Privacy notice

This Privacy Notice is provided by DIGI Communications Belgium NV (hereinafter “DIGI”, “we”, “us”, “our”), a company incorporated under the laws of Belgium, with its registered offices in Rue de l’Hôpital 31, 1000 Bruxelles, registered at the Crossroads Bank for Enterprises under number 0803.299.956, in its quality as Data Controller (hereinafter “the Controller”), in compliance with articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter “GDPR”).

For the provision of interpersonal and electronic communication services and/or for the provision of digital services activated by you through your telephone credit (hereinafter the “Services”) as well as, upon the occurrence of the conditions specified below, DIGI explains (in paragraphs 1 - 7) the purposes and legal basis for which we collect and process your personal data, which categories of data are processed, the transfers of data and modalities they happen, which rights you have as a data subject (hereinafter “data subject”, “you”, “your”, “yours”) and how to exercise.

DIGI has appointed a Data Protection Officer (hereinafter “DPO”), pursuant GDPR, who can be contacted by writing for the attention of Data Protection Officer, Rue de l’Hôpital 31, 1000 Bruxelles or via privacy@digi-belgium.be.

 

    1.Categories of personal data processed

 

DIGI will process:

a) the personal data provided by you when entering into the contract for the provision of services;

b) certain personal data that may be acquired by other means during the course of the contractual relationship, such as:

          i) Name, surname, date of birth, citizenship, gender, eID card and national register numbers, residential or home address and contact details telephone, e-mail address, Facebook and WhatsApp eID;

          ii) Telephone and electronic traffic data;

          iii) Bank and/or payment data;

          iv) Data relating to the position of your device determined by GPS coordinates or information about the telephone cells you are connected to while using telecommunication services;

           v) Data provided by third parties in the context of partnerships with DIGI;

          vi) Data on your creditworthiness and payment punctuality, also acquired through the IT systems of authorised companies providing credit risk management and fraud control services;

         vii) Data relating to your consumption habits and/or interests;

         viii) Data belonging to special categories within the meaning of Article 9 GDPR;

            ix) Data relating to criminal convictions or offences, within the meaning of Article 10 GDPR, provided by judicial authorities as part of their own requests;

            x) Data processed or generated as part of the provision of electronic communications networks or services.

 

    2. Purposes and legal basis of data processing

 

Under the specified conditions, your personal data will be processed for the purposes indicated in letters a) to e) below

 

         a) For execution of the contract

Your personal data will be processed for the management of the contractual relationship (for example, for the invoicing of fees, handling payments or claims you may submit to us, credit collection, etc.) and to provide the services you have requested (internet access, interpersonal communications, television services). In particular, for this purpose, DIGI may process the data indicated in paragraph 1.b), points i), ii), iii), iv) and vi). DIGI informs you that it may contact you and process the above data for purposes related to the execution of the contract (such as but not limited to: assistance, provisioning, activation, support) also through DIGI's official chat channels (WhatsApp, Facebook and DIGI’s platforms).

In processing data indicated in paragraph 1.b), points ii), DIGI will make your data anonymous, as soon as they are no longer necessary for the transmission of the communication, except for fulfilment of legal obligations or for the sole purpose of invoicing or making interconnection payments.

DIGI may process the data referred to in paragraph 1.b) point viii) in an encrypted way, without knowing the content of the communication.

 

         b) For fulfilment of legal obligations

Your personal data will be processed by DIGI for the fulfilment of legal obligations. Specifically, DIGI may process your data for the fulfilment of accounting and tax obligations, for the fulfilment of judicial authority orders to prevent and repress crimes. For such purposes, the data indicated in paragraph 1.b), points i), ii) iii), iv), viii) and x) may be processed.

In case of emergency communication to the management centres of emergency services offering on-site help, your geographical location may be processed without your consent, with a view to allowing the processing of the emergency communication by the management centres concerned .

Moreover, exclusively to comply with requests from judicial authorities, DIGI may acquire the data referred to in paragraph 1.b), point ix). Finally, DIGI may process your data in order to comply, also by sending SMS messages, with public authority measures adopted for urgent public order, safety, health and hygiene reasons or in the event of disasters, catastrophes or other exceptional events and situations.

 

         c) In pursuit of its own legitimate interest, DIGI may implement the following procedures

With reference to the subscription services, in order to carry out the preliminary checks connected with the conclusion of the contract, DIGI may process:

•     the data indicated in paragraph 1.b), point vi) to check your creditworthiness and punctuality of payments by accessing the IT systems of authorised companies that provide credit risk management and fraud control services and that process the data in their capacity as Data Controllers.
•     data relating to the status and punctuality of your payments with reference to contracts already in place.

DIGI may use the e-mail address you have provided to send commercial communications regarding services and/or products similar to those covered by the contract.

Within the context of art. 9 of the Royal Decree of 12 September 2018 on the obligations applicable to the provision of paid services as referred to in Article 116/1, §2, of the Law of 13 June 2005 on electronic communications, DIGI may process and share your data with third party service and/or content providers, providers acting in their capacity as data controllers ("third data controllers") for the purposes of pursuing their own legitimate interests, since you have provided them with your DIGI mobile number in order to use/subscribe to their services.

DIGI may record your interactions with the customer care with the exclusive and solely purpose to control the quality of service in call centres, in compliance with Article 10/1 of Law 30 July 2018 relating to the protection of individuals with regard to the processing of personal data. Furthermore, DIGI may carry out activities aimed at improving the services provided (including the customer care service) and related to the contractual relationship also by means of technologically advanced tools (i.e. artificial intelligence tools) and also with the help of third parties in quality of Data Recipients, as indicated in paragraph 3 of this Privacy Notice.

We inform you that you have the right to object at any time, for reasons related to your particular situation with reference to the data processing indicated above in letters a) to c) that may be carried out by DIGI on the basis of its own legitimate interest. Following your objection, DIGI will refrain from further processing this personal data unless there are compelling legitimate grounds for processing that override your interests and rights.

You may oppose, without limitation, the sending of commercial communications to your email address and aggregate profiling by writing at privacy@digi-belgium.be. Any updates on these methods will be indicated from time to time on our websites.

 

         d) For marketing purposes, subject to your consent

With your express consent, DIGI may process your data in order to send you commercial communications regarding DIGI's services and products. In particular, for this purpose, DIGI may process the data indicated in paragraph 2.b), point i) and ii).These communications may be sent through automated communication channels (e.g. SMS, e-mail, notifications on the App) and through traditional channels (operator calls, paper mail). Furthermore, DIGI may process the data provided by you and those acquired during the use of the services to perform market research and analyse the customer satisfaction level.

 

         e) For data enrichment purposes, subject to your consent

With your consent, DIGI may enrich the personal data provided by you and those collected during your use of DIGI services with data acquired from third parties (e.g. content providers, service providers, social media).

These parties will only disclose your personal data to DIGI if you have given your specific consent to do so. The enrichment of personal data is functional to improve your experience when using the services and to offer you services in line with your needs.

 

    3.The recipients or categories of recipients of the personal data

 

For the implementation of the contract, the fulfilment of legal obligations and the pursuit of its legitimate interests, DIGI may disclose your personal data to the following categories of persons:

• parties that perform services for the acquisition, processing and elaboration of the data needed for the provision of customer services, including authorised companies that provide credit risk management and fraud control services;
• parties that provide services for the management of DIGI's IT system;
• parties involved in the transmission, mailing, forwarding and sorting of the data subject's communications;
• parties performing customer service activities (e.g. call centres, etc.);
• parties who carry out data entry and filing;
• parties who carry out control, audit and certifications on the activities carried out by DIGI also in the interest of its customers and users;
• other telecommunications operators, for the management of interconnection and roaming relationships;
• group companies;
• subsidiary, parent and associated companies;
• credit transferee companies;
• parties who perform technical and organisational tasks on behalf of DIGI;
• sales agents, firms and companies as part of service and consultancy relationships;
• public authorities, if the conditions are met;
• parties that carry out, also by means of automated tools and/or Artificial Intelligence, activities aimed at improving the services provided and are connected to the contractual relationship. These parties will process the data as Data Processors on behalf of DIGI.

Furthermore, if you have consented to the processing of your data for the purposes referred to in paragraph 2.b), points d) and e) above, DIGI may disclose your data to third parties that it uses to carry out these activities (for example, entities entrusted with marketing activities). These parties will process the data as data processors on behalf of DIGI.

 

    4.Data processing methods

 

Your data is collected and recorded in a lawful and correct manner for the purposes indicated above and are processed, also with the aid of electronic or automated means and specific databases, in terms not incompatible with these purposes and, in any case, in a manner such as to guarantee the security and confidentiality of the data.

DIGI has taken all reasonable technical and organisational measures to protect your personal data against unauthorised access and use, loss or theft, such as: security of your passwords, encryption software, firewalls, antivirus, intrusion and anomaly detection, as well as control for the DIGI employees (the number of Employees who have access to your personal data are limited and access is only granted insofar as these specific data are required to perform their tasks properly).

 

    5.Processing term and retention period

 

Your data will only be processed for the time necessary for the purposes mentioned above. Specifically, below are the main use and retention periods relating to your personal data for the various processing purposes:

 

      5.1. Execution of contract

DIGI will retain the data processed for the execution of the contract throughout the duration of the contract and for a further period of 10 years and 3 months thereafter, unless the need for further retention for additional periods to enable DIGI to defend its rights arises;

Your traffic data will be retained for a maximum period of six months for billing purposes or for making interconnection payments, without prejudice to any further specific retention required as a result of a dispute, including in court.

In the provision of data traffic or location data service, DIGI limits the processing of your geographic location to the acts and duration necessary to provide the services in question.

 

      5.2. Fulfilment of legal obligations

DIGI will retain data processed for the purpose of fulfilling legal obligations to the extent provided for by law and for as long as the need for processing persists in order to fulfil said legal obligations;

The information regarding both incoming and outgoing telephone and electronic communications, excluding the actual content of the communications:

• is retained for 12 months for the purposes (i) to prevent end users of DIGI from be harmed or bothered and detect fraud and malicious use on their networks and services, pursuant to the Law of 13 June 2005 concerning electronic communications; and (ii) to provide you with the most advantageous alternative tariff plans of DIGI, if it is applicable pursuant to the Law of 13 June 2005 concerning electronic communications.

For the purposes of safeguarding national security, combating serious crime, preventing serious threats to public security, and safeguarding the vital interests of a natural person DIGI will retain the data indicated in paragraph 2.b), point x) for a maximum of 12 months, or according to specific geographical areas defined by Law 13 June 2005 concerning electronic communications, for another maximum subsequent 12 months.

 

      5.3. Legitimate Interest

The data processed for the pursuit of DIGI's legitimate interest will be processed for the time strictly necessary for the pursuit of that interest, namely:

•     data collected to carry out preliminary checks in connection with the conclusion of the contract, including data collected by third parties as indicated in paragraph 1, letter c), will be processed until the conclusion of the contract;
•     data relating to the status and punctuality of your payments to DIGI will be retained for the entire duration of the contract and for a period of 10 years following the conclusion of the contract;
•     the data used for sending commercial communications to your email address, as indicated in paragraph 1, letter c), will be processed until the termination of the contractual relationship, unless you have previously objected;
•     data collected for the purposes to control the quality of service in call centers will be processed for a maximum of one month;
•     Geolocation and traffic data
  • for the purpose of proper functioning and security of the network or service, are stored for 12 months from the date of communication, except in the event of a specific security breach of the network requiring the retention of the data concerned to be extended beyond this period;
  • for the purpose of detecting and analysing fraud or malicious use of the network are retained for 4 months, except in the event of specific fraud or malicious use requiring extension the retention of the data concerned beyond this period.

 

      5.4. Consent

        Marketing

The data for marketing purposes will be processed for a period of 24 months and until you revoke your consent to use the data for that purpose; following such revocation, DIGI will cease the processing in question and will no longer retain the data acquired exclusively for that purpose;

        Data Enrichment

The data collected for enrichment purposes will be processed for a period of 12 months and until you revoke your consent for such processing;

 

    6.Transferring data outside the European Union

 

Your data may also be transferred outside the European Union to companies that are part of the DIGI Group or to different Data Recipients. Such transfers, where applicable, will be regulated through the use of standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to GDPR or on the basis of an adequacy decision by the European Commision. You may obtain information on where your data has been transferred to and a copy of that data by sending an e-mail to privacy@digi-belgium.be.

 

    7.Data Subject's Rights

 

In accordance with the regulations in force, you may exercise the following rights:

• request and obtain information relating to the presence with the Data Controller or your personal data, the purposes of the processing and access to such data;
  • by sending an e-mail to privacy@digi-belgium.be, and attaching a valid identification document to your request
• request and obtain the modification and/or correction of your personal data if you believe that they are inaccurate or incomplete;
  • by sending an e-mail to care@digi-belgium.be, and attaching a valid identification document to your request
• request and obtain the cancellation - and/or limitation of processing - of your personal data if data or information are unnecessary (or no longer necessary) for the above purposes;
  • by sending an e-mail to privacy@digi-belgium.be, and attaching a valid identification document to your request
• request and obtain portability of the personal data that are processed by automated means in a structured, commonly used format and readable by an automatic device and request their transfer to another data controller.
  • by sending an e-mail to care@digi-belgium.be, and attaching a valid identification document to your request.

 

Please note that if you use addresses other than those indicated in this Policy to exercise your rights or to change optional consents, the handling of your request may be slowed down.

 

      7.1. Procedure for revoking optional consents - referred to in paragraph 1, letters (d) and (e) above

Your consent under paragraph 1, letters d) and e) may be revoked by you at any time and in several ways:

• by sending an e-mail to care@digi-belgium.be, and attaching a valid identification document to your request;
• calling at 0800 41 0 41

If you are no longer one of our customers, you may revoke your consent under paragraph 1, letters  d), e),within 6 months after deactivation of your account in the following ways: by sending an email to the following address care@digi-belgium.be, enclosing a valid identification document with your request.

 

      7.2. Procedure for universal revoking of consents for marketing correspondence and calling

If you do not wish to receive any commercial calls, you can register yourself on the Don’t-call- me-anymore list. You can do this via the website https://www.dncm.be (only available in Dutch or French).

If you no longer wish to receive commercial letters, you can register yourself on the so-called Robinson list via the website https://www.robinsonlist.be (only available in Dutch or French)

 

    8.Additional information

 

DIGI is a Full Mobile Virtual Network Operator (Full MVNO). This means that we can develop our own mobile services on the Proximus mobile network, and to market, distribute and sell them under our name and for our account. Proximus is fully responsible for the operation of its mobile network. In the capacity of Network Operator, Proximus may process your data for purposes such as: (i) the delivery of the Services; (ii) maintenance, repairs, improvement and development of the Proximus infrastructure; (iii) legal obligations.

For further information, we invite you to read the Privacy Notice of our Network Operator Partners.

 

        Exercise of Rights and lodge of a complaint to the Belgian Data Protection Authority

You can exercise your rights or file complaints about the processing of your personal data by contacting DIGI at the following address: DIGI Communications Belgium NV, for the attention of Data Protection Officer, Rue de l’Hôpital 31, 1000 Bruxelles or via privacy@digi-belgium.be.

DIGI needs to verify your identity. Therefore we ask you to include a copy of your identity card with your request. You can exercise your privacy rights free of charge, unless your request is unfounded or excessive. DIGI can then charge a reasonable fee, taking into account the administrative costs to be able to carry out the request, or refuse to execute the request.

If DIGI does not respond within 30 days to your request or if it refuses to do so in your opinion, or if our response does not meet your expectations, you can lodge a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels, or via commission@privacycommission.be, who will start a mediation procedure.

 

Definitions

 

• Anonymised data: Personal data made anonymous through a process which is non-reversible within the limits of the technology applicable from time to time.
• Consent: means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to them.
• Legitimate Interest: any interest of the Data controller or third parties for which the data processing is necessary to achieve it and it is overriding to the interests, rights and freedoms of the data subject.
• Traffic Data: the identifier of the origin of the communication; the identifier of the destination of the communication; the precise dates and times of start and end of the communication; the telephone number from which the incoming communication originated; the IP address used to send the incoming communication, the timestamp and the port used; and the precise dates and times of the start and end of the incoming)
• Data processed or generated as part of the provision of electronic communications networks or services: Data referred to in Articles 126, § 1 and 126/2, § 2 of Law 13 June 2005 concerning electronic communications.

 

Legal Disclaimers

 

This Privacy Notice has been drawn up with due observance of the obligations in GDPR  and the provisions of European Directive 2002/58/EC

DIGI may use your personal data for new purposes that are not yet provided for in our "Privacy Notice". In that case, we will contact you before using your data for these new purposes, to inform you of the changes to our regulations for the protection of personal data and to give you the opportunity to refuse your participation.

If this privacy policy is changed, you can always find the most recently published version on this page. If the law so requires, DIGI will inform you individually.