1. Introduction

The Ring Ring Company, a public limited company with registered office at Culliganlaan 2/F, 1831 Machelen, Belgium and registered in the Belgian Crossroads Bank for Enterprises under the number 0445.262.068 (hereinafter “RingRing”, “we” or “us”) values your privacy and is committed to protecting your personal data in accordance with applicable privacy laws.

This privacy policy applies to the personal data processed via all products, services (ex: Naxai) and websites offered by RingRing (the “Privacy Policy”). We refer to these products, services and the website as the “Services”.

Unless otherwise provided for in your contract, the Services are provided by RingRing inside of Europe on behalf of its customers.

2. What personal data do we collect?

2.1 Who are “you”?

We refer to “you” a lot in this Privacy Policy. To better understand what information is most relevant to you, see the following useful definitions:

• Prospect or Customer: You (could) hold an account with RingRing and you (and other administrators of your company or organisation) either directly send messages, create applications or you are collaborating on, commenting on, or reviewing applications linked to an account;
• Recipient: You have received a message, SMS, RCS, call, e-mail, … powered by RingRing;
• On line Visitors: you are visiting the website because you are curious, or you have heard about us from our marketing and sales channels. Below we will differentiate with visitors of our website, but we will also address the processing activities when visiting our premises.
• On Site visitors, in our offices, on a fair, etc.

2.2 Personal data we collect from you

We may collect the following personal data from you:

• Contact Information: Such as your first name, last name, phone number, email address or other addresses, time zone, language, company information and registration information you provide to us via the use of our Services, an interaction with us, or by any other means that allows us to communicate with you;
• Cookies and other trackers: We provide more information on cookies in our  Cookie Policy.
  • Marketing campaign visit information: When you visit our website through a marketing campaign (for example, by clicking a link in an email, advertisement, or social media post), we may collect information about the origin of your visit using URL parameters such as utm_source, utm_medium, utm_campaign, etc. This information may be temporarily stored in your browser’s sessionStorage and used to understand the effectiveness of our marketing efforts and attribute conversions (e.g., form submissions or purchases) to their source. We do not use this data to identify you directly, unless you provide personal information (for example, by submitting a form), in which case the attribution data may be linked to your profile. This data is only used for marketing and analytical purposes, based on your consent, and is automatically deleted at the end of your browsing session.
  • Usage information: We collect usage information about you whenever you use our Services. This includes which webpages you visit, what you click on, when you perform those actions, what language preference you have, what you buy and so on;
  • Device and browser data: we collect information from the device and application you use to access our Services. Device data mainly means your IP address, operating system version, device type, device ID/MAC address, system and performance information, and browser type. If you are on a mobile device we also collect the UUID for that device;
  • Information from page tags: We use first party and third party cookies and tracking services that employ cookies and page tags (also known as web beacons https://www.ringring.be/cookie-policy/ to collect data about visitors to our websites. This data includes usage and user statistics. Emails sent by RingRing or by customers through our services also include page tags that allow the sender to collect information about who opened those emails and clicked on links in them. We provide more information on cookies in our Cookie Policy.
  • Log data: Like most websites today, our web servers keep log files that record data each time a device accesses those servers. The log files contain data about the nature of each access, including originating IP addresses, internet service providers, the files viewed on our site (e.g. HTML pages, graphics, etc.), operating system versions, device type and timestamps.

If you are a Customer, we may collect and process the following personal data that we received from you:

• Account registration information: you need an account with RingRing before you can use our Services (ex: Naxai). Our Services are mainly directed to businesses (companies and other types of organizations) so when you register for an account, we collect certain information on your company or organization, such as the name of your company/organization, the company’s/organization’s registration number and its address. In this process we also collect the name, phone number, and email address of the legal representative(s) of the company/organization and of other users within the account (users within the account are also referred to as owner, administrator or collaborator, depending on their role). We also collect your username and password to the account.
• Billing information: If you make a payment to RingRing, we require you to provide your billing details, a name, address, e-mail address and financial information corresponding to your selected method of payment (e.g. a credit card number and expiration date or a bank account number).
• Account settings: when you sign up for our Services you are asked to provide us with information about individuals within your company or organization who can act as a user (whether it be as owner, administrator or collaborator) within the account. The information we collect are: first name, last name, email address, role, time zone, language and phone number. Administrators can also manage various preferences and personal details on their account which may include a profile picture and communication preferences (e.g. opting in or out of receiving our newsletter or product information).

If you use our Services, we may also collect the following data on your behalf for certain Services:

• Address book information: we may allow the customer to import email addresses and other contact information, such as your phone number, into an address book so the Customer can easily create his/her personalized campaigns, and other variations of our products or applications. We do not use this data for our own purposes or to contact anyone, except at your direction.

If you are a Recipient, we may also collect the following data on behalf of our Customer for certain Services:

• Metadata of communication: such as timestamps, the operator and status of the delivery will be gathered and stored. RingRing needs to process this data to perform the contractual agreement with the Customer. RingRing will also be processing as data Controller this data regarding its legal obligations as described in the law of 13th of June 2005 regarding electronic communication.

3. How do we process your personal data and why?

We process your personal data for the following purposes and based on the legal basis mentioned with each purpose:

3.1 If you are a Prospect or a Customer

We may collect and process the above personal data for the following purposes and based on the following legal grounds:

• 3.1.1. we need to fulfill our contractual responsibility to deliver the Services to you;
  This is the case for your Account Registration Information, your Billing Information and your Account Settings to run your account, provide you with our Services, bill you for our Services, provide you with customer support and contact you about your account or our Services, and to send you key communications of a transactional nature related to service announcements, billing related matters, changes to our Services or policies, a welcome e-mail upon your first registration (communications of which you cannot opt-out).
• 3.1.2. we have a legitimate interest to do so;

  This is the case for (i) your Contact Information when we send you marketing information (for as long as you do not opt-out) and (ii) your Device and browser data to Ringring.be.

  We may also need to disclose certain personal data for the following legal use purposes, namely to disclose it with competent authorities if we are obliged to do so by law or judicial process and to disclose it to legal counsels and/or courts if we need to protect and defend our rights.

  This is the case when we collect your data indirectly for prospecting purposes. For example, by searching for the professional contact details of sales staff from potential client companies on websites (such as Linkedin or the websites of companies that might be interested in Ring Ring’s services) or in specialist magazines, or at conferences, fairs or special events related to Ring Ring’s activities.

• 3.1.3. you have consented.
  This is the case for (i) usage information and (ii) information from page tags based on the cookies and similar technologies on our website and platform. For all information regarding cookies and similar technologies we refer you to our Cookie policy.

  We also ask for your consent regarding our newsletter and other marketing or promotional materials.

3.2 If you are a Recipient

We may collect and process the above personal data for the following purposes and based on the following legal grounds:

• 3.2.1 we have a legal obligation;
  As mentioned above, RingRing has, as data Controller, a legal obligation to process and store metadata of electronic communications as described in the law of 13th of June 2005 regarding electronic communication.
• 3.2.2 we need to fulfill our contractual responsibility;
  As RingRing will mostly be qualified as a processor. This means that RingRing will process your data when the Customers have requested RingRing to do so. Therefore if you have received an e-mail or SMS through our Services we will most likely refer you to our Customer.
• 3.2.3 you have consented.
  This is the case for your Contact Information when we need to respond to your request made via our website (or any other way) about our Services and/or why we contacted you (e.g. your reach out to us regarding a survey you have received from a company or organization).

  We also ask for your consent regarding our newsletter and other marketing or promotional materials.

3.3 If you are a Visitor

• 3.3.1 Visitor on the website
  We may collect and process the above personal data for the following purposes and based on the following legal grounds:
  • 3.3.1.1 we have a legitimate interest to do so;
    This is the case for your Device and browser data. We refer you to our Cookie Policy.
  • 3.3.1.2. you have consented;
    This is the case for (i) your Contact Information when we need to respond to your request made via our website (or any other way) about our Services, and when accepting our cookies (ii) usage information and (iii) information from page tags based on the cookies and similar technologies on our website and platform. For more information regarding the processing through cookies, we refer you to our Cookie Policy. We also ask for your consent regarding our newsletter and other marketing or promotional materials.
• 3.3.2 Visitor at the office
  We may collect and process the above personal data for the following purposes and based on the following legal grounds:
  • 3.3.2.1 we have a legitimate interest to do so.
    i. Camera surveillance
    When visiting our office, it is possible that we process your image through our camera surveillance. RingRing relies on its legitimate interest and more specifically the aim of preventing, establishing or detecting crimes against persons or property. RingRing will always handle their camera surveillance in accordance with the law of 21st of March 2007 regulating the placement and use of surveillance cameras will be installed and handled.In case of a judicial investigation or a police request, the data be transferred in accordance with the GDPR, without your prior agreement. This will always be under the supervision of the judicial and police authorities and your data will never be used transferred for other (e.g. commercial) purposes.
    ii. Registration kiosk
    When visiting our office, you will be asked to fill in the visitor registration form at our registration kiosk. We will process your name (first and last name), contact details (email address, telephone number) and company details. We process this information, relying on our legitimate interest, for the following purposes:
  • • Notifying the host of your arrival;
    • Security and internal audits;
    • In case of emergency situations; and
    • Draw up visitor statistics.

4. Do we share personal data with third parties?

We only use the personal data we receive for the purposes described above. In that regard, we may need to share your personal data with third parties, so-called ‘recipients’:

4.1. External service providers

We may use external service providers to provide or perform services and functions on our behalf. We may make personal data available to them solely to perform these services and functions. We have taken the necessary technical and organizational measures to ensure compliance with data protection provisions and also require external service providers to do so. Examples of such service providers are:

• Network operators and telecom providers to facilitate our Services by text or e-mail to Recipients;

• Payment solution providers or banks;

• IT service providers (such as IBM, Calendly, etc.);

4.2. Authorities and justice system

We may also make personal data concerning individuals available to public or judicial authorities, law enforcement personnel and agencies as required by law, including to meet national security or law enforcement requirements, and including to agencies and courts in the countries where we operate. Where permitted by law, we may also disclose such information to third parties (including legal counsel) when necessary for the establishment, exercise or defense of legal claims or to otherwise enforce our rights, protect our property or the rights, property or safety of others, or as needed to support external audit, compliance and corporate governance functions;

4.3. Potential acquirers of RingRing

In the event of a sale, merger, liquidation, dissolution, or other, certain personal data may be disclosed to the party (and/or its legal counsels) acquiring all or part of the equity or assets of RingRing or its business operations. If this proves to be necessary, we will take the necessary precautions (e.g. need-to-know-basis only, enter into confidentiality agreements and apply other industry best practices) to protect your privacy at all times.

5. Do we share personal data outside of the European Economic Area?

In principle, RingRing does not transfer your personal data to recipients in countries outside the European Economic Area. However, when performing our Services sometimes we use to relay a message to or receive feedback from a recipient in a country outside of the European Union, RingRing will ensure that if personal data is transferred to a recipient in a country not covered by a European Commission decision to provide an adequate level of protection, it will be subject to the provisions of a data transfer agreement, which will include (a) the standard contractual clauses issued by the European Commission, or (b) any other mechanism in accordance with the privacy legislation, or any other regulation relating to the processing of personal data.

6. How long do we retain personal data?

We may retain your personal data no longer than necessary for the purposes for which they were collected or as required by applicable law.

If you are a Customer, we generally do not delete the data in your account as long as your account is active – you are responsible for and control the time periods for which you retain this data.

If you are a Recipient, we store your metadata in accordance with law of 13th of June 2005 regarding electronic communication. For the other data processed regarding processing activities relevant for you, we comply with the retention period provided by our Customer.

If you are a Visitor, your image captured by our camera surveillance will be stored for 30 days in accordance with the law of 21^st of March 2007 regulating the placement and use of surveillance cameras will be installed and handled. If you have put your data in our registration kiosk the data will be stored for 24h.

We also describe the expiry periods for cookies on our websites in our Cookie Policy.

7. What about security?

We apply appropriate technical, physical and organizational measures that are reasonably designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, and against other unlawful forms of processing. Access to personal data is restricted to authorized recipients on a need-to-know basis. We maintain a comprehensive information security program that is proportionate to the risks associated with the processing. The program is continuously adapted to mitigate operational risks and to protect personal information, taking into account industry-accepted practices.

8. Who is your data controller?

The data controller determines the purpose and means of the processing of your personal data. You can determine your data controller based on the following:

If you are a Customer using our services:

• If you have provided us your contact details through our website or any other way, we will be the Controller in that data processing activity;
• If it is your company or organization who has provided us with your contact details (name, e-mail address and role within our platforms). You can reach out to your organization in case of any questions or concerns.

If you are a Recipient, we have received your personal data via the company or organization that is contacting you by using our Services. That company or organization is your data controller, who you can reach out to if you wish to amend, delete or receive a copy of your personal data.

If you are a Visitor, we only receive the personal data that you have entered into our website, entered our premisses or that we acquired with cookies in compliance with our Cookie Policy.

9. What are your rights?

You may wish to exercise a right to obtain information about yourself or to correct, update or delete that information. Some of these rights may be subject to some exceptions or limitations in local law.

If you are a Recipient, you will need to reach out directly to the company or organization, data controller, to exercise these rights. We are not in control of your response data and, accordingly, not in a position to directly handle these requests in relation to your personal data. If you are having difficulties finding the customer, you can contact us through dpo@ringring.be and we will try our best to help you.

We will take reasonable steps to verify your identity and we will respond to your request to exercise these rights within a reasonable time (and in all cases within 30 days of receiving a request) subject to the below for specific categories of personal data.

• You always have a right of access your personal data. This allows you to check what personal data we process about you and to get a copy of it;
• You always have a right to rectify your personal data. This allows you to correct or complete incorrect or incomplete personal data that we process about you;
• You have a right to erasure of your personal data. This allows you to permanently delete personal data that we process about you. We are not always obliged to delete your personal data at your request – this right only applies in the cases and to the extent provided for by law;
• You have a right to restrict the processing of personal data relating to you. This allows you to freeze the use of your personal data by us, without deleting it. We are not always obliged to restrict your personal data at your request – this right only applies in the cases and to the extent provided for by law;
• You have the right to object to the processing of your personal data in general. This allows you to oppose the further processing of your personal data. We are not always obliged to honour your objection – this right only applies when we process your personal data on the basis of our legitimate interest;
• You always have the right to object to the processing of your personal data for direct marketing purposes (e.g. via clicking on the unsubscribe button);
• You have the right to withdraw your consent at any time where the processing of your personal data is carried out on the basis of your consent;
• You have the right to data portability. This allows you to transfer, copy or forward personal data easily from one data controller to another. This right can only be exercised if the processing is based on your consent or on an agreement we have with you.

If you believe we have not handled your request appropriately, you may always lodge a complaint with a competent supervisory authority in Belgium (https://www.dataprotectionauthority.be). 

If you wish to exercise any of the rights mentioned above, please send your request to dpo@ringring.be.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. In circumstances where a change will materially change the way in which we collect or use your personal data, we will send a notice of this change to all of our customers.

11. Do you have any questions or a complaint?

If you have any comments, questions, complaints or of you wish to exercise any of the rights mentioned above, please do not hesitate to contact us dpo@ringring.be.

Other than your Data Protection Rights mentioned above, you also the right to lodge a compliant with a competent supervisory authority in Belgium (https://www.dataprotectionauthority.be), if you believe we have not handled your request appropriately.