Scope

CHÂTEAU D’AIGUEVILLE attaches great importance to complying with legal requirements relating to the confidentiality of personal data. We do this so that the parties concerned (staff, clients and suppliers) may continue to communicate with them in complete confidence. By personal data, we mean all information related to an identified or identifiable individual (Art. 4 §1 of the GDPR) such as their name, identification number, email address, address, telephone number, etc.

To this end, CHÂTEAU D’AIGUEVILLE ensures that personal data is:

• Processed in a legal, transparent way and that their use is easy to understand for the data subject.
• Relevant and restricted to the aim pursued.
• Collected with an identified, explicit and legal purpose.
• Accurate and kept up to date.
• Stored only for the period required for pursued processing.
• Processed while taking adequate computer and organisational security measures.

Our aim is to use the personal data in a fair way in order to be worthy of the trust of the data subjects and to avoid misuse.

Personal data may be used at various levels, such as staff and wage administration, client and supplier files, job applicants, event photos, etc.

Type of data collected

The data collected by CHÂTEAU D’AIGUEVILLE can come from two different sources:

• Data collected directly: this information is information that the data subjects voluntarily communicate to us and are essential for answering requests, such as names and contact details.
• Data collected indirectly: this information is collected indirectly, for example during competitions, via Facebook, via online ordering websites belonging to one of our clients, etc.

Data commitment and processing

CHÂTEAU D’AIGUEVILLE implements measures to demonstrate compliance with the GDPR.

Creation of a data registry (inventory) for all activities involving the processing of personal data.

Ensuring that the personal data processed is minimised to only that required to achieve the objectives of legal processing.

Developing an internal information and staff training policy and nominating a data protection controller.

Where appropriate, conducting a data protection impact assessment to identify risks linked to the data processing (description, evaluation) and how to mitigate them in order to ensure protection.

Implementing effective procedures to ensure compliance with respect for GDPR ‘privacy’. To do this, CHÂTEAU D’AIGUEVILLE may as appropriate use different techniques, such as encryption of data, etc.

The rules on consent will be followed.

Offering the option for individuals to exercise their rights concerning personal data and these requests being effectively processed.

Regular evaluation of procedures relating to personal data.

Purpose of the data collection</h4 >

CHÂTEAU D’AIGUEVILLE collects and uses personal data only to the extent required for the purposes for which it was obtained. There are two categories of processing. Either the processing is carried out with the consent of the data subject or the processing is required for:

• performance of a contract (e.g. delivery of goods ordered)
• performance of legal requirements (e.g. declaration of salary data to social security and tax authorities)
• protecting the vital interests of the data subject or another person.

 The data can only be communicated to a third party with the prior agreement of users, unless the communication is strictly necessary for the provision of a requested product or service or when the request is made by an administrative or judicial legal authority.

Period for which the data will be stored

The data is stored for a period which does not exceed  the time necessary for the purposes for which it is collected and which complies with the relevant legal obligations.

Personal data related to children

CHÂTEAU D’AIGUEVILLE does not deliberately collect any personal data related to children except for the children of staff.

Consent

By communicating your personal data, you consent to CHÂTEAU D’AIGUEVILLE using it or divulging it according to the data protection policy that it has implemented internally. If you do not agree to this policy, please do not communicate your personal data either directly or indirectly. It is however possible to withdraw your consent as soon as you wish to do so.

Rights of data subjects

CHÂTEAU D’AIGUEVILLE undertakes to respect the rights of data subjects by the personal data described below.  Nevertheless, in order to exercise their right, the data subject must first prove their identity via a substantiating document.  The controller will provide proof that the action is carried out.  The request may be refused when it is manifestly excessive or abusive, or the request is impossible to carry out. A justified request shall be carried out free of charge for the individual.

The rights can be categorised into seven areas:

• Automated and profiling individual decision-making: any individual has the right to not be subject to an individual decision when it is based exclusively on automated processing.  In this case, CHÂTEAU D’AIGUEVILLE ensures that the individual may obtain human intervention in the decision-making, that they may express their point of view and that they may obtain an explanation for the decision and contest it. This right does not apply if the decision is required for the conclusion or performance of a contact or if it is permitted by the Law or taken based on explicit consent.
• Right to information: Through this procedure, CHÂTEAU D’AIGUEVILLE provides, with full transparency, information about how it processes personal data. A more explicit request can also be addressed directly to the controllers. The request will be processed within one month.
• Right to be forgotten: the data subjects may request to be ‘forgotten’; however, this is not an absolute right. Erasure is only possible if the data and its processing are damaging to them.  There are also special circumstances where CHÂTEAU D’AIGUEVILLE may refuse to erase personal data (pay, legal administrative requirements, etc.).
• Right to rectification: CHÂTEAU D’AIGUEVILLE commits to, upon request by the data subject, to rectify the personal data if it is inaccurate or incomplete, to inform third parties to whom this data was transmitted of this (specifying this to the data subject), within a month.
• Right to data portability: the data subject may request the personal data to be transferred from one computer environment to another in a safe and secure way. Only the personal data that an individual has provided to a controller (based on consent or a contract) is concerned.  The data must be provided in an organised, commonly used and legible format, free of charge, within a month.
• Right to access: when the individual requests it, CHÂTEAU D’AIGUEVILLE must provide them with their personal data in a concise, transparent, intelligible and easily accessible way, written in plain language that is easy to understand, free of change, within a month.
• Right to object: the data subject may object to direct marketing, processing based on legitimate interests (apart from legal exceptions) and to processing for scientific or historical research. They have the right to lodge a complaint to the data protection authority.

Data breaches

By personal data breaches, we refer to destruction, loss, alteration or unauthorised disclosure. If the breach risks affecting the rights and freedoms of individuals, CHÂTEAU D’AIGUEVILLE commits to notifying the Belgian Privacy Commission within 72 hours of the beach being identified.  When the breach is likely to lead to a high risk for the rights and freedoms of individuals, CHÂTEAU D’AIGUEVILLE will inform the data subjects directly.

Data sharing

CHÂTEAU D’AIGUEVILLE may share your data with its service providers. The use of such service providers and the communication of your data are necessary for the proper performance of our work.

In all cases, CHÂTEAU D’AIGUEVILLE commits to ensuring the confidentiality of the data, in particular by concluding appropriate contracts with our partners who will have already been chosen with respect for the GDPR taken into consideration.

In addition, our company is required to communicate personal data when such communication is required by the Law, a decree or an ordinance, or by court ruling.

Transfer of data outside of the European Economic Area

CHÂTEAU D’AIGUEVILLE stores all the data on servers located within the European Economic Area such that their protection is fully ensured.

It is possible that certain data may be transferred outside of the European Economic Area only as part of our activities, for example information requests from our parent company in Switzerland.We also work with suppliers outside of the EEC such as for the supply of Chilean wines. In this regard, the exchange of personal data is limited; however, CHÂTEAU D’AIGUEVILLE commits to always ensuring an adequate and sufficient level of protection for your data, in particular by using standard contractual clauses approved by the European Commission or other means that comply with Belgian and European legislation on personal data protection.

Contact

e-mail: info@aigueville.com

Address: Château d’Aigueville – Groupe Schenk – Route de Serignan – 84100 Uchaux

Phone: +33 (0)6 72 10 39 56