B2C Privacy Policy

1. INTRODUCTION

Brussels Expo appreciates your interest in its products, services, and website. We want you to understand how we collect, process, and store your personal data, which we strive to do in a manner that respects your rights. We also want you to be aware of these rights. To that end, we invite you to carefully read this B2C Privacy Policy (hereinafter, the “ Policy ”).

This policy is established by the non-profit organization Parc des Expositions de Bruxelles (hereinafter “ Brussels Expo ,” “ we ” or “the Data Controller ”), with its registered office at Place de Belgique 1, B-1020 Brussels, and registered with the Crossroads Bank for Enterprises under number 0406.655.573, in order to comply with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter “ GDPR ”).

Our mission is to foster and develop a hub for meetings and exchanges with a view to promoting economic, commercial, industrial, scientific, cultural, and recreational activities, particularly throughout the territory and in the various buildings granted to us by the City of Brussels. We also have decision-making authority regarding the selection of events to be organized.

This position leads to the conclusion that our role under the GDPR when processing your data varies depending on the circumstances. When a data subject purchases a ticket to an event, that person has a relationship with both Brussels Expo and the event organizer. For the data we collect for ticketing purposes, Brussels Expo and the event organizer each act as separate data controllers. However, when Brussels Expo collects data that goes beyond what is necessary for managing its ticketing and the organizer’s specific request, Brussels Expo then acts as a data processor on behalf of that organizer.

This privacy policy does not cover data processing carried out by Brussels Expo in its capacity as a data processor on behalf of an event organizer; such processing is governed by the privacy policy of the relevant organizer. For your information, we encourage you to review both our privacy policy and that of the organizer of the event you wish to attend.

2. ESSENTIAL CONCEPTS

For the purposes of this Policy, the following terms shall have the meanings set forth below:

• " data subject” means any natural person who can be identified, directly or indirectly, by means of information.

For example : visitors to Brussels Expo, people who fill out contact forms on one of our websites, people who purchase a ticket for an event organized on our site or a parking ticket, and any other person whose personal data is provided to us, etc.

• " personal data ” or “ data” means any information relating to an identified or identifiable natural person.

For example : last name, first name, photo, national ID number, email address, customer number, employee number, etc.

• " processing of personal data ” means any operation or set of operations, whether or not by automated means, applied to personal data or sets of personal data.

For example : collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or any other form of making available, alignment or combination, restriction, erasure, or destruction.

• " data controller ” means the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing. In this case, that is Brussels Expo.

• " processor ” means a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the data controller.
• " third party ” means any natural or legal person, public authority, agency, or body other than the data subject, the controller, the processor, and those persons who, acting under the direct authority of the controller or the processor, are authorized to process personal data
• " recipient ” means the natural or legal person, public authority, agency, or any other body to which personal data are disclosed, whether or not it is a third party. However, public authorities that may receive personal data in the course of a specific investigative mission in accordance with Union law or the law of a Member State are not considered recipients; the processing of such data by the public authorities in question complies with the applicable data protection rules depending on the purposes of the

3. WHAT PERSONAL DATA DO WE PROCESS? AND HOW DO WE ACCESS IT?

• COLLECTION METHODS

1. Direct Collection

This Policy covers the processing of personal data carried out by Brussels Expo in connection with all of its activities, namely trade shows and fairs, conferences, symposia, exhibitions, concerts, festivals, and other events, in particular through one of the following means:

• brussels-expo.com website;
• Website: ing.arena.brussels;
• Website: la-madeleine.be;
• When you participate in a survey or contest;
• When you purchase or obtain a parking ticket parking the parking platform parking parking;
• When you purchase or obtain a ticket for an event through the Brussels Expo ticket office (specific links such as tickets.brussels-expo.com, xxx.ticketlive.be, or any other URL that redirects to the ticket office);

1. Indirect collection

It is also possible that some of your personal data may be provided to us indirectly, for example, when you purchase or receive a gift card or when you use a VIP ticket.

In such cases, it is therefore possible that the information we have about you was provided to us by third parties, rather than by you directly.

• CATEGORIES OF DATA PROCESSED

The purchase of tickets is limited to legal entities and individuals who have the legal capacity to enter into a contract or, where applicable, who have received the necessary authorization from their parents or guardians (or any person exercising parental authority).

The data we collect and process is the data you voluntarily provide to us or to one of our subcontractors or partners. For certain order-related operations, you may be required to provide your personal data to third-party partners through their own services, specifically when making payments. We will not have access to this data, as its collection and processing are governed by the terms and conditions specific to these third parties. We encourage you to review their terms and conditions before providing your data.

1. As part of an admission ticket to an event and/ora parking ticket

When you purchase a ticket for an event for the first time, we give you the option to place your order with or without creating an account. In either case, we collect:

• Last name, first name: required identification information;
• Gender: only if necessary due to a body search upon entering an event;
• Language: information needed to facilitate communication with you;
• Email address: Required information used to communicate with you via email and to send electronic tickets;
• Phone number: Required information that allows us to contact you in the event of a problem related to the event; this information will not be used for any other purpose under any circumstances;
• Date of birth: required information that allows us to verify our customers’ ages and prevent sales to minors when an event is not intended for a minor audience (for example, an adult entertainment fair); it is also useful for gaining an overall picture of the age groups of people attending each event, so that we can adapt our strategy and programming;
• Zip code and country: for statistical purposes;
• Any other data: The rationale for any additional requests will be provided at the time of collection.

1. As part of a gift card program

When a gift card is ordered, the following information is also collected regarding the recipient:

• First and last name (required identification information);
• Email address (required information used to contact the recipient and send them the card);
• Possibly, the information contained in the personal message addressed to the recipient, as provided by the purchaser of the gift card.

1. As part of an event

In the event that Brussels Expo installs Wi-Fi sensors and visual sensors to track—after encryption—visitors’ movements during an event, you will be notified of this processing at the event entrance via an informational sign. This processing is based on the legitimate interests of Brussels Expo, the organizers, and the exhibitors, as well as those of our visitors; the goal is to improve the quality of the event by managing crowds more effectively (reducing wait times, adapting facilities, increasing exhibitor visibility, improving communication based on crowd levels, etc.). This processing is carried out, among other things, using equipment from third-party companies.

If applicable, the data collected consists, on the one hand, of the MAC addresses of your mobile device—which are encrypted almost immediately—and, on the other hand, of images from visual sensors that do not allow for the identification of a visitor (blurred, grayscale images). This data is encrypted, aggregated, and used to generate a statistical report. You are, of course, free to opt out of this processing by registering your MAC address on the website https://smart-places.org/mobile-location-analytics-opt-out/about-mobile-location-analytics-technology/, or by simply turning off your Wi-Fi.

Please note that some mobile devices use technology that involves regularly changing the MAC address. Our opt-out system should allow you to opt out from your device despite this change in MAC address. In any case, you can avoid this tracking by simply turning off your Wi-Fi.

1. As part of your use of our virtual assistant, TILI

If you interact with our virtual assistant “TILI,” which is available exclusively on the ticketlive.be website, you may provide personal data about yourself.

• SPECIAL CATEGORIES OF DATA

As a matter of principle, Brussels Expo does not process special categories of personal data revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning your sex life or sexual orientation without your consent.

• NON-PERSONAL DATA

We may also collect non-personal data.

This data is classified as non-personal data because it does not allow for the direct or indirect identification of a specific individual. It may therefore be used for any purpose.

This includes, for example, anonymized data such as survey results.

However, if non-personal data is combined with personal data in such a way that the data subjects can be identified, such data will be treated as personal data until it is no longer possible to link it to a specific individual.

• CONSEQUENCES OF FAILURE TO PROVIDE THIS INFORMATION

Providing some of the information mentioned above is required to access certain services offered by Brussels Expo, including purchasing a ticket for an event.

If the data subject does not provide the requested personal data, the data subject will be unable to access the services offered by Brussels Expo.

• NO PROFILING OR AUTOMATED INDIVIDUAL DECISION-MAKING

Brussels Expo does not, under any circumstances, engage in automated profiling or individual decision-making.

4. WHY DO WE PROCESS YOUR PERSONAL DATA? AND ON WHAT LEGAL BASIS(ES) DO WE PROCESS YOUR PERSONAL DATA?

We process your personal data for specific purposes and in accordance with the relevant legal bases, as outlined in the following table:

5. WHO HAS ACCESS TO YOUR PERSONAL DATA?

We are committed to not sharing your personal data with third parties except as necessary to achieve the purposes stated above. In this regard, we may share your data with our subsidiaries, our service providers, law enforcement, or our direct partners whose involvement is necessary to fulfill the aforementioned purposes.

• INTERNAL RECIPIENTS

Access to your personal data is strictly limited within Brussels Expo, specifically to the following individuals:

• Authorized personnel in the Marketing & Ticketing department, particularly those responsible for managing your tickets;
• Authorized personnel in the Entertainment department, particularly with regard to the promotion of our services;
• Authorized personnel from the Operations department, particularly with regard to event organization, security management, and management of Brussels Expo’s IT infrastructure;
• Authorized personnel in the Legal Department, particularly with regard to the protection of Brussels Expo’s rights in court and compliance with applicable laws.
  • EXTERNAL RECIPIENTS

As part of our business operations, we may share your data with the following recipients, among others:

• The organizer of the event for which you purchased a ticket. This organizer is also responsible for processing your data. We only share your data with the organizers of the events for which you purchased a ticket, and we provide you with the organizer’s privacy policy at the time of data collection, when available.

Furthermore, when Brussels Expo collects personal data at the request of an event organizer, beyond what is necessary for ticketing purposes, Brussels Expo acts as a data processor on behalf of that organizer. In this case, and as previously stated, Brussels Expo processes this data only upon the organizer’s instructions. We invite you once again to review the privacy policy of the relevant organizer for any information regarding this data processing.

• The exhibitor at the event where you scanned the QR code on your admission ticket, in order to facilitate contact with the exhibitor. This exhibitor is also responsible for processing your data;
• Our subcontractors and external service providers whom we engage to support our business operations. These companies process your data only in accordance with our express instructions, and their access is limited to the data they strictly need to perform their tasks.
• Our external DPO, regarding the handling of your requests to exercise your rights and in the event of a personal data breach.

Brussels Expo may also be required to disclose certain personal data about you to third parties authorized to receive such information, particularly when such disclosure is required by law, a court order, or an order from a public authority. This may include disclosure to the following third parties: judicial or government authorities, banking institutions, police departments, bailiffs, etc.

• DATA STORAGE AND TRANSFER

Your personal data is hosted by Brussels Expo, which may itself use a qualified subcontractor with servers located within the European Economic Area (EEA).

These hosting solutions offer security measures to guarantee the confidentiality, availability, and integrity of your data. The chosen subcontractor also undertakes, under the same conditions, to back up your data or have it backed up under conditions that guarantee its security and integrity, and to protect it from any damage that may occur to the servers.

None of your personal data is transferred to third countries outside the European Union or to international organizations. Should this become necessary, we are committed to implementing appropriate security measures to ensure an adequate level of protection for your personal data.

6. HOW LONG DO WE RETAIN YOUR DATA?

Your personal data will be retained for as long as necessary to fulfill the purposes for which it was collected and, in any event, until the expiration of the statutory retention periods, particularly those related to tax and accounting matters, and until the expiration of the statute of limitations for contractual liability.

Your data will be deleted when:

• They will no longer be necessary for the purpose for which they were collected; or
• You have validly exercised your right to erasure; or
• You have withdrawn your consent, where the lawfulness of the processing is based on that consent.

The table below details certain specific legal bases and the corresponding data retention periods.

7. WHAT SECURITY MEASURES HAVE BEEN IMPLEMENTED TO PROTECT YOUR PERSONAL DATA? 

We have implemented the necessary organizational, technical, and physical measures—commensurate with the risks of infringement of your rights and freedoms—to best protect your personal data against unauthorized access, loss, destruction, or alteration.

Our security measures are regularly evaluated and adapted to ensure a consistently high level of protection.

We have implemented internal access control procedures to limit access to your data to only those individuals whose involvement is necessary for the purpose of processing.

8. WHAT ARE YOUR RIGHTS?

We do everything possible to ensure that your rights regarding your personal data are respected.

To this end, you have the following rights, under the conditions defined by applicable regulations, including the GDPR:

• The right to withdraw your consent to the processing of your personal data at any time for purposes based on such consent (right to withdraw consent);
• The right to obtain confirmation from Brussels Expo as to whether or not personal data concerning you is being processed and, if so, access to such personal data as well as to various details regarding the processing (purposes of the processing, categories of personal data involved, recipients or categories of recipients to whom the personal data have been or will be disclosed, the intended retention period for the personal data or, where this is not possible, the criteria used to determine that period, etc.) (right to information andright of access);
• The right to have Brussels Expo correct, as soon as possible, any personal data concerning you that is inaccurate or incomplete. If we have made your data available to other entities, we are required to take all necessary measures to inform those entities of your request for correction (right to rectification);
• The right to have Brussels Expo erase your personal data as soon as possible, where required by applicable law. If we have shared your data with other entities, we are required to take all necessary steps to inform those entities of your request to be forgotten (right to erasure);
• The right to have Brussels Expo restrict the processing of your data to storage only, where provided for by applicable law. If we have disclosed your data to other entities, we are required to take all necessary measures to inform those entities of your request to restrict processing (right to restriction of processing);
• When the processing of your personal data is based on your consent or a contract and is carried out using automated means, you have the right to request that this data be provided to you in a structured, commonly used, and machine-readable format. You may also request that this data be transferred to another data controller (right to data portability);
• The right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you (the right not to be subject to an automated individual decision);
• The right to object at any time to the processing of your personal data for marketing purposes, including profiling to the extent that it is related to such marketing (right to object).

Please note that even in this case, when weighing your interests against ours, our interests or fundamental rights and freedoms may take precedence and justify our processing of your data on the basis of our legitimate interest, despite your objection.

9. HOW CAN YOU EXERCISE YOUR RIGHTS?

You may exercise the rights described above free of charge by contacting our DPO, the law firm Lex4u, represented by Frédéric Dechamps, at the following email address:[email protected].

Your request must specify the right(s) you wish to exercise. We may ask you to provide proof of your identity for security reasons, to prevent the unauthorized disclosure or misuse of your personal data.

We will then have one month from the date we receive your request to respond. This period may be extended by two months, depending on the complexity or number of requests. If this occurs, the extension may only be granted if you have been notified and the reasons for the delay have been communicated to you.

If we decide not to proceed with your request, we will inform you of the reasons for our refusal or inaction.

In the event of manifestly unfounded or excessive requests, particularly due to their repetitive nature, we may:

(i) require payment of reasonable fees that take into account the administrative costs incurred in providing the information, making the disclosures, or taking the requested actions; or

(ii) refuse to comply with these requests.

It is incumbent upon us to demonstrate that your request is manifestly unfounded or excessive.

10. QUESTIONS, CLAIMS, OR COMPLAINTS

If you wish to raise a concern regarding any of the practices described in this Policy, we recommend that you first contact our DPO: the law firm Lex4u, represented by Attorney Frédéric Dechamps, who can be reached at the following email address: [email protected].

You may also contact the Data Protection Authority (hereinafter the“DPA”) if you are dissatisfied with how Brussels Expo processes your personal data, using the following contact information:

Data Protection Authority

35 Rue de la Presse

1000 Brussels

Tel. +32 2 274 48 00

Fax: +32 2 274 48 35

[email protected]

All information on this subject can be found on the APD website:

• autoriteprotectiondonnees.be/(EN);
• gegevensbeschermingsautoriteit.be/(NL);
• dataprotectionauthority.be(EN);
• datenschutzbehorde.be/(DE).

11. POLICY UPDATE

This Privacy Policy may be amended at any time to comply with applicable laws. The applicable version of the Privacy Policy is the one currently posted on our website:https://www.brussels-expo.com. We therefore recommend that you review it regularly.

Date of last update: June 15, 2026