Privacy Notice

Privacy Notice

xplus takes the protection of personal data seriously. This Privacy Notice explains how XPlusConsultants BV (“xplus”, “we”, “us”, “our”) collects and processes personal data through this Website, in compliance with Regulation (EU) 2016/679 of 27 April 2016 (the “GDPR”) and the Belgian Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

xplus is a subsidiary of YUMA SA/NV (Yuma Group), a digital transformation group headquartered in Zaventem, Belgium. Where Yuma Group entities act as joint controllers or process data on behalf of xplus, this is described below.

This Privacy Notice is structured as a series of questions and answers. We encourage you to read it carefully.

1.  Who is responsible for processing your personal data?

The data controller is:

XPlusConsultants BV
Rue de Livourne 158-160, 1000 Brussels, Belgium
BCE / VAT: BE 0896.257.630
E-mail: info@xplus.eu

2.  What is personal data?

Personal data means any information relating to an identified or identifiable natural person. This includes, for example, your name, professional address, e-mail address, telephone number, organisation, job title, and any other information that allows you to be identified directly or indirectly.

3.  For what purposes and on what legal bases do we process your personal data?

We process personal data collected via this Website for the following purposes:

3.1 Responding to enquiries and contact form submissions

When you contact us through this Website – to request information about our services, register for an event or training, or subscribe to our newsletter – we process your name, title, professional address, telephone number, e-mail address, organisation, function, and a description of your request.

Legal basis: our legitimate interest in responding to business communications (Article 6(1)(f) GDPR), or, where required, your prior consent (Article 6(1)(a) GDPR). You may withdraw consent at any time without affecting the lawfulness of prior processing.

3.2 Processing of job applications and spontaneous candidacies

If you submit a job application or a spontaneous candidacy through this Website or by e-mail, we will process the personal data contained in your application file, which typically includes:

  • identification data (name, address, contact details);
  • professional background (CV, work history, qualifications, references);
  • other data you choose to include in your application (e.g., covering letter, motivation).

Legal basis: performance of pre-contractual measures taken at your request (Article 6(1)(b) GDPR) and, where applicable, our legitimate interest in identifying suitable candidates (Article 6(1)(f) GDPR).

Your application data will be retained for a maximum period of 12 months from the date of receipt. If you wish your application to be kept on file for future vacancies beyond this period, we will ask for your explicit consent, which you may withdraw at any time.

Your application data is accessible only to staff who need it to perform their tasks. It is not shared with companies or individuals outside xplus or the Yuma Group without your explicit consent.

We do not make automated decisions that produce legal or similarly significant effects in the context of our recruitment process.

3.3 Direct marketing and commercial communications

If you are an existing client of xplus, or a person with whom we maintain a relevant business relationship (e.g., a commercial prospect or newsletter subscriber), we may use your contact data to inform you about our services, events, trainings, webinars, and publications.

Legal basis: our legitimate interest (Article 6(1)(f) GDPR) where a prior relationship exists, or your explicit consent (Article 6(1)(a) GDPR) where no such relationship exists. You may unsubscribe or object at any time, without any consequences to other aspects of your relationship with us.

We may analyse browsing and reading behaviour on our Website and in our newsletters to personalise content to your interests. This is done only where you have consented to analytical cookies or subscribed to our newsletter.

3.4 Website operation and security

We process technical data (IP address, browser type, pages visited, time stamps) as part of the normal operation and security of our Website. Legal basis: our legitimate interest in maintaining a secure and functional website (Article 6(1)(f) GDPR).

4.  What categories of personal data do we process?

Depending on your interaction with this Website, we may process the following categories of personal data:

  • General identification data: title, first name, last name, professional address;
  • Contact data: telephone number, e-mail address, social media handles (where provided);
  • Professional data: organisation, function, seniority level;
  • Application data (candidates only): CV, qualifications, career history, covering letter;
  • Usage and traffic data: IP address, pages visited, links clicked, session duration;
  • Newsletter preferences and interaction data (subscribers only).

We do not intentionally collect special categories of sensitive personal data (such as health data, racial or ethnic origin, or data concerning sexual orientation) through this Website. If you include such data in a free-text field or application document, we will handle it with particular care and will not use it as a basis for any decision.

This Website is not intended for use by persons under the age of 18. We do not knowingly collect personal data from minors.

5.  Who has access to your personal data within xplus?

Access to your personal data is restricted on a strict need-to-know basis. The following internal teams may have access, depending on the purpose of the processing:

  • Sales and marketing teams (for contact enquiries, newsletter, and direct marketing);
  • Human resources and recruitment teams (for job applications);
  • IT and operations staff, to the extent required for the maintenance and security of our systems.

All xplus employees who handle personal data are bound by confidentiality obligations.

6.  With whom may your personal data be shared?

xplus does not sell, rent, or trade your personal data. Your data may, however, be shared in the following circumstances:

  • With Yuma Group entities: as a subsidiary of Yuma Group, xplus may share data with affiliated entities where necessary for the purposes described above, subject to appropriate intra-group data sharing arrangements.
  • With trusted IT service providers acting as data processors on our behalf (e.g., cloud hosting, CRM, e-mail platform operators). Such providers process data only on our documented instructions and are bound by appropriate data processing agreements.
  • Where required by law or by an order of a competent authority.

We do not obtain data from third-party mailing list providers for direct marketing purposes without ensuring that the individuals concerned have been appropriately informed and that a valid legal basis exists for the transfer and further processing of their data.

We will not share your data for any purpose incompatible with those described in this Privacy Notice without your prior consent.

7.  International transfers of personal data

xplus uses certain IT service providers whose infrastructure is located outside the European Economic Area (EEA), including in the United States. Any such transfer is governed by appropriate safeguards, in particular the standard contractual clauses approved by the European Commission pursuant to Article 46(2)(c) GDPR. You may request a copy of the applicable transfer mechanisms by contacting us at the address below.

8.  Automated decision-making

xplus does not make decisions based solely on automated processing – including profiling – that produce legal effects or similarly significantly affect you.

9.  How long do we retain your personal data?

We retain your personal data only for as long as necessary for the purposes described in this Privacy Notice, subject to the following indicative retention periods:

  • Contact form submissions and general enquiries: up to 3 years from the date of last contact;
  • Job applications and candidacy files: up to 12 months from receipt, unless you consent to a longer retention period for the purpose of future vacancies;
  • Client and prospect data processed for direct marketing: up to 3 years from the last meaningful interaction;
  • Newsletter subscriber data: for the duration of the subscription and up to 3 years after unsubscription;
  • Technical/traffic data: up to 26 months;
  • Cookie data: as specified in our Cookie Policy.

After the applicable retention period, we will securely delete or anonymise your personal data, unless a longer retention period is required by law.

10.  Cookies

This Website uses cookies and similar tracking technologies. For a complete description of the cookies we use, their purpose, and how to manage your preferences, please refer to our Cookie Policy, available at: www.xplus.eu/cookie-policy.

11.  How do we protect your personal data?

xplus has implemented appropriate technical and organisational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include access controls, encryption of data in transit, staff confidentiality obligations, and regular security reviews.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with Article 34 GDPR.

12.  What are your rights and how can you exercise them?

Under the GDPR, you have the following rights in relation to your personal data:

  • Right of access: you may request a copy of the personal data we hold about you.
  • Right to rectification: you may ask us to correct inaccurate or incomplete data.
  • Right to erasure (“right to be forgotten”): you may ask us to delete your personal data, subject to applicable legal obligations.
  • Right to restriction of processing: you may ask us to limit how we use your data in certain circumstances.
  • Right to object: you may object at any time to processing based on our legitimate interests, including for direct marketing purposes.
  • Right to data portability: where processing is based on consent or contract and carried out by automated means, you may ask us to transmit your data in a structured, machine-readable format.
  • Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
  • Right to lodge a complaint: you have the right to submit a complaint to the Belgian Data Protection Authority (Autoriteit Gegevensbescherming / Autorité de protection des données) at www.dataprotectionauthority.be.

To exercise any of the above rights, or for any questions regarding this Privacy Notice, please contact us at:

XPlusConsultants BV
Att: Privacy contact
Rue de Livourne 158-160, 1000 Brussels, Belgium
E-mail: info@xplus.eu

We will respond to your request within 30 days of receipt. This period may be extended by a further two months where requests are complex or numerous, in which case we will inform you accordingly.

13.  Amendments to this Privacy Notice

We reserve the right to update this Privacy Notice at any time to reflect changes in our practices, applicable law, or our Website’s features. The date of the latest revision is shown at the top of this page. Where material changes are made, we will take appropriate steps to bring them to your attention.