PRIVACY STATEMENT 

1. Controller 

This Privacy Statement applies to all processing of personal data mentioned herein by TamTamTools, owned by Toolbox Media Group BV.

 When you use our services and products, including our websites and apps (hereinafter: "Digital Services"), privacy-sensitive data (hereinafter: "personal data" or "data") of you is processed. By processing, we mean all use of your personal data, such as storing, modifying, forwarding or (partially) deleting this data.

2. Types of Data 

We use the following data for the purposes stated in this statement: 
- Name, address and place of residence; 
- Contact details such as (mobile) telephone number and e-mail address; 
- Date of birth and age; 
- Gender; 
- Profile name; 
- Location data, such as GPS coordinates and/or IP address; 
- Payment details such as billing address, bank account number and credit card details if applicable; 
- Your purchase history; 
- Detailed (technical) data about the use of our Digital Services, for example device type and characteristics, browser type and language, date and time of interaction and IP address; 
- Search terms used on our Digital Services; 
- Derived data from your browsing, clicking and purchasing behavior, such as your interests whether or not categorized (these are also called taxonomies). 
It is not the case that we always use all of your data. Often it is limited to some of the above types of data. 
What data we use depends on the purpose for which we are processing the data. We have deliberately chosen not to use (or as little as possible) special personal data, and we also ask you not to provide them to us e.g. via open input fields. 
Special personal data includes data on race, ethnic origin, political opinions, religious beliefs, union membership, sexual orientation, health or criminal data. In addition, we deliberately block from the previously mentioned taxonomies the categories that could be seen as special personal data. 

Some of the above types of data can be seen as sensitive data though, for example income data, data of minors and location data. 
We also combine the above data to build personal profiles of you so that we can show you targeted content and personalized ads. Because this sensitive data can have an impact on your privacy, we will handle it with extra care. 

3. Source of acquisition 

The main way we obtain data is by asking you for it. You have the choice whether or not to provide us with these data. 
For example, the data that you can enter yourself on one of our Digital Services. For some (additional) services it is mandatory to provide certain information before you can use these services. 
For example, your name, e-mail address and age when you register an account. When entering personal data, we indicate which data are necessary and which can be provided optionally. 
In addition, there are also data that we obtain through cookies and similar techniques. For example, the detailed (technical) data about the devices you use. 
We may also receive information from third parties (e.g. Google) about your approximate geolocation (the country where you live). We use this information to comply with our legal obligations applicable to the processing of your personal data, to adapt certain services to your location, and to prevent fraud or abuse. 

4. Purposes of processing 

We use your data for the following purposes: 
- To offer you our services, products and/or information, such as a Digital Service, and to enable it to work; 
- To send you user information, push and service messages (via your cell phone or by email); - To analyze, maintain, secure, troubleshoot and optimize our Digital Services and related technologies; 
- For the execution of a (purchase) agreement and the mediation agreement, such as the purchase, delivery and invoicing of your product, service, voucher or subscription, or your participation in a contest; 
- To compile statistics to optimize our Digital Services and the effectiveness of content; 
- For identifying trends so that we can improve our services and products; 
- To record and analyze your click and surfing behavior in order to build personal profiles and/or make predictions about your preferences on the basis of algorithms, so that we can show you targeted content and advertisements that better suit your interests. 
- To send you (electronic) commercial messages from our brands; 
- To measure the effectiveness of our electronic messages, such as receipt and click-through rates; 
- To provide you with support through our customer service, both by phone and through our digital customer support portals; 
- So that you can easily share content on social networks; 
- For marketing purposes, so we can target certain (groups of) users for our services; 
- For internal analysis and reporting purposes, and reporting to our partners; 
- To comply with applicable laws and regulations, such as verifying your age or to give effect to your rights as a data subject; 
- To show in real time through our Digital Services which users are bidding and winning on our auctions; 
- To mediate the conclusion of a contract between you and a third party, for example, for the delivery of your product, service or voucher; 
- So that you can redeem vouchers for purchased auction and deals, indicate your preferences and/or make a reservation, which data may be shared directly with the deal provider through the reservation system. 

5. Principles of processing 

We always process your personal data on one of the following legal bases. - Execution of an agreement: we process your personal data to execute a (purchase) agreement, subscription or when registering for an account. The processing is necessary to deliver the product or service. 
- Your consent: we process your data if you have given us permission to do so for a specific purpose. Therefore we inform and ask for your permission when creating an account. We also inform and ask for your permission before we place and read tracking cookies or before we send you (electronic) commercial messages. 
- Compliance with legal obligations: we process your personal data if legislation requires us to do so, for example, to retain data for a certain period of time. Such as payment details. We may also be obliged to verify your age. 
- Legitimate interests: We also process data because we ourselves or a third party has a legitimate (business) interest in doing so, such as securing our Digital Services. In that case, we will always make a thorough assessment of whether this interest is greater than your privacy interest. 

6. Sharing of data 

In order to process your personal data, we use third parties who have access to your data. This includes the following parties: 
- Suppliers and service providers who perform our services and/or can deliver the product you won or ordered. We may also share data with sellers for whom we mediate, for the execution of the purchase agreement. This includes suppliers of software we use. 
- Commercial partners, media agencies and/or advertisers, with whom we jointly organize auctions, deals, events and competitions. 
- Social media parties, such as Facebook and Google. We can match users' email addresses with these parties in a secure (pseudonymized) way, so we can target (similar) audiences via social media, they will then see content and/or search results relevant to them; 
- Some of our websites and apps offer the possibility to share certain content on social media. You will then be asked to log in with your login details for that social media platform. In that case, a link to the website you want to share will be placed on the respective website or social media platform. The service we use to enable the sharing of content on social networks may collect certain information, such as your IP address, geolocation data obtained from your IP address, the URL leading to the website and the date and time you visited and used our website or app. 
- We may also share your personal data in the event of a reorganization, merger, sale, cooperation, transfer or other disposition of any of our business units (including any bankruptcy or similar proceeding). 
- Finally, we may disclose your information in response to lawful requests from public authorities, including law enforcement agencies, government departments or the judiciary. Where possible, we require these third parties to act in the capacity of processors. This means that we determine the purpose and means of these processes and that the processor may only handle your data according to our instructions and our (security) standards. We lay down these agreements with each processor in a so-called processor's agreement. Some of these processors are located outside the EU. Because outside the EU the same level of privacy protection is not guaranteed, we have made (additional) agreements with these parties. With these processors we conclude an approved model contract of the European Commission (also called standard contractual clauses). In case the data are transferred to the United States we also conclude the model contract. 

7. Cookies 

On our Digital Services we use cookies and other similar technologies (hereinafter: "cookies"), with your permission we may also share the data collected by these cookies with third parties. We may also track your clickstream on our emails if you have previously accepted all cookies on any of our Digital Services. Want to find out more about what cookies are, what specific types of cookies we use and why, and how you can control them? Then please refer to our Cookie Statement. 

8. Retention 

We do not keep your personal data longer than necessary. How long that is depends on the purpose for which your data is processed. There is no fixed retention period that we can give to all types of data, we determine this for each processing. As far as the use of our Digital Services is concerned, we will keep your data for at least as long as you use our (account) services. We do this so that when you reactivate you can easily continue to use our services. If you are inactive for a long period, we will send you a message and remove your data, unless you indicate that you do not want this. An exception to this is if the law requires us to keep certain data for longer. 

9. Security 

We do our utmost to protect personal data as best as possible. We do this by taking organizational and technical security measures which, given the state of the art, try to prevent someone from gaining unauthorized access to the data, from modifying it, from making it public or from causing the data to be lost. If we engage so-called processors, we oblige them to handle your data according to our instructions and our (security) standards. 

10. Rights as data subject 

You have the right to access, correct, delete or transfer your personal data. In addition, you have the right to restrict and object to the processing. We try to ensure that you can exercise these rights yourself as much as possible. For example, by allowing you to view and correct your data in the profile page on one of our Digital Services. Or, for example, by giving you the opportunity in our newsletters to indicate that you no longer wish to receive future communications. Please specify in your request which right you want to exercise. We will then send you a confirmation message to verify your e-mail address. We will process your request within one month. If we are unable to process your request within one month, for example because it is very complex, we will inform you within one month of your request about extending our response time (by up to two months). If there are any uncertainties about your request, we may ask you additional questions about this. If we cannot (fully) fulfill your request for deletion because, for example, you have an open order with one of our brands or we have a legal obligation to keep your data (partially), we will inform you about this. 

11. Amendments 

We may unilaterally amend this Privacy Statement. We therefore recommend that you check this Privacy Statement regularly for changes. If we make major changes, we will notify you. For example, by placing a notice on our Digital Services, by email, or by asking for your permission again. 

12. Questions and/or Contact 

Questions or complaints relating to privacy can be submitted to info@tamtamtools.com. This also applies to a request as referred to in clause 11. You have the right to lodge a complaint with the Data Protection Authority (GBA), rue du Mail 35, tel +32 (0)2 274 48 00, fax +32 (0)2 274 48 35, e-mail: contact@apd