based on specific legal obligations or in case of pending litigation(s).

Personal Data of our employees will be removed 5 years after the termination of the employment agreement, except for the Personal Data that we have to store for a longer duration based on specific legal obligations or in case of pending litigation(s).

Personal Data of applicants will be removed after the relevant vacancy has been filled or 2 years after obtaining the permission to inform applicants about future job opportunities.

Other data will not be stored longer than 2 years after the last useful contact between us and you, except in the case of your explicit to retain this data for a longer period of time.

We will not transfer Personal Data to third parties outside the European Economic Area, except to subcontractors or associates who retain the Personal Data in accordance with the European Commission’s Standard Contractual Clauses and thereby provide an adequate level of security for the processing of Personal Data.

Furthermore, we will not transfer your Personal Data to third parties inside the European Economic Area without your permission, except:

1. when such transfer is necessary to permit associates, agents, subcontractors, suppliers or commercial partners to provide a service or accomplish a task in the name of Gorilla which is necessary for the execution of the agreement we have with you pursuant to our legitimate interest (including but not limited to providing marketing support, accomplish market research or providing user services);
2. if it is required or permitted by applicable laws and regulations.

Any transfer of Personal Data to one of the third parties mentioned in the list above is in accordance with the stipulations of the General Data Protection Regulation (GDPR) 2016/679.

We ensure that measures are taken to make sure that third parties cannot use your Personal Data for other purposes than the purposes mentioned exhaustively in Article 2, and that these third parties have taken the necessary technical and organizational measures to protect these data.

We will have data processing agreements in place with the aforementioned third parties in order to ensure the security of the Personal Data.

Finally, we shall take all necessary precautionary measures to assure that our employees and associates who have access to Personal Data will process these Personal Data exclusively in accordance with this privacy statement and the obligations under the applicable privacy regulations.  

‍

By virtue of both Belgian and European legislation concerning data protection, you have the rights as mentioned below. If you want to exercise these rights, you have to send a written request to privacy@gorilla.co. If there is no reasonable certainty as to your identity, we may ask you to provide us with a copy of the front side of your ID card.

Some of the rights are complex, and not all of the details have been included in our summaries. Accordingly, you should read the relevant laws and guidance from the regulatory authorities for a full explanation of these rights.

We will provide you with information within one (1) month of receipt of the request on the action that will be taken. We can extend this one-month period to a maximum of three (3) months, in which case you will be informed about the reasons for such delay within one (1) month of the original request.

The right of access to Personal Data
You have the right to instruct us to provide you with any Personal Data we hold about you, providing the rights of other data subjects are not affected.

The right to rectification of Personal Data
We kindly ask you to help to make sure that the Personal Data in our records are as accurate and up-to-date as possible. If you believe that the Personal Data submitted to us are incorrect or incomplete, please notify us as described above. We will correct or adapt your Personal Data as soon as possible.

The right to erasure of Personal Data  
In some circumstances, you have the right to the erasure of your Personal Data without undue delay. Those circumstances include:

1. the unnecessity to hold the Personal Data any longer in relation to the purposes for which they were collected or otherwise processed;
2. the withdrawing of the consent to consent-based processing;
3. the processing that is for direct marketing purposes; and
4. in case the Personal Data have been unlawfully processed.

However, there are certain general exclusions of the right to erasure. Those general exclusions include where processing is necessary:

1. for exercising the right of freedom of expression and information;
2. for compliance with a legal obligation; or
3. for the establishment, exercise or defence of legal claims.

The right to restrict the processing of Personal Data
In the following circumstances you have the right to restrict the processing of your Personal Data:

1. for contesting the accuracy of the Personal Data;
2. when the processing is unlawful but you don’t want the Personal Data to be erased; or
3. when you objected to processing, pending the verification of that objection.

Where processing has been restricted on this basis, we may continue to store your Personal Data. However, we will only process it with your explicit consent, for the establishment, exercise or defense of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest.

The right to object
You have the right to object to our processing of your Personal Data, under the following circumstances:

1. when we process your Personal Data for direct marketing purposes (including profiling for these purposes) based on our legitimate interest; and
2. on grounds relating to your particular situation (special personal circumstances).

The right to data portability
If you wish to exercise your right to data portability, we will send the Personal Data in a structured, commonly used and machine-readable format to a controller of your choice.

The right to withdraw consent
To the extent that the legal basis for our processing of your Personal Data is consent, you have the right to withdraw that consent at any time. However, withdrawal will not affect the lawfulness of processing before the withdrawal.

The right to complain to a supervisory authority
You can file a complaint with the Data Protection Authority (“Gegevensbeschermingsautoriteit”) by sending an e-mail to contact@apd-gba.be or by sending a written request to the Data Protection Authority with registered address located at 1000 Brussels, Drukpersstraat 35.