Trade-in Privacy Notice

Which categories of personal data will Proximus use?

• Identification and contact information
• Financial data
• Hardware information of your device
• Internal identifiers

What are the different processing activities linked to “Trade-in”, what justifies them and what are the different parties involved?

Proximus shares your personal data with CTDI who acts as a joint controller together with Proximus. This means that Proximus and CTDI determine together why and how your personal data is processed and that both Proximus and CTDI are responsible for ensuring that the rules and principles of data protection legislation are respected (including regarding data subject rights and transparency obligations). The purposes for which Proximus and CTDI act as joint controllers are the following:

• Collection and transfer of personal data necessary for the trade-in. The processing of personal data for this purpose is necessary for the performance of the contract to which you are a party (art. 6(1)(b) GDPR).
• Returning the device in case you don’t accept the proposed trade-in fee. The processing of personal data for this purpose is necessary for the performance of the contract to which you are a party (art. 6(1)(b) GDPR).
• General communication on questions or complaints. The processing of personal data for this purpose is necessary for the performance of the contract to which you are a party (art. 6(1)(b) GDPR).
• Aggregation of data for reporting purposes. The processing of personal data for this purpose is based on the legitimate interest (art. 6(1)(f) GDPR) of Proximus and CTDI to generate aggregated reports and gain insight into the service offered.
• Collection and data sharing of the IMEI number of the device with Checkmend for fraud purposes. The processing of personal data for this purpose is based on the is based on the legitimate interest (art. 6(1)(f) GDPR) of Proximus and CTDI to verify that the device has not been reported as stolen or missing.

For the processing activities where Proximus and CTDI act as joint controllers, you can contact both parties for questions regarding the processing of your personal data or to exercise your data subject rights as explained in the section “What are my privacy rights and how can I exercise them?”. Proximus can be contacted at privacy@proximus.com and CTDI can be contacted at Janos.kopecek@ctdi.eu.

Proximus acts as a separate controller for the following purposes:

• Storing and processing personal data for direct marketing purposes. The processing of personal data of existing Proximus customers who already use our products and/or services for direct marketing purposes is based on the legitimate interest (art. 6(1)(f) GDPR) of Proximus to further promote our brand, as well as relevant products and services, to existing customers. The processing of personal data of individuals who make use of the trade-in service but who don’t use Proximus products and/or services is based on their consent (art. 6(1)(a) GDPR).
• Collection of personal data for the purpose of identity verification. The processing of personal data for this purpose is based on the necessity of the processing to comply with a legal obligation (art. 6(1)(c) GDPR) namely the legal obligation of Proximus to carry out an identity check.

For the processing activities where Proximus acts as a separate controller, you can contact Proximus at privacy@proximus.com for questions regarding the processing of your personal data or to exercise your data subject rights as explained in the section “What are my privacy rights and how can I exercise them?”.

CTDI acts as a separate controller for the following purposes:

• Reimbursement of the proposed return fee in case you accept it.
• Storing personal data for legal and accounting obligations

For the processing activities performed by CTDI as a separate controller, you are invited to contact CTDI at Janos.kopecek@ctdi.eu for questions regarding the processing of your personal data or to exercise your data subject rights.

How long will your personal data be processed?

Certain contact information or bank account information will be deleted when you decide whether you accept the proposed trade-in fee or not. In case you accept the trade-in fee, then your address will be deleted. In case you don’t accept the return fee, then your bank account number will be deleted.

The personal data collected in the context of this service will be processed for a period of 6 months.