Privacy Policy

1 Introduction

Ekopak Group is committed to protecting the confidentiality and privacy of all personal data entrusted to us. This Privacy Statement explains how we collect, use, share, protect, and otherwise process personal data in accordance with applicable data protection legislation, including the General Data Protection Regulation (GDPR).

Ekopak N.V. with registered office at Souverainestraat 13, 9800 Deinze (Belgium), (company number BE 0461.377.728), acts as the controller for the processing of your personal data as described in this Privacy Statement. This Privacy Statement applies to the processing of personal data carried out by Ekopak N.V. and, where applicable, by other entities within the Ekopak Group when they act:

as joint controllers together with Ekopak N.V.; or
as processors processing personal data on behalf of Ekopak N.V.

When this Privacy Statement refers to “Ekopak”, “we” or “us”, this refers to Ekopak N.V. and, to the extent they process personal data for the same purposes and in accordance with this Privacy Statement, the other companies of the Ekopak Group.

2 Collection and Use of Personal Data

2.1 What personal data we collect

We collect personal data when you:

Contact us via our website, email, or phone
Request information about our water infrastructure services
Enter into a contract with Ekopak
Apply for a job with us
Subscribe to newsletters or events
Visit our website

The types of personal data we may collect include:

Identification details (name, company name, job title)
Contact information (email address, telephone number, stated address)
Contractual and billing information
Technical and operational data related to service delivery
Recruitment information (CV, employment history, qualifications)
Website usage data (IP address, browser type, device information)

If you log in via a third-party authentication provider (e.g. LinkedIn or Google), we may receive limited profile information that you have authorized that provider to share.

We only collect personal data necessary for legitimate business purposes.

2.2 Legal grounds for processing

Ekopak processes personal data on one or more of the following legal bases:

Performance of a contract: where processing is necessary to provide water infrastructure and/or other services and/or manage contractual relationships.
Legal obligation: where we must comply with regulatory requirements (e.g. environmental, tax, safety, or compliance laws).
Legitimate interests: for operating and improving our business, securing our infrastructure, preventing fraud, or conducting direct B2B marketing, provided these interests do not override your rights.
Consent: where you have explicitly agreed (e.g. for marketing communications). You may withdraw consent at any time.

We only process special categories of personal data where legally permitted and strictly necessary (e.g. in employment contexts). We discourage the submission of sensitive personal data unless required.

We ensure that we only process personal data where we can rely on at least one of these legal bases.

2.3 Purposes of processing

We process personal data for specific and legitimate purposes, including:

Delivering and managing water supply and treatment services
Operating and maintaining infrastructure installations
Managing customer, supplier, and partner relationships
Billing and financial administration
Ensuring regulatory and environmental compliance
Improving our website and digital platforms
Sending relevant industry updates or event invitations
Recruitment and HR management
Ensuring IT and operational security

Personal data will not be processed for purposes incompatible with those listed above.

Where a specific Ekopak Group entity is the primary contracting party for the services you receive (for example, as indicated in a contract, order form, or invoice), that entity will also act as a (joint) controller for the related processing of your personal data, together with Ekopak N.V., for the purposes described in this Privacy Statement.

2.4 Automatic Collection of Personal Data

When you visit our website, certain data may be collected automatically.

IP Addresses: We may record IP addresses for IT security, system diagnostics, fraud prevention, and aggregated website analytics.
Our website uses cookies to improve functionality, analyze traffic, and enhance user experience. You can manage cookie preferences via your browser settings or our Cookie Policy.
Web Beacons: We may use web beacons or similar technologies in newsletters to measure engagement (e.g. open rates) to improve communication relevance.
Location Data: Where relevant, we may collect approximate location data to provide region-specific information about our water services and infrastructure projects.

2.5 Social Media

Our website may contain links or sharing tools related to third-party social media platforms. Any data collected via these platforms is governed by their respective privacy policies. Ekopak is not responsible for the data practices of such third parties.

2.6 Children

Our services are intended for businesses and professional stakeholders. We do not knowingly collect personal data from minors.

3 Sharing and Transfer of Personal Data

3.1 Within the Ekopak Group

Where applicable, personal data may be shared within Ekopak Group entities for operational, administrative, compliance, HR, or IT support purposes. In such cases:

Ekopak N.V. will generally act as the (joint) controller determining the purposes and means of the processing; and
other Ekopak Group entities will act either as joint controllers or as processors on behalf of Ekopak N.V., based on appropriate intra‑group agreements that allocate responsibilities in line with GDPR requirements.

All Ekopak Group entities that receive personal data are required to comply with this Privacy Statement and with equivalent data protection and security standards.

3.2 Third Parties

We may share personal data with:

IT and cloud service providers
Infrastructure and technical subcontractors
Legal, financial, compliance and/or other business advisors
Public authorities and regulators where legally required
Auditors and certification bodies

All third-party processors are required to comply with strict data protection and security standards.

We do not sell personal data or share it with third parties for their own marketing purposes.

We select our third‑party processors with care and ensure that appropriate data processing agreements are in place, requiring them to process personal data only on our documented instructions and to implement adequate security measures.

When you interact with Ekopak content on third‑party platforms (such as LinkedIn or other social media), any personal data you provide to those platforms is collected and processed by them under their own terms and privacy policies. Ekopak may receive aggregated or limited statistics from such platforms but does not control their use of your personal data. Ekopak is not responsible for the data practices of independent controllers, such as third‑party websites or social media platforms that you may access via links on our website; their own privacy statements apply.

3.3 International Transfers

If personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as standard contractual clauses or equivalent legal mechanisms.

4 Your Choices

You are not obligated to provide personal data. However, certain data may be necessary for us to deliver services or respond to requests.

If you subscribe to communications, you may unsubscribe at any time using the link provided in each message.

5 Your Rights

Under GDPR, you have the right to:

Access your personal data
Rectify inaccurate or incomplete data
Erase your data (where legally permissible)
Restrict processing in certain circumstances
Object to processing based on legitimate interest
Data portability where applicable
Withdraw consent at any time

Requests may be submitted using the contact details below. We may request proof of identity before responding.

These rights apply in accordance with the conditions and limitations set out in the GDPR and depend on the legal basis on which we process your personal data (contract, legal obligation, legitimate interest, or consent).We will respond to your request as soon as reasonably possible and in any event within the deadlines set by the GDPR. In principle, we handle such requests free of charge, unless they are manifestly unfounded or excessive.

6 Data Security and Retention

Ekopak implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, or alteration.

Access to personal data is limited to personnel who require it for legitimate business purposes and are bound by confidentiality obligations.

We retain personal data only for as long as necessary to fulfill the purposes described above or to comply with legal and regulatory obligations. In particular, and unless a longer or shorter retention period is required by law:

customer and supplier data are generally kept for the duration of the contractual relationship and for up to ten (10) years thereafter, in line with applicable limitation periods;
recruitment data are generally kept for up to two (2) years after the end of the recruitment process, unless you ask us to delete your data earlier or consent to a longer retention;
technical logs and security‑related data are generally kept for up to two (2) years for security, incident management, and audit purposes.

We may retain certain personal data for a longer period where this is necessary for the establishment, exercise, or defence of legal claims, for handling (potential) disputes, for responding to requests from supervisory or other public authorities, or for documenting our compliance with applicable legal and regulatory requirements.

7 External Links

Our website may contain links to third-party websites. We encourage you to review the privacy statements of those websites, as Ekopak is not responsible for their data practices.

8 Changes to This Privacy Statement

We may update this Privacy Statement periodically to reflect changes in our operations or legal requirements. Significant changes will be clearly communicated.

9 Contact and Complaints

If you have any questions about this privacy policy or privacy at Ekopak N.V., you can contact our Data Protection Office either by mail:

Data Protection Officer

Ekopak N.V.
Souverainestraat 13
9800 Deinze
Belgium

Or by e-mail at legal@ekopakwater.com

You also have the right to lodge a complaint with the supervisory authority in the European member state of your habitual residence, place of work or of the alleged infringement of applicable data protection legislation:

In Belgium, the Supervisory Authority is:

Rue de la Presse 35 / Drukpersstraat 35
1000 Bruxelles / 1000 Brussel
Tel. +32 2 274 48 00
Fax +32 2 274 48 35

commission@privacycommission.be
http://www.privacycommission.be/