1.    Introduction and definitions

We understand the importance of protecting personal data. This is why we have drafted this prior information document in accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (“GDPR“), as well as the Belgian law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data (“Privacy Law“).

WE is concerned about respecting the confidentiality and protection of the personal data it is required to process. As such, WE undertakes to act in strict compliance with the applicable laws in this area and in particular with the GDPR and the Privacy Law.

As part of its activity, WE processes personal data concerning different categories of persons as defined below.

For a proper understanding of this Policy, it is specified that:

• Clients are the persons who request and/or benefit from the services, products, expertise or intervention of WE, whether in equity by WE or in delegated mission in the name and on behalf of the Walloon Region;
• Project leaders are the people who present a project for evaluation to a committee/jury in which at least one representative of WE participates;
• Candidates are people who apply for a job offer from WE or apply spontaneously;
• Suppliers are persons who provide goods or services to WE;
• Partners are the people with whom WE collaborates in the context of its missions;
• Operators are partners that WE uses to offer accompaniment or support services to beneficiaries;
• The beneficiaries are the people who benefit from WE’s expertise and intervention, through the operators;
• Internet users are the people who consult the WE website;
• The users of the platforms are the people going to and using the various online platforms managed, where applicable, by WE outside the banking partner;
• Contacts/prospects are people who may be interested in WE’s services or information related to WE’s public interest missions whose contact data has been collected during meetings or through online databases/sources.
• Physical visitors are the people who visit WE’s buildings.

With this Data Protection Policy, we would like to inform you about how we collect, use and protect your personal data.

2.    Customer data

2.1.          Management of your intervention request and the pre-contractual relationship

Purpose

WE’s mission is to support companies by intervening in the form of capital, loans, advances or guarantees, or providing services either on behalf of the Walloon Government or in equity.

The data you provide to us and the data we receive from third parties about you will be processed at your request in order to carry out pre-contractual measures and to communicate with you about this. Prior to the intervention, the data provided also allows us to be able to identify you in accordance with the legal requirements (KYC, anti-fraud, corruption, detection and prevention of money laundering and terrorist financing).

Legal basis

The processing of this data is necessary for the performance of the contract concluded with WE or for the implementation of pre-contractual measures (Article 6.1, b) GDPR) or is necessary for the performance of our public interest tasks (Article 6.1, e) of the GDPR).

Categories of data processed

For this purpose, we may process your identification data (e.g. surname, first name, photos, etc.) but also your contact data (e.g. home or residence, telephone number, email address, etc.), your professional data (e.g. position) as well as data relating to the company, its managers (e.g. shareholders, UBOs, directors and day-to-day management delegates), its third-party investors (e.g.  description of the activity, history of the company, financial situation, strategy, etc.) and the data necessary for the proper management of your file (e.g. articles of association, operating permit and environmental permit, organizational chart of the company and the group to which it belongs, composition of the board of directors, etc.).

In the event that you have not provided all the personal data necessary for the purpose set out above, we collect and use the information available on official public and non-public websites such as the website of the Belgian Official Gazette, that of the Crossroads Bank for Enterprises, Belfirst, and others (in particular sites gathering commercial and economic information),  in order to complete and execute the pre-contractual measures and documents useful for the management of a request for intervention file opened within our company in general.

Duration

Your personal data are retained for 10 years after the end of any contractual relationship or after the moment of refusal to intervene. This period could be longer due to a legal obligation or a possible litigation or an ongoing audit.

Recipients of the data

These data are processed internally by the relevant departments. In addition, it could also be transmitted:

• to our external legal counsel or a bailiff in the event of debt recovery by legal means;
• to the competent authorities (Belgian, Walloon and European) in the context of tax, social, audit, reporting, compliance and public interest obligations;
• company auditors and statutory auditors;
• as well as to our IT service provider.

2.2.          Management of the contractual relationship

Purpose

The data is also used to perform our contractual relationship throughout its term, to recover our receivables, and to notify a change in the contract.

Legal basis

The processing of this data is necessary for the performance of the contract concluded with WE (Article 6.1 b) GDPR) or is necessary for the performance of our public interest tasks (Article 6.1, e) of the GDPR).

Categories of data processed

This includes identification data (e.g. surname, first name), contact data (e.g. e-mail address and telephone number) and company identification data. Information related to the professional lives of the persons concerned (e.g. title/profession, skills and organisation), financial data (e.g. financial situation, bank details, etc.), and data necessary for the proper management of your file (e.g. articles of association, operating permit and environmental permit, organisation chart of the company and the group to which it belongs, composition of the board of directors, minutes of the Board of Directors and the General Assembly for the past year, etc.) are also being processed.

Duration

Your personal data are retained for 10 years after the end of our contractual relationship. This period could be longer due to a legal obligation or a possible litigation or an ongoing audit.

Recipients of the data

The data is processed internally by the competent departments. In addition, it could also be transmitted:

• to our external legal counsel or a bailiff in the event of debt recovery by legal means;
• to the competent authorities and administrations (Belgian, Walloon and European) in the context of tax, social, reporting, audit, compliance and the performance of public interest missions;
• company auditors and statutory auditors or, where applicable, if relevant to a partner;
• as well as to our IT service provider.

2.3.          Direct marketing

Purpose

The processing of your data is carried out for the promotion of our services and events.

Legal basis

Depending on the case, we process your personal data for the purposes of our public interest tasks (Article 6.1(e) of the GDPR) or on the basis of your explicit consent (Article 6(1)(a) of the GDPR).

Categories of data processed

This includes identification data (e.g. surname, first name), contact data (e.g. e-mail address and telephone number) and company identification data. Information related to the professional life of the persons concerned (title/profession, skills and organisation) is also processed.

Duration

These data are retained, as the case may be, for up to three years after the last contact or until consent is withdrawn.

Recipients of the data

These data are processed internally, in particular by the persons responsible for communications, and, where applicable, by an external e-mail service provider.

2.4.          Accounting, tax, compliance, auditing and reporting obligations

Purpose

The processing of your data is carried out for the purposes of compliance with various legal and regulatory obligations in the context of financing, but also for the fight against fraud, bookkeeping, statistics, auditing, ESG analysis and reporting.

The data provided also allows us to be able to identify you in accordance with legal requirements (KYC, anti-fraud, corruption, detection and prevention of money laundering and terrorist financing).

Legal basis

Depending on the case, we process your personal data for the purpose of complying with a legal obligation (Article 6.1, c) of the GDPR) or for the purpose of carrying out our tasks in the public interest (Article 6.1, e) of the GDPR).

Categories of data processed

This includes identification data (e.g. surname, first name), contact data (e.g. e-mail address and telephone number) and company identification data. Information related to the professional life of the persons concerned (title/profession, skills and organisation), your professional data (e.g. function) as well as data relating to the company, its managers (e.g. shareholders, UBOs, directors and day-to-day management delegates) and its third-party investors (e.g. description of the activity, history of the company, financial situation, strategy, etc.) are also processed,  or any other data that any legal or regulatory provision may require.

Duration

We store these data for 10 years after the end of our contractual relationship. This period could be longer due to a legal or regulatory obligation or a possible ongoing litigation or audit.

Recipients of the data

The data are processed internally by the competent departments. In addition, it could also be transmitted:

• to our external legal counsel;
• to partners in the context of the performance of tasks in the public interest, in particular the transfer of data, where appropriate anonymised, for statistical purposes;
• to the competent authorities and administrations (Belgian, Walloon and European) in the context of tax, social, reporting, audit, compliance and the performance of our public interest obligations;
• company auditors and statutory auditors or any other external operator;
• as well as to our IT service provider.

2.5.          Promotion of our activities, services and events

Purpose

The processing of your image (photo or video) and your testimony (e.g. your company’s story) is carried out for the promotion of our activities, services and events, or as part of specific projects.

Legal basis

We process your personal data on the basis of your explicit consent (Article 6.1(a) of the GDPR).

Categories of data processed

This includes photos or videos as well as any personal data disclosed in your testimonial.

Duration

These data are retained until the withdrawal of consent or, when the image is used in the context of a project, for the duration of this project and then until the withdrawal of consent.

Recipients of the data

These data are used internally, in particular by the people responsible for communications, and where applicable, by an external service provider in charge of capturing or editing videos or photos. These data may also be communicated to the outside world, in particular on social networks.

3.    Project leader data

Purpose

Your data are processed to share our expertise on a project/file as part of the exercise of our support mission.

Legal basis

We process your personal data for the purpose of complying with a legal obligation (Article 6.1(c) of the GDPR) or for the purposes of our public interest tasks (Article 6(1)(e) of the GDPR).

Categories of data processed

This includes identification data (e.g. surname, first name), contact data (e.g. e-mail address and telephone number), your professional data (e.g. position) and, where applicable, data relating to the company, its managers and its third-party investors (e.g. description of the activity, history of the company, financial situation, strategy, etc.).

Duration

In principle, we retain these data for 10 years. This duration could be longer due to a legal or regulatory obligation or a possible ongoing litigation or audit or shorter depending on the mission concerned.

Recipients of the data

The data are processed internally by the competent departments. In addition, it could also be transmitted:

• to partners in the context of the performance of tasks in the public interest, in particular the transfer of data, where appropriate anonymised, for statistical purposes;
• to the competent authorities and administrations (Belgian, Walloon and European) in the context of legal, reporting, audit, compliance and the performance of our public interest missions;
• to external service providers such as our IT service provider.

4.    Candidates’ data

Purpose

If you send us your application, your data will be processed at your request in order to assess the possibility of a contractual relationship.

Legal basis

The processing of this data is necessary for a potential future contractual relationship (Article 6.1, b) GDPR).

Categories of data processed

This includes identification data (e.g. surname, first name), contact data (e.g. e-mail address and telephone number), the composition of your household, any information found on your curriculum vitae and/or cover letter (professional and academic background, interests, etc.) as well as any information that will be communicated to us in the recruitment process.

Duration

In principle, your data will be deleted within six months of the end of the recruitment process, unless the recruitment results in the conclusion of an employment contract.

However, it is possible that your data will be stored for a longer period of time when WE uses external service providers as part of the recruitment process. In this context, you will always have the option to request deletion or delete your data at any time.

Recipients of the data

The data are used internally by WE, in particular by the human resources department and the manager(s) of the department concerned by the application. It may also be used by external persons acting as service providers, such as recruitment agencies or our IT service provider.

5.    Supplier data

5.1.          Management of the pre-contractual relationship

Purpose

The data is used to manage pre-contractual relations with WE’s suppliers and external service providers, including negotiation procedures or any legally required procedures.

The data provided also allows us to be able to identify you in accordance with legal requirements (KYC, anti-fraud, corruption, detection and prevention of money laundering and terrorist financing).

Legal basis

The processing of this data is necessary for the implementation of pre-contractual measures (Article 6.1(b) of the GDPR) or is necessary for the performance of our public interest tasks (Article 6.1, e) of the GDPR).

Categories of data processed

This includes identification data (e.g. surname, first name), contact data (e.g. e-mail address and telephone number), data relating to the company, its managers (e.g. shareholders, UBOs, directors and day-to-day management delegates) and its third-party investors (e.g. description of the activity, history of the company, financial situation, strategy, etc.). In addition, economic and financial data, such as bank data (e.g. account number, account holder, BIC) are collected.

Duration

We store your data for 10 years after the decision not to award or the end of a possible business relationship. This period could be longer due to a legal or regulatory obligation or a possible ongoing litigation or audit.

Recipients of the data

These data are processed internally. In addition, it could also be transmitted:

• to our external legal counsel or a bailiff in the event of debt recovery by legal means;
• to the competent authorities (Belgian, Walloon and European) in the context of tax, social, reporting, audit, compliance and the performance of our public interest missions;
• to our IT service provider.

5.2.          Management of the contractual relationship

Purpose

The data are used to establish and manage contracts with WE’s external suppliers and service providers. It is also processed in order to ensure the provision of services in accordance with expectations and the terms of the contract, as well as to ensure compliance with financial and logistical commitments.

The data provided also allows us to be able to identify you in accordance with legal requirements (KYC, anti-fraud, corruption, detection and prevention of money laundering and terrorist financing).

Legal basis

The processing of this data is necessary for the performance of the contract concluded with WE (Article 6.1 b) GDPR) or is necessary for the performance of our public interest tasks (Article 6.1, e) of the GDPR).

Categories of data processed

This includes identification data (e.g. surname, first name), contact data (e.g. e-mail address and telephone number) and company identification data. Information related to the professional life of the persons concerned (e.g. title/profession, skills and organisation) is also processed. In addition, economic and financial data, such as bank data (e.g. account number, account holder, BIC), data relating to the company, its managers (e.g. shareholders, UBOs, directors and day-to-day management delegates) and its third-party investors (e.g. description of the activity, history of the company, financial situation, strategy, etc.) and data relating to the monitoring of services are collected.

Duration

In principle, the data you entrust to us are retained for 10 years after the end of our contractual relationship. This period could be longer due to a legal or regulatory obligation, or a possible ongoing litigation or audit.

Recipients of the data

The data are processed internally by the competent departments. In addition, it could also be transmitted:

• to our external legal counsel or a bailiff in the event of debt recovery by legal means;
• to the competent authorities (Belgian, Walloon and European) in the context of legal or contractual obligations relating to tax, social, reporting, audit, compliance and the performance of missions in the public interest;
• to our IT service provider.

5.3.          Legal, accounting, tax, compliance, auditing and reporting obligations

Purpose

The processing of your data is mainly carried out for the purposes of compliance with various legal and regulatory obligations, in particular in terms of taxation and accounting, reporting, auditing and compliance (KYC, anti-fraud, corruption, detection and prevention of money laundering and terrorist financing).

Legal basis

We process your personal data for the purpose of complying with a legal obligation (Article 6.1(c) of the GDPR) or for the purposes of our public interest tasks (Article 6(1)(e) of the GDPR).

Categories of data processed

This includes identification data, information related to the professional lives of the persons concerned, data relating to the company, its managers (e.g. shareholders, UBOs, directors and day-to-day management delegates) and its third-party investors (e.g. description of the activity, history of the company, financial situation, strategy, etc.)  (e.g. title/profession, skills and organisation) or financial/economic data, or in some cases extracts from the criminal record.

Duration

In principle, the data you entrust to us are retained for 10 years after the end of our contractual relationship. This period could be longer due to a legal or regulatory obligation, or a possible ongoing litigation or audit.

Recipients of the data

The data are processed internally by the competent departments. In addition, it could also be transmitted:

• to our external legal counsel or a bailiff in the event of debt recovery by legal means;
• to the competent authorities (Belgian, Walloon and European) in the context of tax, social, reporting, audit, compliance obligations and the performance of our public interest missions;
• to our IT service provider.

6.    Partner data

6.1.          Relationship Management

Purpose

The data is used to establish and manage relationships, if any, of a contractual nature, with WE’s partners. It is also processed in order to ensure the provision of services in accordance with expectations and, if applicable, in accordance with the terms of the contract, but also in order to effectively manage training and files, in particular through the online platforms to be used for these purposes.

Legal basis

The processing of this data is necessary for the performance of the contract concluded with WE (Article 6.1, b) GDPR) or is necessary for compliance with a legal obligation (Article 6.1, c) GDPR) or for the purposes of our public interest tasks (Article 6.1, e) GDPR).

Categories of data processed

This includes identification data (e.g. surname, first name), contact data (e-mail address and telephone number) and company identification data. Information related to the professional life of the persons concerned (e.g. title/profession, skills and organisation) is also processed. In addition, economic and financial data, such as bank data (e.g. account number, account holder, BIC) and data relating to the monitoring of services, may be collected.

Duration

In principle, the data you entrust to us are retained for 10 years after the end of our contractual relationship. This period could be longer due to a legal or regulatory obligation, or any ongoing litigation or audit, or shorter depending on the quality or mission of the partner.

Recipients of the data

The data are processed internally by the competent departments. In addition, it could also be transmitted:

• to our external legal counsel or a bailiff in the event of debt recovery by legal means;
• to the competent authorities (Belgian, Walloon and European) in the context of tax, social, reporting, audit, compliance and the performance of our public interest missions;
• to our IT service provider.

6.2.          Legal, accounting, tax, compliance, auditing and reporting obligations

Purpose

The processing of your data is carried out for the purposes of compliance with various legal and regulatory obligations within the framework of WE’s missions, but also for statistical, reporting, auditing and compliance purposes (KYC, fight against fraud, corruption, detection and prevention of money laundering and terrorist financing).

Legal basis

Depending on the case, we process your personal data for the purpose of complying with a legal obligation (Article 6.1, c) of the GDPR) or for the purposes of our tasks in the public interest (Article 6.1, e) of the GDPR).

Categories of data processed

This includes identification data (e.g. surname, first name), contact data (e-mail address and telephone number) and company identification data. Information related to the professional life of the persons concerned (e.g. title/profession, skills and organisation) is also processed. In addition, economic and financial data, such as bank data (e.g. account number, account holder, BIC), data relating to the company, its managers (e.g. shareholders, UBOs, directors and day-to-day management delegates) and its third-party investors (e.g. description of the activity, history of the company, financial situation, strategy, etc.) and data relating to the monitoring of services may be collected.

Duration

In principle, the data you entrust to us will be retained for a maximum of 10 years after the end of our contractual relationship. However, this period could be longer due to a legal obligation or a possible ongoing litigation or audit.

Recipients of the data

The data are processed internally by the competent departments. In addition, it could also be transmitted:

• to our external legal counsel or a bailiff in the event of debt recovery by legal means;
• to the competent authorities and administrations (Belgian, Walloon and European) in the context of tax, social, reporting, audit, compliance and the performance of public interest obligations;
• to our IT service provider.

7.    Operator and beneficiary data

7.1.          Relationship Management

Purpose

The data are used to establish and manage contracts and relationships with WE operators, for the benefit of beneficiaries in particular. It is also processed in order to ensure that the service is provided in accordance with expectations and the terms of the contract.

Legal basis

The processing of this data is necessary for the performance of the contract concluded with WE (Article 6.1, b) GDPR), for compliance with a legal obligation (Article 6.1, c) GDPR) or for the performance of our tasks in the public interest (Article 6.1, e) GDPR).

Categories of data processed

Regarding operators, we process identification data (e.g. surname, first name), contact data (e.g. e-mail address and telephone number) and company identification data (e.g. CBE number). Data related to the professional life of operators (title/profession, skills and organisation), economic and financial data, such as bank data (e.g. account number, account holder, BIC), data relating to the company, its managers (e.g. shareholders, UBOs, directors and day-to-day management delegates) and its third-party investors (e.g.  description of the activity, history of the company, financial situation, strategy, etc.) and data relating to the monitoring of services (e.g. deliverables) are also collected.

Regarding beneficiaries, we process the data sent to us by the operators through deliverables, i.e. identification data (e.g. first and last name) as well as data related to professional life (title/profession, skills and organisation). The said data are encoded on a specific dedicated platform (Imhotep platform).

Duration

In principle, your data are retainedfor 10 years after the end of the contractual relationship, in particular for the purpose of fulfilling our reporting obligations. This period could be longer, in particular, due to a legal or regulatory obligation, a possible litigation or ongoing audit.

Recipients of the data

The data are processed internally by the competent departments. In addition, it could also be transmitted:

• to our external legal counsel or a bailiff in the event of debt recovery by legal means;
• to the competent authorities (Belgian, Walloon and European) in the context of tax, social, reporting, audit obligations and the performance of our public interest missions through the specific dedicated platform;
• to our IT service provider;
• to external persons in charge of quality control.

7.2.          Promotion of our activities, services and events

Purpose

The processing of your image (e.g. photo or video) and your testimonial (e.g. your company story) is carried out for the promotion of our activities, services and events, or as part of specific projects.

Legal basis

We process your personal data on the basis of your explicit consent (Article 6.1(a) of the GDPR).

Categories of data processed

This includes photos or videos as well as any personal data disclosed in your testimonial.

Duration

These data are kept either until the withdrawal of consent or, when the image or testimony is used in the context of a project, for the duration of this project and then until the withdrawal of consent.

Recipients of the data

These data are used internally, in particular by the people responsible for communications, and where applicable, by an external service provider in charge of capturing or editing videos or photos. External communications are also possible, in particular on our social networks.

8.    Internet users’ data

8.1.          Visiting our website

In principle, access to the information available on or via the website is done without having to provide personal data.

However, the use of certain cookies is necessary to browse our website. For more information in this regard, we refer you to our cookie policy: www.wallonie-entreprendre.be/fr/politique-cookies/.

8.1.1.      Additional services and contact form

Exceptionally, in order to obtain additional services (request for information, registration for an event, registration for a training course), certain personal data may be requested from the user of the site.

Purpose

The data provided are only used to fulfil your request for additional services or your contact request.

Legal basis

Your personal data are processed on the basis of your consent (Article 6.1(a) of the GDPR) or its processing is necessary for the performance of a contract (Article 6(1)(b) of the GDPR).

Categories of data processed

This includes identification data (e.g. surname, first name) or data related to the profession as well as contact data (e.g. e-mail address and telephone number). Other categories of data include the data contained in the message left by the data subject, as well as the subject of the request.

Duration

If your contact request leads to a contractual relationship, your personal data will be stored for 10 years after the end of our contractual relationship. This period could be longer due to a legal obligation or a possible litigation or an ongoing audit.

Otherwise, they are deleted 3 years after the last contact.

Recipients of the data

Your data are only used internally, in particular by the persons in charge of processing the request. They could also be dealt with, in terms of the social economy, by our partner the non-profit organisation iES![1].

8.1.2.      Cookies

A “cookie” is a small piece of information stored by a website within your computer’s web browser. This “cookie” can be retrieved during a subsequent visit to the same site. The “cookie” cannot be read by any website other than the one that created it. The site uses “cookies” for administrative purposes to, for example, store your preferences for certain types of information, so that you do not have to repeat the same keystrokes each time you visit our site.

The list and description of the cookies used on our website and extranet can be found here: www.wallonie-entreprendre.be/fr/politique-cookies/.

Most cookies only work for the duration of a session or visit. None of them contain information that makes you likely to be contacted by phone, email or post.

Most browsers automatically accept cookies. However, it is possible to set your browser to receive a warning before a cookie is stored on your computer or to block them. You can find more information about how to set your browser via the “Help” button on your browser or via the following links:

Google Chrome https://support.google.com/chrome/answer/95647?hl=fr

Internet Explorer https://support.microsoft.com/fr-be/help/17442/windows-internet-explorer-delete-manage-cookies

Mozilla Firefox https://support.mozilla.org/fr/kb/activer-desactiver-cookies

Safari https://support.apple.com/kb/PH19214?viewlocale=fr_FR&locale=en_US

8.2.          Direct marketing

Purpose

The processing of your data is carried out for the promotion of our services and events (e.g. newsletter).

Legal basis

Depending on the case, we process your personal data for the purposes of our public interest tasks (Article 6.1(e) of the GDPR) or on the basis of your explicit consent (Article 6(1)(a) of the GDPR).

Categories of data processed

This includes identification data (e.g. surname, first name), contact data (e.g. e-mail address and telephone number) and company identification data. Information related to the professional life of the persons concerned (title/profession, skills and organisation) is also processed.

Duration

These data are retained, as the case may be, for up to three years after the last contact or until consent is withdrawn.

Recipients of the data

These data are used internally, in particular by the persons responsible for communications, and, where applicable, by an external e-mail service provider.

8.3.          Social media

8.3.1.      Consultation of WE’s social media pages

Purpose

The data that you provide when visiting our pages on social networks are or may be processed jointly by the social network and the administrator of this page for the following purposes:

• The collection of certain data by means of cookies;
• The improvement by the social network of its advertising system;
• Obtaining page audience statistics.

These data will only be processed by the page administrator within the scope of his legitimate interest in obtaining statistics about the visitors to his page in order to adequately promote his page. The audience statistics compiled by the social network are only transmitted to the page administrator in an anonymised form.

Legal basis

The processing of this data is necessary for the performance of our public interest tasks in terms of promoting our services via social networks (Article 6.1, e) of the GDPR).

Categories of data processed

This may include data related to your account, data related to content sharing, or communications you have with others.

Duration

These data are or may be kept for as long as the page exists and you visit it.

The policies on the use of personal data of each social network can be found by clicking on the following links:

• Facebook and Instagram,
• Youtube,
• LinkedIn,
• Twitter (now “X”).

Recipients

These data may be passed on to our employees, subsidiaries, suppliers, external service providers (including our IT service provider) or consultants.

8.3.2.      Cookies

It is also possible that cookies are installed by the social networks listed on our site. These social networks may themselves use cookies, in particular, to collect information that they use for their own purposes.

The “cookie” policies of the various social networks can be consulted at the following links:

• Facebook and Instagram;
• Youtube (via Google policy)
• Linkedin;
• Twitter (now “X”).

9.    Platform user data

9.1.          Simply consulting our websites

In principle, access to the information available on or via the website is done without having to provide personal data.

However, the use of certain cookies is necessary to browse our website. For more information in this regard, we refer you to our cookie policy: www.wallonie-entreprendre.be/fr/politique-cookies/.

9.2.          Request information

For people who visit the platform and wish to obtain more information or communicate with us, personal data will be processed.

Purpose

The data are processed for the purpose of communicating with you and answering your questions. This includes receiving requests for information, suggestions, complaints, or any other type of feedback. The data collected are used to improve our services and our interaction with stakeholders based on the feedback obtained.

Legal basis

The processing of this data is based on the performance of the contract (Article 6.1 b) GDPR) or is necessary for the performance of our public interest task (Article 6.1, e) of the GDPR.

Categories of data processed

This includes identification data (e.g. surname, first name) as well as contact data (e.g. e-mail address and telephone number). Other categories of data include the data contained in the message left by the data subject, as well as the subject of the request.

Duration

All data collected as part of this activity are kept for 3 years from the last contact.

Recipients of the data

Internal use by the persons responsible for requests for information and our IT service provider.

9.3.          Direct marketing

Purpose

The processing of your data is carried out for the promotion of our services and events, and to inform you in the context of our missions of public interest

Legal basis

We process your personal data for the purposes of our public interest mission (Article 6.1, e) of the GDPR).

Categories of data processed

This includes identification data (e.g. surname, first name), contact data (e.g. e-mail address and telephone number) and company identification data. Information related to the professional life of the persons concerned (e.g. title/profession, skills and organisation) is also processed.

Duration

These data are retained for up to three years after the last contact or until you request the deletion of your data.

Recipients of the data

These data are used internally, in particular by the persons responsible for the departments, and, if necessary, by an external e-mail service provider and our IT service provider.

9.4.          Access and use of the platforms

Purpose

The processing of your data is carried out in order to provide the functionalities and services offered by the platform.

Legal basis

The processing of this data is based on the performance of the contract (Article 6.1, b) GDPR) or is necessary for the performance of our public interest task (Article 6.1, e) of the GDPR). It is necessary to enable us to provide the services and features offered on the platform in question.

Categories of data

This includes identification data (e.g. surname, first name) and contact data (e.g. e-mail address and telephone number). Depending on the case, this may include information relating to the professional or student background as well as data relating to the company concerned. The data is provided by you or, where applicable, collected from public or professional databases.

Duration

The data is kept for a period of 10 years following the end of the contract or the unsubscription from the platform. This duration could be longer due to a legal obligation or a possible ongoing litigation or audit, or shorter depending on the services offered.

Recipients of the data

These data are used internally. In addition, it could also be transmitted:

• to the competent authorities and administrations (Belgian, Walloon and European) in the context of tax, social, reporting, audit, compliance and the performance of public interest missions;
• to any external partners and service providers, including our IT service provider;
• according to the data, to certain other users who have a right and interest in knowing about it.

9.5.          Support and reporting

Purpose

The data are processed in order to enable us to carry out our related support and reporting mission to the Walloon Region, given our mission to provide support, information, awareness-raising and support services for the economic and technological development of companies in the Walloon Region. Typically, the data are transmitted in aggregate form.

Legal basis

The processing of this data is necessary for the performance of our public interest mission to promote our services (Article 6.1.e) of the GDPR).

Categories of data processed

This includes identification data (e.g. surname, first name, information about your background), contact data (e.g. e-mail address and telephone number).

Duration

The data are retained for a period of 10 years following the end of the contract or the unsubscription from the platform. This duration could be longer due to a legal obligation or a possible ongoing litigation or audit, or shorter depending on the services offered.

Recipients of the data

These data are used internally by the people responsible for support and reporting, as well as by the authorities to whom the reporting is to be carried out.

10. Contact/prospect data

Purpose

We contact you in order to offer you our services or to inform you in the context of our missions of public interest, in particular, following meetings or data obtained through databases, internet sources, external directories paid or not and during the performance of our services.

Legal basis

Your personal data are processed on the basis of your consent (Article 6.1(a) of the GDPR) or for the performance of our tasks in the public interest (Article 6(1)(e) of the GDPR).

Categories of data processed

Your identification data (e.g. first and last name) and contact data (e.g. email address and telephone number).

Duration

We will retain your contact data for this purpose until you withdraw your consent and no later than 3 years after our last contact, unless a contractual relationship has been established retrospectively.

Recipients of the data

Internal use by the persons and departments concerned, and if applicable, by an external e-mail service provider and our IT service provider.

11. Physical visitor data

Purpose

The processing of your data is carried out for and to the extent necessary for the security of our infrastructures and equipment as well as the events that may be organised there.

Legal basis

We process your personal data for the purposes of our public interest missions which authorise us to secure our premises and equipment.

Categories of data processed

This includes identification data (e.g. first and last name, function or role) and video surveillance images.

Duration

Video surveillance logs and recordings are not kept for more than 30 days unless these images can help to provide proof of an offence, damage or nuisance or incivility or make it possible to identify a perpetrator, a disturber of public order, a witness or a victim. The data contained in the badges is kept for 12 months after the end of access.

Recipients of the data

These data are processed internally and is not passed on to any third party. However, they could be transferred to the appropriate police service upon request.

12. All data subjects

12.1.       Exercising of the rights

Purpose

When you exercise the rights conferred on you by the GDPR and described in this data protection policy (right of access, rectification, etc.), we retain the data strictly necessary to prove that we have responded to your requests in a meaningful way.

Legal basis

The retention of this data is based on the legal obligation imposed by Article 5.2 of the GDPR, namely the accountability principle.

Categories of data processed

This is your surname, first name, request, proof of the measures taken by WE following the request.

Duration

We will retain your data for this purpose for as long as we can be held liable for non-compliance with the requests, i.e. for a maximum period of 10 years.

Recipients of the data

These data are processed by the DPO and the persons likely to be able to respond to the request and, where appropriate, are transmitted to the data protection authority.

12.2.       Whistleblowers

Purpose

When you report any wrongdoing or suspicion of corruption, unlawful or unethical behaviour that has occurred or is very likely to occur in connection with WE’s activities, we retain your data in order to effectively process this report. We refer you to the reporting process as outlined on our website: www.wallonie-entreprendre.be/fr/processus-de-signalement-par-une-personne-externe/.

Legal basis

These data are processed in order to comply with a legal obligation (Article 6.1, c) of the GDPR), namely the Act of 28 November 2022 on the protection of persons who report breaches of Union or national law found within a legal entity in the private sector.

Categories of data processed

This includes identification data (e.g. surname, first name) and contact data (e.g. e-mail address, telephone number) as well as the content of the report.

Duration

In the event of legal proceedings, the data are retained until the expiry of the limitation period or the outcome of the legal proceedings, as the case may be. If the report is not acted upon, these data are retained for a period of 2 months from the end of the examination.

Recipients of the data

These data are processed internally by the people who have to process the report.  In addition, it could also be transmitted:

• to any external service providers, including the IT service provider;
• To our external advisors/experts, and in particular legal experts.

13. Where are your personal data stored?

Your data are exclusively stored by WE on servers located within the E.U.

It may be communicated to WE’s processors in the context of services on behalf of WE exclusively (e.g. IT service providers and others) and only on the basis of our instructions. Exceptionally, it may be communicated to other data controllers.

These recipients are in principle located in the European Union and are contractually bound by security and confidentiality obligations in accordance with Article 28 of the GDPR. Where these data are transferred to a country that does not offer an adequate level of protection, we ensure that appropriate safeguards are in place to ensure that this transfer is in place. A copy of these appropriate safeguards would then be available upon request.

14. How does WE protect your personal data?

WE takes appropriate technical and organisational measures, such as access control, encryption, regular data backup, and staff awareness, to protect personal data from accidental or unlawful destruction or loss, improper use, unauthorised access and disclosure, or alteration or destruction. WE requires its own service providers and other third parties who help to provide the services of WE to make a similar commitment to protect the personal data concerned.

15. What are your rights? How can you exercise them?

The GDPR gives you several rights in relation to the personal data we process. In particular, the GDPR gives you the following rights in principle:

• Right to information: You have the right to obtain information about the processing of your personal data. For example, you have the right to know the purposes of the processing, the categories of personal data concerned, the categories of recipients to whom the personal data is transmitted, the criteria used to determine the data retention period and the rights you can exercise over your personal data. This right is respected through this document.

• Right of access: You have the right to access your personal data and to receive a copy of it.

• Right to rectification: You have the right to ask us to update or correct your personal data, if you believe it is incorrect or incomplete.

• Right to erasure: You have the right to ask us to erase your personal data or to restrict the way in which we use that data, if you believe that we do not (or no longer) have a legitimate basis for processing it.

• Right to withdraw consent: You have the right to withdraw your consent to the processing of your personal data based on that consent at any time.

• Right to portability: You have the right to receive your personal data n a structured, commonly used and machine-readable format and to transfer it to another party.

• Right to object: You have the right to object to processing of personal data for which we are using legitimate interests as a legal basis, unless we have compelling and justified reasons for the processing.

• Right to restriction of processing: You have the right to restrict the processing of your personal data in certain circumstances listed in Article 18 of the GDPR.

For more information on your rights: https://www.autoriteprotectiondonnees.be/citoyen/vie-privee/quels-sont-mes-droits-.

You can exercise the above-mentioned rights by sending an e-mail to dpo@wallonie-entreprendre.be or by sending a letter to the attention of our Data Protection Officer (DPO) at the following address: Wallonie Entreprendre SA, Avenue Maurice Destenay, 13, 4000 Liège.

In addition, if you believe that WE has not acted in accordance with the legislation on the processing of personal data, you may lodge a complaint with the Belgian Data Protection Authority (Data Protection Authority, rue de la Presse 35, 1000 Brussels, +32 (0)2 274 48 00, contact@apd-gba.be).

16. Social media

If you share information on the WE website through social networks, personal data may be observed by visitors to your personal pages on this website.

WE cannot be held liable in any way for any data processing through this type of media.

17. Changes to this Policy

We may change this Policy at any time. In order to keep you informed of the last modification of this Policy, we will adjust the revision date each time it is changed. The amended Policy will come into effect on that date.

18. Applicable law

This policy is governed by Belgian law. Any dispute relating to the interpretation or execution of this policy will be subject to Belgian law.

Last updated on 22 April 2026

[1] The Incubator of the Social Economy in Wallonia, Rue de l’Académie 53 – 4000 Liège, n° BCE 0793.254.815.