De Cronos Groep NV is committed to your privacy and proper handling of your personal data. We therefore put every effort to plainly and clearly explain which personal data we collect, what purpose they will serve and what your rights are in this respect.

The version of this privacy statement (version: 1.00) dates from (10/08/2023)

1      Table of Contents

2       Who are ‘we’?

3       Scope

4       Why and how do we process your personal data?

4.1       Heart rate monitoring

4.2       Use of our app

5       How Long do We store your Personal Data?

6       Automated individual decision-making

7       What are your rights and how to exercise them?

7.1       Right to information and right of access

7.2       Right to rectification

7.3       Right to restriction of processing

7.4       Right to data portability

7.5       Right to object

7.6       Right to data erasure (‘right to be forgotten’)

7.7       Right to revoke your consent

7.8       Right to object to the processing of your personal data in automated individual decision-making

8       Whom to address questions or possible complaints about privacy?

9       Amendments to the Privacy Statement

2      Who are ‘we’?

“We” or “our” implies De Cronos Groep NV with registered office in Veldkant 33a, 2550 Kontich, Belgium, and with registration number 0467.132.994.

If you have any questions, comments or complaints regarding this privacy statement or the processing of your personal data, or if you wish to exercise any of your rights, please contact us by email to [email protected].

3      Scope

This privacy statement applies to the application “Breathe4Balance”, hereinafter referred to as “the application” or “the app”, and all marketing activities linked to the application.

4      Why and how do we process your personal data?

If you use our app and/or are in contact with us, certain personal data may be processed. You will find more information on the different processing activities that may apply to you below.

4.1      Heart rate monitoring

Consent – The app is processing personal data, including your heart rate, in order to fullfil its core functionality: providing you with a heart coherence score and helping you improve your score by doing generic or custom exercises.

The data are processed with your explicit consent which you give when using the app. You can revoke the given consent at any time without prejudice to the lawfulness of the data processing up to the time the revocation took place. This means that your consent applies for the use of the applciation up to the point of withdrawal, but you will no longer be able to use the application. You can withdraw your consent by deleting the application.

  • Which personal data do we process?
    • We do not use any personal data identification
    • We do process health data:
      • Your heart rate
      • Your heart coherence ratings
      • Your breathing cycle settings

All data is stored on the device and does not leave the device. The app does not use or store any personal identifier.

  • How do we acquire the data?
    • Heart rate is acquired by using the core functionality of the app, more specifically by using an external bluetooth heart rate sensor.
    • Heart coherence rating is calculated on the device
    • Breathing cycle settings are manual settings that you can change in the app itself.
  • How long do we store them?
    • Heart rate: duration of the active session
    • Heart coherence ratings and breathing cycle settings: indefinitely by your devices as long as you not manually delete the app
  • With whom do we share the personal data? No personal data is shared or stored beyond the physical boundaries of your device
  • Do these activities include automated individual decision-making? No
  • Are data transferred outside the EEA? No

5      How Long do We store your Personal Data?

We will not retain your personal data for longer than strictly necessary to fulfil the purposes for which the personal data were collected or according to the legal obligation imposed on us. We refer to the section “Use of our app?”) for the specific retention period.

6      Automated individual decision-making

European data protection legislation (GDPR) imposes certain conditions on organisations when they make decisions about individuals solely on the basis of processing operations that are fully automated, including profiling, and when these decisions have legal effects or other significant consequences. De Cronos Groep NV does not engage in this type of decision-making.

7      What are your rights and how to exercise them?

De Cronos Groep NV considers it important that you always retain control over the processing of your personal data. Below you will find more information on the various rights you have and can invoke in relation to the processing of your personal data:

Depending on the processing and its legal ground, certain conditions or restrictions may be attached to the exercise of the rights below.

To exercise the aforementioned rights, or information about them, please contact [email protected] We will provide more information if there are certain modalities associated with your request. Furthermore, we may request additional information to verify your identity so that your personal data are not erroneously deleted or shared with someone who is not entitled to them. We will endeavour to respond to your request without unreasonable delay, but in any event within a period of one month from receipt of your request. If we cannot respond within one month and wish to extend the deadline, or if we will not act on the request, we will notify you.

7.1      Right to information and right of access:

When we process your personal data, you have the right to access your personal data, as well as certain additional information as described in this privacy statement. You have the right to receive from us a copy of the personal data we hold, provided this does not adversely affect the rights and freedoms of others. The first copy will be provided to you free of charge, but upon repeated request we reserve the right to charge a reasonable fee.

7.2      Right to rectification:

If the personal data we hold about you are inaccurate or incomplete, you have the right to have this information corrected or, given the purposes of the processing – completed.

7.3      Right to restriction of processing:

You have the right to have the processing of your personal data restricted. This means that the personal data may only be stored by us and used only for limited purposes. This right applies if any of the following situations occur:

  • You dispute the accuracy of the personal data, for a period that allows us to verify the accuracy of the personal data;
  • The processing is unlawful, but you oppose the deletion of the personal data and request instead that its use be restricted;
  • We no longer need your personal data for the processing purposes described above but you need it for the establishment, exercise, or defence of legal claims; or,
  • You have objected to a processing operation and request to restrict the processing pending the answer to whether our interests outweigh yours.

In addition to our right to store your personal data, we can still process them, but only:

  • With your consent;
  • For instituting, exercising, or defending legal action;
  • To protect the rights of another natural or legal person; or
  • For reasons of public interest.

Before we lift the restriction on processing your personal data, you will be informed about it.

7.4      Right to data portability:

If the processing of your personal data is based on your consent, and the processing is carried out through automated processes, you have the right to receive a copy of your personal data in a structured, common, and machine-readable form. You also have the right, where technically possible, to have your personal data transmitted directly by us to a third party. This right does not apply where this would infringe the rights and freedoms of others.

7.5      Right to object:

You have the right to object to the processing of your personal data in the activities described above. In the latter case, this is only possible if the activity is related to (1) the performance of a task in the public interest or in the exercise of a task in the exercise of public authority conferred on us or (2) the protection of our legitimate interests or those of a third party.

If you object to the processing of your personal data, we will no longer process the personal data unless we can demonstrate legitimate interests for processing that outweigh your interests, fundamental rights, and freedoms.

If your personal data are processed for direct marketing purposes, regardless of whether this is initial or further processing, you have the right to object to this processing at any time and free of charge, including in the case of profiling insofar as it relates to direct marketing. If you raise such an objection, we will cease to process your personal data for this purpose.

7.6      Right to data erasure (‘right to be forgotten’):

You have the right to request us to delete your personal data. This means that the personal data must be deleted by us without unreasonable delay. This right applies if any of the following situations occur:

  • The personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
  • You withdraw your consent on which the processing is based, and there is no other legal basis for processing your personal data;
  • Your personal data have been processed unlawfully;
  • Erasure of your personal data is necessary to comply with European or Belgian law;

If you request to delete your personal data, we will delete the personal data unless any of the following situations (exceptions) occur:

  • The processing is part of exercising the right to freedom of expression and information;
  • Deletion is not applicable for the reason of general interest in the domain of public health;
  • Deletion is not applicable given the need for archiving in the public interest, or statistical purposes;

A legal obligation to retain the data applies; or,

  • Deletion is not applicable given the institution, exercise, or substantiation of a legal claim.

7.7    Right to revoke your consent:

If you have consented to certain processing of your personal data, you can withdraw your consent at any time. We try to make withdrawal of consent as simple as giving your consent possible, wherever possible.

7.8      Right to object to the processing of your personal data in automated individual decision-making:

When your personal data are used in the context of automated individual decision-making and when these decisions have legal effects or other significant consequences, you can ask us to stop using your data. If you oppose such processing, we will stop or restrict processing unless there are compelling reasons to do so.

8      Whom to address questions or possible complaints about privacy?

If after reading this privacy statement you have further questions or comments regarding the collection and processing of your personal data, you can always contact us at the following e-mail address: [email protected] . Please refer to “Breath4Balance”.

In addition, you have the right to submit any comments and observations or complaints to the supervisory authority responsible for data protection. You can do this in the EU Member State where you reside, the place where you work or the place where the alleged breach took place. In Belgium, you can file a complaint with the Data Protection Authority:

Gegevensbeschermingsautoriteit (Data Protection Authority)
Drukpersstraat 35, 1000 Brussel
+32 (0)2 274 48 00
https://www.dataprotectionauthority.be/citizen/actions/lodge-a-complaint
www.gegevensbeschermingsautoriteit.be

As we are committed to our mutual relationship, we ask you to always contact us first so that we can work out a solution to what lies at the root of your complaint.

9      Amendments to the Privacy Statement

Our organisation and our website are a dynamic and innovative environment. This privacy statement may be modified if our services or applicable legislation so require. This means that we are constantly looking to provide a better service tailored to your needs. It is possible that there will be new applications where we will collect or process your personal data in a different way. As a matter of course, we will inform you when there are important changes to this privacy statement, and we will ask your permission if necessary.