1. General

1.1. The concepts relating to the protection of personal data used in this Article 12 have the meaning given to them in the Data Protection Legislation.  

1.2 ESNAH undertakes to comply with the General Data Protection Regulation (2012/679) in any processing of information relating to an identified or identifiable natural person in the performance of the Contract (referred to as “personal data” under the Data Protection Legislation) and in particular the following provisions:

2. Esnah as data controller

2.1. ESNAH processes personal data relating to its Customers (and possibly their co-users and end-users), such as identification data, contact data, data on the use of ESNAH products and services, Customer communication traffic data, billing and payment data and technical data. In so doing, ESNAH acts as data controller. The data may be processed for the following purposes:

• The performance of the contract concluded with the Customer and the supply of the services requested by the Customer;
• Administration and management of customer relations;
• The establishment of customer profiles and the organisation of information or promotional campaigns relating to ESNAH’s Products and Services, unless the customer objects;
• Improving and developing ESNAH’s products and services 

ESNAH’s files are accessible to third parties working in the name of ESNAH or on its behalf.

ESNAH may share customer data with third parties in order to carry out information or promotional campaigns relating to ESNAH products and services, unless the customer objects.  

In the cases provided for by law, ESNAH communicates customer data on request to the competent public authorities of the requesting country.

Customers have the right to access, rectify and delete data concerning them.

For more information on the processing of personal data by ESNAH, the purposes of the processing, the categories of personal data concerned, the collection of data, how long the personal data is kept and how the Customer can exercise his/her rights and communicate his/her privacy preferences. ESNAH refers to its privacy policy on its website www.ESNAH.be.

Data relating to customers who have terminated their contract with ESNAH may subsequently be used by ESNAH to inform them about ESNAH products and services, unless the customer has objected.  

ESNAH hereby entrusts the Customer, who accepts, with the performance of the following obligations of ESNAH arising from the Data Protection Legislation. In particular, the Client :

• Ensure that all personal data is accurate, complete and up-to-date;
• Shall ensure that the data subjects to whom the personal data relate are duly informed, in accordance with data protection legislation, that their personal data may be processed by ESNAH under this Contract. To this end, the customer will inform the persons concerned of ESNAH’s Privacy Policy and, more specifically, of the manner in which they may exercise their rights with regard to their personal data.
• At ESNAH’s request, provide proof that the persons concerned have been duly informed.

2.2. Regardless of the personal data received or held, ESNAH will take the technical and organisational measures necessary to ensure a level of security appropriate to the risks inherent in the processing (in particular the risks of accidental or unlawful destruction, loss, alteration, disclosure, unauthorised use or access and any other unlawful form of processing), taking into account the state of the art, the costs of implementation and the nature of the personal data and the potential risks.

2.3 If ESNAH detects a personal data breach affecting personal data within the framework of the execution of the Contract, it will inform the Client as soon as possible.  

2.4. At the Customer’s request and taking into account the nature of the processing and the information made available to ESNAH will reasonably help the Customer, as far as possible, to :

• Handle requests from data subjects exercising their rights as data subjects in accordance with Data Protection Legislation;
• To apply technical and organisational security measures in order to comply with the Customer’s security obligation with regard to the processing of personal data;
• Notify the supervisory authority and the data subject of any personal data breaches affecting personal data, and 
• Carrying out data protection impact assessments and consulting the supervisory authority in this context.

2.5. At the Customer’s request, ESNAH will provide all information necessary to prove compliance with this Agreement and to contribute to reasonable requests for verification by the Customer or any independent auditor appointed by the Customer. At least 60 (sixty) calendar days’ notice is required, unless shorter notice is required by data protection legislation.  

2.6. At the end of the Contract, ESNAH will delete the personal data (unless the law or the execution of the Contract requires the subsequent storage of the personal data) or, at the request of the Client, will return them to the latter or authorise it to proceed with their extraction.  

2.7. If a request from the Customer obliges ESNAH to take additional measures other than those directly imposed on ESNAH by the Data Protection Legislation, the Customer will reimburse ESNAH for all costs incurred in order to take such measures.

2.8. Violation of the Data Protection Legislation by ESNAH will only be considered a fault of ESNAH if it has acted outside or contrary to the legal or contractual instructions of the Customer.