PRIVACY POLICY

Updated September 30, 2020

1. Parties and Purpose

LELLAL SPRL (hereinafter"LELLAL" or the"Data Controller")
Rue Charles Jaumotte 29, 1300, Wavre
BCE / VAT: BE0887.577.912
Mail: info@lellal.com
Telephone: +32 (0) 473 315 148

LELLAL establishes this Privacy Policy whose purpose is to inform in full transparency the Users of the website hosted at the following address: https://www.lellal.com, (hereinafter the"Site"), of the manner in which personal data is collected and processed by LELLAL.

. The term"User" refers to any user, either a natural or legal person, who visits or interacts in any way with the Site.

As such, LELLAL determines all the technical, legal and organizational means and purposes of the processing of Users' personal data. To this end, LELLAL undertakes to take all necessary measures to ensure the processing of personal data in accordance with the law of July 30, 2018 on the protection of individuals with regard to the processing of personal data (hereinafter, "the Law") and the European Regulation of April 26, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter the"Regulation").

LELLAL is free to choose any natural or legal person who processes users' personal data at its request and on its behalf (hereinafter the"Subcontractor"). Where appropriate, LELLAL undertakes to select a Subcontractor offering sufficient guarantees as to the technical and organizational security measures for the processing of personal data, in accordance with the Law and the Regulation.

2. Processing of personal data

The use of the Site by Users may result in the communication of personal data. The processing of such data by LELLAL, in its capacity as Data Controller, or by service providers acting on behalf of and for LELLAL, will be in accordance with the Law and Regulations.

Personal data will be processed by LELLAL, in accordance with the purposes set out below, via:

- The creation of a customer account; the newsletter registration form; the use of cookies.

3. Purpose of the processing of personal data

In accordance with article 13 of the Regulations, the purposes of the processing of personal data are communicated to the User and are as follows:

- to ensure the execution of the services offered and agreed upon on the Site;
- to ensure the control of the execution of the services offered;
- to carry out marketing activities and promotional information after prior consent of the User and until revocation of such consent, for example the sending of promotions on LELLAL's products and services;
- to produce statistics in order to improve the Website, the services offered and the internal organization of operation;
- to improve the quality of the Website and the products and/or services offered by LELLAL;
- to allow a better identification of the User's interests.

4. Personal data that may be processed

The User consents, when visiting and using the Site, that LELLAL collects and processes, according to the terms and principles described in this Privacy Policy, the following personal data:

- The information of the Users that they give for contractual purposes and to allow the proper execution of reciprocal obligations, namely the name, first name, address, IBAN number and banking data, ... ; and more generally any information voluntarily given by the User;
- The information of the Users by filling in forms or by contacting by telephone, e-mail address or other means, for example the name, address, e-mail address and telephone number of the Users;
- With regard to each of the visits of the Users to the Site, the information automatically collected is :
a) IP address, browser type and model, time zone, operating system
b) all information concerning the pages that the User has consulted on the Site, including the URL, browsing time, ...

5. Consent

By accessing and using the Site, the User declares that he or she is aware of and agrees freely, specifically, knowingly and unequivocally to the processing of personal data concerning him or her. This agreement relates to the content of this Privacy Policy.

Consent is given by the positive act by which the User has ticked the box proposing the Privacy Policy in a hyperlink. This consent is an indispensable condition to carry out certain operations on the Site or to allow the User to enter into a contractual relationship with LELLAL. Any contract between LELLAL and a User concerning the services and goods offered on the Site is subject to the User's acceptance of the Privacy Policy.

The User consents that the Data Controller processes and collects, in accordance with the terms and principles included in this Privacy Policy, his/her personal data that he/she communicates on the Site or during the services offered by LELLAL, for the purposes indicated above.

The User has the right to withdraw his/her consent at any time. Withdrawal of consent does not compromise the lawfulness of the processing based on the consent previously given.

6. Storage period of Users' personal data

In accordance with Article 13 §2 of the Regulation and the Law, the Data Controller shall only keep personal data for the time reasonably necessary to enable the fulfilment of the purposes for which they are processed.

Your personal data shall remain stored for as long as necessary for the purposes of this Privacy Policy, in particular for the fulfilment of our contractual and legal obligations. Where appropriate, we also store your personal data for other purposes, if and as long as the law allows us to store it for specific purposes, including the defence of a right. If you close your customer account, we will delete all stored data about you. If complete deletion of your data is not possible or not necessary for legal reasons, the data concerned will be blocked for further processing. The deletion of data can be waived in the cases provided for by law if the data is anonymous or pseudonymous and if the deletion would make processing for scientific research or statistical purposes impossible or seriously hampers such processing.

7. Recipients of data and disclosure to third parties

Personal data may be transmitted to LELLAL's employees, collaborators, subcontractors or suppliers who offer adequate data security guarantees, and who collaborate with LELLAL in the marketing of products or the provision of services. They act under the direct authority of LELLAL, and are responsible, among other things, for collecting, processing or subcontracting such data.

In all cases, the recipients of the data and those to whom the data has been disclosed will comply with the contents of this Privacy Policy. LELLAL assures that they will process these data only for the purposes intended, in a discreet and secure manner.

In the event that the data is disclosed to third parties for direct marketing or prospecting purposes, the User will be informed beforehand so that he can express his consent to the use of this personal data.

8. Data Protection Officer (DPO)

The following person is appointed Data Protection Officer (hereafter"DPO"): Nicolas HENRARD

The role of the DPO is to ensure the proper implementation of national and supranational provisions regarding the collection and processing of personal data.

The DPO can be contacted as follows: info@lellal.com

9. Users' Rights

At any time, the User may exercise his rights by sending a message by e-mail to the following address: info@lellal.com, or a letter by post, enclosing a copy of his identity card to the following address: Rue Charles Jaumotte 29, 1300, Wavre

a. Right of access

In accordance with article 15 of the Regulations, LELLAL guarantees the User's right of access to his/her personal data. The User has the right to obtain access to the said personal data as well as the following information:

- the purposes of the processing;
- the categories of personal data concerned;
- the recipients or categories of recipients to whom the personal data has been or will be communicated, in particular recipients who are established in third countries or international organizations;
- where possible, the intended period of retention of the personal data or, where this is not possible, the criteria used to determine this period;
- the existence of automated decision making, including profiling, as referred to in Article 22(1) and (4) of the Regulation, and, at least in such cases, relevant information concerning the underlying logic and the importance and expected consequences of the processing for the data subject

The Controller may require the payment of reasonable charges based on administrative costs for any additional copies requested by the User.

Where the User submits this request electronically (e.g. via e-mail address), the information is provided in a commonly used electronic form, unless the User requests otherwise.

The User will be provided with a copy of his/her data no later than one month after receipt of the request.

b. Right of rectification

LELLAL guarantees the right of rectification and deletion of personal data to the user.

In accordance with Article 16 of the Regulation, incorrect, inaccurate or irrelevant data may be corrected or deleted at any time. The User shall first make the necessary changes himself/herself from his/her user/other account, unless such changes cannot be made independently, in which case the request can be made to LELLAL.

In accordance with Article 19 of the Regulation, the Data Controller shall notify each recipient to whom the personal data has been communicated of any rectification of the personal data, unless such communication proves impossible or requires disproportionate efforts. The Controller shall provide the data subject with information about these recipients if the data subject so requests.

c. Right to erasure

The User has the right to obtain the erasure of his/her personal data as soon as possible in the cases listed in Article 17 of the Regulation.

Where the Data Controller has made the personal data public and is required to erase them pursuant to the previous paragraph, the Data Controller, taking into account the available technologies and the costs of implementation, shall take reasonable measures, including technical measures, to inform the other data controllers processing such personal data that the data subject has requested the erasure by such data controllers of any link to such personal data, or any copy or reproduction thereof.

The two preceding paragraphs shall not apply insofar as such processing is necessary:

- for the exercise of the right to freedom of expression and information;
- to comply with a legal obligation which requires processing in accordance with Union law or the law of the Member State to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- for the establishment, exercise or defence of legal claims.

In accordance with Article 19 of the Regulation, the Controller shall notify each recipient to whom the personal data have been communicated of any erasure of personal data or any restriction on the processing carried out, unless such communication proves impossible or involves a disproportionate effort. The data controller shall provide the data subject with information about these recipients if the data subject so requests.

d. Right to limit processing

The User has the right to obtain the limitation of the processing of his/her personal data in the cases listed in article 19 of the Regulation.

In accordance with article 19 of the Regulation, the Data Controller shall notify each recipient to whom the personal data has been communicated of any limitation of the processing carried out, unless such communication proves impossible or requires disproportionate effort. The Controller shall provide the data subject with information about such recipients if the latter so requests.

e. Right of data portability

In accordance with article 20 of the Regulation, Users have the right to receive from LELLAL personal data concerning them in a structured, commonly used and machine-readable format. Users have the right to transmit such data to another data controller without LELLAL's interference in the cases provided for in the Regulation.

When Users exercise their right to data portability pursuant to the previous paragraph, they have the right to have personal data transmitted directly from one data controller to another, where technically possible.

The exercise of the right to data portability is without prejudice to the right to erasure. This right does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The right of data portability is without prejudice to the rights and freedoms of third parties.

f. Right of opposition and automated individual decision making

The User has the right at any time to object to the processing of his personal data due to his particular situation, including the automation of data by LELLAL. In accordance with Article 21 of the Regulations, LELLAL will no longer process personal data, unless there are legitimate and compelling reasons for the processing that prevail over the interests and rights and freedoms of the User, or for the establishment, exercise or defense of legal rights

.Where personal data is processed for the purposes of canvassing, the User has the right to object at any time to the processing of personal data concerning him/her for such purposes, including profiling insofar as it is related to such canvassing.

Where the data subject objects to processing for canvassing purposes, personal data is no longer processed for such purposes.

g. Right of complaint

The User has the right to file a complaint regarding the processing of his personal data by LELLAL to the Data Protection Authority, competent for the Belgian territory. More information can be found on the following website: protectiondonnees.be

The submission of a complaint can be made at the following addresses:

Data Protection Authority
Rue de la Presse 35, 1000 Brussels
Phone + 32 2 274 48 00
Fax + 32 2 274 48 35
E-mail: contact@apd-gba.be

The User can also submit a complaint to the Court of First Instance of his domicile.

10. Cookies

The Site uses cookies to distinguish the Users of the Site. This helps to provide Users with a better browsing experience and an improvement of the Site and its content. The objectives and modalities of cookies are contained in this article.

a. General principles

A "Cookie" is a file deposited temporarily or permanently on the User's hard disk when consulting the Website, with a view to later connection. Thanks to cookies, the server recognizes the User's computer.

Cookies can also be installed by third parties with whom LELLAL collaborates.

Some of the cookies used by LELLAL are necessary for the proper functioning of the Website, others allow to improve the User's experience.

The User can personalize or disable cookies by setting up his browser.

By using the Website, the User expressly agrees with the management of cookies as described in this article.

b. Type of cookies and purposes

Different types of cookies are used by LELLAL on the Website:

- Technical cookies: they are necessary for the operation of the Website, allow the communication of the data entered and are intended to facilitate the navigation of the User;
- Cookies for statistical and audience measurement: these cookies allow the recognition of the User and are used to count the number of Users of the Website over a certain period of time. Since they also indicate browsing behaviour, they are an effective means of improving the User's browsing by displaying proposals and offers that may be of interest to him/her. They also allow LELLAL to identify possible bugs on the Website and to correct them.
- Functional cookies: these cookies facilitate the use of the Website by retaining certain choices introduced (for example, the user name or language);
- Tracking cookies: LELLAL uses tracking cookies via Google Analytics, to measure the interaction of Users with the content of the Website and produce anonymous statistics. These statistics allow LELLAL to improve the Website. Google supports the explanation of these cookies at the following address: google.com/privacy
.

c. Time limit for storing cookies

Cookies are stored for the time necessary to achieve the intended purpose. The cookies that may be stored on the User's hard drive and their retention period are as follows:

- Temporary cookies (session cookies) are stored in your browser or app. They are automatically deleted as soon as you close your browser or app.

-Permanent cookies remain on your computer or mobile device, even when you close the browser or app. They enable us to recognise you on subsequent visits and remain on your device until they expire, until a new version of the cookie is installed or until you manually delete them.

d. Management of cookies

If the User does not want the Website to place cookies on his/her hard disk, it is easy for him/her to manage or delete them by modifying the parameters of his/her browser. Browser programming also allows the User to receive a notice or notification as soon as a Website uses cookies and thus decide whether to accept this, or refuse it.

If the User deactivates certain cookies, he accepts that the Website may not function optimally. Certain parts of the Website may not be usable, or may only be partially usable.

If the User wishes to manage and/or delete certain cookies, they can do so by using the following link(s):

For Users with the following browsers:
- Internet Explorer
- Microsoft Edge
- Chrome
- Firefox
- Safari

If the User does not want Google Analytics cookies to be used, they are invited to set their browser to do so, on the following website: tools.goolge.com

11. Limitation of liability of the Data Controller

The Website may contain links to other websites owned by third parties not related to LELLAL. The content of these sites and their compliance with the Law and Regulations is not the responsibility of LELLAL.

The holder of parental authority must give his or her express consent for a minor under 16 years of age to disclose personal information or data on the website. LELLAL strongly advises persons exercising parental authority over minors to promote responsible and secure use of the Internet. The Data Controller cannot be held responsible for collecting and processing information and personal data from minors under 16 years of age whose consent is not effectively covered by that of their legal parents or for incorrect data - particularly concerning age - entered by minors. Under no circumstances will personal data be processed by the Data Controller if the User specifies that he/she is under 16 years of age.

LELLAL is not responsible for the loss, corruption or theft of personal data caused in particular by the presence of viruses or following computer attacks.

12. Security

The Data Controller implements organisational and technical measures to guarantee an appropriate level of security for the processing and collection of data. These security measures depend on the costs of implementation with regard to the nature, context and purposes of the processing of personal data.

The Data Controller uses standard encryption technologies within the IT sector when transferring or collecting data on the Site.

13. Changes to the Privacy Policy

LELLAL reserves the right to modify this Privacy Policy in order to comply with legal obligations. The user is therefore invited to regularly consult the Privacy Policy in order to be aware of the modifications and adaptations. Any such modification will be posted on the Site or sent by e-mail for enforceability purposes.

14. Applicable law and jurisdiction

This Privacy Policy is governed exclusively by Belgian law. Any dispute will be brought before the courts of the judicial district of LELLAL's registered office.

15. Contact

For any questions or complaints relating to this Privacy Policy, the User may contact the Data Controller via the following address: info@lellal.com.