Privacy Notice JPF AICO Office
1. Introduction and scope
This supplement complements the general privacy notice of JPF Lawyers & Consultants BV and applies to the processing of personal data in connection with the JPF AI Governance Readiness Assessment (Dutch and English versions) and the subsequent email communication from JPF AICO Office. For all matters not expressly addressed in this supplement, the general privacy notice continues to apply in full. In the event of any conflict between the two documents, this supplement prevails solely for the processing described herein.
2. Controller and contact
The controller is JPF Lawyers & Consultants BV, registered with the Belgian Crossroads Bank for Enterprises under number BE0745974342, with its registered office at Bosvelden 8, 2220 Heist-op-den-Berg, Belgium, and visiting address (by appointment only) at Kardinaal Mercierplein 2, 2800 Mechelen, Belgium.
For any question about this processing, or to exercise your rights, please contact info@jpf-lawyer.com or call +32 15 18 62 62.
3. Data, purposes and legal bases
JPF only processes the business contact details you enter yourself, and uses them for the three purposes described below.
| Purpose | Data | Legal basis |
|---|---|---|
| Running the assessment you requested and showing your result | First name, last name, business email address, company name, job title, organisation size; your answers are processed only in your browser to calculate your result and are not sent to JPF | Art. 6(1)(b) GDPR (steps taken at your request prior to a possible contract) |
| Sending a confirmation email with the link to the assessment | First name, email address | Art. 6(1)(b) GDPR |
| Sending practical AI governance insights and information about similar JPF AICO Office services by email (no more than eight emails over fourteen days) | First name, email address, language, company name | Art. 6(1)(f) GDPR (legitimate interest: direct marketing of similar services) in conjunction with Article XII.13 of the Belgian Code of Economic Law and Article 1, 1° of the Royal Decree of 4 April 2003 regulating the sending of advertising by electronic mail (customer exception: data obtained directly, similar services only, free opportunity to object at collection and in every email) |
You are expressly informed of these emails when your data is collected. You can unsubscribe free of charge with one click in every email. JPF does not take automated decisions with legal effects based on your data; the assessment result is an indicative governance maturity diagnostic, not legal advice, an audit opinion or a certification of compliance.
4. Recipients, processors and transfers
JPF does not sell your data and does not share it with third parties for their own purposes. For the assessment pages, contact management and the sending of emails, JPF uses the systeme.io platform, which acts as a processor on JPF's behalf.
- Processor: ITACWT Limited (systeme.io), 2 Cruise Park Rise, Tyrrelstown, Dublin 15, Ireland. According to systeme.io, data is stored with Amazon Web Services in Ireland.
- Sub-processor for email delivery: Twilio Inc. (SendGrid), United States. The emails you receive from JPF are sent through this service; your email address, name and the content of the email are processed for that purpose.
- Transfers outside the EEA: Twilio Inc. is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023). Twilio also applies Binding Corporate Rules approved by the European supervisory authorities and the European Commission's Standard Contractual Clauses.
JPF has concluded a data processing agreement with systeme.io within the meaning of Article 28 GDPR.
5. Retention periods
JPF does not keep your contact details longer than necessary for the purposes described above.
| Situation | Retention period |
|---|---|
| You completed the assessment and no further relationship follows | 12 months after your last interaction (completing the assessment, opening or replying to an email), after which the data is deleted |
| You unsubscribe from the emails | Your email address is kept only on a suppression list so that you receive no further emails; other data is deleted within 30 days |
| You become a JPF client | The retention periods of the general privacy notice and applicable statutory retention obligations apply |
Your answers to the assessment questions are not stored by JPF; they are processed only in your browser to show your result.
6. Your rights, unsubscribing and complaints
You have the right to request access to, rectification or erasure of your personal data, restriction of processing, and portability of the data you provided. You also have the right to object at any time to processing for direct marketing purposes; JPF will then immediately stop sending emails.
- Unsubscribe: via the unsubscribe link at the bottom of every email, or by writing to info@jpf-lawyer.com. Unsubscribing is always free of charge.
- Exercising your rights: via info@jpf-lawyer.com. JPF will respond within one month of receiving your request.
- Complaints: you may lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be.