Privacy policy

This Privacy Policy (the “Policy”) explains how Commuty SA (“Commuty”, “we”, “us” or “our”) processes personal data in the context of all of its activities where it acts as data controller. This includes, in particular: your visit to our website www.commuty.com (the “Website”); your subscription to our newsletter or request to obtain other documents (such as case studies or whitepapers); your submission of a contact or demo request form; your registration for, or attendance at, one of our webinars or events; our use of professional contact information for business-to-business prospecting; and your interactions with us on social media.

This Policy applies where Commuty acts as data controller, i.e. where Commuty determines the purposes and means of the processing of your personal data. It does not cover the processing of personal data of the end users of the Commuty workplace management application (the “App”), which is governed by a separate document, the Application Privacy Declaration, available on our Help Center, and where Commuty generally acts as data processor on behalf of its clients.

This Policy is drafted in accordance with Regulation (EU) 2016/679 of 27 April 2016 (the “General Data Protection Regulation” or “GDPR”) and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

1. Who we are

Commuty is a public limited company under Belgian law, with its registered seat at Rue Louis de Geer 6, 1348 Ottignies-Louvain-la-Neuve, Belgium, registered in the register of legal entities of Brabant Walloon under enterprise number 0556.631.530.

Commuty has appointed a Data Protection Officer (“DPO”), who can be contacted at privacy@commuty.com for any question relating to this Policy or to the way Commuty processes your personal data.

2. Scope of this Policy

This Policy applies to personal data collected:
‍- Through your visit to and use of the Website (www.commuty.com), including any associated landing or campaign pages, which will always sit on the commuty.com domain (whether directly or via a subdomain);
- When you subscribe to the Commuty newsletter or request to obtain other documents (such as case studies or whitepapers);
- When you submit a contact or demo request form;
- When you register for, or attend, a Commuty webinar or event;
- When we obtain your professional contact details from publicly available business sources or prospecting suppliers for business-to-business outreach, where this activity is carried out;
- When you interact with Commuty on social media.

3. What personal data do we collect, and why

The personal data we collect about you, and the purpose and legal basis for processing it, depend on how you interact with us.

3.1 General visitors of the Website

When you browse the Website, we automatically collect certain technical information through cookies and similar technologies (e.g. IP address, browser type, pages visited, time spent on the Website, referring website).

Purpose: to operate, secure and improve the Website, and to measure its audience.

Legal basis: your consent, where required for non-essential cookies, or our legitimate interest in ensuring the Website functions properly and securely (for strictly necessary cookies).

Detailed information on the cookies used, their purpose and duration, and how to manage your preferences, is available in our Cookie Policy.

3.2 Contact form

- Data: e-mail address, phone number, first and last name, country, whether you are already a Commuty client, the organisation you represent where requested, the reason for your enquiry and any free-text comment you provide;

- Purpose: to identify and respond to your request, and to route it to the right team, keep a record of our exchanges and, where relevant, manage any resulting pre-contractual or contractual relationship;

- Legal basis: the steps taken at your request prior to entering into, or in the performance of, a contract (Art. 6.1(b) GDPR), or our legitimate interest in responding to enquiries where no contract is in place.

3.3 Demo request form

- Data: e-mail address, phone number, first and last name, country, the organisation you represent where requested, the challenges you are facing and any free-text comment you provide;

- Purpose: to organise a product demonstration and follow up with relevant commercial information;

- Legal basis: the steps taken at your request prior to entering into a contract (Art. 6.1(b) GDPR), or our legitimate interest in pursuing commercial prospection with professional contacts.

Both forms are rendered on the Website but are hosted and processed within our form and marketing automation provider (see Section 6); the data you submit through them is transmitted directly to that provider and is not stored by our website hosting provider beyond the technical request logs described in Section 6.

3.4 Marketing and events

- Data can include: name and e-mail address, professional contact details, organisation they represent, job title, communication preferences, event or webinar registration and attendance information, and newsletter/whitepaper or resource download information (and, for clients subscribed outside of the Website, professional contact details already held by Commuty in the context of the commercial relationship);

- Purpose: to send you news, updates and marketing communications about Commuty’s products and services; to provide requested documents; to administer webinar or event registration, attendance and follow-up; and, separately, where relevant, to send subsequent marketing communications relating to Commuty’s products, services and events;

- Legal basis: your consent for the newsletter and other marketing communications where consent is required, which you may withdraw at any time by using the unsubscribe link included in every communication or by contacting us at privacy@commuty.com, and our legitimate interest in administering B2B events, managing attendance, providing requested documents and following up with relevant professional contacts about Commuty’s products, services and events.

3.5 Social media

Commuty maintains a professional presence on LinkedIn. When you interact with us there (e.g. by following our page, commenting, or sending us a message), we may process the data visible in that interaction.
- Purpose: to respond to your messages or comments, to analyse engagement with our page and content, and to promote Commuty’s products, services and events;
- Legal basis: our legitimate interest in maintaining an online presence, engaging with our audience, understanding how our content performs, promoting our products, services and events and protecting our reputation and the security of our accounts.

When you interact with Commuty’s page on a social media platform, that platform (e.g. LinkedIn) also processes your data as an independent, and in some cases joint, controller, for its own purposes (including its own advertising and audience-measurement systems), under its own privacy policy. We invite you to consult the relevant platform’s privacy policy for further information.

3.6 Legal compliance and regulatory obligations

We may also process personal data collected through the Website to comply with our own legal, accounting, tax, and other regulatory obligations — for example, retaining invoicing records for the legally required period, or responding to a lawful request from a competent authority.

Legal basis: legal obligation (Art. 6.1(c) GDPR). This processing does not require your consent and cannot be objected to on the basis of Section 10 below.

4. Cookies

The Website uses cookies and similar tracking technologies. Details on the categories of cookies used, their respective purposes, retention periods, and how you can manage or withdraw your consent, are set out in our Cookie Policy, available on the Website.

5. Do we use artificial intelligence?

Some of the marketing data-enrichment and prospecting tools referred to in Section 3 may use artificial intelligence to help identify or organise publicly available professional information about prospective business contacts. Artificial intelligence is not used to take any decision producing legal effects concerning you, or similarly significantly affecting you, without human involvement, and no such automated decision-making within the meaning of Article 22 GDPR is carried out on the Website.

Our team retains oversight of the information produced by these tools and will review, correct, or delete it before it is used for any further outreach, in compliance with this Privacy Policy.

6. Who has access to your personal data

We only grant access to your personal data to persons who need it in the context of their function, and to the following categories of recipients:
- Commuty staff members involved in sales, marketing or customer support;
- Our form and marketing automation provider, which hosts and processes our contact and demo request forms, and manages our newsletter (subscription, opt-in records, and future send-outs);
- Our webinar hosting provider, which hosts webinar subscriptions, reminder and follow-up emails, as well as the webinar broadcast itself;
- Our website hosting provider, which technically serves the Website’s pages and, in that capacity, processes visitors’ IP addresses and requested URLs as part of standard web server logs — our hosting provider does not receive or process the content of the contact or demo forms themselves, which go directly to our form and marketing automation provider;
- Web analytics and audience-measurement providers, for website traffic measurement and technical monitoring;
- Providers of marketing data-enrichment and prospecting tools, used solely on the professional contact details of prospects and representatives of organisations (never on our clients’ end-user data), to verify, complete or update professional information obtained from you, your organisation, public professional profiles, event interactions, and to improve the accuracy and relevance of our commercial outreach.

Each of these service providers acts as a processor on our behalf and is contractually bound to process personal data only on our documented instructions, and to implement appropriate technical and organisational security measures, in accordance with Article 28 of the GDPR. The specific tools used within each category may change from time to time as part of our normal operations; this does not, by itself, require an update to this Policy, provided the purpose and category of processing remain the same.

We do not sell your personal data to third parties. We may disclose personal data to competent authorities where required by law, or in the context of a merger, acquisition or transfer of assets.

Some providers, such as social media platforms, may act as independent controllers for part of their processing: in that case, their own privacy terms will also apply.

7. International transfers of personal data

Some of the service providers referred to in Section 6 may be located outside the European Economic Area (“EEA”) or may transfer personal data outside the EEA. Where this is the case, we rely on an appropriate mechanism such as an adequacy decision issued by the European Commission, including the EU-U.S. Data Privacy Framework (“DPF”) for certified U.S. organisations, Standard Contractual Clauses approved by the European Commission or another appropriate safeguard recognised under Chapter V of the GDPR.

You may contact us at privacy@commuty.com to obtain more information about these transfers, including the identity of the specific recipient and the country concerned.

8. How long do we keep your personal data

- Website logs and strictly necessary cookie data: for the period needed to operate, secure and troubleshoot the Website, and in any event no longer than 12 months, unless a longer period is required to investigate a security incident or comply with a legal obligation;
- Cookie and analytics data: for the periods stated in the Cookie Policy and reflected in your cookie preferences;
- Newsletter subscribers: until you unsubscribe, or after 3 years of inactivity (i.e. no engagement with our communications), whichever comes first;
- Contact and demo form submissions, whitepaper downloads, and other outbound marketing/prospecting activity: 3 years from your last interaction with Commuty;
- Social media interactions: for as long as the interaction remains visible on the relevant platform or until you delete it, subject to the platform’s own retention rules, and for no longer than 3 years from your last interaction with Commuty where we separately record the interaction.

These periods may be extended where necessary to comply with a legal, accounting, or statute-of-limitation obligation, or shortened at your request in accordance with Section 10 (“Your rights”), where the GDPR allows or requires us to do so.

9. Security of your personal data

Commuty implements appropriate technical and organisational measures designed to protect your personal data against unauthorised access, loss, misuse, alteration or destruction, taking into account the nature of the data and the risks involved.

10. Your rights

In accordance with the GDPR, you have the following rights regarding the personal data we process about you as controller:
- Right of access to your personal data;
- Right to rectification of inaccurate or incomplete personal data;
- Right to erasure (“right to be forgotten”), in the cases provided for by the GDPR;
- Right to restriction of processing;
- Right to data portability;
- Right to object to processing, in particular processing carried out for direct marketing purposes or on the basis of our legitimate interest;
- Right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

To exercise any of these rights, please contact us at privacy@commuty.com. We will respond to your request within the timeframes required by the GDPR. We may ask you for information required to verify your identity and process your request.

This Website is not directed at, and Commuty does not knowingly collect personal data from, individuals under the age of 16.

11. Complaints

If you believe that your rights have not been respected, you may lodge a complaint with the Belgian Data Protection Authority, located rue de la Presse 35, 1000 Brussels, Belgium (instructions being available on their website: https://www.autoriteprotectiondonnees.be/).

12. Changes to this Policy

Commuty may update this Policy from time to time, in particular to reflect changes in our practices or in applicable law. The date of the last update is indicated at the top of this Policy. We encourage you to review this Policy periodically.

13. Contact

For any question regarding this Policy or the way Commuty processes your personal data, please contact:

- E-mail: privacy@commuty.com
- Postal address: Commuty SA, to the attention of the Data Protection Officer, rue Louis de Geer 6, 1348 Ottignies-Louvain-la-Neuve, Belgium