General Privacy Policy


July 2018

This Privacy Policy is addressed to:

  • our prospective, current and former members of personnel (including trainees and temporary workers);
  • our shareholders who are natural persons and representatives of our “institutional” shareholders;
  • our business contacts who are natural persons and representatives of our portfolio entities and target companies;
  • products or service suppliers who are natural persons (such as self-employed persons) or the representatives or contact persons of our suppliers who are legal entities;
  • our board members;
  • the visitors of our premises; and
  • our website’s visitors and any third parties entering in contact with our company, such as journalists/analysts and individuals having signed up for our news alerts and/or our newsletter.

The policy does not apply to any information processed about legal entities.

You are receiving this Privacy Policy because Sofina SA (“Sofina”) or another entity of the Sofina group is processing information about you which constitutes “personal data”.

Sofina or another entity of the Sofina group is responsible for the processing of your personal data as it decides why and how it is processed, thereby acting as the “controller”. In this Privacy Policy, “we” or “us” refers to Sofina or the relevant entity of the Sofina group.

Since 25 May 2018, Sofina is subject to and complies with the revised data protection rules applicable in the European Union under the General Data Protection Regulation (the “GDPR”)1.

In line with our commitment to protect your personal data, we want to inform you and explain in all transparency:

  • why and how Sofina or another entity of the Sofina group collects, uses and stores your personal data; and
  • what your rights and our obligations are in relation to such processing.

1 Regulation 2016/679 of the EU Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or “GDPR”).

1. Who is responsible for the processing of your personal data?

Unless otherwise specified in this section, Sofina is responsible, as controller, for the processing of your personal data.

For prospective, current and former members of personnel, the controller in relation to your personal data will be your potential, current or former employer (which may be another entity of the Sofina group).

2. What type of personal data do we collect?

We collect or become aware of basic identification information about individuals with whom we interact, such as, for instance your name, title, position, company name, email and/or postal address and landline and/or mobile phone number.

This information may either be directly provided by you, communicated to us by the legal entity for whom you work (e.g. if you are the contact person designated by your employer to manage the Sofina account), supplied to us by one of our service providers (e.g. financial institutions or recruiters) or obtained from publicly available sources (e.g. social media profiles).

2.1. Prospective, current and former members of personnel (including trainees and temporary workers)

For our prospective current and former members of personnel (including trainees and temporary workers), we may in addition also collect or become aware of the following information:

  • additional identification information (e.g. date and place of birth, nationality, ID card or passport numbers and copy of ID card/passport, travel cards, residence and work permits, contact person in case of emergency);
  • your family information (e.g. marital status, number of children, date of birth and household composition, as well as working status of the spouse);
  • your education and experience (e.g. employment and education history, other details included in the CVs (such as hobbies or other activities), professional qualifications, board membership and experience);
  • other information relating to your recruitment (e.g. information you provided during your interview, notes and comments regarding candidates made during the recruitment process, result of personality and competency assessment based on test, reports from head hunters or recruitment agencies, result of public search, personality tests);
  • your function (e.g. position information such as position title, role and responsibility in the position, reference number, supervisor and subordinates, employment dates such as dates of hiring/promotion/position change, work schedule, performance evaluations, language skills, periodic evaluation assessments, additional professional education and certification, results of surveys on wellbeing and resilience at work);
  • your remuneration data (such as salary level and amount, years of experience, bonus, stock and grant options, loans, expenses information, insurance and other perks and benefits, pension entitlements, bank account details and seizure on wages);
  • your social security information (such as tax/social security status, insurance details, disabilities, attendance information including illness or leaves of absence)
  • your electronic identification data (e.g. login, passwords, IP address, badge number, logs relating to the usage of IT tools/cookies, online identifiers Sofina professional email address and unique code identifying each member of personnel’s account for expenses, sound and/or image recording such as CCTV or voice recordings, websites with which the member of personnel registered using his/her professional email address);
  • information required to set up and maintain insider lists for Sofina SA in accordance with the Market Abuse Regulation2 (using the model issued by the FSMA) and project M&A insider lists in accordance with the Sofina Dealing Code;
  • geolocation data (from mobile phones and tablets in case of loss or theft);
  • information collected by smartwatches (e.g. number of steps);
  • your picture; and
  • more generally, information about the activities you are carrying out in your professional capacity at Sofina.

Regulation 596/2014 of the European Parliament and of the Council of 16 April 2014 on market abuse (the “Market Abuse Regulation” or “MAR”).

2.2. (Representatives of) shareholders

For our shareholders who are natural persons or representatives of “institutional” shareholders, we may in addition also collect or become aware of the following information:

  • additional identification information (e.g. copy of ID card/passport);
  • information relating to your or your company’s shares (e.g. number, split of ownership (bear owner/usufruct), pledge on shares and type of rights);
  • your or your company’s financial information (bank account number for payment of dividends);
  • your family information (parents, spouse, children, brothers/sisters or other heirs, your act of donation) (for shareholders who are natural persons); and
  • contents of communications (if any).

2.3. (Representatives of) business contacts, portfolio entities and target companies

For our business contacts who are natural persons or representatives of portfolio entities and target companies, we may in addition also collect or become aware of the following information:

  • additional identification information (e.g. copy of ID card/passport); and
  • contents of communications (if any).

2.4. (Representatives of) suppliers

For our products or service suppliers who are natural persons (such as self-employed persons) or the representatives or contact persons of our suppliers who are legal entities, we may in addition also collect the following information:

  • your electronic identification data where required for the purpose of the delivery of products or services to our company or of visits to our premises (e.g. login, access right, passwords, badge number, IP address, online identifiers/cookies, logs, access and connexion times, image recording or sound such as badge pictures, CCTV or voice recordings, information contained in the reports from the guards (after hours));
  • for natural persons acting as suppliers or service providers, financial information (e.g. bank account details, credit card number, bills and invoices) and information relating to the contract (e.g. type of agreement, parties and duration); and
  • information required to set up and maintain insider lists for Sofina in accordance with the Market Abuse Regulation (using the model issued by the FSMA) and project M&A insider lists in accordance with the Sofina Dealing Code.

2.5. Board members

For our board members, we may in addition also collect or become aware of the following information:

  • additional identification information (e.g. date and place of birth, nationality, copy of ID card/passport and travel cards);
  • your family information (e.g. marital status, number of children, date of birth and household composition);
  • your education and experience (e.g. employment and education history, professional qualifications and experience);
  • your function (e.g. dates and duration of the mandate, presence/absence);
  • your remuneration data (such as the amount, expense claim information, insurance and bank account details);
  • your electronic identification data (e.g. login, passwords, sound and/or image recording such as CCTV or voice recordings);
  • information required to set up and maintain insider lists for Sofina SA accordance with the Market Abuse Regulation (using the model issued by the FSMA) and project M&A insider lists in accordance with the Sofina Dealing Code;
  • your picture; and
  • more generally, information about the activities you are carrying out in your professional capacity at Sofina.

2.6. Visitors of our premises

For the visitors of our premises, we may in addition also collect or become aware of your electronic identification data where required for the purpose of managing the visits to our premises (e.g., image recording or sound such as badge pictures, CCTV or voice recordings, information contained in the reports from the guards (after hours)).

2.7. Website’s visitors and any third parties entering in contact with our company such as analysts/journalists and individuals having signed up for our news alerts or newsletter

For website’s visitors and any third parties entering in contact with our company such as analysts/journalists and individuals having signed up for our news alerts or newsletter, we may in addition also collect the following information:

  • electronic identification data (http header fields, IP address, browser identification information, information on hardware and software location data if available);
  • information regarding your browser and device (e.g. internet service provider’s domain, browser’s type and version, operating system and platform, screen resolution, device manufacturer and model);
  • information provided by you during registration to receive our news alerts and/or newsletter (e.g. name/first name, address, choice to sign up to our news alerts or newsletter); and
  • data collected through cookies, code on the website and our news alerts and/or newsletter delivery provider’s web beacons (e.g. language preferences and analytics of the use of the website, such as the pages visited, in which order these pages were visited and the duration of the visit).

To the extent authorised or required by law, we may also process sensitive data, such as trade union membership or health data. Sofina will only do so as strictly required for the relevant purposes listed in Section 4 below or to comply with a legal obligation and, where required, subject to having obtained your prior consent. In such case, the data will be accessed and processed solely under the responsibility of a representative of Sofina who is subject to an obligation of confidentiality.

If and whenever personal data is collected (e.g. in forms), we will indicate whether the provision of such data is mandatory (e.g. with an asterisk) and the consequences of a refusal to provide the requested data.

We may also collect your national registry number or social security number but will only process such data if and when legally required.

3. When do we collect personal data?

Personal data will be collected by Sofina:

  • whenever individuals apply to become a member of personnel of Sofina;
  • whenever a member of personnel interacts with Sofina, its other members of personnel, its IT equipment and other systems;
  • whenever Sofina interacts with former members of personnel;
  • whenever Sofina interacts with (the representatives of) our prospective investors, shareholders and suppliers;
  • whenever Sofina interacts with representatives of portfolio/target companies;
  • whenever Sofina interacts with board members; and
  • whenever individuals visit our website, visit our premises, sign up for our news alerts and/or newsletter or contact us.

4. On which legal basis and for which purposes do we process personal data?

4.1. Legal basis for the processing

We are not allowed to process personal data if we do not have a valid legal ground. Therefore, we will only process personal data if:

  • we have obtained your prior consent;
  • the processing is necessary to perform our contractual obligations towards you or to take pre-contractual steps at your request;
  • the processing is necessary to comply with our legal or regulatory obligations;
  • the processing is necessary to protect your vital interests or those of another natural person; or
  • the processing is necessary for the legitimate interests of Sofina and does not unduly affect your interests or fundamental rights and freedoms.

Please note that, when processing your personal data on this last basis, we always seek to maintain a balance between our legitimate interest and your privacy. Examples of such ‘legitimate interests’ are:

  • to benefit from cost-effective services (e.g. we may opt to use certain platforms offered by external suppliers);
  • to facilitate communications with (representatives of) our investors/shareholders (e.g. we may communicate professional contact details of one of our members of personnel to an investor/shareholder, indicating that this person is the contact person within Sofina);
  • to prevent fraud or criminal activity as well as to protect the security of our IT systems, architecture and networks;
  • to meet our corporate and social responsibility objectives; and
  • to reach a number of steps to promote health within the company.

4.2. Purposes of the processing

We always process your personal data for a specific purpose and only process the personal data which is relevant to achieve that purpose. In particular, we process personal data for one of the following purposes.

4.2.1. Prospective, current and former members of personnel (including trainees and temporary workers)

In relation to prospective, current and former members of the personnel (including trainees and temporary workers), we process personal data for:

  • recruitment activities;
  • personnel administration (including organisation of work, tasks, benefits, expenses and holiday and absence management, performing employment and background checks, creating and maintaining directories of the members of personnel, travel arrangements);
  • payroll management and benchmarking (such as administering remuneration and other contractual benefits, calculation of social security and professional income withholding tax, salaries and pay reviews and other awards such as stock options, stock grants and bonuses, pensions and savings plans, benefits to families, business expenses, public transport and leasing for mobility purposes);
  • performance reviews (such as appraisals, evaluations, promotions, career and succession planning, staffing and talent and development management);
  • monitoring members of personnel’s activities in the workplace, including compliance with policies as well as health and safety rules in place;
  • managing any disciplinary action and handle internal complaints relating to violence, moral harassment and undesirable (sexual) conduct;
  • ensuring compliance and reporting (such as complying with our policies and legal requirements, income tax and insurance deductions, managing alleged cases of misconduct fraud; conducting audits, defending litigation);
  • ensuring business continuity;
  • managing investments and divestments involving our company; and
  • any other purposes imposed by law and authorities.

4.2.2. (Representatives of) shareholders

In relation to our shareholders who are natural persons or representatives of “institutional” shareholders, we process personal data to:

  • analyse the shareholding of our company;
  • communicate about and prepare for the shareholders’ meeting (e.g. sending convening notices) and pay dividends to our shareholders, when applicable;
  • answer shareholders’ questions; and
  • convert dematerialised shares into nominative shares and the reverse.

4.2.3. (Representatives of) business contacts, portfolio entities and target companies

In relation to our business contacts who are natural persons or representatives of portfolio entities and target companies, we process personal data to:

  • source potential investment opportunities and to maintain relationships with our portfolio companies and their shareholders and to monitor such companies.
  • communicate about and prepare for events (e.g. sending invitations); and
  • answer questions.

4.2.4. (Representatives of) suppliers

In relation to our products or service suppliers who are natural persons (such as self-employed persons) or the representatives or contact persons of our suppliers who are legal entities, we process personal data to:

  • implement tasks in preparation of or under existing contracts;
  • monitor activities at our facilities, including compliance with applicable policies (including Sofina’s Dealing Code) as well as health and safety rules in place;
  • manage our IT resources, including infrastructure management and business continuity; and
  • billing and invoicing.

4.2.5. Board members

In relation to board members, we process personal data for:

  • the organisation and preparation of board and board committee meetings (including presence and absence management, performing background checks, creating and maintaining directories, travel arrangements);
  • remuneration management and benchmarking (such as administering remuneration and other contractual benefits, business expenses);
  • ensuring compliance and reporting (such as complying with our policies and legal requirements, income tax and insurance deductions, managing alleged cases of misconduct fraud; conducting audits, defending litigation);
  • ensuring business continuity;
  • managing investments and divestments involving our company; and
  • any other purposes imposed by law and authorities.

4.2.6. Visitors of our premises

In relation to the visitors of our premises, we process personal data to:

  • manage our facilities (e.g. management of access and visits to the building); and
  • ensure security of the building (e.g. CCTV).

4.2.7. Website’s visitors and any third parties entering in contact with our company such as journalists/analysts and individuals having signed up for our news alerts and/or newsletter.

In relation to visitors of Sofina’s website and any third parties entering in contact with our company such as journalists/analysts and individuals having signed up for our news alerts and/or newsletter, we process personal data to:

  • manage and improve our website (e.g. diagnose server problems, optimize traffic, integrate and optimize web pages where appropriate);
  • measure the usage of our website (e.g. by drawing up statistics about the traffic or by gathering information regarding the users’ behaviour and the pages they visit);
  • periodically send our news alerts and/or our newsletter (depending on your subscription), using the email address which you have provided (if you choose to do so);
  • analyse the performance of email campaigns and improve the email delivery services to better communicate with our subscribers; and
  • monitor and prevent fraud, infringement and other potential misuse of our website.

4.2.8. Public relations

In relation to public relations (journalists/analysts), we process personal data to:

  • invite selected individuals for the presentation of our annual report (for analysts only);
  • answer questions;
  • register attendees to our shareholders’ meeting; and
  • organise events.

4.2.9. General

In addition to the above specific purposes, we process all collected personal data for the following general purposes:

  • storing contact details (e.g. business cards);
  • manage and administer the relationship between Sofina and the data subjects;
  • manage our IT resources, including infrastructure management and business continuity;
  • preserve the company’s economic interests and ensure compliance and reporting (such as complying with our policies and local legal requirements, tax and deductions, managing alleged cases of misconduct or fraud, conducting audits and defending litigation);
  • comply with any legal obligations imposed on Sofina in relation to its activities;
  • reply to an official request from a public or judicial authority with the necessary authorisation;
  • archiving and record-keeping; and
  • manage investments and divestments involving our company.

5. How do we protect personal data?

We have implemented appropriate technical and organisational measures to provide a level of security and confidentiality to your personal data. These measures take into account:

  1. the state of the art of the technology;
  2. the costs of its implementation;
  3. the nature of the data;
  4. and the risk of the processing.

 

The purpose thereof is to protect it against accidental or unlawful destruction or alteration, accidental loss, unauthorized disclosure or access and against other unlawful forms of processing.

Moreover, when handling your personal data, we:

  • only collect and process personal data which is adequate, relevant and not excessive, as required to meet the above purposes; and
  • ensure that your personal data remains up to date and accurate.

For the latter, we may request you to confirm the personal data we hold about you. You are also invited to spontaneously inform us whenever there is a change in your personal circumstances so we can ensure your personal data is kept up-to-date.

6. Who has access to personal data and with whom are they shared?

6.1. Transfers to third parties

We may transfer or give access to personal data to third parties outside Sofina to complete the purposes listed in Section 4.2 above, to the extent they need it to carry out the instructions we have given to them. Such third parties may include:

  • third parties who process personal data, such as our payroll provider, our (IT) systems providers, website designers and hosting provider, payment services providers, financial institutions and clearing companies, provider of compliance services (e.g. for Market Abuse Regulation purpose) bank card companies, insurances companies and pensions funds, leasing companies, social security bodies, event organisers (e.g. for shareholders’ meetings), education centres, email delivery service providers, database and storage/archiving service providers, consultants, travel agencies, taxi, rail and airline companies, security companies;
  • any third party to whom we assign or novate any of our rights or obligations under a relevant agreement;
  • our lawyers and external advisors; and
  • any national and/or international regulatory, enforcement or exchange body or court where we are required to do so by applicable law or regulation or at their request.

With the exception of public authorities which are subject to their own rules, the above third parties will be contractually obliged by Sofina to protect the confidentiality and security of your personal data, in compliance with applicable law.

6.2. Transfers outside the European Economic Area

The personal data transferred by Sofina may also be processed in a country outside the European Economic Area (“EEA“), which covers the EU Member States, Iceland, Liechtenstein and Norway. Non-EEA countries may not offer the same level of personal data protection as EEA countries.

For example, the personal data of employees of Sofina Asia are transferred to Singapore, where the employees are located. Personal data may also be transferred to the service provider performing salary and benefits benchmark on our behalf (i.e. to the USA and to other offices of our service provider).

If your personal data is transferred outside the EEA, we will therefore put in place suitable safeguards to ensure such transfer is carried out in compliance with the applicable data protection rules. You may request additional information in this respect and obtain a copy of the relevant safeguard by exercising your rights as set out below. 

7. How do we use cookies and other similar technologies such as analytics on our websites?

A cookie is a text file which may be placed on your device when visiting our website. It contains information that is collected from your device and sent back to the website on each subsequent visit so as to remember your actions and preferences over time.

A detailed list of the cookies used on our website “sofinagroup.com” is included in Annex 1 to this policy.

Please note that you can modify your browser so that it notifies you when cookies are sent to it. If you do not want to receive cookies, you can also refuse cookies altogether by activating the relevant settings on your browser. Please note that if you choose to refuse all the cookies, some sections of the website may not be accessible by you or not work properly. Finally, you can also delete cookies that have already been set.

For more information about how to manage cookies on your device, please consult the Help function of your browser or visit http://www.aboutcookies.org, which contains comprehensive information on how to do so on a wide variety of browsers (link is external).

8. How long do we store your data?

We will only retain personal data for as long as necessary to fulfil the purpose for which it was collected or to comply with legal, regulatory or internal policy requirements.

We only keep data related to candidates for recruitment purposes for a maximum period of 2 years. For current members of personnel, the retention period is the time of your employment, and 5 years thereafter, unless overriding legal or regulatory schedules require a longer or shorter retention period.

For contracts, the retention period is the term of your (or your company’s) contract with us, plus the period of time until the legal claims under this contract become time-barred, unless overriding legal or regulatory schedules require a longer or shorter retention period.

Personal data collected and processed in the context of a dispute are deleted (i) as soon as an amicable settlement has been reached, (ii) once a decision in last resort has been rendered or (iii) when the claim becomes time barred.

When the above retention periods expire, your personal data will be removed from our systems

However, if individuals wish to have their personal data removed from our databases, they can make a request as described in Section 9, which we will review as set out below.

9. What are your rights and how can you exercise them?

9.1. Your rights

You have a right of access to your personal data as processed by Sofina under this policy. If you believe that any information we hold about you is incorrect or incomplete, you may also request the correction thereof. Sofina will promptly correct any such information.

You also have the right to:

  • request the erasure of your personal data;
  • request the restriction of the processing of your personal data;
  • withdraw your consent where Sofina obtained your consent to process personal data (without this withdrawal affecting the lawfulness of processing prior to the withdrawal);
  • object to the processing of your personal data (e.g. for direct marketing purposes); or
  • object to the processing of your personal data for other purposes in certain cases where Sofina processes your personal data on another legal basis than your consent.

Sofina will review such requests, withdrawal or objection and honour them as required under the applicable data protection rules.

In addition, you also have the right to data portability. This is the right to obtain the personal data you have provided to Sofina in a structured, commonly used and machine-readable format and to request the transmission of such personal data to a third party, without hindrance from Sofina and subject to your own confidentiality obligations.

9.2. Exercising your rights

If you have a question or want to exercise the above rights, you may send an email to Wauthier de Bassompierre at privacy@sofinagroup.com or a letter at Sofina SA, to the attention of Wauthier de Bassompierre, rue de l’Industrie 31, B-1040 Brussels, Belgium with a scan of your identity card for identification purpose, it being understood that we shall only use such data to verify your identity and shall not retain the scan after completion of the verification. When sending us such a scan, please make sure to redact your picture and national registry number or equivalent on the scan.

If you are not satisfied with how we process your personal data, please address your request to Wauthier de Bassompierre at privacy@sofinagroup.com, who will investigate your concern.

In any case, you also have the right to file a complaint with the competent data protection authorities, in addition to your rights above.

10. Updates to this policy

This policy may be subject to amendments. Any future changes or additions to the processing of personal data as described in this policy affecting you will communicated to you through an appropriate channel, depending on how we normally communicate with you.

 

***

 

SOFINA S.A.
Rue de l’Industrie, 31 – 1040 Bruxelles
RPM Brussels : 0403.219.397Listed on Euronext Brussels
(ISIN BE0003717312)
Contact person: Wauthier de Bassompierre
Tel. : +32 2 551 06 11
Email : privacy@sofinagroup.com
Website : www.sofinagroup.com

 


 

ANNEX 1 – DETAILED LIST OF COOKIES

 

Name of the Cookie Third Party Provider Type Retention Description
_ga Google analytics Analytical 2 years The Google Universal Analytics javascript library uses first-party cookies to: distinguish unique users and throttle the request rate. To opt out click here.
_gat Google analytics Analytical session Used to distinguish users.
_gid Google analytics Analytical 1 minute Used to distinguish users.
_icl_current_language Technical 1 day Contains the current language of the site user.
gadwp_wg_default_dimension Technical Session Used to collect visitor statistics for Google Analytics. Data collected is not personal, but only for used browsers.
gadwp_wg_default_swmetric Analytical Session Used to collect visitor statistics for Google Analytics. Data collected is not personal, but only for used browsers.
wordpress_test_cookie Technical Session WordPress sets this cookie when you navigate to the login page. The cookie is used to check whether your web browser is set to allow, or reject cookies.
tplis_cl_cookie_policy_accepted Technical Session This cookie is used to remember the user’s choice about cookies on the website to avoid opening the popup after acceptance