Valuethrough, with registered office at Zingemkouterstraat 24, B-9040 Gent, Belgium and registered with the Crossroads Bank for Enterprises under company number 0799.848.241, and available on www.valuethrough.com (hereinafter "Valuethrough"), acts as the controller for the processing of your personal data covered by this Privacy Policy.

This Privacy Policy is drafted in accordance with the GDPR and any applicable Belgian legislation on the protection of personal data.

If you have any questions about this Privacy Policy or about the way Valuethrough processes your personal data, you can contact us at info@valuethrough.com.

Valuethrough may collect and process personal data in different ways, including:

• when you use the website or our digital services;
• when you contact Valuethrough by phone, e-mail, via the contact form or through other communication channels;
• when you interact with our applications, including chat-based tools and AI-supported services;
• through cookies and similar technologies (please also see our Cookie Policy).

Personal data that may be processed includes:

• Category 1: technical and usage data, such as IP address, browser type, device information, website usage data and log information;
• Category 2: identification and contact data, such as your first name, last name, e-mail address, telephone number, company, job title and any information you provide when contacting us;
• Category 3: communication and service interaction data, such as the contents of forms, e-mails, support requests, chat messages, answers, uploaded material and related metadata;
• Category 4: cookie and analytics data, as further described in our Cookie Policy.

1. General purposes

Valuethrough processes personal data only for specified, explicit and legitimate purposes. Depending on the context, we rely on the performance of a contract, your consent, our legitimate interests, or compliance with legal obligations.

• Category 1: technical and usage data may be processed to maintain, secure and improve the website and our services, to detect misuse, and to compile aggregate statistics. This processing is based on Valuethrough's legitimate interests in operating secure and effective services.
• Category 2: identification and contact data may be processed to respond to your requests, manage our relationship with you, provide requested information or services, enter into and perform agreements, and comply with legal or administrative obligations. This processing is based on the performance of a contract, taking steps prior to entering into a contract, and/or compliance with legal obligations.
• Category 3: communication and service interaction data, including chat content, may be processed to provide our services, generate requested insights, recommendations or advice, improve the quality and safety of our services, offer support, and document service delivery. Depending on the context, this processing is based on the performance of a contract, your consent, and/or Valuethrough's legitimate interests in providing and securing its services.
• Category 4: cookies and similar technologies are processed as described in our Cookie Policy and, where required, on the basis of your consent.

You are not obliged to provide your personal data. However, you should understand that certain services may become impossible to provide if you refuse the processing of personal data required for those services.

2. AI-supported services and chat data

Where Valuethrough offers AI-supported services, personal data such as your name, e-mail address and the content of your interactions may be processed to generate insights, recommendations or other outputs requested by you or your organisation.

Chat content is stored securely and processed confidentially. Valuethrough implements appropriate technical and organisational measures, which may include encryption, access controls, pseudonymisation and role-based access restrictions, taking into account the nature of the data and the risks involved.

Valuethrough does not use your personal data or chat content to train general-purpose AI models for unrelated purposes unless this has been clearly disclosed to you in advance and a valid legal basis, including consent where required, is in place.

Where AI is used to support the generation of advice or recommendations, such outputs are intended to assist decision-making and should not be considered the sole basis for decisions with legal or similarly significant effects unless expressly stated otherwise and supported by an appropriate legal framework.

3. Legal requirements

In exceptional cases, Valuethrough may disclose personal data where required to do so by law, regulation, judicial order or a competent public authority. Where legally permitted, Valuethrough will take reasonable steps to inform you in advance.

Valuethrough does not retain personal data longer than necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

• Category 1: technical and website usage data is retained for as long as reasonably necessary for security, troubleshooting, performance and audit purposes.
• Category 2: contact and relationship data is retained for the duration of our relationship with you and for a reasonable period thereafter as required for follow-up, compliance, limitation periods or record-keeping obligations.
• Category 3: communication, service and chat data is retained for as long as necessary to provide the relevant services, ensure continuity, handle support and comply with legal obligations. Where appropriate, such data may subsequently be deleted, anonymised or archived in a restricted manner.
• Category 4: cookies and similar technologies are retained in accordance with the retention periods stated in our Cookie Policy.

Where feasible, Valuethrough applies deletion, anonymisation or minimisation measures when data is no longer needed.

1. Right of access

You have the right to obtain confirmation as to whether or not Valuethrough processes your personal data and, where that is the case, to access that data and receive information about the processing.

2. Right to rectification, erasure and restriction

You have the right to request that inaccurate or incomplete personal data be corrected. You also have the right, in certain circumstances, to request the deletion of your personal data or the restriction of its processing.

3. Right to object

You have the right to object to the processing of your personal data where such processing is based on Valuethrough's legitimate interests. You also have the unconditional right to object at any time to the processing of your personal data for direct marketing purposes.

4. Right to data portability

To the extent provided by applicable law, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and, where technically feasible, to have it transmitted to another controller.

5. Right to withdraw consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal.

6. Exercising your rights

You can exercise your rights by contacting us by e-mail at info@valuethrough.com. We may request additional information to verify your identity where necessary.

7. Automated decision-making and profiling

Valuethrough does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, unless explicitly stated otherwise and permitted by applicable law.

Where AI-supported tools are used to assist in generating advice, recommendations or similar outputs, these tools support human, organisational or user decision-making and do not replace case-specific assessment where such assessment is required.

8. Right to lodge a complaint

You have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorite de protection des donnees), Drukpersstraat 35, 1000 Brussels, Belgium, www.gegevensbeschermingsautoriteit.be.

This is without prejudice to any other administrative or judicial remedy available to you.