Data Privacy Notice

Materialise values the right to privacy and is committed to ensure all personal data is obtained, processed and used in a safe, secure, ethical and transparent way. The privacy of our clients and partners is important to us, and we appreciate your trust that Materialise will use your personal data both carefully and sensibly, in conformity with the principles laid out in the present Notice.

By providing us with your information, you confirm that you have acknowledged the content of this Data Privacy Notice, which is meant to help you understand what personal data we collect about you (hereinafter ‘your personal data’), why we collect it, and what we do with it. References to personal data in this Data Privacy Notice include any information which directly or indirectly identifies you.

You understand that this Data Privacy Notice applies in conjunction with other policies and procedures. It does not establish contractual or legal rights for any persons, but intends to comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and other local data protection legislation (hereinafter, respectively ‘the GDPR’ and ‘the applicable legislation’).

MATERIALISE NV is registered in Belgium under company number BE 0441.131.254. Its main establishment is located on Technologielaan 15, 3001 Leuven, Belgium.

Unless otherwise stated in the present Notice, MATERIALISE acts as Data Controller of your personal data, and is thus responsible for the processing of your personal data under the applicable data protection legislation. In this capacity, MATERIALISE determines both the purposes (‘why’) and the essential means (‘how’) of the processing of your personal data.

This Data Privacy Notice outlines which personal data we collect about you (Section 3.1), what legal grounds we rely on to collect your personal data (Section 3.2), how we protect your personal data (Section 4), to whom we disclose your personal data (Section 5), if necessary outside the European Union (Section 6). In addition, we also define for how long we need to keep your personal data (Section 7). Lastly, this Data Privacy Notice describes your rights under the GDPR (Section 8), including who to contact in case you wish to exercise any of these rights (Section 9).

3.1    PERSONAL DATA WE COLLECT ABOUT YOU
Because data privacy is of high importance for us, we intend to remain open and transparent about which personal data we collect and how we intend to use it. 

As a general rule, MATERIALISE will only collect your personal data where necessary for maintaining our relationship with you as business contact and as a (potential) customer. Depending on your exact relationship with us, both currently and in the future, MATERIALISE may thus collect, use and disclose (i.e., process) the following types of personal data: contact information, such as your name, surname, email address and phone number and postal address for invoicing and delivery purposes.


3.2    LEGAL GROUNDS FOR PROCESSING

3.2.1     Your Personal Data
Under the applicable legislation, personal data may only be collected and processed based on a limited number of legal grounds. At MATERIALISE, we rely on one of the following bases to process your personal data:

1. Necessity for the performance of a contract with you (e.g. for handling your payment details when you purchase software licenses from us); or
2. Legal obligation to which MATERIALISE is subject (e.g. medical regulations and traceability requirements); or
3. Legitimate interests of MATERIALISE (e.g. when we send you marketing e-mails regarding products similar to the ones you already purchased from us); or
4. Your explicit and informed consent (e.g. when you request a trial license for our software products).

3.3    CUSTOMER SUPPORT
Because ensuring technical support as well the efficient handling of complaints and queries is necessary for the provision most of our Services, you understand and acknowledge that we may process personal data such as your name, contact details, client number, and IP addresses, as well as any other personal data we might come in contact with during the provision of customer support services.

MATERIALISE is committed to the processing of your personal data in a lawful, fair and transparent manner. 

Accordingly, we guarantee that any processing of your personal data will be limited to what is necessary, adequate and relevant in order to achieve the purposes for which your personal data was collected. Moreover, MATERIALISE will use anonymized or pseudonymized data whenever possible and technically feasible, e.g. for customer support, internal statistics or financial reporting purposes.

Because the protection of your personal data is essential to us, MATERIALISE is also dedicated to protect the systems where your personal data is held in. For that reason, we have defined and implemented adequate technical and organizational measures in cooperation with our service providers, with a view to protect your personal data against any unauthorized access, unlawful use, accidental loss, corruption or destruction. This way, you can be confident that your personal data will be processed on a strictly ‘need to know basis’, when necessary and where appropriate. 

Furthermore, since we are fully aware threats evolve and diversify and because we wish to sustain your trust throughout the years, we commit to regularly review and update our security measures and infrastructure, with a view to mitigate operational risks and maintain our security programs up to the latest industry-accepted standards and best practices. 

Under no circumstances will MATERIALISE sell your personal data to third parties. 

Where relevant and necessary for the purpose of the processing activity, we may however need to disclose your personal data to appropriate third-party recipients who have a need to know (e.g. financial institutions, in order to verify your payment details and because this is necessary for the performance of the contract).

In any case, MATERIALISE shall restrict the access and transfer of your personal data to trusted third-party recipients only, who demonstrate an adequate level of data protection. 

Moreover, each time your personal data is shared externally, this will be covered by strict data processing agreements, where MATERIALISE remains the Data Controller and the third-party recipients involved act as Data Processors. Consequently, the third-party recipients with whom we may share your personal data will be required to delete or return all the personal data to MATERIALISE after the end of the provision of Services relating to the processing activity, and delete all existing copies (unless these third-party recipients are themselves legally required to further retain the personal data).

Materialise is headquartered in Belgium, and has branches worldwide as listed on https://www.materialise.com/en/about/locations.

Insofar as your personal data needs to be transferred to a country outside of the European Economic Area (‘EEA) which does not offer adequate protection of personal data, MATERIALISE will put in place appropriate safeguards offering a level of protection at least equivalent to the standards contained in this Data Privacy Notice.

MATERIALISE will thus remain responsible for the processing of your personal data and take the necessary measures to protect the processing thereof by relying on adequate data transfer mechanisms such as Standard Contractual Clauses or the EU-U.S. Privacy Shield.

As a general rule, MATERIALISE only keeps your personal data for as long as necessary to fulfill the purposes for which we initially collected it. However, based on the type of personal data being processed and the processing purposes, the actual retention periods may vary significantly. In addition, there are laws and sectoral regulations that apply and which set minimum periods for retention of personal data. 

Except when we need to retain your personal data for statistical purposes, to establish, exercise or defend legal claims or insofar as we are legally required to retain a copy of your personal data, MATERIALISE shall either securely dispose of or permanently anonymize your personal data once we have fulfilled the initial processing purpose and further retention of your personal data is no longer necessary. 

The effective retention period applicable to your personal data will depend on whether we process your personal data in the context of a contractual relationship with you or based on your explicit consent; whether we process the personal data for our own legitimate interests, or whether MATERIALISE is legally obligated to retain the personal data for a specific period or to comply with specific legal obligations.

Although MATERIALISE is technically the Data Controller, the ultimate control over your personal data remains with you at all times, on condition that you provide us a proof of your real identity. 

Consequently, and insofar you do not already have the information, the request is not manifestly unfounded or excessive, or if fulfilling your request does not appear unreasonably difficult, MATERIALISE will handle your request at no cost, without undue delay, and in any case within one month upon its reception. We are entitled to extend this period by two additional months where the fulfillment of your request necessitates more time. In such case, you will be kept informed of the underlying reasons. 

8.1    RIGHT OF ACCESS 
You have the right to request access to a copy of the personal data we currently maintain about you in a commonly used format and obtain information regarding the processing, including whether we process your personal data for profiling purposes. 

8.2    RIGHT TO RECTIFICATION
In case you notice an error in your personal data, you may request that we rectify the inaccurate personal data or complete your personal data. MATERIALISE will notify your request to each third-party recipient with whom we have disclosed your personal data, unless this proves impossible or involves a disproportionate effort. 

8.3    RIGHT TO ERASURE
To the extent that (i) your personal data is no longer necessary for the initial purpose, (ii) the processing was based on your consent and you withdrew it, or (iii) you have already objected to the processing based on our legitimate interest, you have the right to request the erasure of your personal data from our systems without undue delay, and have us inform third-party recipients to whom we provided your personal data of this request, unless the latter proves impossible or involves disproportionate efforts.  

8.4    RESTRICT OF PROCESSING
In case you contest the accuracy of your personal data, you have the right to request that we restrict the processing thereof, for the duration necessary to verify the accuracy within our systems. You may also request that we restrict the processing of your personal data to the mere storage thereof, insofar that we no longer need your personal data for our processing purposes, but you need it for the establishment, exercise, or defence of legal claims. If MATERIALISE disclosed your personal data with third-party recipients, we will notify them of your request to a reasonable extent.

8.5    RIGHT TO OBJECT
You have the right to object at any time to the processing of your personal data by MATERIALISE based on our legitimate interest.

8.6    DATA PORTABILITY
Where technically feasible, you may request MATERIALISE to export the personal data we currently maintain about you in a structured, commonly used and machine-readable format and demand that we transmit your personal data to another company of your choice. 

For further information regarding the processing of your personal data and your rights, please contact us by sending an e-mail to privacy@materialise.be. If you are not satisfied with the way we handled your request, you have the right to request the restriction of our use of your personal data and lodge a complaint with the supervisory authority responsible for the protection of personal data in your country of residence.