Privacy statement

1. General

‍The Evoluno website, hosted at www.evoluno.com (hereinafter the " Site ").And the Evoluno iOS/Android mobile Platform and web version (hereinafter collectively " Platform ") are an initiative of :

‍Evoluno SRL

‍Avenue Arnaud Fraiteur 15/23 1050 IxellesCompany number (BCE/TVA): BE0758.358.272

E-mail: hello@evoluno.com

‍(hereinafter referred to as " Evoluno" or the "Data Controller").

Evoluno processes certain personal data of any person who visits our Site (hereinafter the " Visitor "), of any person who uses our Platform (hereinafter the " User ") as well as of any person who enters into a contract with us for our services (hereinafter the " Customer ").

The Visitor, the User and the Customer are also collectively referred to in this privacy statement as " you/your ".

Where Evoluno processes your personal data, the General Data Protection Regulation (" GDPR ") and other relevant legal provisions apply. Each reference in this privacy statement to the GDPR is a reference to the Regulation of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

‍With this privacy statement, Evoluno wishes to inform you in a transparent manner about how Evoluno collects and processes personal data when Evoluno acts as data controller. In other words, when Evoluno decides "why" and "how" personal data is processed.

‍2. What personal data is processed and how is it used?‍

‍2.1. Processing of Site Visitor data

‍Evoluno may collect and process the following personal data about you as a Visitor:

1/ Visitor browsing data (technical data)

- IP address ;

- geographical location ;

- browser type and version ;operating system ;

- reference source ;

- duration of your visit, pages viewed and website navigation paths, as well as information on the time, frequency and pattern of your use of the service.

The source of this data is the use of unnecessary cookies.

Purpose of processing: Unnecessary cookies containing technical data may be processed to analyze/improve the Site.

The legal basis for this processing is your consent, obtained via our cookies banner on the Site.(

In addition to unnecessary cookies, Evoluno also uses necessary cookies that are processed for the proper technical operation of the Site).

Shelf life: See www.evoluno.com/cookie-statement

2/ Visitor communication data

- First and last name ;
‍
- E-mail address ;
‍
- Company name ;
‍
- Phone number ;
- Communication/message content.

Purpose of processing: Communication data may be processed to contact you if necessary, to be able to respond to your requests, questions or comments addressed to Evoluno (e.g. when you contact Evoluno via the contact form or live chat on the Site, by telephone or by email).

The source of communication data is the information you provide when you contact us.

Legal basis: Our legitimate interest in being able to respond to requests, questions or comments or to contact you if necessary.

Retention period: Personal data is kept until we consider that you are satisfied with our response.

3/ Newsletter data (direct marketing) when a Visitor registers

- E-mail address

Purpose of processing: Newsletter data is processed to send you newsletters or promotions from Evoluno, for which you have given your consent via the Site. You may unsubscribe at any time by clicking on the "unsubscribe" link in the relevant e-mail or by any other action described therein.

The source is the information you provide when you register for the newsletter.

Legal basis: Your consent.Retention period: Your data will be processed until you unsubscribe from the newsletter.

‍2.2. Processing of Platform Users' data
‍
1/Data concerning your account as a Platform User

- Company code ;
‍
- First name ;
‍
- Login data, i.e. user name and password ;
‍
- E-mail address.

Purpose of processing: Account data is processed to enable your access to and use of the Platform and the management of your account. This includes User registration, authentication and profile management. This is necessary to enable individuals to access and use the features and services of the Mental Health Platform.

The source of the account data is the information you provide when creating your account.

Legal basis : The performance of a contract between you and us, the Terms of Use or, at your request, taking steps to enter into such a contract.

Retention period: Users can delete their account data themselves via the special page in their Personal Area (by deleting their account). If the User remains inactive for 3 years, Evoluno will automatically delete the account data.

2/ Data concerning your interactions as a Platform User

- mental well-being/state of mind ;
‍
- physical health ;

- User entries, such as questionnaires, courses taken, exercises completed and self-evaluations carried out

Purpose of processing: Interaction data is processed to provide mental health treatment and therapeutic services to individuals. This includes analyzing user input, monitoring progress and providing personalized recommendations, and interventions based on information provided by the user. The Platform also enables users to be matched with a therapist according to their needs and preferences (separate consent is required for this). See chapter 5 for more information). In addition, certain aggregated data (analysis) is shared with the Customer. See chapter 5 for details.

The source of interaction data is the information you provide when you fill in questionnaires, take a certain course, complete exercises and carry out self-assessments.

Legal basis : The performance of a contract between you and us, the Terms of Use and/or General Conditions and your consent. This involves personal data from which a person's health can be inferred and therefore falls under special categories of personal data. For this reason, in accordance with the RGPD, we rely on two legal foundations.

Retention period: Users can delete their interaction data themselves via the special page in their Personal Area (by deleting their account). If the User remains inactive for 3 years, Evoluno will automatically delete the account data.

3/ User communication dat

- First and last name ;

- E-mail address ;

- Communication/message content.

Purpose of processing: Communication data may be processed to contact Users if necessary, to be able to respond to Users' requests, questions or comments addressed to Evoluno (e.g. when Users contact Evoluno by phone or email).

The source of communication data is the information you provide when you contact us.

Legal basis: Our legitimate interest in being able to respond to requests, questions or comments or to contact you if necessary.

Retention period: Personal data is kept until we consider that you are satisfied with our response.

‍2.3 Processing of Evoluno customer data

1/ Customer administrative data

- First name and surname of the customer's contact person ;

- Company information: company name, VAT number, address, e-mail address;

- Transaction data: payment method, card details, purchase details and transactions carried out.

Purpose of processing: Customer administrative data is processed for the provision of services purchased from Evoluno, for the billing of these purchased services and for proper customer administrative management.The source of the data consists of the information you provide us as a Customer when you use Evoluno's services.

Legal basis: The performance of a contract between you as a Customer and us or, at your request, the taking of steps to conclude such a contract.

Retention period: Personal data is retained for the duration of the contract. After termination of the contract, transaction data is kept for seven years to comply with a legal obligation (tax obligation).

2/ Direct marketing data for existing customers

- First name and surname of the customer's contact person ;
- Company information: company name, VAT number, address, e-mail address;

Purpose of processing: Data is processed to inform you of similar Evoluno services that you have purchased as a Customer or of certain actions or promotions thereof.

The source consists of the information you have provided to us after using our services.

Legal basis: Our legitimate interest, so that Evoluno can keep you informed of similar Evoluno services for which you have already used Evoluno, or to inform you of certain Evoluno actions or promotions.

Retention period: Your data will be processed until you unsubscribe from the newsletter.

‍2.3 Data processing for statistical analysis and research purposes

- Activities on the platform: tracked sessions, exercises...

- Results of self-assessments & surveys

‍Purpose of processing: The platform may process anonymized or pseudonymized data for statistical analysis and research purposes. This may help to improve the effectiveness of the platform's services, understand user behavior and preferences, and promote research into mental health. Care should be taken to ensure that all data used for research is properly anonymized and that individuals cannot be identified from the results.

Source: data on our servers

Legal basis: Consent was given at the time of registration

Shelf life: 3 years

‍3. Consent

‍Consent is given by the positive act by which the User has ticked the box with the privacy statement in the hypertext link. This consent is a prerequisite for certain actions on the Platform. Without your consent you cannot interact on the Platform.

The User has the right to withdraw his consent at any time. You may contact us for this purpose. Withdrawal of consent does not compromise the lawfulness of processing based on consent previously given.

‍4. Subcontractors

‍A processor is a natural or legal person who processes personal data at our request or on our behalf. Evoluno sometimes contracts with such a party to provide certain products and/or services. In other words: Evoluno uses subcontractors because it is necessary to provide the services. Where appropriate, Evoluno undertakes to select a processor who offers sufficient guarantees as to the technical and organizational measures for the processing of personal data. Evoluno enters into a written contract with the processor to guarantee the protection of your personal data. The processor always acts in accordance with Evoluno's instructions.

Evoluno uses the following categories of subcontractors:

- Companies we have hired for marketing purposes;

- The companies we have hired to provide ICT technical support and hosting;

- Companies we have hired for administrative purposes (e.g. CRM system);- Companies hired by us for communication purposes (e.g. live chat on the Site);

- Companies we have engaged for analysis purposes ;

‍5. Provision of data to third parties

‍Evoluno will not share your personal data with third parties (other than subcontractors) for any purpose whatsoever, subject to the following exceptions.

Firstly, in certain circumstances, Evoluno may be legally required to share certain personal data, including yours, if we are involved in legal proceedings or to comply with legal obligations, a court order or instructions from a public authority.

Secondly, your personal data is shared with therapists, such as psychologists, according to your needs and preferences. We require separate consent to send your personal data, such as your first name, last name and e-mail address. The therapist who receives the data is a separate data controller. We therefore recommend that you consult the privacy statement of the therapists concerned for information on their treatment processes.

Third, we share your personal data with our Customers, who are the Users' employers. We are contractually obliged to share aggregated analyses with your employer. Shared reports contain aggregated data from at least 5 Users. This means that the report does not contain any directly identifiable personal data of the Users, but only displays average scores/statistics of the organization or of a certain department of the organization. Statistics are only displayed when sufficient data points have been aggregated. The legal basis for this activity is based on the contract we have concluded with you and the Customer (terms and conditions and conditions of use) and with your consent. In this case, the Customer is a separate data controller. We recommend that you consult the customer's privacy statement for further information.

‍6. International transfer (outside the EEA) of your personal data

‍We may store or transfer some or all of your personal data in countries that are not part of the European Economic Area (the "EEA" includes all EU member states, plus Norway, Iceland and Liechtenstein). These countries are referred to as "third countries" and may have data protection laws that are less stringent than those of the EEA. This means that we take additional measures to ensure that your personal data is processed as securely and reliably as in the EEA. We will only transfer your personal data to countries which, in the opinion of the European Commission, offer an adequate level of personal data protection. Further information is available from the European Commission.If no adequacy decision is available, we will use specific contracts with external third parties approved by the European Commission (also known as Clauses Contractuelles Types: CCT) for the transfer of personal data to third countries. The STCs guarantee the same level of personal data protection as would apply under the RGPD. Furthermore, additional measures are taken to protect your data against unauthorized access. More information is available from the European Commission.

‍7. Privacy contact person

‍The following person is Evoluno's confidentiality contact: Alexandre Vandermeersch

The privacy contact person can be reached as follows: alexandre.vandermeersch@evoluno.com.‍

‍8. Your rights

‍You can exercise your rights by sending a message by e-mail to the following address: hello@evoluno.com, or a letter by post to the following address: Evoluno / Silversquare Delta, Avenue Arnaud Fraiteur 15-23, 1050 Brussels.

Evoluno will respond to your request within one month of receipt. Normally, Evoluno endeavors to provide a complete response within this timeframe. However, in some cases, particularly if your request is more complex, a longer period may be necessary, up to a maximum of three months from the date Evoluno receives your request. You will be kept fully informed of the progress of your request.Some rights are complex and not all details are included here. Therefore, please read the relevant provisions and guidelines of the supervisory authorities for a full explanation of these rights.

‍a. Right of accessYou have the right to confirm whether Evoluno may process your personal data or not and, where we do so, to access the personal data as well as certain additional information. This additional information includes data on the purpose of the processing, the categories of personal data concerned and the recipients of the personal data. Provided that the rights and freedoms of others are not infringed, we will provide you with a copy of your personal data. The first copy is provided free of charge, but additional copies may be provided at a reasonable charge.

‍b. Right of rectificationYou have the right to rectify inaccurate personal data concerning you and, in view of the purposes of the processing, to have incomplete personal data concerning you completed.

‍c. Right to erasure

‍In certain circumstances, you have the right to have your personal data deleted without undue delay. These circumstances include:

- the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;

- you withdraw your consent to processing based on consent ;

- you object to the processing under certain rules of applicable data protection law (RGPD);

- processing is intended for direct marketing purposes;

- personal data have been processed unlawfully ;

- the personal data have been collected in the case of a direct offer of services to a child and the processing is based on consent.

- personal data must be deleted to comply with a legal obligation to which we are subject.

There are, however, exclusions to the right to erasure of data. The general exclusions apply in particular when processing is necessary:

- to the exercise of the right to freedom of expression and information ;

- to comply with a legal obligation to which we are subject;

- the establishment, exercise or defense of claims ;archiving in the public interest, for scientific or historical research, or for statistical purposes;

- for reasons of general public health interest.

‍d. Right to restrict processing

‍In certain circumstances, you have the right to restrict the processing of your personal data. These circumstances are as follows: you dispute the accuracy of the personal data; the processing is unlawful, but you object to the deletion; we no longer need the personal data for our processing, but you need personal data for the establishment, exercise or defense of claims; and you have objected to the processing pending verification of this objection.

If processing is limited on this basis, we may continue to store your personal data. However, we will only process them: with your consent; for the establishment, exercise or defense of legal claims; for the protection of the rights of another natural or legal person; or for important reasons of general interest.e. Right to data portabilityInsofar as the legal basis for our processing of your personal data is based on :

(a) consent ;

(b) processing is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into a contract; or

(c) this processing is carried out automatically, you have the right to receive your personal data from us in a structured, commonly used and machine-readable format.

However, this right does not apply when it would infringe on the rights and freedoms of others.

‍f. Right to object and automated individual decision-making

‍You have the right to object to the processing of your personal data by Evoluno on grounds relating to your specific situation, but only to the extent that the legal basis for the processing is that the processing is necessary for the purposes of the legitimate interests pursued by Evoluno or a third party. If you make such an objection, Evoluno will cease processing the personal data, unless Evoluno can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.

Furthermore, you have the right to object to the processing of your personal data by Evoluno for direct marketing purposes (including profiling for direct marketing purposes). If you object, Evoluno will stop processing your personal data for this purpose.

In addition, you have the right to object to the processing of your personal data for scientific or historical research or statistical purposes on grounds relating to your specific situation, unless the processing is necessary for the performance of a task of general interest.

‍g. Right to lodge a complaint with a supervisory authority

‍You have the right to lodge a complaint concerning the processing of your personal data by Evoluno with a supervisory authority responsible for data protection. In Belgium, the supervisory authority is the Data Protection Authority (DPA). Data subjects from other member states have the right to lodge a complaint with their own national supervisory authority. For an overview of the contact details of these authorities, click on this link.

APD contact details :

Data Protection Authority (DPA)
Rue de la Presse 35, 1000 Brussels
+32 (0)2 274 48 00
‍contact@apd-gba.be
‍https://www.autoriteprotectiondonnees.be
‍


Right to withdraw your consentInsofar as the legal basis for the processing of your personal data by Evoluno is consent, you have the right to withdraw such consent at any time. Revocation does not affect the lawfulness of processing prior to revocation.

‍9. Security

‍The Data Controller (Evoluno) implements organizational and technical measures to guarantee an appropriate level of security for the processing and collection of data. These security measures depend on the cost of implementation in relation to the nature, context and purposes of the personal data processing.The data controller (Evoluno) uses industry-standard encryption technologies when transferring or collecting data on the Site.

‍10. Changes to the privacy statement

‍Evoluno reserves the right to amend this privacy statement to comply with legal obligations in this respect or if Evoluno makes changes in a way that affects the processing of your personal data. Consequently, you are invited to consult the privacy statement regularly to be informed of any changes and adaptations. Such changes will be published on the Site.

‍11. Contact

‍If you have any questions or complaints about this privacy statement, you can contact Evoluno at hello@evoluno.com.