1. PURPOSE

The purpose of this Data Management Policy is to ensure that BEKAERTDESLEE complies with local regulations, protecting personal information and ensuring its proper collection, storage, processing, use, transfer, and deletion in alignment with applicable laws and regulations.

2. SCOPE

This policy applies to all BEKAERTDESLEE employees, contractors, and third-party processors handling personal information. It covers all forms of personal information collected, processed, and stored by BEKAERTDESLEE, whether manually or electronically.

3. DEFINITIONS

• Personal Information (PI): Any information, in electronic or other formats, related to identified or identifiable individuals.

• Sensitive Personal Information: Personal information that, if leaked or misused, could harm an individual’s dignity, safety, or property, such as biometric data, religious beliefs, health information, financial accounts, or location data.

• Data Processor: Any entity processing personal information on behalf of BEKAERTDESLEE.

• Data Controller: BEKAERTDESLEE, which determines the purposes and means of personal information processing.

4. PRINCIPLES OF DATA MANAGEMENT

BEKAERTDESLEE follows these principles in managing personal information:

1. Lawfulness and Transparency: Personal information is processed lawfully, fairly, and transparently.

2. Purpose Limitation: Information is collected for specified, clear, and legitimate purposes.

3. Data Minimization: Information collected is limited to what is necessary for the intended purpose.

4. Accuracy: Personal information is kept accurate and up-to-date.

5. Storage Limitation: Personal information is retained only as long as necessary for its intended purpose or as required by law.

6. Security: Appropriate technical and organizational measures are implemented to safeguard personal information.

7. Individual Rights: Individuals’ rights to access, correct, delete, or restrict processing of their personal information are respected and facilitated.

5. DATA COLLECTION AND PROCESSING

1. Consent:

   • Individuals must provide informed and explicit consent for the collection and processing of their personal information.

   • Separate consent must be obtained for processing sensitive personal information, cross-border transfers, and third-party sharing.

2. Collection Requirements:

   • Personal information must be collected lawfully and for legitimate purposes.

   • Individuals must be informed of the purpose, processing methods, retention period, and their rights regarding their information.

3. Processing Purposes:

   • Personal information is processed strictly for purposes disclosed at the time of collection, such as providing services, conducting research, or fulfilling legal obligations.

6. DATA STORAGE

1. Retention Period:

   • Personal information must not be retained longer than necessary for its intended purpose.

   • Retention periods must comply with applicable laws and contractual obligations.

2. Storage Location:

   • Data collected is stored locally unless cross-border transfer requirements are fulfilled.

7. DATA TRANSFERS

1. Cross-Border Transfers:

   • Personal information may be transferred outside regulated areas only if:

     • Explicit consent is obtained from the individual.

     • The receiving entity ensures adequate data protection measures.

     • A security assessment is conducted when required.

2. Third-Party Processors:

   • Processors must sign a data processing agreement, adhere to PIPL standards, and only process personal information as instructed by BEKAERTDESLEE.

8. INDIVIDUAL RIGHTS

BEKAERTDESLEE ensures individuals can exercise the following rights:

1. Access: Request access to their personal information.

2. Correction: Request corrections to inaccurate or incomplete data.

3. Deletion: Request deletion of personal information when processing is no longer necessary or consent is withdrawn.

4. Restriction: Restrict processing in specific circumstances.

5. Data Portability: Receive a copy of their personal information in a structured format.

6. Objection: Object to processing for direct marketing or other purposes.

Requests can be made by contacting BEKAERTDESLEE via the details in Section 12.

9. DATA SECURITY

1. Security Measures:

   • Implement encryption, access controls, firewalls, and monitoring systems to protect personal information.

   • Conduct regular security assessments and audits.

2. Incident Response:

   • Report data breaches to relevant authorities and affected individuals within the regulated timelines

   • Maintain a breach response plan to minimize risks and damages.

10. TRAINING AND AWARENESS

BEKAERTDESLEE provides regular training to employees on data protection responsibilities and internal data management procedures.

11. COMPLIANCE AND MONITORING

1. Audits: Conduct regular internal and external audits to ensure compliance with this policy and local data protection regulations

2. Non-Compliance: Non-compliance may result in disciplinary action, up to and including termination of employment or contracts.

12. CONTACT INFORMATION

For questions about this policy or to exercise data rights, contact:

• Address: B-8790 Waregem, Deerlijkseweg 22

• Email: privacy@bekaertdeslee.com (Subject: "Data Management Inquiry")

13. REVIEW AND UPDATES

This policy is reviewed annually or when necessary to comply with changes in the legal or regulatory environment.

Last updated: March 17th, 2025.