How we handle personal data.

1. Who is responsible

The controller is Warre Pieters, sole proprietorship, trading under the name Hunch, Eisenhowerlaan 45, 2820 Bonheiden, België, enterprise number 1044.738.597, email warre@hunchleads.com.

Given the scale and nature of our processing, we are not required to appoint a data protection officer. For any question about privacy, you can contact Warre Pieters directly at warre@hunchleads.com or through the form on the Our data page.

2. Who this policy applies to

• Visitors to hunchleads.com.
• Anyone who books a call or contacts us.
• Clients and their users, who log in to their client page.
• Business contacts: managers, directors, self-employed persons and employees of businesses, insofar as their business details appear in the company information we work with (see section 4).

3. Overview of our processing

4. Company information and business contacts

This section contains the information required by Article 14 GDPR for data that we did not obtain directly from you. It is the most important part of this policy if you did not contact us yourself.

4.1 What we do

For each client, a model monitors Belgian businesses for public signals, such as a new establishment, a recruitment, participation in a trade fair or a published change. From those signals, it selects the businesses most likely to be interested at that moment in what the client offers, with a short explanation of why.

Our work concerns businesses, not individuals. We limit personal data to what is needed to reach the right business contact at a selected business. We do not sell databases or bulk lists.

A client can also follow its sector and businesses of its own choosing in Your market. That concerns businesses and their public activity, such as their website, their public company pages and official publications, not individuals. In Hunch Lab we publish only aggregated figures about the Belgian market, never traceable to a person or a client.

4.2 Where the data comes from

• Public registers and official publications, such as the Crossroads Bank for Enterprises (KBO/BCE) and the Belgian Official Gazette.
• Information that businesses make public themselves, for example on their website.
• Other publicly accessible sources, such as news items and press releases.
• Specialised providers of business contact data.

If you would like to know which source your own data comes from, we will tell you on simple request.

4.3 What we do not do

• We do not look up private addresses, private telephone numbers or private email addresses.
• We do not process special categories of data (such as health, beliefs or origin) or data relating to criminal convictions.
• We do not take decisions about individuals that are based solely on automated processing and have legal effects (Article 22 GDPR).

4.4 Legal basis and balancing of interests

We process this data on the basis of our legitimate interest and that of our clients: bringing businesses into contact with other businesses for which their offering is relevant. Recital 47 of the GDPR recognises that direct marketing may be a legitimate interest.

We have assessed in writing whether that interest outweighs your interests and rights. That assessment is favourable because:

• it concerns only data relating to you in your professional capacity, which you or your business made public yourself or which is public by law;
• anyone holding a business position can reasonably expect to be contacted in that capacity about something relevant to the business;
• we deliberately keep the amount of data and the number of businesses passed on to a client small;
• you can object at any time, without giving a reason and free of charge, after which you will no longer be contacted.

We will explain this assessment on request.

4.5 How long we keep data

We keep this data for as long as it is needed for the purpose for which we collected it and for as long as it can be found in a source. Data that is out of date or relates to a business that has ceased trading is deleted or anonymised after a reasonable period. Data that a client has received from us is kept by the client under its own responsibility (see 4.6).

Anyone who objects is placed on a suppression list containing the strict minimum of data, so that they are not added again.

4.6 Who receives the data

When a business is selected for a client, the client initially sees only the reason, without contact details. Only once the client accepts the business does it receive the business contact details. From then on, the client is itself responsible for their use. Our terms require every client to comply with the GDPR and the Belgian rules on electronic advertising, to respect objections and to notify us of any objection.

In addition, we work with processors, as described in section 7.

4.7 How we inform you

This page is public and freely accessible. When we contact you ourselves, our first message states where we found your data, how you can object and where this policy can be found. We ask our clients to do the same.

4.8 Objection and removal

You can object at any time, without giving a reason. To do so, use the form on the Our data page, reply to a message from us or email warre@hunchleads.com. We will then remove your data from our company information, place the strict minimum on the suppression list and confirm this to you. If clients have already received your data from us, we will inform them of this insofar as reasonably possible.

5. Automated analysis

To read, organise and summarise public information, we use software, including software from specialised providers acting as processors. Ranking businesses is a form of profiling of businesses. It does not lead to decisions with legal effects for individuals: a client or Hunch decides whether contact is made.

6. Security

We take appropriate technical and organisational measures to protect personal data against loss and unlawful access, taking into account the state of the art and the risks, including encryption, access control and keeping each client’s data separate. No system is completely invulnerable; we therefore cannot guarantee absolute security.

7. Recipients and transfers outside the European Union

We share personal data only with those who need it for the purposes set out in this policy:

• providers of hosting, infrastructure and security;
• providers of software for processing and analysing information;
• providers of error logging and technical monitoring;
• providers of business contact data;
• providers of email and communication services;
• our accountant and professional advisers;
• clients, for company information and business contact details, as described in section 4.6;
• public authorities, where the law requires us to do so.

Providers that process data on our behalf do so as processors, in accordance with our instructions and under a data processing agreement or equivalent terms. If, as a client, you connect your own Gmail or Outlook mailbox, this takes place under your own agreement with Google or Microsoft.

Some providers are established or process data outside the European Economic Area, including in the United States. This is done only with an appropriate safeguard: an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework for certified companies) or the standard contractual clauses of the European Commission. On request, we will provide you with more information about these safeguards.

8. Your rights

• Access: to know whether and which data we process about you, and to receive a copy.
• Rectification: to have inaccurate or incomplete data corrected.
• Erasure: to have your data deleted, within the limits of the law.
• Restriction: to have the processing temporarily suspended, for example while you contest its accuracy.
• Portability: to receive data that you provided to us yourself in a commonly used format.
• Objection: to object to processing based on legitimate interest. You can always do so against direct marketing, without giving a reason.
• Withdrawal of consent: where we rely on your consent, you can withdraw it at any time.

You can submit a request via the form or by email to warre@hunchleads.com. It is, as a rule, free of charge. We reply within the statutory period of one month, which may be extended by two months for complex or numerous requests. We may ask you to prove your identity, and we may refuse manifestly unfounded or excessive requests or charge a reasonable fee for them, as permitted by the GDPR.

9. Complaints

If you are not satisfied with how we handle your data, please let us know first; we will gladly look for a solution together. You can also always lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse/Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, +32 2 274 48 00, www.dataprotectionauthority.be.

10. Other

You can read more about cookies and local storage in our cookie policy. Our service is aimed at businesses; we do not knowingly process data of minors.

We amend this policy when our processing or the law changes. The date at the top shows the latest version. We notify clients of significant changes in advance.