Data Protection Policy for Bringme Users

Version 2026-05

Bringme (Bringme Finance NV and its affiliated companies) is committed to processing your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (hereinafter "GDPR") and other applicable legislation.

This data protection policy applies to the processing of your personal data that Bringme obtains through your use of Bringme products and services. Bringme processes your personal data for and on behalf of its client, the organisation that uses our services and makes them available to its users.

1. The Controller

Your organisation (being your employer or the manager of your residential building) (hereinafter "the Controller") has identified you as part of the target audience of end users of the services provided by Bringme (hereinafter "Services"). The Services include making all Bringme products available, as well as their maintenance to ensure the proper functioning of those products.

The Controller may have its own data protection policy regarding the processing of your personal data by Bringme, in which case that policy must be read together with this policy. In the event of any conflict, the Controller's policy shall take precedence (as certain specific arrangements may have been made between you and the Controller).

The Controller and Bringme have entered into an agreement regarding the performance of these Services.

2. The Processor

Bringme Finance NV and its affiliated companies (hereinafter 'Bringme', 'we', 'us' or 'our') with registered office at Bondgenotenlaan 138, 3000 Leuven, Belgium and registration number 0471.705.258, is the processor for the above processing of your personal data for the purpose of performing the Services.

"Affiliated company" means any entity that directly or indirectly controls, is controlled by, or is under common control with Bringme, where "control" means the ownership of more than 50% of the voting rights or the right to direct the policy and management of that entity.

3. Contact Details

If you wish to contact us regarding this policy, you may do so by emailing our DPO: legal@bringme.com.

Our Data Protection Officer (DPO) can be reached at legal@bringme.com or by post at: Bringme, for the attention of the DPO, Bondgenotenlaan 138, 3000 Leuven, Belgium.

If you wish to exercise any of your rights (see point 10), we kindly ask you to contact the Controller.

4. The personal data we process

The Controller is required to provide Bringme with the following personal data when creating or uploading users:

• Last name and first name;
• Email address.

Bringme also collects and processes the following personal data in the context of performing the Services:

• Location of the Bringme product used;
• Date of user registration, time of visitor check-in and check-out, time of use of the Bringme product and other usage information;
• Customer support message, verification message and meeting invitation title or email message;
• Bringme Desk only: compliance or non-compliance with the Controller's attendance requirements;
• Bringme Bell only: account name, video of the visitor and timestamp of the conversation.

The following personal data are only processed if and to the extent that the Controller or the user activates these optional features and provides the data:

• Office presence status (e.g. scheduled working days, remote working days, leave);
• Check-in and check-out times (at the office or at home);
• Parcel delivery data (including collection date, status and shipping information);
• Expected visitors (name of visitor, date, linked employee, meeting location, exact check-in and check-out time);
• Information about the Controller's Incident Response Team (name, job title, team role, office presence, business telephone number);
• Optional telephone number of the user.

These data are provided to us by the Controller, who (a) has lawfully obtained such personal data from you and lawfully provided them to Bringme, (b) has provided Bringme with personal data that are accurate and up to date, and (c) will provide you with relevant information about the processing activities.

5. Purposes and legal basis for processing

We process personal data because this is necessary for the performance of the Services in accordance with our agreement with the Controller (legal basis). In this context, we process your personal data for the following purposes on the instructions of the Controller (depending on the Bringme Services you use):

• Creating user accounts and inviting users to create their Bringme account;
• Sending and receiving communications to users (e.g. authentication notifications and delivery notifications for parcel deliveries) by email and SMS;
• Facilitating the use of Bringme products (e.g. collection and delivery of parcels);
• Providing an overview of all deliveries and shipments via the Bringme Box in the Bringme App;
• Recording the start and end times of employees' working day via the Bringme App;
• Recording employees' office days via the Bringme App;
• Providing an overview of the Controller's Incident Response Team, indicating their job title, office presence and telephone number;
• Providing an overview of employees' office days;
• Any other processing necessary for the performance of the agreement with the Controller, within the limits of the Controller's instructions.

Bringme will not process your personal data for purposes other than the performance of the Services and/or the fulfilment of the responsibilities set out in the agreement between Bringme and the Controller. Bringme will only process your personal data on the instructions of the Controller and in accordance with the Controller's documented instructions.

6. Sharing personal data with third parties / international transfers

We only disclose relevant aspects of personal data to third parties where those parties are contractually bound to Bringme or act on behalf of or under contract with Bringme. We have of course made arrangements with these parties regarding the protection of your personal data.

Bringme may disclose personal data where this is necessary to comply with a legal obligation to which we are subject, or to protect (vital) interests. We may also disclose personal data where such disclosure is necessary for the establishment, exercise or defence of legal claims, in judicial proceedings or in administrative or out-of-court proceedings.

We do not transfer personal data to companies outside the European Economic Area, unless there is an adequacy decision, standard contractual clauses, appropriate safeguards, binding corporate rules or transfers as referred to in Article 49(1) GDPR.

In the event of a full or partial reorganisation, merger, demerger, acquisition or sale of assets, we are entitled to transfer personal data to the relevant third party.

7. Storage and deletion of personal data

A user's personal data are retained for as long as that user's Bringme account exists and are automatically and permanently deleted once the account is deleted.

The account may be deleted in the following ways:

• the user can delete their own account at any time in the Bringme App;
• the Bringme administrator (the Controller) can delete a user account at any time;
• Bringme can delete the account at any time at the request of the user or the Controller;
• each year, "inactive" accounts are deleted by Bringme: an account is inactive when it is no longer linked to any Bringme product, or when no Bringme product has been used for more than one year.

For the Bringme Manager and Bringme App, automatic deletion applies once the user account is deleted. For the Bringme Desk and Bringme Bell, the Controller can set its own retention periods (retain until the user or administrator deletes the account, or for 1 month, 1 year, 2 years or 5 years). Exceptions are possible to the extent that Bringme is legally required to retain certain data for longer (e.g. tax, accounting or judicial obligations). In that case, access to such data is restricted to what is strictly necessary.

8. Automated decision-making & profiling

Bringme does not use automated decision-making or profiling that produces legal effects or similarly significantly affects you within the meaning of Article 22 GDPR.

9. Your data protection rights

Your requests regarding the exercise of your data protection rights must be addressed to the Controller, who is responsible for handling such requests. These will under no circumstances be handled by Bringme, unless the Controller expressly instructs it to do so.

For information purposes and for the sake of clarity, we have summarised your rights under the GDPR in this section. As some of these rights are complex, not all details are included in this summary. You may therefore read the relevant legislation and regulations for a full explanation of these rights, or contact the Controller.

To exercise your rights, you must also prove your identity adequately. In this regard, we recommend that you attach a secure copy of your identity document to your request. A secure copy means that all non-essential information is redacted and a watermark is added. This watermark must contain the purpose of the copy, the recipient and the date of issue. The only information that is necessary is your name (so all other information can be redacted).

• Right of access and right to a copy of your personal data: you have the right to be informed as to whether or not the Controller is processing your personal data and, if so, to access those personal data, along with the supplementary information referred to in Article 15 GDPR. Where the protection of the rights and freedoms of others is not adversely affected, the Controller will provide you with a copy of your personal data.
• Right to rectification: you have the right to have inaccurate and / or incomplete personal data rectified and / or completed.
• Right to erasure: you have the right to have your personal data erased in the circumstances set out in Article 17(1) GDPR, such as when you object to processing or the legal basis ceases to apply.

The Controller is responsible for handling your request. Bringme will carry out the deletion on the instructions of the Controller, unless a statutory retention obligation applies.

• Right to restriction of processing: you have the right to restrict the processing of your personal data in the circumstances set out in Article 18(1) GDPR, such as where you contest the accuracy of the personal data.
• Right to data portability: you have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format, and to transmit those data to another controller, where (a) the processing is based on consent or is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract, and (b) the processing is carried out by automated means. This right does not apply, however, if it would adversely affect the rights and freedoms of others.
• Right to withdraw consent: to the extent that the legal basis for the processing of your personal data by Bringme is consent, you have the right to withdraw that consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

We hereby confirm that the processing activities relating to your personal data are not based on your consent, but on the performance of the agreement between Bringme and the Controller.

• Right to lodge a complaint with the supervisory authority: we always encourage you to forward any questions, comments or complaints regarding the processing of your personal data in accordance with point 8. In any event, in particular if you disagree with Bringme's position following a complaint/request or the way in which your request was handled by Bringme (for example if you believe that our processing of your personal data is contrary to data protection legislation or if you have comments about the use of your personal data), you have the right to lodge a complaint with the competent supervisory authority, including the Belgian Data Protection Authority (GBA) (online or by letter to the Data Protection Authority at 35 Drukpersstraat, 1000 Brussels).
• Right to object to processing: you have the right to object to the processing of your personal data by Bringme on the basis of Article 6(1)(e) or (f) GDPR on grounds relating to your particular situation. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

In addition, you have the right to object to our processing of your personal data for scientific, historical or statistical (research) purposes on grounds relating to your particular situation, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

10. Updates

Bringme reserves the right to make changes and/or updates to this Data Protection Policy in order to take account of technological advances, changes in legislation and regulations, and good business practices.