Privacy statement

Multicall Business Services & Security NV (MBSS NV) attaches great importance to the protection of your personal data and respects your privacy. In this privacy statement we provide clear and transparent information about which data we collect and how we handle it within the checkinandoutatwork service.

MBSS NV complies at all times with applicable laws and regulations, including the General Data Protection Regulation (GDPR). This means that we, in any case:

• process your personal data in accordance with the purpose for which it was provided;
• limit processing to only the data that is minimally necessary for those purposes;
• ask for your explicit consent when we need it for processing;
• take appropriate technical and organisational measures to ensure the security of your personal data;
• do not pass on personal data to other parties, unless this is necessary for the performance of the purposes for which it was provided;
• inform you of your rights regarding your personal data, and respect them.

As MBSS NV, we are responsible for the processing of your personal data. Questions or contact regarding this can be addressed to: Multicall Business Services & Security NV (MBSS NV), Impestraat 23 bus 3, B-9420 Erpe-Mere, 053 76 78 78, info@checkinandoutatwork.be.

Your personal data is processed by MBSS/checkinandoutatwork for the following purposes and legal bases:

• To allow employees to check in and check out at their work location and to forward and follow up those registrations with the NSSO (performance of the contract / statutory obligation of the customer).
• To confirm, via geofencing, at the moment of checking in or out, that the employee is at the indicated work location (performance of the contract).
• To process and follow up a request for a demo or quotation (performance of the contract / legitimate interest).
• Accounting purposes (statutory obligation).
• Sending notifications about the status of declarations (accepted or refused) and about missing or rejected registrations (performance of the contract).

For these purposes we may collect and process the following personal data:

• Business data of the customer: company number, name of contact person, address, telephone number and e-mail.
• Personal identity data of contact persons and supervisors: name, first name, e-mail and telephone number.
• Data of employees checking in or out: name or identification number, time of check-in/check-out, work location or geofence confirmation at the time of check-in/check-out, and the status of the NSSO declaration (accepted, refused, error code).
• The customer's NSSO certificate, used to sign declarations on behalf of the customer.

We only use the data collected for the purposes for which it was obtained. Location data is only read at the moment of checking in or out; there is no permanent background tracking.

The data you provide to us may be disclosed to third parties if this is necessary for the performance of the purposes described above. For example, we use third parties for, among other things, the internet environment (web hosting and the content management environment), the IT infrastructure, the NSSO (for the mandatory declaration itself) and, where applicable, the customer's social secretariat (subject to consent).

We never pass on personal data to other parties with which we have not concluded a data processing agreement. We make the necessary arrangements with these processors to guarantee the security of your personal data. We will not disclose the data you have provided to third parties unless this is legally required and permitted.

MBSS NV does not keep personal data longer than necessary for the purpose for which it was provided, or as long as the law requires. Location history of check-in and check-out registrations is kept for a short and configurable period, in line with the GPS privacy policy that the customer can set itself. Other personal data is kept for a maximum of 5 years after last use, unless otherwise provided by law (accounting records: 7 years).

We have taken appropriate technical and organisational measures to protect personal data against unlawful processing, including:

• everyone who may access your data on behalf of MBSS NV is bound to confidentiality;
• we apply a username and password policy on all our systems;
• we pseudonymise and ensure encryption of personal data where necessary, including encrypted storage of NSSO certificates;
• we make back-ups of personal data so that we can restore it in the event of incidents;
• we regularly test and evaluate our security measures;
• our employees are informed of the importance of the protection of personal data;
• every registration is kept in a complete audit trail, with role- and rights-based access management.

You have the right to inspect and the right to correct or delete the personal data that we have received from you. To verify your identity, we may ask you to send a copy of your identity card; please make your photo unrecognisable and state that it concerns a copy.

You may object to the processing of your personal data (or part of it) by us or by one of our processors. You also have the right to have the data you have provided transferred to yourself or, at your request, directly to another party.

If you have a complaint about the processing of your personal data, please contact us directly via info@checkinandoutatwork.be. You also always have the right to lodge a complaint with the Data Protection Authority, the supervisory authority for privacy protection in Belgium.

MBSS NV/checkinandoutatwork may amend this privacy statement. We will announce any amendment on our website.