Personal data protection policy

---

1. General

Freedelity is a provider of IT solutions and services to support the collection, updating and management of certain personal data (hereinafter "Data").

Among other things, Freedelity enables its customers to centralize and update your data by creating a reference file.

Freedelity's customers (hereinafter referred to as "Customers") are mainly:
Retail chains (https://www.myfreedelity.com/repertoire-des-commerces) and other companies wishing to authenticate you (KYC) and get to know you better (market research) in order to develop a relationship and personalized services with their consumers (you), while meeting the various regulatory requirements in terms of Data protection and processing, and with whom you have registered for a loyalty program, a dematerialization of the warranty, or any other customer relations program (for example, a club);

Each Freedelity Customer is a data controller for certain processing operations and certain Data. Freedelity primarily acts as a processor for its Customers and as a joint controller. For certain processing operations, Freedelity also acts as an independent data controller.

Freedelity therefore acts:

1. As a processor for processing carried out on behalf of its retail Customers (management of their database, loyalty, marketing, etc.);
2. As a joint controller with the retailers for the mutualisation and maintenance of data (reference file);
3. As an independent data controller for certain further processing operations (Know Your Customer (KYC), market research, additional MyFreedelity services, etc.).

The personal data protection policies of Freedelity's Customers will also apply to explain how Freedelity's Customers process your Data. We refer you to their own documents for these purposes.

Freedelity and its Customers attach great importance to your Data and to their protection in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as well as the Belgian law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

This personal data protection policy aims to explain to you how your Data is collected, used, stored, protected and made accessible to our Customers and to yourself.

Through the www.myfreedelity.com portal and the MyFreedelity mobile application, you can, at any time, access your Data and manage it both in terms of content and use (management of consents and preferences). Freedelity thus enables you to exercise direct, complete and immediate control over the use of your Data, by each Customer and by Freedelity, and/or enables you to consult your benefits with our Customers at any time.

If you have a complaint, question or problem concerning the way we use your Data, please contact our Data Protection Officer (DPO) via the email address dpo@freedelity.be.

---

2. What data do we collect and use?

Depending on the context and the processing to which you have subscribed, Freedelity processes the following data:

1. Identification data: surname, first name, date and place of birth (hashed, no direct identification possible), gender, language, unique identifier, token, identity card number (until 31/07/2026. Number is hashed, no direct identification possible);
2. Contact data: your postal address, email, phone/mobile number and data history;
3. Connection data: IP addresses, logs, login credentials (username and password); the date your profile was created, information relating to the sending of the registration confirmation email in the reference file, the date of the last visit to the MyFreedelity portal and application;
4. Location data (based on postal address): geographical coordinates, sector/street/address/building/street section coding and geomarketing typology (data from open data, e.g. Statbel, OpenStreetMap);
5. Internet: cookies, trackers, browsing data, audience measurement;
6. Transactional data: data generated by transactions carried out as part of the loyalty program implemented by the retailer: purchases, warranties, amounts, transaction objects, loyalty points, coupons, receipts, competitions, savings cards, gift vouchers, discount vouchers,...
7. Interaction data: kiosk visits, responses to marketing campaigns, communication preferences
8. Other data categories: postal returns and undelivered emails.

On the MyFreedelity portal and mobile application, you have access to other information specific to your interaction with each Customer (for example, receipt details or purchase and communication histories, etc.). Freedelity does not process this Data on its own behalf, but on behalf of its Customers. Freedelity then acts as a processor. In this regard, we comply with the applicable regulations on the protection of personal data and we assist you in particular in the exercise of the rights you have as a data subject. More information on this Data, this processing and its purposes can be obtained from the personal data protection policies of the relevant Customers.

How is your data collected?

Your data is collected directly from you when you create your account/customer profile in store (at the checkout or at the terminals provided for this purpose) or on the retailer's website/mobile application, checkout systems, kiosks, APIs, web portals, etc.

The tools for collecting your data, including via reading your identity card, are made available to you by Freedelity SA. Freedelity processes your data as a processor and only on the instructions of the retailers.

Your data is transferred by the retail Customers to Freedelity as part of the creation and maintenance of the reference file.

Other data sources processed by Freedelity are:

1. Data that you voluntarily provide to us (email, mobile, preferences);
2. Data that you provide directly via MyFreedelity (portal or mobile application), via our website, via kiosks, our customers' websites, APIs;
3. Your transactions and interactions with our customers.

---

3. Purposes, legal bases and responsibilities

3.1. Freedelity as processor of your personal data

Freedelity acts as a processor for its Customers for the following purposes:

1. Customer relationship management, loyalty, marketing, management of your rights;
2. Securing your data: hosting, backup, restoration, access control;
3. Collecting, recording and managing consents for sending marketing communications (email, SMS, postal mail) and your preferences in this regard;
4. Integration of connection tools: this processing is carried out by Freedelity as a processor on behalf of the Customer on whose website you wish to authenticate using the connection tool. Your data will only be processed for this purpose if you consent to it. The Customer will inform you of the planned processing at the time your consent is collected.

Personal data processing is strictly governed by processing agreements that comply with the GDPR. These agreements specify, in particular, the retention periods applicable for each customer and the specific provisions relating to the data we process for them. To learn more about the processing implemented by our customers (retailers), we invite you to consult their specific Privacy Policies.

3.2. Freedelity is a data controller, jointly with its customers.

To ensure that your identification and contact data is kept up to date, we process your identification and contact data jointly with the retail Customers (partners) as part of a service for the mutualisation of the maintenance of your Data.

What is the mutualisation of the maintenance of your data:

The identification and contact data we hold is sent to us by the partner retailers so that it can be entered into a Reference File, the management of which is entrusted to Freedelity as a trusted third party and joint controller. The centralisation of this data then enables Freedelity to detect changes and subsequently automate the updating of the databases of all Freedelity partner retailers for which you have accepted the processing of your personal data. Thus, if you update your data at one of the retailers, this data will be automatically updated with us and automatically passed on to each Freedelity customer using solutions developed by Freedelity. In this way, you ensure that your data is correct and up to date in the systems of all your favourite stores affiliated with the data management services marketed by Freedelity.

Legal basis: The processing of your data for the purposes of mutualisation of data maintenance is justified by:

1. Your convenience: the fact that your data is up to date at the retailers with which you are affiliated. This allows you, in particular, to modify/correct/update your data at just one of these retailers, so that these changes are reflected in the databases of the other retailers with which you are affiliated.
2. The legitimate interest of the retailers in ensuring that the data relating to their customers, stored in our databases, is up to date. It is on the basis of this data that they communicate with you and manage their customer relationship (communications, marketing, loyalty program, etc.).
3. The legitimate interest of Freedelity in offering and marketing its solution for the mutualisation of data maintenance to retailers.

You can object to the processing of your data for these purposes, at the time your data is collected and at any subsequent time.

If you object to this processing, you will of course still be able to register with the retailer. However, you will not benefit from the automatic updating of your data across all retailers affiliated with the data maintenance mutualisation service. Please consult the "Your rights" section for more information on how to do this.

Data processed: As part of the mutualisation of the maintenance of your data, we process the following data jointly with the partner retailers:

1. Data required to create a unique identifier: surname, first name, date of birth, place of birth, identity card number. This data is used to create your unique identifier. Your place of birth and identity card number are immediately and irreversibly encrypted. They are therefore not stored in clear text in our databases,
2. Contact data: phone number, postal address, email address.
3. Identification data: surname, first name, gender, language, date of birth, unique identifier, userID, etc.

Recipients: provided that you have not objected, your data will be updated with the other retailers where you already have an account/customer profile. However, these retailers will only receive updates to your identification and contact data when you register or when you modify them. You can view the list of these retailers at any time by visiting your MyFreedelity portal. Please consult the "Your rights" section for more information on how to do this.


You can object at any time to the mutualisation and maintenance of your data. For more information on how to exercise your rights, please consult the "Your rights" section of this policy.

3.3. Freedelity is an independent data controller

Once your data has been entered into the Reference File, and unless you indicate otherwise, your data is then processed by Freedelity in its capacity as an independent data controller.

1. Your data is processed by Freedelity in order to offer its Customers the following services:
   1. Identity verification or KYC ("Know Your Customer") enabling Freedelity's Customers to verify the identity of data subjects. This service consists of confirming to our Customers that the data they provide us about you is accurate.
   2. Market research and establishment of geomarketing typologies. We allow our partners to carry out these studies only on the basis of anonymised data.
2. Freedelity also offers you tools via its portal or mobile application:
   1. Analysis of your spending budget
   2. A nutriscore
   3. Dematerialisation of your cards
3. Communication
   1. We use your data to inform you of the integration of new Freedelity Customers, to inform you of new features and technical developments developed by Freedelity, relating to the MyFreedelity portal and application.
   2. Communications may be carried out by postal mail, email, telephone, SMS or via the MyFreedelity application or portal.

No directly identifying data is transmitted to third parties in the context of market research or Know Your Customer.

You can object, at any time, to the processing of your Data carried out on the basis of our legitimate interest, and you can also withdraw your consent when the processing of your data is based on it. For more information on how to exercise your rights, please consult the "Your rights" section of this policy.

---

4. Recipients of your data

Your Data are accessible by the competent Freedelity staff.

It is also processed by:

1. Our technical subcontractors (hosting, maintenance, emailing, security, etc.)
2. Our partner retailers (as part of the shared maintenance of your data)
3. Freedelity customers for additional services (KYC, market research, connection tools)
4. Competent authorities, if required by law. Certain public authorities have the right to consult or request part of your Data. We must cooperate in such cases.

All such parties must comply with the regulations applicable to the protection of personal data, and in particular the rights you have as a data subject, and must respect the contractual provisions aimed at ensuring a high level of security.

---

5. Where do we store your data?

The Data is stored on secure servers, located in the European Union or in places with a sufficient and appropriate level of data protection in accordance with the opinion of the European Commission or legislation, so that the level of protection of individuals guaranteed by the General Data Protection Regulation is not compromised.

---

6. Your rights

You have the following rights regarding the processing of your Data:

Right of access

You have the right to obtain confirmation that your Data is being processed by Freedelity, to ask us about the Data we hold about you and to obtain a copy of your Data.

Right of rectification

You have the right to rectify inaccurate Data and to complete incomplete Data.

Right to object

You have the right to object to any use of your Data, where processing is based on our legitimate interests.

Right to restrict processing

You may ask us to restrict the processing of your Data, in accordance with applicable data protection legislation.

Right to be forgotten or deleted

You have the right to ask us to delete your Data, if you find yourself in the conditions provided for by the applicable Data protection legislation, unless we are legally obliged to retain some of it.

Right to withdraw your consent

You have the right to withdraw, at any time, your consent to the processing carried out on the basis thereof, and this at any time, without justification and without this calling into question the lawfulness of the processing carried out when your consent was active.

Right to Data portability

You may request that your Data be recovered in a machine-readable format or that your Data be transferred to another data controller of your choice. For intellectual property reasons, the file containing your Data will be unstructured (flat file).

Complaints concerning Freedelity's processing of your Data may be addressed to the Data Protection Authority, rue de la Presse 35, 1000 Brussels / +32 (0)2 274 48 00 / contact@apd-gba.be.

---

7. How can you contact us and assert your rights?

You can exercise your rights:

1. Via MyFreedelity (https://www.myfreedelity.com) If you do not have access to the MyFreedelity portal or application: you can send an email to privacy@myfreedelity.com, enclosing proof of your identity with your request.
2. Directly in store: you can exercise your rights by contacting the in-store cashier at the store concerned
3. By phone: +32 2 880 98 36
4. By email: privacy@myfreedelity.com
5. You can also send us a letter, enclosing proof of your identity, to Freedelity SA, Rue Altiero Spinelli 7, 1401 Nivelles. Please always state clearly the right you wish to exercise

We would like to draw your attention to the fact that Freedelity also acts as a subcontractor for some of its customers. As a result, you may see, through the MyFreedelity portal or application, certain Data that are not processed by Freedelity as the data controller, but rather as a subcontractor (for example, sales receipts, purchase history analyses, etc.). In the event of requests to exercise any of your rights in relation to your Data, Freedelity may respond to such requests, in accordance with the provisions of the processing agreement entered into between Freedelity and its Customers, acting as data controllers, as well as the General Data Protection Regulation. Freedelity may also pass on your request to the Customer and will cooperate to the best of its ability to satisfy your request.

Similarly, when you use the MyFreedelity portal or application to exercise control over the processing of your Data by Customers, Freedelity automatically passes the instruction on to the Customer. It is the Customer's responsibility to act on this instruction on its own systems (by deleting your Data from its own systems, for example), in accordance with its own personal data processing policy. Freedelity acts only as an intermediary in this respect.

---

8. Security

Your Data is stored on secure computer servers in accordance with state-of-the-art standards. When we collaborate with other parties, such as our subcontractors, we require the same level of security from them.

Adequate security measures, verified by competent and independent bodies, have been put in place in accordance with the provisions of the relevant European Regulation and in compliance with best practice, to prevent any destruction, loss, alteration, unauthorized disclosure or unauthorized access to your personal data.

Despite all the efforts made by Freedelity, we can never fully guarantee the security and protection of your Data.

---

9. Retention periods

Your data is kept in the Reference File for a maximum of 3 years after your last interaction with one of the stores participating in the data maintenance pool (in-store purchase, loyalty program registration or data update).

Data processed in the MyFreedelity application or portal are kept for 3 years after the last active use of MyFreedelity.

---

10. Contact and complaints

1. Freedelity SA - Rue Altiero Spinelli 7, 1401 Nivelles, Belgium - info@freedelity.be
2. Data Protection Officer: privacy@myfreedelity.com
3. Data Protection Authority: Rue de la Presse 35, 1000 Bruxelles - contact@apd-gba.be

---

11. Cookies

We use cookies and trackers on our website, on the MyFreedelity portal, on the MyFreedelity application and to provide you with any other services set up by Freedelity.

You can manage your cookie preferences or withdraw your consent at any time by clicking this link.

If you would like more information about the cookies we use on our website, you can consult our Cookie Policy.

---

12. Updating this policy

We are constantly developing our solutions and services so that we can continue to offer you the best possible support and service. For this reason, we will regularly adapt this Privacy Policy to reflect the way in which we process your Data. Although we make every effort to draw your attention to these changes, we ask you to consult the Privacy Policy regularly. It is therefore also your responsibility to keep abreast of any changes.

This Privacy Policy was last amended on December 31, 2025.