Privacy Notice Pulso

1. How do we protect your information?

We have implemented security policies and procedures as well as technical and organisational measures to protect your information and privacy. Examples of these security measures are:

• Security policies and procedures such as access control policies, a password policy, clear desk and clear screen policy, mobile device and teleworking policy, disposal and destruction of assets policy, anonimisation and pseudonymization policy, security procedures, policy on the use of encryption, backup policies, training and incident management policies.
• Technical measures include strong authentication and authorization controls, encryption of data at rest and in transit, database encryption, logging and monitoring, backup controls, firewalls, anti-virus protection, physical security controls of the IT infrastructure, ...

To ensure the confidentiality of the Re-Boost application and our services we do not transfer identifiable information to your employer or other parties

With the Re-Boost application, your employer receives anonymous statistics from Pulso about the users of your organisation, such as the number of users over a certain period and the average scores on all used modules of the app.

Your employer may order anonymized and aggregated reports based on certain socio-demographic parameters. To guarantee the confidentiality and your privacy towards your employer only information of groups with a minimum 7 individuals is included in these reports. Information about groups regarding less than 7 individuals is not included in these aggregated reports.

2. Which information is collected?

Pulso Europe BV may collect the following types of personal data from you to provide our services:

• Personal Data: language, affiliation with your employer by means of the organisation code used in the app, gender, age group, education / degree, and job classification.
• Data concerning health: information about your well-being, physical and mental health, risk situations and risk behaviours and other healthcare related data.

Pulso Europe BV processes your information after you have agreed to the privacy conditions described in this text and in this way you have given consent to the processing of your personal information for the purposes described in this privacy notice.

As the data subject you may refuse or decline to provide personal data, or in certain cases you may be obliged to provide the personal data. Refusing or declining to provide the required personal data may have certain consequences to the performance or provision of service: without certain information the service is unable to provide individual feedback to you.

3. Why is your information processed?

We need your personal data in order to provide you and your employer with the following services:

• Providing individual, personalised and actionable feedback to you based on your answers to the surveys
• Providing your employer with anonymized, aggregated statistical reports
• Providing your employer advice to improve the well-being of its employees
• Improving our product

4. Where is your information processed?

Your personal data is processed by Pulso Europe BV located in Kessel-Lo, Belgium.

Your information is stored in the datacenters of the following subprocessors:

• Antwerp Datacenter located in Antwerp, Belgium
• Amazon Web Services, Inc. located in Dublin, Ireland
• Hatch Group BVBA located in Leuven, Belgium, provides technical maintenance services of the Reboost application and its infrastructure.

No third party providers have access to your data, unless specifically required by law.

5. How long is your information stored?

Your personal information is stored for up to 1 year after the contract with your employer has terminated. After this period, personal identifiable information is irreversibly erased and only anonymized information relevant to the provision of our services is retained.

6. What are your rights?

Should you believe that any personal data we hold on you is incorrect or incomplete, you have the ability to request to see this information, rectify it or have it deleted. You have the right to withdraw your consent at any time. You have the right to obtain from the controller restriction of processing, as well as the right to object to the processing of your personal data and automated individual decision-making and profiling. As the data subject you can exercise your rights through the Data Subject Access Request Form located at https://pulso-europe.eu/policies/data-subject-access-request-form

In the event that you wish to file a complaint about how we have handled your personal data, please contact the Data Protection Officer at the contact details listed below. Our Data Protection Officer will then look into your complaint and work with you to resolve the matter.

If you still feel that your personal data has not been handled appropriately according to the law, you have the right to lodge a complaint with the supervisory authority.

• Gegevensbeschermingsautoriteit
• Drukpersstraat 35
• 1000 Brussel
• Belgium
• Tel: +32 2 274 48 00
• Fax: +32 2 274 48 35

7. Contact details

You can contact your employer as the controller of your personal information.

Contact details of Pulso Europe BV as the processor of your personal information:

• Pulso Europe BV
• Diestsesteenweg 52 bus 0201
• 3010 Kessel-Lo
• Belgium
• Tel: +32 16 20 85 96
• Fax: +32 16 20 86 60

You can contact the Data Protection Officer at dpo@pulso-europe.eu or in writing at address listed above.