TrustBuilder Privacy Statement
for Business Relations

• for the purpose of concluding and performing contracts concluded with you, including (but not limited to) accounting, invoicing and deliveries;
• for complying with our legal obligations;
• for the purpose of the legitimate interests of our company and/or a third party, including (but not limited to) our business activities, customer and supplier management etc. and after conducting a balancing test with your interests. If you would like more information about this, you can always contact us.

• gain access to your personal data and request a copy thereof;
• ask that We update or correct your personal data when you believe they are incorrect or incomplete;
• ask that We delete your personal data, or restrict the way in which We use such personal data when you believe that We have no (longer a) lawful ground to process it;
• withdraw consent to the processing of your personal data (to the extent such processing is based on your consent);
• receive your personal data in a structured, commonly used and machine-readable format and to transfer such data to another party (to the extent the processing is based on consent or on the execution of a contract);
• object to the processing of your personal data for which We use legitimate interest as a legal ground, in which case We will cease the processing unless We have compelling legitimate grounds for the processing.

• by sending an e-mail to [email protected];
• by sending a written query to: TrustBuilder, Kris Van Opstaele, Poortakkerstraat 93, 9051 Ghent.

You may also use these contact details if you wish to make a complaint to us relating to the processing of your personal data.

We may also obtain your personal data through the way you interact with us.

• external service providers We rely on for various business services;
• law enforcement authorities and public authorities in accordance with the relevant legislation;
• external professional advisors (e.g. attorneys or consultants of the company).

With your explicit consent, We may transfer personal data to third parties (e.g. marketeers) for direct marketing purposes, including targeted advertising.

• Access control and authentication:
  • An access control system applicable to all users accessing the IT system is implemented. The system allows creating, approving, reviewing and deleting user accounts.
  • The use of common user accounts is avoided. In cases where this is necessary, it is ensured that all users of the common account have the same roles and responsibilities.
  • When granting access or assigning user roles, the “need-to-know principle” shall be observed in order to limit the number of users having access to personal data only to those who require it for achieving TrustBuilder’s processing purposes.
  • Where authentication mechanisms are based on passwords, TrustBuilder requires the password to be at least eight characters long and conform to very strong password control parameters including length, character complexity, and non-repeatability.
  • The authentication credentials (such as user ID and password) shall never be transmitted unprotected over the network.
• Logging and monitoring:
  • Log files are activated for each system/application used for the processing of personal data. They include all types of access to data (view, modification, deletion).
• Security of data at rest:
  • Server/Database security:
    
    • Database and applications servers are configured to run using a separate account, with minimum OS privileges to function correctly.
    • Database and applications servers only process the personal data that are actually needed to process in order to achieve its processing purposes.
  • Workstation security:
    
    • Users are not able to deactivate or bypass security settings.
    • Anti-virus applications and detection signatures is configured on a regular basis.
    • Users don’t have privileges to install or deactivate unauthorized software applications.
    • The system has session time-outs when the user has not been active for a certain time period.
    • Critical security updates released by the operating system developer is installed regularly.
• Network/Communication security:
  • Whenever access is performed through the Internet, communication is encrypted through cryptographic protocols.
  • Traffic to and from the IT system is monitored and controlled through Firewalls and Intrusion Detection Systems.
• Back-ups:
  • Backup and data restore procedures are defined, documented and clearly linked to roles and responsibilities.
  • Backups are given an appropriate level of physical and environmental protection consistent with the standards applied on the originating data.
  • Execution of backups is monitored to ensure completeness.
• Mobile/Portable devices:
  • Mobile and portable device management procedures are defined and documented establishing clear rules for their proper use.
  • Mobile devices that are allowed to access the information system is pre-registered and pre-authorized.
• Application lifecycle security:
  • During the development lifecycle, best practice, state of the art and well acknowledged secure development practices or standards is followed.
• Data deletion/disposal:
  • Software-based overwriting will be performed on media prior to their disposal. In cases where this is not possible (CD’s, DVD’s, etc.) physical destruction will be performed.
  • Shredding of paper and portable media used to store personal data is carried out.
• Physical security:
  • The physical perimeter of the IT system infrastructure is not accessible by non-authorized personnel. Appropriate technical measures and organizational measures are in place to protect security areas and their access points against entry by unauthorized persons.

• Security management:
  • Security policy and procedures:
    
    • TrustBuilder must document a security policy with regard to the processing of personal data.
  • Roles and responsibilities：
    
    • Roles and responsibilities related to the processing of personal data is clearly defined and allocated in accordance with the security policy.
    • During internal re-organizations or terminations and change of employment, revocation of rights and responsibilities with respective hand-over procedures is clearly defined.
  • Access Control Policy: specific access control rights are allocated to each role involved in the processing of personal data, following the need-to-know principle.
  • Resource/asset management: TrustBuilder has a register of the IT resources used for the processing of personal data (hardware, software, and network). A specific person is assigned the task of maintaining and updating the register (e.g. IT officer).
  • Change management: TrustBuilder makes sure that all changes to the IT system are registered and monitored by a specific person (e.g. IT or security officer). Regular monitoring of this process takes place.
• Incident response and business continuity:
  • Incidents handling / Personal data breaches:
    
    • An incident response plan with detailed procedures is defined to ensure effective and orderly response to incidents pertaining personal data.
    • TrustBuilder will report without undue delay to the relevant controller any security incident that has resulted in a loss, misuse or unauthorized acquisition of any personal data.
  • Business continuity: TrustBuilder establishes the main procedures and controls to be followed in order to ensure the required level of continuity and availability of the IT system processing personal data (in the event of an incident/personal data breach).
• Human resources:
  • Confidentiality of personnel: TrustBuilder ensures that all employees understand their responsibilities and obligations related to the processing of personal data. Roles and responsibilities are clearly communicated during the pre-employment and/or induction process.
  • Training: TrustBuilder ensures that all employees are adequately informed about the security controls of the IT system that relate to their everyday work. Employees involved in the processing of personal data are also properly informed about relevant data protection requirements and legal obligations through regular awareness campaigns

• by e-mailing us at [email protected];
• by calling us at +32 (0)9 265 02 70;
• by addressing your written query to TrustBuilder, Kris Van Opstaele, Poortakkerstraat 93, 9051 Ghent.