Privacy and Personal Data Protection Policy – “Best HR Insights” Newsletter of Balencio SA

1. Why this policy and what does it apply to?

Balencio SA is committed to respecting privacy and attaches great importance to the protection of the data it processes, as well as to legislation relating to privacy protection.

Our policy regarding the protection of personal data is based on the applicable legal provisions in this field, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, the “GDPR”), and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

This policy complies with the requirements of Articles 13 and 14 of the GDPR and aims to inform, in a concise, transparent, and understandable manner, individuals wishing to subscribe to Balencio SA’s “Best HR Insights” newsletter about practices relating to the protection, collection, use, and sharing of the personal information provided.

It applies solely to the processing of data capable of identifying or rendering identifiable the data subjects, directly or indirectly (hereinafter “Personal Data”).

Balencio SA undertakes at all times to comply with the requirements of the applicable Personal Data Protection Regulations and to process Users’ personal data only under the conditions set out below.

---

2. Balencio SA as Data Controller

2.1 Who is the controller of the personal data processing?

Balencio SA, whose registered office is established at:

Rue Emile Francqui, 3
1435 Mont-Saint-Guibert
BELGIUM

registered with the Crossroads Bank for Enterprises under number 0662.639.464, is the controller of the personal data processing.

---

2.2 What personal data do we process?

We collect only your email address.

No other personal data is collected within the scope of this processing activity.

---

2.3 For what purposes do we process your personal data?

We process your email address solely for the purpose of:

• managing your subscription to our newsletter;
• sending you informational communications, news updates, or content related to our activities.

These data are processed in accordance with this statement and in compliance with the provisions of the European Data Protection Regulation.

They will only be processed by Balencio SA personnel and its processors, solely for the purposes described above.

No other use of your data is made. Under all circumstances, Balencio SA undertakes to collect and process your personal data only to the extent strictly necessary for the achievement of one of the purposes set out in this policy. In principle, your personal data will never be used in any context other than the one announced.

When collecting your personal data, you will be informed whether certain personal data must or must not be provided in order to achieve the expected result. Failure to provide mandatory information may render the execution of the request impossible.

No processing activity involves automated decision-making.

---

2.4 What is the legal basis for the processing activity?

The processing is based on your consent, which you provide when subscribing to the newsletter.

You may withdraw this consent at any time via the unsubscribe link included in the newsletter copies received.

---

2.5 Who are the recipients of the collected data?

These personal data processing activities are carried out while complying with a strict confidentiality principle to which these persons are contractually bound.

Your data are accessible only to Balencio internal teams requiring access in the performance of their duties, namely:

• the marketing department;
• the sales department.

Such access is strictly limited to what is necessary for subscription management and newsletter distribution.

The data are neither sold, transferred, nor used for any other purposes.

• Processors involved in various operational processes, cybersecurity, and responses to cyberattacks;
• Any public authority legally authorised to receive the data in the event of a cyberattack or attempted attack, any court, governmental or police department in charge of investigations, lawyers and bailiffs appointed by Balencio SA, and any judicial personnel involved in the prosecution of offences and related compensation matters.

Balencio SA works closely with third-party companies providing IT services necessary for the proper functioning of the website (hosting, storage, maintenance, subscription invitations, etc.).

The Client expressly acknowledges and accepts that Balencio SA may subcontract the performance of all or part of the Client Data processing activities. Balencio SA undertakes to inform the Client of any planned change regarding the addition or replacement of a processor and to give the Client the opportunity to raise objections to such change.

The user accepts that such information may be provided in accordance with this policy under the clause entitled “List of Processors,” which the user is responsible for consulting regularly. Where a processor engages another processor, the processor undertakes to ensure that the same obligations relating to personal data protection imposed under this policy are also imposed on such sub-processor, so that this sub-sub-processor complies with the requirements of the aforementioned Regulation.

Balencio SA ensures that these processors act only on the basis of documented instructions and implement appropriate technical and organisational measures so that the processing of Personal Data they carry out complies with GDPR requirements and guarantees the protection of the rights of data subjects. Balencio SA remains responsible towards data subjects for the performance of its obligations by its own processors.

No personal data are transmitted to third parties other than the above-mentioned recipients or outside the indicated legal framework, without prejudice to any transmission to authorities responsible for supervisory or inspection missions under Belgian law, such as an investigating judge.

In any event, Balencio SA will not disclose personal data to third parties for direct marketing purposes.

---

2.5.1 List of processors

Processor	Processing Activity	Data Location
Brevo	Subscription management and mass newsletter distribution – email invitations to participate in analyses	France / Belgium

---

2.6 How long are your data retained?

In addition to its legal retention obligations, Balencio SA uses the purpose as one of the criteria for defining the period during which data must be retained. Depending on the processing concerned, your data are retained only for the period necessary for the processing activity and subsequently deleted, unless an investigation is ongoing. In such a case, the data will be retained for the time necessary to conclude the investigation.

Your email address is retained for:

• the duration of your subscription;
• and for a maximum of 3 years following your last contact.

Beyond this period, your data are deleted or anonymised.

---

2.7 Are your Personal Data transferred outside the European Union?

We do not transfer your Personal Data outside the European Union. Indeed, we rely on service providers guaranteeing primary hosting within Europe.

---

2.8 What measures are implemented to protect your data?

Balencio SA has implemented a number of appropriate technical and organisational security procedures, which it regularly reviews and updates, in order to prevent destruction, loss, falsification, alteration, unauthorised access, accidental disclosure to third parties, and to ensure the security and proper use of the information collected for the purpose of carrying out the relevant processing activity.

We implement appropriate technical and organisational measures in order to ensure the security and confidentiality of your personal data, in accordance with our Information Security Management System (ISMS), complying with the principles of the ISO 27001 standard.

Where a service provider is engaged, Balencio SA ensures that the latter complies with its security obligations prior to any communication of your Personal Data.

Balencio SA has also appointed a Data Protection Officer in order to monitor and validate compliance with the regulations applicable to personal data protection. You may contact this Officer via the email address dataprotection@balencio.com.

---

2.9 What are your rights?

Each newsletter contains an unsubscribe link allowing you to unsubscribe at any time in a simple and immediate manner.

In accordance with the applicable regulations, you also have the following rights:

• right of access;
• right to rectification;
• right to erasure;
• right to restriction of processing.

---

2.10 How can you exercise your rights? To whom should you address your questions/complaints?

You may send your requests to exercise your rights:

• by email to support@balencio.com or dataprotection@balencio.com.

or

• by regular mail to the following address:

Balencio SA
Rue Emile Francqui, 3
1435 Mont-Saint-Guibert
Belgium

To ensure respect for your privacy and guarantee your security, we will take the necessary steps to verify your identity before allowing you to access and, where applicable, correct your data.

If you believe that we are failing to comply with one of our legal and/or contractual obligations, we invite you to contact us at the same addresses, or directly our DPO at dataprotection@balencio.com.

We will make every effort to provide you with follow-up as quickly as possible.

Should our response not satisfy you, you have the right to lodge a complaint with the Data Protection Authority (DPA).

Data Protection Authority
Rue de la Presse 35
1000 Brussels

Tel.: +32 (0)2 274 48 00
Fax: +32 (0)2 274 48 35
Email: contact@apd-gba.be
URL: https://www.dataprotectionauthority.be

---

3. Updates and effective date

This policy entered into force on 15 April 2026.

It may be amended at any time, notably to take into account any legislative, regulatory, or processing activity changes.

Balencio SA therefore reserves the right, at its sole discretion, to change, modify, add, or remove parts of this policy at any time.

We therefore encourage you to consult it regularly via https://balencio.com/en/privacy-and-personal-data-protection-policy-best-hr-insights-newsletter-of-balencio-sa/ .