Data charter

Last updated: 19 August 2026

Summary

Heading 2

This charter summarises the commitments of Dérard - Valmondier Belgium SRL regarding personal data protection, in accordance with the Data (EU 2016/679), the Belgian law of 30 July 2018, and any equivalent European or national legislation. It complements the Privacy Policy.

1. Company commitment

The Company commits to respect the principles of article 5 Data: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability.

2. Privacy by Design and by Default

In accordance with article 25 Data, data protection is integrated from design and guaranteed by default. Each major evolution undergoes prior review.

3. Records of processing activities

The Company maintains records in accordance with article 30 Data, listing all operations under its responsibility and as processor.

4. Roles

4.1. Controller for directly collected data (prospects, clients, suppliers, candidates, visitors, employees).

4.2. Processor within the meaning of article 28 Data for data deposited by Clients on the Services.

5. Technical measures

  • TLS 1.3 encryption, EV certificates
  • AES-256 encryption at rest
  • Pseudonymisation for testing, development, analysis
  • Encrypted backups every 6 hours, 90-day retention, EU geographic replication
  • Strict multi-tenant isolation
  • Robust authentication, mandatory MFA for admins, rotation
  • RBAC access control (least privilege)
  • Logging of personal data access, logs kept for 1 year
  • Annual external penetration testing
  • CVE monitoring and diligent patching

6. Organisational measures

  • Mandatory annual employee awareness
  • Confidentiality undertaking signed by each employee
  • Equipment usage policy
  • Formal onboarding/offboarding procedures
  • Continuity and recovery plans tested annually
  • Formal incident management procedure

7. DPO

The Company has appointed a DPO in accordance with articles 37 to 39 Data. Contact: [email protected].

8. Notification of breaches

  • To supervisory authority within 72 hours (Art. 33)
  • To data subjects if high risk, without undue delay (Art. 34)
  • To Clients when acting as processor, without undue delay (Art. 33.2)

The Company documents all breaches and measures taken.

9. DPIA

In accordance with article 35 Data, the Company conducts a prior impact assessment for any processing likely to result in high risk. Reviewed at each substantial evolution, at least every 3 years.

10. International transfers

  • Adequacy decision (Art. 45)
  • Standard contractual clauses (decision 2021/914)
  • Binding Corporate Rules (Art. 47)
  • Codes of conduct or certifications (Art. 40 and 42)
  • Strict derogations of article 49

12. Cooperation with authorities

The Company actively cooperates with supervisory authorities and responds to their requests within the timeframes they impose.

13. Periodic review

The charter undergoes annual review by Management, under the control of the DPO. Any substantial modification is communicated by appropriate means.