The online merchandising of STIB/MIVB s.a (with registered office at Koningsstraat 76
1000 Brussel - Belgique and with enterprise number 0247.499.953) is distributed by Kick and Rush NV (with registered office at Boulevard de l'Europe 123 1300 Wavre, Belgium and with company number 0457.855.935) (hereinafter: "Kick and Rush") and can be ordered via the webshop https://www.stibstore.be/ (hereinafter: the "Webshop").

This Privacy Policy will explain to you how our organization uses the personal data we collect from you when you use our website in accordance with the applicable laws and regulations with regard to privacy and data protection, in particular the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data and the European Regulation 2016/679 of 27 April 2016 regarding the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter the "General Data Protection Regulation" or "GDPR").

1. Personal data collected
1.1 The data that you communicate to us

This happens when you create an account on the Webshop and includes for example your identification details (name and first name, address, date of birth, IP address) and your contact details (e-mail address or telephone number).

This is also the case when you proceed to payment of an order made on the Webshop through your account (bank details).

1.2 The data that is collected automatically

Certain data is collected via cookies. For more information about cookies, we refer you to our Cookie Policy that you can find [here].

2. Purposes and lawfulness of the processing of personal data
2.1 General purposes
We only process your personal data for legitimate purposes. In particular, we collect your personal data in order to:

2.1.1        be able to invoice, allow the payment and deliver the products or services offered on the Webshop;

2.1.2        manage the technical administration of the Webshop;

2.1.3        keep track of your order history, in order to enhance your experience as a user of the Webshop via web analytics;

2.1.4        allow you, where applicable, to exercise your rights under consumer protection rules;

2.1.5        to send you e-mails with promotional offers on the Webshop that might interest you; and

2.1.6        allow the User to submit a so-called « contact » form.

2.2 Legal basis for personal data processing:
2.2.1        In the first two cases 3.1.1-3.1.2, the processing of your personal data is necessary for the performance of a contract to which you, as the user of the Webshop, are a party, as provided for in article 6.1 (b) GDPR.

2.2.2        In the third case 3.1.3 the processing of your personal data is in the framework of a legitimate interest of the controller, as provided for in Article 6.1 (f) GDPR.

2.2.3        In the fourth case 3.1.4, the processing of your personal data is necessary to comply with a legal obligation, as provided for in Article 6.1 (c) GDPR.

2.2.4        In the fifth case 3.1.5, the processing of your personal data is in the framework of:

(i)             a legitimate interest of the controller for direct marketing purposes, as provided for in Article 6.1 (f) GDPR, in the event that you have already placed an order with  Kick and Rush  or in case you registered on the Webshop; or

(ii)             your consent as provided for in Article 6.1 (a) GDPR, (which can be revoked at any time) to the processing of your personal data for direct marketing purposes for products available on the Webshop.

2.2.5        In the sixth case 3.1.6, the processing of the User's personal data is in order to take steps at the request of the data subject prior to entering into a contract as provided for in Article 6.1 (b) GDPR.

2.3 Direct marketing and communication to third parties
Your personal data will be kept strictly confidential and will in no case be communicated to third parties or used for direct marketing purposes (apart from the direct marketing of the products of the Webshop itself, as mentioned in point 3.2.4).  If you no longer wish to receive promotional offers, you can unsubscribe from promotional e-mails and newsletters.

We will share your personal data with external service providers only to the extent necessary for the type of work that our external service providers offer to us, which may include:

●      Distribution and logistics to deliver your order;

●      the support of our services such as hosting, maintenance and support of our Webshop and applications;

●      supporting our customer service and sending of transactional e-mails;

●      support of advertising and marketing campaigns and sending of commercial e-mails;

●      providing financial services, such as payment services, collection agencies and credit reporting agencies.

3. Duration of keeping your personal data
Your personal data will not be stored for longer than is necessary for the purposes mentioned above.

Order data on the webshop will be anonymized two (2) years after the order and a user account will be anonymized two (2) years after the last login. 

Invoices will be kept for the statutory retention period.    

4. Your rights as a user of the Webshop
As a user of the Webshop you have the following rights:

4.1          the right to view your personal data and to have them rectified or erased;

4.2          the right to request that the processing of your personal data be restricted;

4.3          the right to object to the processing of your personal data;

4.4          the right to portability of your personal data.

4.5          the right to file a complaint with the supervisory authority, namely the Data Protection Authority (Gegevensbeschermingsautoriteit- Autorité de protection des données) which can be reached at +32 (0)2 274 48 00 or contact@apd-gba.be.

5. Security and confidentiality
Kick and Rush stores your data within the European economic area (' EEA '). However, it may happen that certain information we collect is transmitted to, or stored at, a destination outside the EEA, for example, because one of our external service providers is established there. If this is the case, we will make sure that this happens in a safe and lawful manner.

Kick and Rush has developed appropriate technical and organizational security measures in order to prevent the destruction, loss, forgery, modification, unauthorized access or notification by mistake to third parties of personal data collected on the Webshop, as well as any other unauthorized processing of these data.

Kick and Rush reminds you that the Webshop may contain links, hyperlinks or references to other websites that Kick and Rush does not control and to which this Privacy Policy does not apply. This is because these sites are not operated by Kick and Rush. Kick and Rush is not responsible for the content of such sites. Kick and Rush therefore recommends that you carefully read the privacy policy of each external site that you visit, as this may differ from this Privacy Policy.

6. General Conditions
This Privacy Policy is subject to, and forms part of, the General Terms and Conditions of the Webshop. You can find these General Terms and Conditions [here].