Privacy & Cookie Policy

1. Introduction

IVY provides discreet, personalised matchmaking services and, in doing so, processes personal data that is often sensitive and highly personal.

This Privacy Policy (“Policy”) explains how we collect, use, store, share and protect the personal data of Applicants. It is an information document within the meaning of Article 13 of the General Data Protection Regulation 2016/679 of 27 April 2016 (“GDPR”). It does not in itself create contractual obligations for the Applicant; any confidentiality commitments expected of Applicants are set out in a separate participation declaration.

IVY complies with the GDPR and with applicable Belgian privacy legislation.

2. When this Policy applies

This Policy applies whenever IVY acts as a data controller in relation to Applicants, meaning that IVY determines the purposes and means of the processing of their personal data. This Policy also applies when you submit an enquiry to IVY or subscribe to IVY’s newsletter via the Website, whether or not you subsequently apply.

IVY’s services are exclusively intended for adults. Participation is only possible for persons who are at least 18 years of age and have full legal capacity. IVY does not knowingly process personal data of minors in the context of its consulting and matchmaking services.

3. Which personal data we process and where it comes from

3.1 Categories of personal data

Depending on your interaction with IVY, we may process the following categories of personal data:

• Identification and contact details: name, address, email address, telephone number, date of birth;
• Profile information: photographs, profile descriptions, relationship preferences, interests, personality characteristics and the profile presentation drafted for you and approved by you;
• Interview and assessment information: notes taken during intake conversations and compatibility assessments;
• Communications: correspondence between you and IVY;
• Technical data: when you use the website, IP address, browser and device information, log data and cookies (see the Cookie Policy);
• Any other information you voluntarily provide in the course of your application or participation.

3.2 Special categories of personal data

In the context of matchmaking, you may choose to share information relating to your sexual orientation, religious or philosophical beliefs, ethnic origin or health (“special category personal data” within the meaning of Article 9 GDPR).

IVY only processes special category personal data on the basis of your explicit consent (Art. 9(2)(a) GDPR), which is requested separately and specifically through the consent declaration in Section 6 of the Participation Declaration once you are in touch with IVY. The mere fact that you provide such information does not in itself constitute consent. If you do not give this consent, you can still participate in the service; IVY will then simply not take these elements into account in the compatibility assessment.

You may withdraw this consent at any time; the special category data concerned will then be erased, unless retention is required for the establishment, exercise or defence of legal claims.

3.3 Sources of personal data

IVY collects your personal data directly from you: through the enquiry form you submit on the website, the following intake conversations and your communications with us.

The provision of your personal data is neither a statutory nor a contractual requirement. Without certain basic information (identity, contact details, profile information), however, your application cannot, or can only partially, be taken into consideration.

4. Purposes, legal bases and retention periods

IVY processes personal data only where a lawful basis applies under the GDPR. The overview below summarises, per processing activity, the purposes, the categories of data processed, the applicable legal basis and the standard retention period.

Application and intake: receiving and reviewing your application, conducting intake conversations and communicating with you

• Data categories: identification and contact details, application form content, communications, interview notes
• Legal basis: consent (Art. 6(1)(a) GDPR)
• Retention: duration of participation; if no introduction takes place, max. 12 months after the decision

Compatibility assessment for the specific Client: assessing compatibility with the Client for whom the application website was created and drafting the profile presentation

• Data categories: profile description, photographs, relationship preferences, interests, personality characteristics, approved profile presentation
• Legal basis: consent (Art. 6(1)(a) GDPR); explicit consent for special category data (Art. 9(2)(a) GDPR)
• Retention: duration of participation

Introduction to the Client: sharing the approved profile presentation with the specific Client

• Data categories: given name, brief personality description, profile picture, approved profile presentation
• Legal basis: consent (Art. 6(1)(a) GDPR), given per proposed introduction
• Retention: duration of participation

Future introductions (optional): retaining your profile so that IVY may consider you for introductions to other Clients

• Data categories: profile information and approved profile presentation
• Legal basis: separate consent (Art. 6(1)(a) GDPR) – see the Participation Declaration
• Retention: max. 24 months, or until consent is withdrawn

Operation and security of the application website: ensuring the website functions properly and securely

• Data categories: IP address, browser and device data, access and security logs, cookies (see Cookie Policy)
• Legal basis: legitimate interest in a secure and functional website (Art. 6(1)(f) GDPR); consent for non-essential cookies (Art. 6(1)(a) GDPR)
• Retention: logs: 30–180 days; cookies: see Cookie Policy

Enquiries: responding to questions and requests submitted via the Website or by email

• Data categories: identification and contact details, content of your enquiry
• Legal basis: legitimate interest in responding to enquiries addressed to IVY (Art. 6(1)(f) GDPR)
• Retention: 12 months after the last contact

Newsletter: sending IVY’s newsletter to subscribers

• Data categories: name and email address
• Legal basis: consent (Art. 6(1)(a) GDPR), given at sign-up; each newsletter contains an unsubscribe link
• Retention: until you unsubscribe

Service improvement: evaluating and improving the quality of the matchmaking process

• Data categories: aggregated or pseudonymised feedback and process information
• Legal basis: legitimate interest in improving services (Art. 6(1)(f) GDPR)
• Retention: 24 months

Marketing, PR and testimonials: any use of personal data or images beyond the operation of the service

• Data categories: name, photographs, testimonial content
• Legal basis: consent (Art. 6(1)(a) GDPR) – requested separately and in writing
• Retention: until consent is withdrawn

Legal position: establishing, exercising or defending legal claims

• Data categories: data relevant to the claim concerned
• Legal basis: legitimate interest in defending IVY’s legal position (Art. 6(1)(f) GDPR)
• Retention: duration of the applicable limitation period

Where IVY relies on its legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to that processing on grounds relating to your particular situation (see Section 10).

5. Compatibility assessment and profiling

Matchmaking involves a form of profiling: IVY analyses the information you provide in order to assess compatibility between parties. All assessments and introduction proposals are prepared and decided by IVY’s consultants; IVY does not make decisions based solely on automated processing within the meaning of Article 22 GDPR.

6. Who receives your personal data?

IVY does not sell personal data. Personal data is shared only with the following (categories of) recipients:

6.1 Internal use

Within IVY, personal data is accessed only by authorised personnel who need it to perform their duties. Access is granted on a need-to-know basis and all staff are bound by strict confidentiality obligations.

6.2 Clients

Your profile is not shared with any other client of IVY without the separate consent set out in the Participation Declaration.

Clients who receive profile information are bound by confidentiality obligations towards IVY. To the extent a Client subsequently processes your data for their own purposes (for example after a successful introduction), the Client acts as a separate controller and is itself responsible for that processing. If you withdraw from the process or request erasure or rectification, IVY will communicate this to the Client who received your profile, unless this proves impossible or involves disproportionate effort; upon request, IVY will inform you of the recipients concerned.

6.3 Service providers acting as processors

IVY relies on external service providers who process personal data on IVY’s behalf and instructions, in the following categories: development and hosting of the application website; IT, hosting and email services; CRM / candidate administration software; photography or profile-presentation support, where applicable; and accounting and administrative support.

6.4 Legal obligations and legitimate disclosures

In limited circumstances, IVY may be required to disclose personal data to public authorities, regulators, courts or external legal or accounting advisers where necessary to comply with a legal obligation or to establish, exercise or defend legal claims. Such disclosures are limited to the minimum necessary.

7. International data transfers

IVY strives to store and process personal data within the European Economic Area (EEA). Some service providers (for example email, cloud or CRM providers) may nevertheless process certain data outside the EEA. Where that is the case, IVY ensures that at least one of the following safeguards is in place:

• the destination country benefits from an adequacy decision of the European Commission (including, for the United States, certification under the EU–U.S. Data Privacy Framework);
• the European Commission’s Standard Contractual Clauses have been concluded, supported by appropriate technical and organisational measures;
• another valid transfer mechanism under Chapter V GDPR applies.

You may obtain further information on the safeguards applied, or a copy thereof, by contacting [email protected].

8. How long we store your data

IVY retains personal data only for as long as necessary for the purposes described in this Policy. The retention periods per processing activity are set out in the overview in Section 4. Where a dispute exists or is reasonably anticipated, the relevant data may be retained for the duration of the applicable limitation period, strictly limited to what is necessary for that purpose. After expiry of the applicable retention period, personal data is securely erased or irreversibly anonymised.

9. How IVY protects your personal data

Given the sensitive nature of the data processed, IVY applies appropriate technical and organisational measures (Art. 32 GDPR) to protect personal data against loss, misuse, unauthorised access, disclosure or destruction. These measures are aligned with the nature of the data and the risks involved, and are reviewed periodically. IVY requires its service providers to apply equivalent safeguards.

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, IVY will inform you without undue delay and will notify the Belgian Data Protection Authority where required (Art. 33–34 GDPR).

10. Your rights and how to exercise them

Subject to the conditions set out in the GDPR, you have the following rights in relation to your personal data:

• Right of access: to obtain confirmation as to whether IVY processes your personal data and to receive a copy of it;
• Right to rectification: to have inaccurate or incomplete data corrected;
• Right to erasure: to request deletion of your data in the circumstances provided by law (for example where the data is no longer necessary or where you withdraw consent and no other legal basis applies);
• Right to restriction: to request that processing be restricted in certain cases;
• Right to object: to object, on grounds relating to your particular situation, to processing based on legitimate interests (website security and service improvement);
• Right to object to direct marketing: to object at any time and unconditionally to the use of your data for direct marketing;
• Right to data portability: to receive the data you provided to us in a structured, commonly used and machine-readable format, where the processing is based on consent or contract and carried out by automated means;
• Right to withdraw consent: where processing is based on consent, to withdraw it at any time, as easily as it was given, without affecting the lawfulness of prior processing.

You may exercise these rights, or ask any question about this Policy, by contacting IVY at [email protected] or at Brasschaatselei 9, 2950 Kapellen, Belgium. IVY may request proof of identity where necessary to verify your identity, and will respond within the statutory period of one month (extendable by two months for complex or numerous requests, in which case you will be informed).

You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat / Rue de la Presse 35, 1000 Brussels, www.gegevensbeschermingsautoriteit.be, or with the supervisory authority of your habitual residence.

11. Changes to this policy

IVY may update this Policy from time to time. The most recent version, with its “Last updated” date, is available via ivyrelations.com/privacy-policy and on request.

This Policy is governed by Belgian law. This choice of law does not affect the protection afforded to you by mandatory provisions of the law of your habitual residence, nor your right under Article 79 GDPR to bring proceedings before the courts of the Member State of your habitual residence.