QPT Tower SA
Av. des Communautés 100
1200 BRUXELLES
T.V.A.: BE0476 302 365

QPT Tower SA, with its registered office at Avenue des Communautés 100, 1200 Woluwe-Saint- Lambert and registered in the Crossroads Bank for Enterprises (BCE/KBO) under enterprise number 0476.302.365, and BESIX RED SA, having its registered office at Avenue des Communautés 100, 1200 Woluwe-Saint-Lambert, Crossroads Bank for Enterprises (BCE/KBO) number 0435.351.341, whose VAT number is BE0435.351.341 (hereinafter: “We” or the “Company”), attach great importance to the gathering and safe, transparent and confidential processing of your personal data. The Company is particularly concerned to protect the data of its clients, subcontractors and suppliers, especially against loss, violation, errors, unauthorized access or unauthorized processing.

The Company is publishing this data protection memorandum to inform you about the gathering and processing of your personal data.

We ask you to read this data protection memorandum carefully, as it contains important information about how and why the Company processes your personal data.

By providing your personal data, you expressly acknowledge that you have read this data protection memorandum, and that you expressly accept its content as well as the processing of the data.

This data protection memorandum covers all activities carried out and all services provided by the Company.

BESIX RED SA, with its registered office at Avenue des Communautés 100, 1200 Woluwe-Saint- Lambert and with the enterprise number 0435.351.341, is the person responsible for the processing of your personal data (“controller” in the language of the General Data Protection Regulation).

In gathering and processing your personal data, the Company complies with the Belgian legislation on the protection of personal data and the General Data Protection Regulation (GDPR), as from its entry into force on 25 May 2018.

Depending on your activities and your relationship with the Company, you may find yourself communicating the following personal data: your identity details and contact information (name, title, address, e-mail address, telephone number, mobile phone number). For some specific legal requirements (electronic registration of attendance, 30bis work declaration), it is possible that you have to provide additional data, especially in order to record your attendance (such as E-ID data, Limosa number).

You bear full responsibility for the completeness and accuracy of the data you provide. If your data is out of date, we ask you to inform us immediately.

• Client data

In the context of its activities and services, the Company gathers and processes identity data and contact information of its existing and prospective clients and principals, of their personnel, persons working for them, agents and any other relevant contact persons. The purposes of this processing are the negotiation and execution of the agreements with the contracting parties concerned, the management of clients and service providers of any kind, the accounting, and direct prospecting activities, such as the sending of promotional or commercial information. The legal bases are the negotiation and execution of the contracts concerned, the respect of legal and regulatory obligations (such as the 30bis work declaration) and/or the legitimate interest pursued by the Company.

• Supplier and subcontractor data

LThe Company gathers and processes the identity data and contact details of its suppliers, subcontractors and suppliers as well as any of their potential (sub)subcontractor(s), of their personnel, persons working for them, agents and any other useful contact person. The purposes of these processing operations are the negotiation and execution of the agreements with the contracting parties concerned, the management of suppliers/contractors and service providers of any kind, the accounting, and direct prospecting activities, such as the sending of promotional or commercial information. The legal bases and the purposes are the negotiation and the execution of the contract, the respect of legal and regulatory obligations (such as the obligatory electronic registration of presence, the 30bis work declaration, the list of presence or other public procurement-related obligations) and/or the legitimate interest pursued by the Company. For the electronic registration of presence, the E-ID data or Limosa number will be processed where applicable.

• Employee data

The Company gathers and processes the personal data of its employees as part of its personnel and salary management. Given its specific nature, this processing is addressed in greater detail in an employee data protection policy.

• Other data

In addition to the data of clients, suppliers / subcontractors / service providers of any kind and employees, the Company also processes the personal data of other persons, such as new clients / “prospects”, useful contacts in relevant market sectors, networking contacts, experts, direct marketing contacts, etc. For direct e-mail marketing activities (such as newsletters or invitations to events), the authorization may be withdrawn at any time.

Personal data are stored and processed for a period of time depending on the purpose of the processing and the relationship (contractual or otherwise) between the parties involved.

Client, supplier or subcontractor data will, in any event, be removed from the Company’s systems after 10 years from the contact between the parties, the termination of the relevant contract or from the end of the project, except for data of a personal nature that the Company is required to keep for longer based on specific legislation or in the event of ongoing litigation for which personal data are necessary and/ or opportune.

In accordance with and under the terms of Belgian data protection legislation and the provisions of the General Data Protection Regulation, we hereby inform you that you have the following rights:

Right of access: You are entitled to ask to know, free of charge, what personal data about you The Companyprocesses and to verify for what purpose they are used.

Right of rectification: You have the right to obtain a rectification (correction) of personal data about you which is incorrect and the right to supplement personal data (about you) that is incomplete.

Right to be forgotten or to restrict data: You have the right to ask the Company to erase personal data about you and to restrict the processing of such data in the circumstances and under the conditions stipulated in the General Data Protection Regulation. the Company is entitled to refuse to erase or to restrict data that is necessary for salary processing, fulfilling a legal obligation, concluding an employment contract or for its legitimate interest, provided that such data are necessary for the purposes for which they were gathered.

Right to data portability: You have the right to receive the personal data concerning you that you have provided to the Company, in a structured, commonly used and machine-readable format. You have the right to pass on this data to another controller.

Right to oppose: You have the right to oppose the processing of your personal data for serious and legitimate reasons. You may not, however, oppose the processing of data that is necessary for The Companyto fulfil a legal obligation, conclude an employment contract or for its legitimate interest, provided that such data are necessary for the purposes for which they were gathered.

Right of withdrawal of consent: Where the processing of personal data is based on prior consent, you have the right to withdraw that consent. This personal data will then be processed only if the Company has another legal basis to justify the said processing.

Decisions based on automatic processing, profiling: the Company confirms that the processing of personal data does not include profiling and that you will not be subject to decisions based entirely on automated processing.

You may exercise the aforementioned rights by contacting: communication@besixred.com.

We make every effort to ensure meticulous and legitimate processing of your personal data in accordance with applicable regulations. However, if you believe that your rights have not been respected and that your concerns are not being heard within our company, you are free to file a complaint with: Commission for the Protection of Privacy Rue de la Presse 35, 1000 Brussels Tel. 02 274 48 00 Fax. 02 274 48 35 Email: commission@privacycommission.be. You can also take legal action if you believe you are suffering harm caused by the processing of your personal data

• Client data

Personal data can be transferred to and may be processed by third parties with whom the Company collaborates for its projects (e.g. real estate agents, public notaries, etc). The performance of our obligations as well as the answer to clients’ requests may imply transferring and processing personal data of our clients and prospects.

The Companymay also transfer personal data to related companies.

The Company will not in any event sell your personal data or make them available to direct marketing offices or similar service providers, except with your prior consent.

• Employee, suppliers and contractors data

Certain personal data of employees collected by the employer will be transferred to and may be processed by third parties (e.g. IT supplier, accountant, auditor), as well as by any administrative and/or public authority (e.g. in the case of the 30bis declaration of work, the electronic registration of presence or for the award of public contracts).

It can happen that one or more of these third parties is located outside the European Economic Area (“EEA”). However, personal data will be transmitted only to third countries having an adequate level of protection.

The employees, managers and/or representatives of the aforementioned service providers or institutions as well as the specialized service providers designated by them, are required to respect the confidential nature of your personal data and may use these data solely for the purposes for which they were provided.

If necessary, personal data may be transmitted to other third parties. This may be done in the event of a partial or complete reorganization of the Company, if its activities are transferred or in the event of a declaration of bankruptcy. It is also possible that your personal data have to be transferred owing to an injunction or in order to fulfil a particular legal obligation. In this case, the Company will endeavour to inform you in advance of this communication to other third parties. You acknowledge and understand, however, that under certain circumstances this is not always technically or commercially feasible or that legal restrictions may apply.

The Company will not in any event sell your personal data or make them available to direct marketing offices or similar service providers, except with your prior consent.

• Client data

Personal data can be transferred to and may be processed by third parties with whom the Company collaborates for its projects (e.g. real estate agents, public notaries, etc). The performance of our obligations as well as the answer to clients’ requests may imply transferring and processing personal data of our clients and prospects.

The Companymay also transfer personal data to related companies.

The Company will not in any event sell your personal data or make them available to direct marketing offices or similar service providers, except with your prior consent.

• Employee, suppliers and contractors data

Certain personal data of employees collected by the employer will be transferred to and may be processed by third parties (e.g. IT supplier, accountant, auditor), as well as by any administrative and/or public authority (e.g. in the case of the 30bis declaration of work, the electronic registration of presence or for the award of public contracts).

It can happen that one or more of these third parties is located outside the European Economic Area (“EEA”). However, personal data will be transmitted only to third countries having an adequate level of protection.

The employees, managers and/or representatives of the aforementioned service providers or institutions as well as the specialized service providers designated by them, are required to respect the confidential nature of your personal data and may use these data solely for the purposes for which they were provided.

If necessary, personal data may be transmitted to other third parties. This may be done in the event of a partial or complete reorganization of the Company, if its activities are transferred or in the event of a declaration of bankruptcy. It is also possible that your personal data have to be transferred owing to an injunction or in order to fulfil a particular legal obligation. In this case, the Company will endeavour to inform you in advance of this communication to other third parties. You acknowledge and understand, however, that under certain circumstances this is not always technically or commercially feasible or that legal restrictions may apply.

The Company will not in any event sell your personal data or make them available to direct marketing offices or similar service providers, except with your prior consent.

• The Company will take the technical and organizational measures to process the data to a sufficient level of security and to protect your personal data against any destruction, loss, falsification, unauthorized access or accidental notification to third parties as well as any unauthorized processing of these data.In no event may The Company be held responsible for any direct or indirect damage caused by the erroneous or illicit use of personal data by a third party.

In order to process your personal data, The Company grants access to your personal data to its employees, persons working for it and agents, as well as to subcontractors. The Company guarantees a similar level of protection by imposing contractual obligations on its employees, persons working for it and agents, as well as on its subcontractors.

If, after reading this data protection memorandum, you have further questions about the gathering and processing of your personal data, you may contact: communication@besixred.com.