B2C Privacy Policy

1. Introduction

Brussels Expo appreciates your interest in its products, services, and website. We believe it is important that you know how we collect, process, and store your personal data. We strive to do so with respect for your rights. We also want you to be aware of your rights. That is why we ask you to read this privacy statement carefully. If you have any questions about the processing of your data, please contact us at[email protected].

2. What is the legal framework in this area?

Although we strive to offer guarantees that go beyond the applicable legal framework in this area, we have taken the necessary organizational and technical measures to comply with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27/04/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, known as the General Data Protection Regulation (hereinafter "GDPR"). 

3. Which terms are useful for understanding this privacy statement?

• Data subject: a natural person who can be identified, directly or indirectly, on the basis of certain information. This is the person whose personal data is collected and processed by the controller or the processor acting on the controller's behalf. In this case, this includes: our visitors, people who fill out contact forms on one of our websites, people who buy a ticket for an event organized on our site or a parking ticket, any other person whose personal data is communicated to us, etc.
• Personal data: any information relating to an identified or identifiable natural person (= the data subject). This definition is broad, as data is considered personal data as soon as it can directly (surname, first name, photo, etc.) or indirectly (email address, customer number, employee number, etc.) identify a natural person. When this privacy statement refers to "data," we mean personal data.
• Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means. Here too, the definition is broad. Any operation involving personal data constitutes processing: collection, consultation, storage, transmission, modification, erasure, etc.
• Data controller: the natural or legal person, public authority, agency, or other body that determines the purposes and means of the processing of personal data. This is the person who decides why your data is collected and processed. This is your point of contact and the person who will be held responsible for compliance with the applicable data protection standards.
• Processor: the natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller. The processor does not decide on the reasons for processing; it carries out the processing on behalf of a controller.

4. Who are we?

The non-profit organization Tentoonstellingspark van Brussel, abbreviated as "Brussels Expo," has its headquarters at B-1020 Brussels, Belgiëplein 1. VAT: BE0406.655.573.

Any natural or legal person who processes personal data must determine whether they are processing this data in the capacity of controller or processor. This distinction is very important when processing personal data. We therefore think it would be useful at this stage to briefly explain our activities, vision, and relationship with our partners.

Our mission is to promote and develop a center for meetings and exchanges by stimulating economic, commercial, industrial, scientific, cultural, and recreational activities, particularly through the territory and various buildings assigned to us by the City of Brussels. To this end, we develop all useful or necessary activities, in particular all services directly or indirectly related to the organization of trade fairs and exhibitions, congresses, conferences, exhibitions, concerts, festivals, and other events. As part of our mission, we alsostrive continuouslyto improve the customer experience when visiting our site. To achieve these objectives, we build our activities in collaboration with a number of partners.

We want to put a varied range of activities on the program. That is why we also want to offer a total service to event organizers. In this way, we hope to attract a wide variety of events that will appeal to both the general public and specific target groups. In a broader sense, and given our unique position, we perform an important coordinating role between events and in terms of overall strategy, with a view to achieving our main objective. In addition, we have decision-making authority in the choice of events organized, and we try to pursue a strategy that is in line with our desire to develop the sites entrusted to us.

From this special position, we conclude that a person who orders a ticket for an event is connected to both Brussels Expo and the organizer of the event they wish to attend. These two separate entities therefore both have the status of data controller as described above.

To ensure you are fully informed, we ask that you read not only our privacy statement, but also that of the organizer of the event you wish to attend.

5. What does this privacy statement cover?

This privacy statement is intended to inform you about what data we collect about you, why we collect it, and how we process it. Through this privacy statement, we want to inform you about our obligations and your rights regarding the protection of your personal data.

Our privacy statement applies to all personal data collected by Brussels Expo in the context of all its activities, namely: trade fairs and exhibitions, congresses, conferences, exhibitions, concerts, festivals, and other events, through one of the following means:

• Websitewww.brussels-expo.com
  Websitewww.bsf.be
  Websitewww.palais12.be
  Websitewww.la-madeleine.be
• Personal data collected when you participate in a survey or contest;
• Personal data collected when you purchase or obtain a parking ticket on the Brussels Expo parking platform, namely:parking
• Personal data collected when you purchase or obtain a ticket for an event via the Brussels Expo ticket service (i.e. links created specifically for each event and referring to the ticket platform in one of the following URL formats: xxx.tickets.brussels-expo.com or xxx.ticketlive.be or any other URL referring to the Brussels Expo ticket service).

By providing us with personal data via one of these means or any other means, you agree to provide accurate information about yourself.

6. What principles do we apply in the area of data protection?

We attach great importance to your personal data and privacy. Your trust in us is a priority. We strive to treat your data in a lawful, transparent, proper, and responsible manner. We make every effort to take the appropriate organizational and technical measures to protect your personal data. We do everything possible to limit ourselves to collecting data that is absolutely necessary in connection with achieving our objectives.

7. What data do we collect, how do we process it, and why?

7.1 We do not process sensitive data relating to race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, or data relating to a person's sexual behavior or sexual orientation. We do not process genetic or biometric data. In the event that the processing of so-called "sensitive" data is considered, you will be informed of this in advance.

7.2 The purchase of tickets is reserved for natural and legal persons who have the legal capacity to enter into a contract or, if applicable, have obtained the necessary consent from their parents or guardian (or any person exercising parental authority).

7.3 The data we collect and process is the data you voluntarily provide to us or to one of our processors or partners. For certain transactions when placing orders, you may be asked to provide data about yourself to third-party partners via their own services, more specifically when making payments. We will not have access to this data, as its collection and processing are governed by the specific terms and conditions of those third parties. We ask that you consult their terms and conditions before providing them with your data.

• Collected dataIf you want to order a ticket for the first time for an event organized at one of our sites, we offer you the choice between ordering with or without creating an account. In both cases, we collect the following data:
  • Title: mandatory identification information.
  • Last name, First name: required identification information.
  • Language: information necessary to facilitate communication with you.
  • Email address: required information, enabling us to communicate via email and send e-tickets.
  • Phone number: A mandatory piece of information that allows us to contact you in case of any issues related to the event. This information will not be used for any other purpose.
  • Date of birth: mandatory information that allows us to verify the age of our customers and prevent sales to minors. We also need this information to achieve our main goal, which is to develop our locations, as it gives us an overall picture of the age groups of people who visit our events. This allows us to adjust our strategy and programming.
  • Note: The reason why we sometimes ask for other information is explained at the time the information is collected.
  • When you purchase or obtain a parking ticket via our platform, the following data is also collected: last name, first name, email address, and postal code.
• Purposes: Our main task is to develop our locations, including by organizing events. With a view to achieving our social objective, we collect and process the aforementioned data in order to optimally carry out our various tasks and to offer an experience and service that meets your expectations. This information is also essential to identify you and fulfill our contractual relationship. By processing this data, we can send you a personalized or non-personalized ticket by email, as well as information about the event. This data also enables us to promote our activities and keep you informed of our offers and schedule. Finally, we also use the data to evaluate the events we organize as part of our overall strategy: age of visitors, location, satisfaction survey, etc.
• Processing: Depending on the case, the personal data collected will be:
  • used to create an account in your name (except for quick purchases);
  • used to create an admission ticket for the event;
  • used to issue a parking ticket that allows your vehicle to be parked in one of our parking lots;
  • recorded in a structured database;
  • used for various security reasons during your visit to one of our sites;
  • passed on to the organizer of the event for which you have ordered a ticket, who processes the data as the controller;
  • stored for the purpose of conducting evaluations in order to optimize our services;
  • used, where applicable, in our direct marketing campaigns (sending our calendar, offers, and promotions, etc.) if you have not objected to this;
  • used to generate statistics that help us improve our overall strategy for organizing events;
  • used to send you satisfaction surveys after the event. Your opinion will be used to improve and adapt the quality of our services.

7.4 Data collected during an event: if Brussels Expo installs Wi-Fi sensors and visual sensors to track visitors' movements during an event, after encryption, you will be informed of this processing via an information panel when you enter the event. This processing is based on the legitimate interests of Brussels Expo, the organizers, and exhibitors, as well as those of our visitors. These interests overlap. The aim is to improve the quality of the event by better managing crowds. This can lead to shorter waiting times in queues, facilities that are adapted to visitors' needs, better visibility for exhibitors, better communication of information to visitors based on the number of visitors at certain points, etc. This processing is carried out using equipment from third-party companies, among other things.

Where applicable, the data collected consists of the MAC addresses of your mobile device, which are encrypted almost immediately, and images captured by visual sensors, which cannot be used to identify visitors because the images are blurred and gray. Please note that you cannot be identified by the collection of this data. This data is encrypted, aggregated, and used to compile a statistical report that helps us better understand visitor movements and respond as effectively as possible to their needs and those of the organizers/exhibitors.

You can, of course, object to this processing by entering your MAC address on the following website: https://smart-places.org/mobile-location-analytics-opt-out/about-mobile-location-analytics-technology/

Please note that some mobile devices use technology that requires the MAC address to be changed regularly. Our opt-out system should allow you to opt out for your device despite this MAC address change. In any case, you can prevent this tracking by simply turning off your Wi-Fi.

8. On what basis do we process your data?

• Execution of an agreement: By purchasing a ticket on our website, you are bound by a contractual relationship that justifies the collection and processing of your personal data for the purpose of executing the contract: sending your ticket, granting you access to the event and/or one of our parking spaces (depending on the situation), providing you with information about the event if desired, managing the locations, etc. 
• Legitimate interest: It is in our legitimate interest to process your personal data for purposes that go beyond the scope of the contract. It is in our legitimate interest to promote our activities with a view to achieving our mission. We strive to process your data in a responsible manner based on our legitimate interest and to minimize the risks of violating your privacy. For example, we undertake to only contact people who have already purchased a ticket for one of the events organized on our site, and we offer you the opportunity to object to this type of processing easily and at any time. To ensure that our direct marketing campaigns do not violate your right to privacy, we have carefully weighed our legitimate interest against the risk of violating your privacy in order to assess the legitimacy of our interest. You may object to this processing at any time.
• Legal obligation: We may need to process your data to comply with a legal obligation arising from European Union or Belgian law. You cannot object to this processing.
• Consent: We may ask for your consent for certain processing of your personal data. You can withdraw your consent at any time.

9. How do we protect your data?

We have taken all technical and organizational measures necessary to protect your personal data in proportion to the risks of your rights being violated. Our security measures are regularly evaluated and adjusted to ensure a high level of protection at all times.

10. Who do we share your data with?

We undertake not to pass on or sell your personal data to third parties other than our subsidiaries, processors, or direct partners whose involvement is necessary to achieve the aforementioned objectives.

In the context of organizing an event, we share your personal data with:

• The organizer of the event for which you have ordered a ticket. The event organizer is also responsible for processing your personal data. We only pass on your personal data to the organizers of the events for which you have ordered a ticket, and we ensure that you can consult the privacy statement (if available) of the organizer in question at the time your data is collected.
• Processors: We engage companies to organize our activities. These companies process your personal data exclusively on the basis of our explicit instructions. We make every effort, to the extent possible and reasonable, to ensure that our processors process your data in accordance with the applicable legal standards. Access to your personal data is limited to the data that is strictly necessary for the performance of their tasks. All our processors are located in the European Economic Area and are subject to the legal and regulatory standards for data protection.

We will only transfer your personal data to a third country if the event organizer has its main office in a third country without a representative in the European Union. At the time of publication of this privacy statement, all organizers with whom we collaborate have an office in the European Union. You will be informed of any data transfer outside the European Union when you order your ticket for the event.

11. How long do we store your personal data?

The period during which personal data will be stored depends on the processing carried out. Brussels Expo stores your data for five years from your last purchase, with the exception of processing based on our legitimate interest (five years from the last contact) and processing justified by the legal obligations we must comply with. We do not store your payment details.

12. What are your rights?

You are in control of your data and how it is processed. We make every effort to ensure that your rights are respected. To manage your personal data optimally, you have the following rights:

• Right to information: You have the right to be informed in a transparent and clear manner about the processing of your personal data and your rights in this regard. We strive to achieve this by publishing this privacy statement and by always being available to provide you with additional information.
• Right of access: You have the right to obtain confirmation as to whether or not your personal data is being processed by us, and to access this data and all other data relevant to its processing.
• Right to rectification: If you find that the personal data about you is incorrect or incomplete, you have the right to ask us to supplement your data or, if necessary, to rectify it by providing us with additional information.
• Right to erasure: In certain cases, you have the right to ask us to remove your personal data from our database.
• Right to restriction of processing: In certain cases, you have the right to have the processing of your personal data restricted to storage only.
• Right to object: If the processing of your personal data is based on the legitimate interest of Brussels Expo, you have the right to object to this processing at any time.
• Right to portability: If the processing of your personal data is based on your consent or on a contract, and is carried out using automated procedures, you have the right to request your personal data in a structured, commonly used, and machine-readable format. You may request that your data be transferred to another controller.

We strive to respond to your requests to exercise your rights as quickly and efficiently as possible. However, we would like to inform you that in certain cases, as described in the relevant legal standards, we have the right to refuse to exercise certain rights if the situation justifies it. We will send you a reasoned refusal so that you can understand why we are unable to comply with your request.

We request that you exercise your rights by sending an email to the following address: [email protected].

Important: Before you provide us with your personal data, please note that we are required to disclose your personal data in the event that you exercise a right. To this end, our ability to verify the identity of the person submitting the request is limited. In accordance with our principle of limiting data collection to data that is absolutely necessary for achieving our purposes, we try not to collect more data than we already have in our possession when verifying your data. We therefore assume that any request to exercise your rights via your account or the email address you have registered with us is sufficient proof of your identity. We ask you to register with your own email address and to pay attention to the security of this address.

13. Where can you file a complaint in the event of a violation of your rights?

If you encounter any problems, you can always contact us at [email protected]. We will do our best to help you. You have the right to lodge a complaint with the Data Protection Authority at any time. More information is available at https://www.gegevensbeschermingsautoriteit.be/. 

14. Update to our privacy statement

Our privacy policy may be expanded or amended in the future, for example in response to new developments. We therefore advise you to consult it regularly.

Date of last update: 09/06/2023