Privacy Policy

1. Identity of the controller

Yusto BV (hereinafter “Yusto”, “we”, or “us”) respects your privacy and strives to always handle your personal data with the necessary care and confidentiality. We undertake to always comply with the General Data Protection Regulation (hereinafter “GDPR”), our deontological obligations and any other applicable regulations.

This Privacy Statement applies to the personal data that we (where appropriate jointly with our lawyer collaborators) process about you in the context of our professional activities as a law firm. We therefore process your personal data mainly in the context of the legal services we provide to our clients.

Yusto is a company governed by Belgian law. You will find all our relevant details below and you can always contact us using the contact details provided for any further questions or comments regarding the way we handle your personal data.

Name and legal form: Yusto BV
Company number: 0894.798.472
Address: Victor Nonnemanstraat 15 B, 1600 Sint-Pieters-Leeuw, Belgium
E-mail address: mbo@yusto.be

2. What does ‘processing personal data’ mean?

The processing of personal data (hereinafter “data”) includes any processing of data that can identify you as a natural person. This may include, for example, your contact details, court judgments in proceedings in which we act for or against you, or family, financial or criminal data in connection with a matter we handle for you. You can read more about exactly which data this concerns further on in this Privacy Statement. The concept of ‘processing’ is very broad and includes, among other things, the collection, storage and use of your data, or sharing it with third parties. Yusto processes your data only in the context of its professional activities as a law firm.

3. To whom and when does this Privacy Statement apply?

This Privacy Statement applies in cases where Yusto is responsible for processing your data. This means that Yusto determines for which purposes (why) and by which means (how) your data are processed (where appropriate jointly with our lawyer collaborators, see below).

For the sake of completeness, we point out that, as a law firm, we rely on the services of our lawyer collaborators, who, in view of the lawyer’s special status, provide these services on a self-employed and strictly independent basis. When providing their services to us as a firm and to our clients, these persons will therefore act as joint controllers together with Yusto. However, Yusto has agreed with its lawyer collaborators that, for the purposes of the GDPR, Yusto will be responsible for informing data subjects and answering any requests in this regard. This Privacy Statement therefore fully applies also in cases of the aforementioned joint controllership.

Specifically, this means that this Privacy Statement applies to the processing of data of the following categories of persons. This also includes persons who previously belonged to these categories (e.g. former client), or persons who may belong to these categories in the future (e.g. prospective client).

Since the data we process about you and the purposes thereof largely depend on your specific relationship with Yusto, we will, where relevant, continue to make a distinction between these categories of persons in the Privacy Statement. It is also possible that you belong to several categories at the same time (e.g. you are a client and a business partner). In addition, you will always fall under the ‘General’ category, since a number of our processing operations may potentially be relevant for all our
contacts.

General: All our contacts. The general processing operations within Yusto are potentially relevant for all our contacts and are therefore listed first below under each of the relevant headings.

Clients: Persons to whom we provide our legal services as lawyers, in the context of a (potential) legal dispute or otherwise (e.g. assistance in the context of legal proceedings, drafting of legal documents and opinions, mediation …). Where appropriate, we provide our services to our clients via an intermediary, such as these persons’ regular counsel (in the case of a referral, replacement or subcontracting). We also consider participants in training courses, seminars or workshops that we provide (on our own initiative or at a client’s request) as clients for the purposes of this Privacy Statement.

Involved parties: Persons involved in the matter we handle for our client and who can be distinguished as a party separate from our client (e.g.
the opposing party or other summoned parties in judicial proceedings, or parties involved in a dispute in respect of which no proceedings are yet pending, e.g. the (sub)lessor/tenant, employee, employer of our client …). We necessarily need to process data about these parties in order to provide the services for which the client has engaged us.

Business partners: Persons who assist us in providing our legal services as a law firm, persons who as a business partner call upon our services in the name of their client (e.g. the regular counsel of a person who engages us for a specific matter, by way of replacement or subcontracting), or persons who act as counsel for an involved party or otherwise professionally represent them or exercise a specific mandate in relation to them (e.g. trustee, administrator, …).

Applicant: Persons who submit an application to us with a view to filling a position within our law firm.

Where one of the persons referred to above is a legal entity, we still process data about our contact persons within these entities, or their representatives.

4. Which personal data do we process?

Below we explain which data we may process about you, depending on your relationship with Yusto. Depending on the specific situation and your preferences and capacity, we do not always process all of the data listed below about you. For clarity, we first indicate below which data we generally process about all our contacts. We then clarify which additional data we process for specific categories of contacts, namely clients and involved parties, business partners and applicants.

General

For all our contacts, we may process the following data (examples are non-exhaustive):

Electronic identification and usage data: IP address, browser type, location data, the route by which you arrive at our website, the type of device with which you visit our website, the web pages visited, the way you navigate on the visited web pages. These data are mainly processed through the use of cookies. For more details, we refer to our separate Cookie Statement. In this Privacy Statement, however, you can already find which data we collect from you via cookies, together with the legal bases for this and the general purposes thereof.

Identification data: A copy of your identity card (solely to verify your identity if necessary when you wish to exercise one of your rights as a data subject
under the GDPR).

Contact details and history: Last name, first name, address, e-mail address, telephone number, sent and received communications (e.g. e-mails, letters, …).

Image and sound: CCTV footage (for the purpose of monitoring and securing our offices, in particular through the presence of surveillance cameras at the entrances to our offices).

Clients and involved parties

For our clients and involved parties, we may additionally process the following data. In our relationships with these persons, it goes without saying that the processed data largely depend on the type of matter we handle for our client and which data are required for an efficient handling thereof.

Identification data: Extract from the National Register and national register number (e.g. in the context of a writ of summons), a copy of your identity card.

Personal details: Age, gender, date of birth, profession and all relevant additional data in this regard for your matter, nationality, residence history, if you are a client: data that could be relevant to send you a corporate gift.

Family data: Marital status, data about the marriage or the current form of cohabitation (e.g. matrimonial property regime), details regarding previous marriages or partnerships, identification data and details regarding family or household members, or descendants.

Financial data: Data relating to income, your assets and debt burden, bank statements, the assets and liabilities of your company or association, solvency data, salary data, your social security status or any other data concerning the financial situation that are relevant in the context of a specific matter.

Payment and invoicing data: Payment card data, bank account number, bank account holder, invoices.

Image and sound: Photos and video footage or audio recordings provided to us in connection with a specific matter (e.g. as evidence), or made by us (e.g. in the context of expert examinations or factual findings).

Service provision and feedback: If you are a client: lawyer engagement agreement, your attendance at trainings, seminars and workshops we provide, your ratings and experiences regarding the services provided.

Judicial data: Data concerning civil, administrative and criminal proceedings that are relevant in the context of a specific matter, the decisions in such proceedings in which we act for or against you.

Criminal data: Data concerning criminal convictions and criminal offences, insofar as relevant in connection with a specific matter, for example for the purpose of asserting your interests as a civil party or for your criminal defence, such as official reports, your extract from the Criminal Register, and imposed convictions.

Special categories of personal data: As lawyers, we regularly and inevitably come into contact with special categories of personal data, the processing of which is subject to strict conditions under the GDPR. These include, among other things: race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, health data, and data concerning sex life or sexual orientation. These are processed only if necessary for handling your legal question or matter, and where relevant the related proceedings. If these data are not relevant in connection with a specific matter, they are not specifically recorded in our systems, but may nevertheless form part of your file because they are included in, or can be inferred from, other data we hold about you (e.g. judgments and rulings concerning you). In that case, we try to limit the processing of these data as much as possible.

Business partners

For our business partners, we may additionally process the following data:

Service provision, payment and invoicing data: Agreements, performance overview, payment card data, bank account number, bank account holder, invoices.

Feedback: Your ratings and experiences regarding our cooperation.ul>

Applicants

For applicants, we may additionally process the following data. This will of course largely depend on which data you yourself wish to provide to us in connection with your application.

Personal details: Age, gender, date of birth, marital status, nationality.

Work-related data: Curriculum vitae, education, certificates and transcripts, language skills, professional career, publications.

Personality profile: Motivation letter, hobbies, social activities, personality, notes from the job interview.

Image and sound: Photos and video footage you would provide to us yourself as part of your application.

5. For which purposes and on which legal bases do we process your data?

We process your data only for legitimate purposes that fall within the scope of our activities as a law firm. The processing is always based on the legal bases listed in the GDPR.

For clarity, we first provide an overview below of the purposes and legal bases of the general processing operations within Yusto. We then list the processing operations that are relevant for specific categories of contacts, namely clients, involved parties, business partners and applicants.

General

The processing operations below are potentially relevant for all our contacts. Answering your question when you contact us, if this does not fall within an existing, former or potentially future relationship with you as a client, involved party, business partner or applicant.
- Legitimate interest

Complying with the legal obligations that apply to us as a law firm, such as in the area of data protection, deontology, tax/accounting, and with regard to regulations on, among other things, anti-money laundering, the UBO register, and anti-terrorism.
- Legal obligation

Promoting Yusto’s activities by using your contact details to send you newsletters or other marketing material by e-mail, if you explicitly give your consent, for example by e-mail or via the subscription form on our website. You have the right to withdraw your consent at any time by using the unsubscribe link at the bottom of each such message you receive from us.
- Consent

Providing a website that functions well technically by using strictly necessary cookies, so that we can offer you a safe and properly functioning website.
- Legitimate interest

Using analytical cookies on our website to gain insight into how you use our website, including for the purpose of detecting navigation problems and making the website more user-friendly and attractive.
- Consent

Using marketing cookies on our website, for the purpose of displaying advertisements, implementing functions on our website provided by social media, and measuring how often these advertisements and functions are displayed and used respectively.
- Consent

Ensuring security within our offices and the efficient protection of the property of Yusto, its employees, clients and third parties through the presence of surveillance cameras in/around our offices, in particular at their entrances, with the strict purpose of monitoring and securing our offices.
- Legitimate interest

Ensuring the possibility to exercise or defend Yusto’s interests in legal proceedings, and actually doing so, if we consider that our interests are harmed and legal proceedings are warranted (e.g. judicial recovery of unpaid fees), or if legal action were to be taken against us by a person who feels harmed by us (e.g. to conduct a defence if you would wish to hold us liable for shortcomings in our legal services).
- General: legitimate interest
- Special categories of data: necessity for the establishment, exercise or defence of legal claims within the meaning of Article 9(2)(f) GDPR.
- Criminal data: necessity for the management of our own disputes.

Clients

For our clients, we additionally process the data for the following purposes:

Entering into, performing or terminating the agreement with you as our client, including:

answering your prior (quotation) questions
requesting all relevant information prior to the (possible) provision of our services
complying with our pre-contractual obligations
the conclusion of the lawyer engagement agreement
scheduling consultations
carrying out the specific legal assignment for which you engaged us, such as studying and answering your legal question, drafting legal documents, assisting and/or representing you in negotiations or transactions, or in the context of (potential) judicial proceedings, providing legal training or workshops, acting as a mediator
processing relevant data in any documents intended for the court or any other competent authorities, such as writs of summons, petitions and submissions
further follow -up and handling of your matter
general management of the client relationship, such as through communication with Yusto staff, and by invoicing and collecting the amounts you owe us as a result of the provision of our legal services the exercise of specific mandates such as that of administrator.

- General: necessity for the conclusion or performance of an agreement. Legitimate interest (for contact persons at our client who are not a party to the agreement).
- Special categories of data: necessity for the establishment, exercise or defence of the legal claims of our client within the meaning of Article 9(2)(f) GDPR.
- Criminal data: necessity for the defence of our client’s interests.

Promoting our services and activities (e.g. self-organised events and seminars) by using your contact details to send you marketing material (including corporate gifts) by e-mail or another channel, within the framework of our existing client relationship and for services similar to those you have already purchased from us, for a reasonable period after your last use of our legal services.
You have an absolute right to object to this processing, after which we must stop this processing. For marketing messages that we send you by e-mail, you can exercise this right at any time by using the unsubscribe link at the bottom of each such message you receive from us.
- Legitimate interest
- Consent if you have explicitly requested this (e.g. by e-mail)

Improving our services based on your feedback as our current or former client, and assessing your interest in services not yet offered with a view to possibly expanding our offering as a law firm. We pursue these purposes by:

conducting market research;
checking your satisfaction and requesting your valuable feedback on our services.

- Legitimate interest

Involved parties

For involved parties, we additionally process the data for the following purposes:

Taking all necessary measures vis-à-vis you to provide the specific legal services for which our client has engaged us and to realise their legal claims, whether or not in the context of an ongoing dispute, such as, among other things:

sending notices of default to your address in the context of a dispute between you and our client
attempting mediation or conciliation with our client with a view to preventing or ending a dispute
processing data relating to you in any documents intended for the court or any other competent authorities, such as writs of summons, petitions, and submissions
assessing your financial situation or that of your company if necessary in connection with a matter, e.g. for the purpose of a potential acquisition or merger, or the collection of unpaid invoices
representing our client in negotiations with you, or in the context of ongoing proceedings in which you are also a party
asserting our client’s legal claims by taking the necessary legal steps with the competent authorities, and contacting you or your counsel in this regard, at any stage of the dispute and regardless of whether judicial proceedings are pending in this respect
the exercise of specific mandates such as that of administrator.

- General: the legitimate interest of our client, or ours.
- Special categories of data: necessity for the establishment, exercise or defence of the legal claims of our client within the meaning of Article 9(2)(f) GDPR.
- Criminal data: necessity for the defence of our client’s interests.

Business partners

For our business partners, we additionally process the data for the following purposes:

Entering into, performing or terminating the specific agreement with you as our business partner, namely (replacement) assignments on behalf of fellow lawyers, supplier agreements or any other cooperation agreement, including negotiating a potential cooperation, concluding the cooperation agreement, managing our relationship as business partners, paying the amounts we owe you as your business partner, or invoicing and collecting the amounts you owe us as a result of the cooperation.
- Necessity for the conclusion or performance of an agreement
- Legitimate interest (for contact persons at our business partner who are not a party to the agreement)

Improving our services based on your feedback as our current or former business partner, and assessing your interest in services not yet offered with a view to possibly expanding our offering as a law firm. We pursue these purposes by:

conducting market research;
checking your satisfaction and requesting your valuable feedback on our services.

- Legitimate interest

If you are counsel for an involved party: contacting you for the purpose of complying with our deontological obligations and, where relevant, for consultation, in order to inform you, as necessary, of all relevant elements of the file as counsel for an involved party.
- Legal obligation, where this falls within a legal obligation
- Legitimate interest, in all other cases

Applicants

For our applicants, we additionally process the data for the following purposes:

Assessing whether Yusto wishes to enter into an employment, internship or cooperation agreement with you.
- Necessity for the conclusion of an agreement

Consulting the applicant’s profile on professional social media channels.
- Legitimate interest

Retaining the data you provided to us in the context of an application for a maximum of 2 years, if you have an interesting profile but we were initially unable to make you an offer because no suitable position was available. If a suitable position becomes available, we use your data to contact you again and gauge your interest in further discussions.
- Consent

6. With whom do we share your data?

We do not transfer your data to third parties, except where this is strictly necessary in light of the purposes mentioned above (e.g. for a specific matter), or if we are legally obliged to do so.

Where necessary, we rely on external service providers to support our operational purposes, such as managing our IT systems and digitally storing our files. These external service providers may, where appropriate, act as processors by carrying out certain processing operations on our behalf. We will share your data with these external service providers only to the extent necessary for the relevant purpose. They may not use the data for other purposes. In addition, these service providers are contractually bound to ensure the confidentiality of your data by means of a so-called “data processing agreement” concluded with these parties.

Specifically, this means that we share your data, insofar as relevant in your situation, with the following third parties for the following purposes, with these third parties in certain cases acting as processors on our behalf:

Postal companies, transport and delivery companies for the purpose of sending mail, or official or judicial documents to you as our current, former or potentially future client, involved party, business partner or applicant.
- Necessity for the conclusion or performance of an agreement, if an agreement has been concluded between us or is being considered.strong>
- Our legitimate interest or that of our client, in all other cases.
- Special categories of data: necessity for the establishment, exercise or defence of the legal claims of our client within the meaning of Article 9(2)(f) GDPR, or the management of our own disputes within the meaning of Article 9(2)(f) GDPR.
- Criminal data: necessity for the defence of our client’s interests or the management of our own disputes.

Payment service providers for the data relevant to processing your payments to Yusto as a client, involved party, or business partner, or for the
processing of (re)payments by Yusto to these persons, for the purpose of efficient management of the payment administration within our law firm.
- Necessity for the conclusion or performance of an agreement, if an agreement has been concluded between us or is being considered.
- Our legitimate interest or that of our client, in all other cases.

The processors who assist us in carrying out our activities as a law firm, including in the IT domain (for efficient digital data management, including digital storage of our files, sending transactional e-mails such as scheduling consultations and legal work, invoicing completed assignments, managing our agenda, hosting and managing our mailboxes), and processors who provide us with specific support in a particular matter (e.g. a translator where it is necessary for a document to be translated), or any other processors we rely on (e.g. our security company).
- Necessity for the conclusion or performance of an agreement, if an agreement has been concluded between us or is being considered.
- Our legitimate interest or that of our client, in all other cases.
- Special categories of data: necessity for the establishment, exercise or defence of the legal claims of our client within the meaning of Article 9(2)(f) GDPR, or the management of our own disputes within the meaning of Article 9(2)(f) GDPR.
- Criminal data: necessity for the defence of our client’s interests or the management of our own disputes.

Business partners we rely on in the context of providing our legal services, such as:

other lawyer (firms) we engage to handle a specific aspect of a matter (e.g. in an area in which we do not usually act, or to minimise costs by engaging a lawyer from another region to attend a specific hearing or carry out another local assignment)
bailiffs and notaries.

- Necessity for the conclusion or performance of an agreement, if an agreement has been concluded between us or is being considered.
- Our legitimate interest or that of our client, in all other cases.
- Special categories of data: necessity for the establishment, exercise or defence of the legal claims of our client within the meaning of Article 9(2)(f) GDPR, or the management of our own disputes within the meaning of Article 9(2)(f) GDPR.
- Criminal data: necessity for the defence of our client’s interests or the management of our own disputes.

If you are a client or involved party, to the involved party or their counsel, respectively to our client, at your request or in the context of complying with our deontological duty to inform, with due regard to the principle of proportionality and after careful consideration in light of the specific matter.
- Necessity for the conclusion or performance of an agreement, if an agreement has been concluded between us or is being considered.
- Our legitimate interest or that of our client, in all other cases.
- Special categories of data: necessity for the establishment, exercise or defence of the legal claims of our client within the meaning of Article 9(2)(f) GDPR, or the management of our own disputes within the meaning of Article 9(2)(f) GDPR.>
- Criminal data: necessity for the defence of our client’s interests or the management of our own disputes.

Government bodies, judicial authorities and practitioners of regulated professions such as bailiffs, notaries, accountants and external lawyers, and administrators of legally regulated databases, for the purpose of complying with our legal and deontological obligations as lawyers and the efficient defence of our client’s interests or our own interests in the context of any legal dispute, with regard to the data that are strictly necessary for this.
- Necessity for the conclusion or performance of an agreement, if an agreement has been concluded between us or is being considered.
- Our legitimate interest or that of our client, in all other cases.
- Special categories of data: necessity for the establishment, exercise or defence of the legal claims of our client within the meaning of Article 9(2)(f) GDPR, or the management of our own disputes within the meaning of Article 9(2)(f) GDPR.
- Criminal data: necessity for the defence of our client’s interests or the management of our own disputes.

7. How long do we retain your data?

We do not retain your data longer than necessary for the purpose for which the data were collected and are processed, as specified above.

This mainly concerns offering and providing our legal services as a law firm and keeping files that contain all relevant data for proper handling thereof in line with legal and deontological requirements. Under normal circumstances, we retain your data as a client or involved party for at least 5 years and at most 15 years after closure of your matter. This is pursuant to our legal obligations in this regard, and to safeguard our evidence in the event of a dispute, or in connection with potential shortcomings in the services provided in light of our professional liability. In addition, certain matters must take into account long limitation or forfeiture periods (whether contractual or not).

For business partners, we retain your data as long as necessary for correct and efficient management of our cooperation. After termination of our cooperation, we retain your data for a reasonable period in light of any disputes or our potential liability.

For your data that may appear to a limited extent in our accounts, as a client, involved party, or business partner, these are retained for 7 years in the context of our legal obligations in this regard.

For your data as an applicant, we undertake to delete your data within a reasonable period if the application does not initially lead to a cooperation proposal. However, if in that case you give your specific consent for us to retain your data so that we can contact you again later, we will retain your data for a maximum of 2 years.

CCTV footage recorded in and around our offices is retained for no longer than 1 month, unless the footage can be lawfully used in accordance with the Belgian Camera Act for evidential purposes or to identify persons involved in a crime.

8. Where do we store your data and how are they protected?

For the digital storage of your data, we mainly rely on external specialised service providers who store them on servers in adequately secured data centres. We process your data mainly via Microsoft 365 and our specialised office software.

We outsource a large part of our processing operations in the context of our activities as a law firm to third parties, as explained under heading 6. Any external service providers may, where appropriate, act as data processors on our behalf.

We and our processors have taken the necessary physical and appropriate technical and organisational (precautionary) measures to secure your data against loss or any form of unlawful processing. We only grant access to the data to our own staff and third parties if they need access for legitimate, relevant business purposes.p>

Your data are, as far as possible, stored within the European Economic Area (EEA). However, it is possible that, in certain cases and to a limited extent, when using ancillary software tools, your data may be processed outside the EEA. This will only take place in or from countries for which the European Commission has confirmed that they ensure an adequate level of protection of your data, or where other measures have been taken to ensure lawful processing of your data in those third countries. Your file data are, however, stored at all times on servers located within the EEA, via the supplier of our office software.

9. From whom do we receive your data?

For clients, business partners and applicants, we mainly obtain your data directly from you. This is in connection with the contact we have with each other with a view to the (possible) provision of legal services, a (possible) cooperation, or because you act as counsel for an involved party. However, we cannot exclude that, in specific circumstances, we obtain some of your data indirectly, from public sources or from third parties.

When we obtain data from the above categories of persons from public sources, this may involve consulting the Crossroads Bank for Enterprises (CBE), for example to check who within your company has management authority, or to verify your proposal for cooperation on behalf of a company. It is also possible that we obtain your data via your company, when the company in which you work is our client or business partner and we need your data in this regard. We may also obtain your data from third parties, such as courts and tribunals, for example to request judgments and rulings in cases in which we have defended your interests, or cases that are relevant for other reasons to our legal services to you. If you act as counsel for an involved party, it is possible that we obtain your data via judicial documents or via your firm.

For applicants, we may additionally consult your profile on professional social media channels.

For involved parties, we obtain your data partly directly from you (e.g. direct consultation with a view to reaching an amicable solution). In addition, we may also obtain your data to a large extent from public sources or from third parties, including our client, your own counsel, or other involved parties in a matter. With regard to public sources, this concerns in particular your data that we consult or collect in the context of carrying out a specific assignment via various private or government databases (e.g. the Crossroads Bank for Enterprises, the Central File of Notices of Attachment, the Belgian Official Gazette, publications on the website of the National Bank of Belgium), or your profile on social media channels and other publicly accessible information. With regard to information obtained from third parties, we may request information about you from your counsel, administrator or trustee. We will only request and include your data in our files insofar as this is relevant and necessary in light of a specific assignment we carry out for our client.

10. What are your rights?

You have various rights with regard to the data we process about you. If you wish to invoke one of the rights listed below, please contact us using the contact details included in the first section of this Privacy Statement.

10.1 Right of access and copy
You have the right to access your data and obtain a copy thereof. This right also includes the possibility to request further information about the processing of your data, including the categories of data processed about you and the purposes for which this is done. Professional secrecy may (temporarily) not allow us to comply (fully) with such a request.

10.2 Right to amendment or rectification
You have the right to have your data amended if you believe we hold incorrect data.

10.3 Right to erasure (right to be forgotten)
You have the right to request that we erase your data without undue delay. However, we will not always be able to comply with such a request, including where we still need the data in connection with an ongoing matter or ongoing agreement, or where retaining certain data for a certain period is legally required.

10.4 Right to restriction of processing
You have the right to restrict the processing of your data. In that way, processing is (temporarily) suspended until, for example, there is certainty about its accuracy.

10.5 Right to withdraw your consent
Where processing is based on your consent (see above under headings 5 and 6), you have the right to withdraw this consent at any time by contacting us. For promotional messages you receive from us by e-mail, you can easily exercise this right by clicking the unsubscribe link at the bottom of each such message.

10.6 Right to object
You have the right to object to the processing of your data that is based on our legitimate interests or those of our clients. This must be done on the basis of specific reasons relating to your situation. In that case, we must stop the processing unless we can demonstrate compelling legitimate grounds to continue processing.

However, you can always object to the use of your data for direct marketing purposes, after which we are obliged to stop processing for these purposes. For promotional messages you receive from us by e-mail, you can easily exercise this right by using the unsubscribe link at the bottom of each such message.

10.7 Right to data portability
You have the right to obtain your data that you provided to us yourself with your consent or in performance of an agreement, in electronic form. This way they can easily be transferred to another organisation. You also have the right to request that we transfer your data directly to another organisation, where technically feasible.

10.8 Right to lodge a complaint with your supervisory authority
If you believe that we process your data incorrectly, you always have the right to lodge a complaint with your supervisory authority for data protection. You can do so with the supervisory authority of the EEA Member State where you usually reside, where you have your place of work, or where the alleged infringement took place. Since we are members of the Belgian Bar Association, and we carry out our activities mainly in and from Belgium, we refer below to the contact details of the Belgian Data Protection Authority.

Belgian Data Protection Authority (DPA)

Drukpersstraat 35
1000 Brussels
+32 (0)2 274 48 00
contact@apd-gba.be
DPA Website - lodge a complaint

For further information and the contact details of the supervisory authority of each EEA Member State, we refer to this webpage of the European Data Protection Board with all relevant contact details. In addition, you can always address to the competent civil court to bring an action for damages.

11. How can you exercise your rights?

You can easily exercise the rights mentioned under heading 10 by contacting us using the contact details mentioned under the first heading of this Privacy Statement.

When you submit a request to exercise your rights, we will, if we have doubts about your identity, ask you to verify it. In that case, we will request that you provide documents that make it possible to identify you without reasonable doubt, such as a copy of the front of your identity card. We do this to prevent your data from falling into the wrong hands. It is sufficient that your name and date of birth are clearly legible on such a copy. You may redact the other data.

Exercising your rights is in principle free of charge. However, if your request is manifestly unfounded or excessive, we may charge a reasonable fee in light of the administrative costs we have incurred. In that same case, however, we may also choose not to act on your request. You will be informed, where appropriate, of the reasons for this.

In any event, we will always inform you, at the latest within 1 month of receipt of your request, of the action taken. In the case of complex or numerous requests, this period may be extended to 3 months. In the latter case, you will be informed of the extension of the response period.

12. Changes

We reserve the right to amend this Privacy Statement. The most recent version is always available on our website www.yusto.be. You can find the date on which this Privacy Statement was last amended at the top. In the event of a substantial change to the Privacy Statement, we will, where possible, inform the data subjects affected by this directly.