GENERAL PRIVACY POLICY ION GROUP

This is the Privacy Policy of the “ION group” (hereinafter referred to as “ION group” or “we”).

This Privacy Policy aims to inform you about the processing of personal data in the context of our activities, including but not limited to our central website (https:// https://www.ion.be/nl - hereinafter the “Main Website”) and our project websites (the Main Website and project websites are hereinafter collectively referred to as the “Websites”).

This Privacy Policy may be updated, for example to comply with new legal, contractual or administrative obligations. We therefore recommend consulting this Privacy Policy regularly. Major changes will be announced through our Main Website. This version of the Privacy Policy was last updated on 11 March 2025.

Other relevant terms for visiting and using our Websites can be found in our Terms of Use and in our Cookie Policy. These form one whole alongside this Privacy Policy and apply together whenever you visit the Websites.

If you have any questions or concerns, you can always contact us using the details below (see Title I).

1. Who is responsible for processing your personal data?

The company within the ION group that processes your personal data in the context of its activities (e.g. the company with which you have entered into a contract, to whom you have provided your personal data, whose website you visit, etc.) is responsible for processing your personal data.[1]

Additionally, ION BV is also a data controller, jointly with the above-mentioned company, specifically for the services that ION BV provides to that company. ION BV is a private limited company under Belgian law, with registered office at Vredestraat 53, 8790 Waregem and is registered in the Crossroads Bank for Enterprises under number 0838.897.867.

In certain cases, ION AGENCY NV will also act as a data controller, jointly with the above-mentioned company (first paragraph), in the context of the agency services that ION AGENCY NV provides to that company. ION AGENCY NV is a public limited company under Belgian law, with registered office at Vredestraat 53, 8790 Waregem and is registered in the Crossroads Bank for Enterprises under number 0650.886.430.

The ION group has a privacy officer who will be your contact person for all questions concerning the processing of your personal data. You can find the contact details of the privacy officer under Title IX of this Privacy Policy.

2. What data do we process?

We collect your data in three ways.

1. The data you provide to us

Firstly, we receive your personal data when you share it with us directly, via the Websites or through other channels.

• This can be, for example, through the contact forms on our Websites. You can use these forms to ask us a question or to request certain information, for example if you are interested, as a tenant or buyer, in a particular property or when you wish to collaborate with us as a property or landowner. In the contact form, you are required to provide the necessary information (indicated with a red asterisk) and you can send us a personal message.
• We may also receive data you provide when you visit our office in person.
• Additionally, we collect your personal data if you apply for a job vacancy or send us an unsolicited application.
• You also provide us with your details when you sign up via the Websites to receive marketing by (electronic) mail, or to receive invitations for events.
• You further provide your personal data when you give a business card to one of the employees of the ION group or when you email or call us.
• You also provide your details when you are interested in a particular ION group project and, in that context (for example as a tenant, buyer or as a property or landowner), contact an ION group employee via property websites.
• When you enter into an agreement with us (for example: a reservation or purchase agreement, a service agreement, etc.), we also receive your personal data.
• You also provide your personal data when you submit an identification form to us for fraud prevention purposes.

This means we may process the following types of data about you:

• identification data, such as your name, company name, position, authority, address, email address, telephone number, gender, place and date of birth, profession, nationality; ID card or passport number; expiry date of ID card or passport; status as a politically exposed person or family/close associate and the relevant function/connection, copies of identification documents (like your ID card), description of business relationship, enterprise number;
• financial data, such as your VAT number, account number, description of transaction;
• other information you provide to us. For example, your preferences, like the property you are interested in, the type of marketing you would like to receive, the vacancy you are applying for, etc.

2. Data we receive from third parties

We may also receive your personal data from third parties, such as external agents, investors, recruitment and temporary work agencies, or from your employer.

This may arise, for example, when we have an agreement with a contracting party (e.g. a supplier or contractor) you work for or on whose behalf you provide services to the ION group.

We may also obtain certain data about you from third parties (natural persons or legal entities) for fraud prevention purposes, particularly when you act as a natural person in a transaction or act as a representative of the third party, when you are a director of the third party, or, in the case of trusts, fiduciaries or similar legal structures, when you are the founder or protector of the third party.

This concerns identification data such as your name, company name, position, address, email address, gender, telephone number, place and date of birth, nationality, ID card or passport number, expiry date of ID card or passport, status as a politically exposed person or family member and relevant function/connection, your authority to represent the third party, your appointment, a copy of your ID card, your CV and/or references to your prior work, etc.

3. Data we collect automatically

We also process certain data via cookies on our Websites, such as the type of browser you use, your operating system, your IP address, the number of page visits, whether you are a unique visitor, etc.

Some of these details may allow us to identify you as a natural person or can be linked to you, for instance your IP address. These thus qualify as personal data, so this Privacy Policy applies to them as well. You can find more information on cookies in our Cookie Policy.

We also process certain non-directly identifying data via cookies when you visit our website, such as your browser type.

In addition, the ION group may process CCTV footage (including audio and e.g. the time of arrival in office buildings) to help improve the safety of our staff and other visitors in our buildings.

The ION group may also take photos and videos of you when you attend our events.

3. Why do we process your data?

1. To answer your questions

If you contact us (e.g. via one of the contact forms on the Websites or the application form on the Main Website), we will use the personal data you provide to get in touch with you and to answer your question.

For this, we process data such as your name, email address, telephone number, address, your area of interest, your correspondence with us, and any other information you supply that is relevant to addressing your query.

We process this data on the basis of our legitimate interest in being able to respond to the questions that are put to us.

2. For selection and recruitment

We also process your personal data in relation to managing vacancies and job applications.

The data processing is based on pre-contractual obligations (e.g. if you send us an application), your consent (e.g. if you provide a reference), or our legitimate interest in conducting the selection and recruitment procedure effectively and improving it for the future (e.g. maintaining a CV database).

3. To keep you informed about our services and activities and for direct marketing purposes

We process data for prospecting, promotional and (direct) marketing purposes. This allows us to inform you about our projects which may be of interest to you. For example, we may invite you to or remind you about our events.

For this, we mainly process personal data such as your name, email address, telephone number and address. We also process data regarding your preferences, for example your preferred location based on a property you have previously shown interest in.

We process this data either on the basis of your consent, or on the basis of our legitimate interest in keeping you informed about our activities and services. For example, we have a legitimate interest (“soft opt-in”) in sending you electronic messages about our activities when you are already a customer of the ION group. You have the right to withdraw your consent or to object at any time (see Title VIII).

The ION group may also process your personal data to send you personalised information or advertising. For this, we process personal data such as your name, email address, telephone number and address.

We can create a profile based on your online behaviour. This profile takes into account your preferences and interests, for example in relation to pages you have visited, links you have clicked, projects you have viewed and other projects that may interest you. We receive this information via cookies placed on our website. Based on the information collected within the profile, we may send you information and advertisements, for example regarding projects matching your profile or which might interest you.

We may also use the services of third parties, such as Facebook, to identify audiences and lookalike audiences, enabling us to advertise our products and services to people with similar profiles. For this purpose, we may process personal data such as your name, telephone number, address, email address, date of birth, age, gender, your position, company name, language preference, and specific products and services you are interested in.

We may create a profile of you and send you personalised (direct) marketing based on your consent, if you accept the cookies that capture this information. You have the right to withdraw your consent for the processing of your personal data for direct marketing at any time (see Title VIII).

You can find more information about the use of cookies by the ION group in our Cookie Policy.

4. To conduct (satisfaction) surveys

We process your data for the purpose of conducting (telephone) (satisfaction) surveys. For this purpose, we may share your personal data (including your name, email address, telephone number, the property you have purchased and the stage of construction) with specialised service providers such as Profacts.

We process this data on the basis of our legitimate interest in, among other things, assessing customer satisfaction. If you do not wish to take part in these telephone surveys, you may object to the processing of your personal data for this purpose at any time by using the contact details provided in Title IX.

5. To organise competitions

We process your data in order to organise competitions. For these competitions, we may process personal data such as your name, email address, address and telephone number, as well as any personal data you provide to us yourself, for example via the competition entry form. In this context, we may also share these personal data with service providers, such as Profacts, and other parties the ION group works with for the organisation of these competitions.

We process this data either on the basis of your consent or on the basis of our legitimate interest in enabling you to participate in these competitions. You have the right to withdraw your consent or to object at any time (see Title VIII).

6. To be able to provide our services and conduct our activities

The ION group processes personal data to conduct its activities as a property developer and real estate investor, to offer, set up, maintain and support its services, to execute agreements and for administrative purposes.

For this, we mainly process personal data such as your name, email address, telephone number, date of birth and address, as well as your personal preferences in connection with the service that the ION group provides to you, correspondence with the ION group, and project information.

We process this data at your request in order to take steps prior to concluding an agreement, based on the performance of a contract, or based on our legitimate interest in offering our services, fulfilling our contracts and/or carrying out our activities.

7. For supplier management

We process personal data in the context of managing our suppliers (for example, our contractors).

This involves data such as your name, email address and, in certain cases, your CV and/or references to your previous work, which are provided to us by our contracting party.

The processing of this data is based on the performance of our agreement or our legitimate interest in fulfilling our agreements with our suppliers.

8. For technical and functional management of our Websites, compiling statistics and saving search preferences

We process personal data obtained via cookies for the technical and functional management of our Websites, to ensure that our Websites are easy to use, to compile statistics (e.g. to measure visitor numbers and identify the most visited pages), and to save your search preferences. Your data enables us to secure our Websites and analyse how the website is used so we can improve its content and layout.

For this, we may process data such as your IP address, the pages you visit, the browser you use, your preferred language, your location, and the time and duration of your visit.

This processing is based on your consent (via our cookie banner) or on the legitimate interest of the ION group in providing a well-functioning and secure website and pages with relevant content for you.

For more information about the use of cookies by the ION group, see our Cookie Policy.

9. To comply with legal obligations

We process personal data to comply with our legal obligations. In many cases, we are legally required to retain and/or disclose certain personal data to government bodies, for example in the context of tax obligations.

For this, we may process data such as your name, address, telephone number, email address, national register number, transaction data and any information necessary to fulfil our legal obligations.

We process this personal data because it is necessary to comply with our legal obligations.

10. For the security of ION buildings (video surveillance)

ION has placed surveillance cameras at certain locations in and around its buildings to enhance the safety of its staff and other visitors.

We collect this data on the basis of our legitimate interest in ensuring the safety of everyone within our office buildings and protecting our business assets.

4. Who has access to your personal data?

You can be confident that we aim to protect your privacy as much as possible. In this context, we strive to minimise the sharing of your personal data with third parties.

• Within the ION group, your data is only shared with those who need access to it (for example, to answer your query or prepare your contract).
• We make use of carefully selected and reliable service providers to carry out certain (processing) activities, such as:
• IT services: for example, the installation and maintenance of PCs and providing a CRM system.
• Marketing activities: such as marketing automation platforms and organising competitions.
• (Satisfaction) surveys: conducting (satisfaction) surveys, for instance via specialised service providers such as Profacts.
• Customer, supplier administration and communication: for example, maintaining communication with customers and suppliers via a customer administration platform and organising customer support via external customer support providers.
• HR activities: for example, via recruitment agencies.
• Asset and property management: for example, via syndics, appraisers, etc.

In this context, the ION group enters into data processing agreements with these parties who require access to personal data to provide their services.

• The ION group may also transfer personal data to a third party that also qualifies as a data controller, such as notaries, external advisers, external property developers, external agents, municipalities, etc., when necessary to provide our services. The ION group may also share personal data with parties in relation to competitions.
• We may also share personal data with competent authorities who are authorised to request this information or to whom we are legally obliged to provide it, as well as when required by law or in the context of legal proceedings or court cases.
• Finally, in the case of a reorganisation, demerger, transfer of business activity, merger or sale of the company, we may transfer all personal data we hold to the relevant third party (parties).

5. Do we transfer your personal data outside the European Economic Area?

The ION group does not process your personal data itself outside the European Economic Area (EEA).

Some personal data may be stored or transferred outside the EEA for the purposes described. This may occur via service providers established outside the EEA or who store data on servers located outside the EEA or accessible from there.

If this is the case, the ION group will ensure there is an adequacy decision (Article 45 of the General Data Protection Regulation (“GDPR”)) for the country to which data is transferred, or that standard contractual clauses (Article 46(2) GDPR) are put in place, or that other appropriate safeguards are adopted in accordance with Chapter V of the GDPR.

If you have questions about the transfer of your personal data outside the EEA or if you would like to obtain a copy of the relevant documents, you may submit a dated and signed request to the ION group (see contact details under Title IX).

6. How long do we retain your personal data and how do we secure your personal data?

We will not retain your personal data for longer than necessary for the purposes for which it is processed, taking into account any legal retention obligations.

Personal data we receive in the context of a question or request will be stored for a limited period in a file to allow follow-up of your request.

Below follows a (non-exhaustive) overview of the most important retention periods the ION group aims to maintain. In any case, ION may retain (personal) data for longer in the context of a (potential) complaint, dispute or investigation.

• Personal data in contracts (such as purchase or tenancy agreements, but also agreements with ION group’s service providers): kept for a minimum of ten years after termination of the contract.
• CCTV footage from security cameras: kept for a maximum period of 1 month (unless the personal data is required for further investigation of an incident that has occurred).
• Personal data of prospects:

who have completed the contact form on the ION website: retained for a reasonable period after any actions taken as a result of the submitted contact form are completed.

• who have registered via the website to receive marketing from ION: held until a) an unsubscribe request is received, b) the email address is no longer valid (if sent emails are not delivered), or c) it is found at the time of a list update that the data is no longer relevant or accurate.
• Personal data of customers (e.g. tenants or buyers) used for direct marketing for similar products/services: retained until a) an unsubscribe request is received, or b) the person is no longer considered a “current customer” of ION. A person is no longer deemed a customer of ION after a period of 10 years following the last transaction or communication with the customer.
• Personal data contained in recruitment documentation: retained for at least five years from the application/publication of the vacancy, unless the applicant is clearly unsuitable, in which case such information is removed within a reasonable period.

The ION group also attaches great importance to the security of your personal data. We take appropriate organisational and technical security measures, in line with the latest technology and the type of data and potential risks involved, to best protect your personal data from accidental or unauthorised destruction, accidental loss, alteration, access and any other unauthorised processing of personal data.

7. What about links to other websites and social media?

1. ION group’s social media pages

ION has pages on Twitter[2], Facebook[3], LinkedIn[4], Instagram[5] and Youtube[6]. When you visit these pages, your personal data will be transferred to the social media operator through the use of cookies.

Social media operators may obtain information such as the websites you are currently visiting or have visited in the past, and your IP address. When you visit these pages, the ION group may also receive aggregated data from the respective social networks in the form of statistics on how our pages are visited by social media users.

2. Links on our Websites and social media “share buttons”

The ION group’s Websites may also include links to other websites (e.g. via hyperlinks, social plug-ins), which are offered by other companies or by social media platforms. Please note that clicking these links will redirect you to websites/platforms which operate under their own terms of use, privacy policy and cookie policy. The ION group accepts no responsibility or liability for any damage arising from the use of these external websites or platforms. We recommend that you read those terms of use, privacy policy and cookie policy carefully before using such websites or platforms.

Our website offers you the option to share content with Facebook[7], LinkedIn[8] and by email. When using these social plug-in features (e.g. “share” button, etc.), information about your usage is transferred directly from your browser to the relevant social network. If you are already logged into a social network when you visit our website, the social media operator may link the visit via social plug-ins to your personal account. If you are not yet a member of a social network, it is still possible for social networks to receive and store your IP address and information about the browser and operating system you use via these social plug-ins.

If you share content from our website directly to your social media page, your personal data will be visible to the visitors of those social media pages. For the scope and purpose of data collection, as well as further processing and use of data by social networks and information about your rights and privacy settings, we refer you to the privacy policies of these social networks.

8. How can you exercise your rights?

Privacy legislation grants you various rights and we take information regarding these rights and the exercise of them very seriously.

You have the right to request free access to the personal data we process about you, to correct it, to delete it or to restrict the processing of your personal data. In some cases, you can also object to the processing of your personal data and you have the right to data portability. In addition, you have the right to human intervention with decisions based on automated decision-making or profiling.

When the processing of your personal data is based on your consent, you have the right to withdraw that consent at any time, but you understand that such withdrawal has no effect on the legitimate processing we have already carried out on the basis of your consent up to that point.

Any questions about your rights, exercising them, or about this Privacy Policy can be addressed to the ION group via the email address in Title IX of this Privacy Policy. We will respond to your request as quickly as possible. In addition, we may request further proof of your identity (e.g. a copy of your identity card) in accordance with legal requirements and in order to protect the privacy of others.

In certain cases, we may refuse your request if it is clearly unfounded or excessive. In doing so, we always act in accordance with applicable data protection legislation.

While we naturally prefer to resolve any issues with you directly, we also inform you that you always have the right to file a complaint or question with a competent supervisory authority. In Belgium, you can file a complaint or question with the Data Protection Authority (see www.gegevensbeschermingsautoriteit.be; address: Drukpersstraat 35, 1000 Brussels; phone: +32 (0)2 274 48 00; E: [email protected]).

9. Questions?

If you have further questions about this website or this Privacy Policy, you can contact the privacy officer of the ION group via [email protected].

[1] “Data controller” means the legal person who determines the purpose and manner of processing personal data. This can be done individually or jointly with other organisations. This means the data controller exercises overall control over the “why” and the “how” of personal data processing.

[2] Twitter.com/en/privacy

[3] https://nl-nl.facebook.com/privacy/explanation

[4] https://www.linkedin.com/legal/privacy-policy

[5] https://help.instagram.com/519522125107875

[6] https://www.youtube.com/intl/ALL_be/howyoutubeworks/user-settings/priva…

[7] https://nl-nl.facebook.com/privacy/explanation

[8] https://www.linkedin.com/legal/privacy-policy