Last update: 14 December, 2023
1.1. About Brik
Brik - Student in Brussel vzw is registered in the Crossroads Bank for Enterprises under number 0464.281.788 and has its registered office at Zavelput 20, 1000 Brussels.
In the context of its activities and services, Brik - Student in Brussel vzw ("Brik") processes, among other things, personal data of users. Within these processing activities, Brik acts as a "data controller" and is responsible for the protection of your personal data. Brik strives to comply with applicable data protection laws, such as, as of May 25, 2018, the European General Data Protection Regulation 2016/679 (the "Regulation" or the "GDPR") and any applicable national laws implementing EU Directive 95/46 in relation to the processing of personal data or which further supplement the GDPR.
1.2. Brik values your privacy
Brik strives to be a trusted partner and therefore wants to respect and protect your personal data.
This Privacy Policy aims to explain how we collect, store, use and disclose your personal data each time you use our products and services, our websites or interact with us. This Data Protection Policy also lists your rights and explains how to exercise those rights.
Read this Privacy Policy carefully so that our processing of your personal data is as transparent as possible.
Brik employees are also adequately informed about the processing of their personal data by Brik, and, where necessary, their consent is obtained for the data processing, as described in this Privacy Policy.
1.3. The following principles are central to the way we process your personal data.
- Transparency and fairness: When we collect and process your personal data, we inform you about who collects and receives it, and why.
- Legitimacy: Brik does not collect or process personal data without a lawful basis. Where required by law, we will always ask for your prior consent (e.g. to the extent necessary in the context of a direct marketing campaign).
- Purpose: We use your personal data for pertinent business purposes (e.g. to provide services, to manage relationships with (re)tenants, for marketing activities, to better serve users, to conduct satisfaction surveys, to prepare reports and to fulfil our legal obligations). We never use your personal data for purposes incompatible with those stated in this Data Protection Policy or communicated to you elsewhere.
- Necessity and proportionality: We only collect personal data that is necessary for data processing, as explained in this Data Protection Policy. We collect sensitive data only when relevant. We take all reasonable measures to ensure that your personal data is correct, complete and up-to-date. We provide your data to service partners and providers only to the extent necessary to provide our services or fulfil legal obligations.
These principles are further outlined in several points below.
2. What activities does data collection cover?
This Privacy Policy applies to all data sources that Brik collects and processes in the context of carrying out its activities and services.
3. Whose personal data is processed?
We may collect and process your personal data depending on the capacity in which you use one of the Brik platforms.
When you sign up as a landlord, the following categories will be processed:
- Name and first name
- Language
- Gender
- Phone number
- Email address
- Address information
- Company data
- Activity on the Brik platforms (e.g., IP address, location data, etc.).
- Bank account number (optional)
- Further data that you add to the Brik platforms (including rental studios/rooms)
When registering on the Brik platforms as a tenant, the following categories will be processed:
- Name and first name
- Language
- Gender
- E-mail address
- Address information (optional)
- School (optional)
- Account number (optional)
- Activities on the Brik platforms (e.g., IP address, location data, etc.).
- Further data you add to the Brik platforms.
If you merely visit the platform without registering, only personal data will be collected based on cookies (see section 5), mainly processing IP address, location data and previous visits.
4. How do we collect your personal data?
Brik may collect your personal data in several ways:
- We collect your personal data directly from you during our interaction with you (e.g. when you contact Brik, Brik may retain that correspondence), when you fill out an online (application) form, when you create an account on one of our websites, etc.
- We might also ask you to complete surveys that we use for research purposes, even if you are not required to respond to them.
- We may store details of your visits to our website including, but not limited to, data traffic data, location data, weblogs and other communication data, and the resources you access.
- We may also collect data about your computer or device, such as IP address, operating system, or browser type. This data is collected for the proper management and operation of our websites. To collect this data, we use cookies.
5. Cookies
To provide you with a better experience when you visit our website(s), we collect certain information automatically using technologies. Our website(s) use cookies or similar technologies. Cookies are small text files that your browser stores on your computer when you visit a website. They serve for example to remember your preferences on a website, the IP address and location information or can be used for statistical purposes.
You can always choose to disable cookies and delete cookies that have already been saved. You can do this by adjusting your browser settings. For this we refer you to the support page of your web browser.
When you use our websites, we may collect information about the browser you are using and your browsing habits.
For the rest, we refer you to our Cookie Policy, which contains more information about the processing of data in this context.
6. For what purposes do we use your personal data?
Brik will process your personal data only in the cases permitted in accordance with the processing grounds provided by Art. 6.1 GDPR.
Brik processes your personal data for the following possible purposes and any other compatible purposes:
- To comply with legal obligations and protect Brik's interests and assets.
- To communicate with you: you can contact us in various ways (via our website, by phone, by email ...) to ask us questions, request information, provide comments, etc. We use your personal data to communicate with you and answer your questions.
- To provide services for which you register with the Brik platforms, namely putting landlords and tenants in contact with each other in the market of student rooms and making it possible for parties to easily conclude an agreement. In the process, data is exchanged between tenant and landlord (execution of agreement).
- To collect anonymous statistical data regarding the Brussels student rental market.
- To use Internet portals.
- To report to landlords on the results of satisfaction surveys.
- For management reporting, such as audits, internal control, data analysis.
- To maintain business records for legal, administrative and audit purposes.
- For marketing purposes: we may use your information to contact you, about new offers or services and special offers that we think you will find valuable, or to send you marketing messages or newsletters. We may analyse your customer profile and preferences and run multi-channel marketing campaigns through automated tools, contact you via text message, email or send you brochures.
- For customer/driver satisfaction surveys based on targeted marketing tools and analytics, we may send you qualitative surveys for our products and services.
- For websites, cookies and occasional newsletters: we may collect data through cookies to enhance our know-how and noticeably improve your browsing experience by storing your preferences and parameters to save your time (such as language preferences), facilitate login, deter fraud and analyse the performance of our websites and services. We may also occasionally notify you about events or communications that we believe are relevant to you, the user of the platform. These include, for example, new regulations or the 'Open Kotdagen'.
This data helps us improve our websites and better understand which products and services you would prefer.
We also use Internet analytics cookies to measure website activity and identify which areas of the websites are visited most frequently.
While we may install functional cookies to facilitate your visit to our websites, you can express your preferences about cookies used for behavioural advertising. This can be done through your browser's privacy settings options, which should include features to prevent data being stored on the terminal or processing of data already stored on that terminal, unless you enable the feature that allows such storage or processing.
Please see our Cookie Policy on our websites for more information.
- For profiling: to better understand your interests and concerns, we may use your personal data to improve our website and services, customise your experience with us, and tailor our marketing activities to your needs and interests.
7. On what grounds do we process your personal data?
Brik processes your personal data, if applicable, on the following legitimate grounds:
- the execution or preparation of your agreement with Brik.
- your prior and informed consent, if necessary.
- compliance with our legal obligations.
- the legitimate interests of Brik or a third party, to the extent that these interests prevail over your interests and fundamental rights and freedoms, such as, where appropriate, for thorough investigation of the opposing party, to provide you with useful information, etc.
8. With whom do we share your personal data?
In principle, your data will be processed purely internally by Brik (and any associated companies or legal successors). If necessary, third-party software will be used for this purpose. Under no circumstances will your data be sold to third parties. Brik guarantees that any processing carried out by or on its behalf by a processor will be done in accordance with applicable regulations.
To offer and maintain our services optimally, we may sometimes rely on certain external parties. We limit the provision of your personal data to the following categories of recipients:
- Internal staff of Brik
- Our service providers such as:
- Internet environment (website hosting);
- IT infrastructure (Servers, CRM, mail service edm.);
- ISP and telephony providers;
- Platform management and data analysis including platform operation and digital strategy;
- Software developers and administrators;
As these external parties may come into contact with personal data, Brik always enters into the necessary processor agreements with such external parties in order to ensure adequate protection of personal data.
- Governments when required by law, such as in court proceedings or at the request of government agencies and law enforcement agencies, among others;
We understand that you do not want us to provide your personal data directly to third parties for their own marketing purposes without your consent.
Please note that we may also use and provide personal data about you that is not personally identifiable, i.e., data in aggregate form that no longer identifies you.
9. How will your personal data be stored and transmitted?
Brik is committed to ensuring that your personal data:
- are protected against accidental or intentional destruction / loss.
- properly used and
- not accessible to unauthorised persons.
All information you provide to us is stored on our secure servers. Your personal data will be stored in our databases or in the databases of our service providers.
10. How long do we retain your personal data?
We generally keep your personal data as long as necessary for the purposes described in section 6 of this Data Protection Policy, or in accordance with relevant applicable laws. We will retain your personal data for no longer than is strictly necessary to fulfil the purposes for which the data was collected.
Brik will therefore retain your data for as long as you use and are registered on the Brik platforms. You can delete your account on the Brik platforms at any time. In this case, your personal data will be kept for a maximum of one month, unless Brik Platforms is legally obliged to do so. After this period, all personal data will be deleted.
We keep your personal data, for example, if it is necessary to fulfil Brik's legal obligations.
In case of a dispute, we may keep your personal data until the dispute is fully resolved. Then we will delete or archive them according to the applicable law.
11. How do we ensure the security and integrity of your personal data?
We protect your data through technical and organisational security measures against accidental or unlawful destruction, accidental loss or alteration, unauthorised disclosure, or access, and against any other form of unlawful processing.
In addition, Brik continuously monitors the security of personal data held and processed within its organisation. As controller, Brik undertakes to take all necessary technical and organisational measures to prevent unauthorised persons from gaining access to the personal data entrusted to it. In doing so, it also seeks to prevent the loss, destruction, or unauthorised distribution of this data.
Brik uses systems that are regularly updated, allow encryption of the data, and contain firewalls in accordance with the applicable standard on this subject. Brik undertakes to inform you of any breach of this Privacy Policy, which may have a serious impact on you.
When we outsource data processing, we impose contractual obligations to protect your information.
12. How can you control and express preferences for the use of your personal data?
You may exercise a number of rights with respect to the processing of your personal data against Brik, to the extent you actually have these rights under applicable data protection laws, such as the GDPR.
To exercise the rights set forth in this section, you may at any time contact Brik's data protection correspondent (see section 13) who will handle your request.
Objection. You have the right to object at any time to the processing of your personal data on the grounds of a legitimate interest of Brik, for example if they are used for (direct) marketing purposes, for profiling to send you targeted advertising or to share your data with third parties or other entities within Brik.
Withdrawal. If you have previously consented to the processing of your personal data, you may withdraw such consent at any time. This does not affect the lawfulness of the processing based on the consent prior to its withdrawal.
Access. You may request access to or a copy of the personal data we hold about you. You may also request information about the purposes of processing, data categories, categories of recipients, retention periods, etc.
Portability. You may have the right to obtain a copy of all personal data we hold about you in a compatible format to enable you to exercise your right to data portability.
Restriction. You have the right to request a restriction on the processing of your personal data in the following cases:
- for a period of time to allow Brik to verify the accuracy of your personal data if you dispute the accuracy of your personal data;
- if the processing is unlawful and you wish to limit the use of your personal data rather than having them erased;
- if you want Brik to retain your personal data because you need it for your defence in the context of legal claims;
- if you have opposed the processing but Brik needs to verify whether it has legitimate grounds for this processing which may take precedence over your own rights.
Rectification. You may also have the right to correct inaccurate personal data and to complete incomplete personal data.
Deletion. You may have the right to request the deletion of your personal data in the following cases:
- if your personal data are no longer necessary for the purpose of data processing.
- if you have withdrawn your consent and there is no legal ground for the processing.
- if you have opposed the processing of the data and there is no prevailing lawful ground for Brik.
- if the personal data has been processed unlawfully.
- if the personal data must be deleted to comply with a legal obligation applicable to Brik.
In case of erasure, we will take responsible steps to inform other entities of Brik that may be involved in data processing of such erasure.
Complaint. You also have the right to lodge a complaint with the competent supervisory authority if you are concerned about the terms and conditions of Brik's processing of your personal data (the Data Protection Authority, Press Street 35, 1000 Brussels, contact@apd-gba.be, www.gegevensbeschermingsautoriteit.be).
13. Who should you contact if you have questions or concerns about the processing of your personal data?
Brik has a data processing officer (DPO). You can reach this DPO at privacy@brik.be.
Consequently, any questions, complaints or comments regarding this Data Protection Policy or our data processing practices should be sent by email to the email address listed above.
14. What happens when we change this Data Protection Policy?
Our Data Protection Policy may change from time to time to reflect changes in the way we process your personal data. We encourage you to check our websites from time to time to have the latest version of our Data Protection Policy. We will notify you of significant changes as required by law.
You can check the date of the last revision of this Data Protection Policy at the beginning of this document.