Privacy

Version: 25/05/2018

Your satisfaction is at the heart of our concerns, in all circumstances. This is why we process your customer data. This enables us to manage your credit as effectively as possible and to offer you product proposals and information suited to your needs. In addition, we place the utmost importance on respecting your privacy. This is a commitment.

This is why we have established this Privacy Policy.

We want to inform you clearly about how we protect your privacy and take your preferences into account. In addition, your data is never sold to third parties. We also carry out checks to ensure compliance with this policy.

Please be assured that we guarantee the security of your customer data.

1. Who is responsible for processing your data?

Crefilux, whose registered office is located at route des Trois Cantons 9 – L-8399 Windhof, hereinafter referred to as “Crefilux”.

This policy is intended to inform you about the processing of your data, for which Crefilux is responsible.

2. What does the processing of personal data involve?

Personal data includes any information relating to an identified or identifiable natural person. This may include a name, an identification number, location data, an online identifier or any other data relating to a person.

The processing of personal data includes any possible operation performed on such data, such as its collection, recording, use or storage.

Crefilux processes your personal data for various purposes, see point 4, on the basis of several legal grounds, and ensures that only the necessary data is processed.

You have no legal obligation to provide us with your personal data. However, if you refuse to do so, this may make it impossible for our financial partners to enter into or continue a relationship with you.

3. What personal data is processed?

• identification data such as your surname and first name, address, date and place of birth, email address, etc.;
• socio-demographic data such as your family situation, marital status, etc.;
• data relating to your products and assets;
• financial and transactional data relating to the payment of your credit;
• data relating to your behaviour and browsing habits on Crefilux websites: viewing information, simulations, applications, reactions to our commercial offers, such as whether or not you click on an online advertisement, or the originating website, for example the website on which you clicked on a Crefilux advertisement, etc.;
• data relating to our satisfaction surveys;
• geolocation data, meaning the precise location where you are;
• data collected via our offices;
• data obtained via third parties, for example from our financial partners, the National Register, the Central Individual Credit Register of the National Bank, or data from external companies;
• data collected via cookies. Cookies are essential to the proper functioning of our websites. They serve various purposes: remembering your preferences, collecting statistical data, adapting website content and/or advertising to your needs. More information: https://www.crefilux.lu/fr/mentions-legales

Crefilux does not process sensitive data such as health data, data relating to racial or ethnic origin, political, philosophical or religious beliefs, trade union membership or sex life.

4. When do we collect your data?

We collect your data when you come into contact with Crefilux, for example when you:

• become a customer;
• contact us, for example as a potential customer;
• take part in a survey;
• use one of our products or services;
• connect to our websites.

We also process your data for the following purposes:

• managing your customer file;
• granting and managing credit and services;
• continuously improving our services and processes;
• ensuring the safety of people and property;
• carrying out satisfaction surveys relating to our products and services;
• carrying out studies, models and statistics;
• administration and risk management, for example the history of the customer relationship;
• preventing money laundering, fraud and terrorist financing;
• fulfilling our legal obligations;
• responding to any legitimate request from judicial or supervisory authorities to access data;
• pre-filling fields;
• pre-filling data already known about existing customers when they apply for additional products or services;
• direct marketing, in order to offer you our products and services and to avoid offering you products or services that are not relevant to you.

5. On what legal grounds is the processing of your data based?

Privacy protection law applies only to individuals, not to companies.

Crefilux processes your personal data only in one of the following cases:

• we are performing a contract or pre-contractual measures; or
• at our request, you have given us your consent; or
• we must comply with a legal or regulatory obligation; or
• on the legal basis of “legitimate interest”, we make every effort to maintain a balance between Crefilux’s interests and your interests, including the protection of your privacy.

6. To whom may your data be transferred?

Your data is processed confidentially. Crefilux will never sell your personal data.

6.1 Transfer of your data to our financial partners

The transfer of your data to our financial partners is limited to the negotiation of your credit. The same applies with regard to your notary.

Your personal data is also exchanged, for example, for the management of the guarantees you have granted us, such as the pledge of insurance, guarantee insurance, etc.

Our financial partners process your personal data as data controllers.

What data is processed?

• data collected via Crefilux;
• data obtained via third parties: the National Register, the Central Individual Credit Register of the National Bank, Atradius, their credit insurer or the group to which they belong, see 6.5.

Purpose of the processing, in particular:

• mainly for granting and managing your credit;
• for commercial purposes;
• to fulfil their legal obligations;
• for administration and risk management.

During the granting procedure, our financial partners transfer this data to Crefilux and, where required by law, to the authorities, as well as to Atradius Crédito y Caución S.A. de Seguros y Reaseguros, ICP division (“Atradius ICP”), avenue Prince de Liège 78, 5100 Namur, for the exercise of its regulated credit insurance activity: dataprotection.icp@atradius.com.

Our financial partners may carry out automated processing of your data in order to grant or refuse you credit on the basis of an algorithm.

The retention period is, in principle, 10 years from the date on which the credit is refused or from the end of your credit agreement if it has been accepted.

You have various rights regarding this data: right of access, right to rectification and right to data portability.

For more details, you can consult their Privacy Policy, available on their website, as well as from Crefilux on its website and in its offices.

Supervisory authority: the Data Protection Authority, rue de la Presse 35, 1000 Brussels.

6.2 Access by Crefilux and its employees

Crefilux and its employees may access your personal data only if this is necessary for operational purposes and for managing your credit, but also for risk or fraud management, in the performance of their duties.

6.3 Operational transfers to selected organisations

For operational reasons, it is sometimes necessary for us to call on carefully selected organisations, such as our real estate experts or our lawyers in the event of litigation.

In the event of the sale of outstanding balance insurance, your data will also be transferred to our insurance partners, who are authorised to conclude and manage your insurance policy.

In this context, the persons authorised to use your data may do so only within the strict limits of their contractual assignment.

6.4 Transfer to authorities and the National Bank of Belgium

In order to fulfil our legal obligations, we share certain personal data with judicial authorities and the National Bank of Belgium.

For example, this may include data used to assess credit risks, notifications in the ENR file, as well as data relating to consumer credit and mortgage credit agreements.

6.5 Who are our financial partners acting as data controllers?

ALPHA CREDIT, whose registered office is located at rue Ravenstein 60 Box 15 – 1000 Brussels, and which is part of the BNP Paribas Group:
https://www.alphacredit.be/sites/default/files/privacy-notice-fr.pdf

ELANTIS, whose registered office is located at rue des Clarisses 38 – 4000 Liège, and which is part of the Belfius Group, Belfius Bank, Belfius Insurance and Crefius:
https://www.elantis.be/fr/vie-privee/

RECORD BANK, whose registered office is located at avenue Matisse 16 – 1140 Evere, and which is part of the ING Group.

6.6 Who are our insurance partners acting as data controllers?

AME Life Lux, whose registered office is located at rue du Puits Romain 41 – L-8070 Bertrange.

CARDIF ASSURANCES, whose registered office is located at chaussée de Mons 1424 – 1070 Brussels, and which is part of the BNP Paribas Group:
https://corporate.cardifluxvie.lu/fr/mentions-legales

7. What are your rights and how can you exercise them?

7.1 General right to object to direct marketing

You may object at any time to the use of the data we collect, store and process for direct marketing purposes, without having to provide a reason.

You can do so by post to the sales department or by email to infos@crefilux.lu, with a copy of the front of your identity card.

You will then no longer receive any commercial offers.

7.2 Right to object to the use of your online behaviour for direct marketing

Do you not want your behaviour on the Crefilux website to be used for direct marketing purposes? You may object without having to provide a reason:

• by post to the sales department; or
• by email to infos@crefilux.lu, with a copy of the front of your identity card.

7.3 Right of access, rectification and data portability

You have a permanent right of access to your personal data. In this context, you may request the following information:

• the categories of personal data in our possession;
• the purposes of the processing;
• the recipients or categories of recipients.

If your personal data is inaccurate, irrelevant or incomplete, we will amend it, complete it and, in certain specific cases, delete it to the extent permitted by law.

You may also request that some of this data be sent directly to you or to a third party.

Please specify your request by post to the sales department or by email to infos@crefilux.lu, with a copy of the front of your identity card.

8. How long do we retain your data?

This varies depending on the type of data and the applicable regulations, for example anti-money laundering regulations. Data is never retained for longer than necessary for the processing purpose for which it was collected.

Retention periods are determined on a case-by-case basis. However, in general, your data will be kept for 10 years after the end of our contractual relationship or after your credit application. For mortgage credit, certain data will be kept for 30 years after the signing of the notarial deed.

9. What happens if the Privacy Policy is amended?

We will inform you of any amendment.

You can also consult the Privacy Policy at any time on the Crefilux website.

Any questions? Our Data Protection Officer, DPO, is available to assist you

Our DPO can be contacted by writing to the following address:

Boulevard Tirou 63 – 6000 Charleroi.

Do you wish to make a complaint?

If we have been unable to provide you with satisfaction, and in the event of a dispute relating to the processing of personal data, you have the option of submitting a complaint to the Data Protection Authority, rue de la Presse 35, 1000 Brussels.