B2C Privacy Policy

1. Introduction

Brussels Expo appreciates your interest in its products, services and website. We want you to know how we collect, process and store your personal data, which we endeavour to do in compliance with your rights. We also wish to ensure you are informed of those rights. To that end, we invite you to read this privacy policy carefully. If you have any question regarding the processing of your data, please contact us at privacy@brussels-expo.com.

2. What is the applicable legal framework?

While seeking to offer guarantees that go beyond the applicable legal framework, we have put in place organisational and technical measures in order to comply with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter "GDPR").

3. What concepts will be useful for understanding this policy?

● Data subject: a natural person who can be identified, directly or indirectly, by means of information. This is the person whose personal data are collected and processed by the controller or on its behalf. In this context, this refers to any natural person whose personal data we process: our visitors, persons who fill in contact forms on one of our websites, persons who purchase an entry ticket for an event organised on our site or a parking ticket, any other person whose personal data are communicated to us, etc.

● Personal data: any information relating to an identified or identifiable natural person (= the data subject). This definition is broad, as data are considered personal whenever they allow a natural person to be identified directly (name, first name, photograph, etc.) or indirectly (e-mail address, customer number, employee number, etc.). Any reference to "data" in this privacy policy refers to personal data.

● Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means. Again, the definition is broad. Any handling of personal data constitutes processing: collection, consultation, storage, transmission, alteration, erasure, etc.

● Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. This is the person who decides why your data are collected and processed. This is your point of contact and the person who will be held accountable for compliance with applicable data protection standards.

● Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. The processor does not decide why a processing operation is carried out; it carries it out on behalf of a controller.

4. Who are we?

The non-profit organisation Parc des Expositions de Bruxelles, abbreviated as "Brussels Expo", has its registered office at Place de Belgique 1, B-1020 Brussels. VAT number: BE 0406.655.573.

Every person or entity that processes personal data must determine whether it does so as a controller or as a processor. This distinction is of fundamental importance in the processing of personal data. In this context, we consider it useful to present our activities and vision at this stage, as well as our relationship with our partners.

Our mission is to foster and develop a hub for meetings and exchanges with a view to promoting economic, commercial, industrial, scientific, cultural and leisure activities, in particular through the territory and the various buildings conceded to us by the City of Brussels. To that end, we develop all activities that are useful or necessary, including all services directly or indirectly related to the organisation of trade fairs & exhibitions, congresses, conferences, shows, concerts, festivals and other events. As part of our mission, we also endeavour to continuously improve the customer experience during visits to our site. It is in pursuit of these objectives that we build our business, supported by a number of partners.

Always mindful of offering a diverse range of activities, we also aim to provide a comprehensive service to event organisers in order to attract eclectic events of interest to both the general public and specific groups. More broadly, and in view of our particular position, we carry out significant coordination work between events and develop an overall strategy aimed at achieving our primary mission. We also have decision-making authority over the choice of events organised and seek to adopt a strategy consistent with our desire to develop the sites entrusted to us.

This particular position gives rise to a finding regarding our capacity under the GDPR when processing your personal data, which varies depending on the circumstances. When a data subject orders an access ticket to an event, they are bound both to Brussels Expo and to the organiser of the event they wish to attend. In this context, and with respect to the data we collect for ticketing purposes, Brussels Expo and the event organiser each act as a separate controller.

However, when Brussels Expo collects personal data that go beyond what is necessary for the management of its ticketing operations and the specific request of an event organiser, Brussels Expo then acts as a processoron behalf of that organiser.

For your complete information, you are invited to read both our privacy policy and the privacy policy of the event organiser whose event you wish to attend.

5. What does our privacy policy cover?

This privacy policy is intended to inform you about the data we collect in our capacity as controller, how those data are processed, and the reasons for such processing. Through this policy, we wish to inform you of our commitments and your rights with regard to the protection of your personal data.

This privacy policy does not cover the processing operations carried out by Brussels Expo in its capacity as processor on behalf of an organiser, which are governed by the privacy policy of the relevant organiser.

Our policy covers all personal data collected by Brussels Expo in the course of all its activities, namely: trade fairs & exhibitions, congresses, conferences, shows, concerts, festivals and other events, through one of the following means:

● Website brussels-expo.com;

● Website ing.arena.brussels;

● Website la-madeleine.be;

● Personal data collected when you participate in a survey or competition;

● Personal data collected when you purchase or obtain a parking ticket on the Brussels Expo parking platform: https://parking.tickets.brusse...;

● Personal data collected when you purchase or obtain a ticket for an event through the Brussels Expo ticketing platform (i.e. links created specifically for each event and directing to the ticketing platform in one of the following URL formats: xxx.tickets.brussels-expo.com or xxx.ticketlive.be or any other URL referring to the Brussels Expo ticketing platform);

● Personal data collected when you purchase or receive a gift card through the Brussels Expo gift card ordering platform.

By communicating personal data to us through any of these means or by any other means, you undertake to provide us with accurate information about yourself.

6. What are our data protection principles?

We attach great importance to your personal data and your privacy. Your trust in us is a priority. We endeavour to process your data lawfully, transparently, fairly and responsibly. We take all necessary steps to implement the organisational and technical measures appropriate to the protection of your data. Finally, we strive to collect the minimum amount of data necessary to achieve our purposes.

7. What data do we collect, how do we process them and why?

7.1 We do not process sensitive data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, health data, or data concerning a natural person's sex life or sexual orientation. We do not process genetic data or biometric data. Should the processing of any such "special category" data be envisaged, you would be duly informed in advance.

7.2 The purchase of tickets is reserved for legal persons and natural persons with legal capacity to enter into a contract or, where applicable, who have received the necessary authorisation from their parents or guardians (or any person exercising parental authority).

7.3 The data we collect and process are those that you voluntarily transmit to us or to one of our processors or partners. For certain order-related operations, you may be required to transmit data about yourself to third-party partners through their own services, specifically during payments you may make. We will not hold such data, as their collection and processing are governed by the terms and conditions of those parties. We invite you to consult their terms and conditions before communicating your data.

Data collected: when you wish to order an access ticket to an event organised at one of our sites for the first time, we offer you the choice of ordering with or without creating an account.

In both cases, we collect the following information:

● Only if required due to a body search at the entrance to an event: Gender

● First name, last name: mandatory identification data

● Language: data necessary to facilitate communication with you

● E-mail address: mandatory data enabling us to communicate with you by e-mail and to send electronic tickets

● Phone number: mandatory data enabling us to contact you in the event of a problem relating to the event. This data will under no circumstances be used for any other purpose.

● Date of birth: mandatory data enabling us to verify the age of our customers and avoid sales to minors where an event is not intended for a minor audience, such as an erotic trade fair for example. This data is also essential for achieving our primary purpose, which is the development of our sites, by providing an overall view of the age brackets of persons attending each event so as to adapt our strategy and programming.

● Etc.: the justification for any additional data request will be provided at the time such data are collected.

• Data collected : when purchasing or obtaining a parking ticket on our platform:

● First name, last name: mandatory identification data

● E-mail address: mandatory data enabling us to communicate with you by e-mail and to send your electronic parking ticket

● Postcode: data processed for statistical purposes

• Data collected : in the event of a gift card order, the following data relating to the recipient of the card are also collected:

● First name, last name: mandatory identification data

● E-mail address: mandatory data enabling us to communicate with the gift card recipient and to send the gift card electronically

● Where applicable, data contained in the personal message addressed to the recipient. These data are collected through the gift card purchaser, who communicates them to us for the purposes set out below.

Purposes: Our primary mission is the development of our sites and the Heysel Plateau through, in particular, the organisation of events. In the context of fulfilling our corporate purpose, we collect and process the above-mentioned data in order to best carry out our various missions and provide an experience and service tailored to your expectations. This information is also essential for your identification and for the performance of our contractual relationship. The processing of these data enables the sending of personalised or non-personalised tickets by e-mail, as well as communications relating to the event. They allow us to promote our activities and to communicate our offers and agenda to you. Finally, they enable us to evaluate events organised as part of our overall strategy: age of visitors, locality, satisfaction survey, etc.

The personal data collected are, as applicable:

● Used in order to create an account in your name (except in the case of a fast checkout);

● Used in order to issue an access ticket to the event;

● Used in order to issue a parking ticket allowing you to park your vehicle in one of our car parks;

● Entered into a structured database;

● Used for various security purposes during your visit to one of our sites;

● Communicated to the organiser of the event for which you have ordered an access ticket, who processes these data as a separate controller; Brussels Expo may also, at the request of that organiser and in its capacity as processor, collect and process additional data on behalf of the organiser. Such processing operations are then governed by the privacy policy of the event organiser;

● Communicated to the exhibitor of the event to whom you have voluntarily shown the QR code on your access ticket, in order to facilitate the connection with the exhibitor, who processes these data as a separate controller;

● Retained for the purpose of carrying out evaluations aimed at improving our services;

● Where applicable, your data are used in our direct marketing campaigns (= sending our agenda, offers and promotions, etc.) where you have not objected to such use;

● Used for the purpose of producing statistics to improve our overall event organisation strategy;

● Used for the purpose of gift card orders for events;

● Used for the purpose of sending gift cards for events;

● Used for the purpose of organising security teams responsible for body searches.

7.4 Data collected during an event: In the event that Brussels Expo installs Wi-Fi sensors and visual sensors in order to track, following encryption, the movements of visitors during an event, you will be informed of this processing upon entry to the event by means of an information sign. This processing is based on the legitimate interests of Brussels Expo, the organisers and exhibitors, as well as those of our visitors. These interests converge. The aim is indeed to improve the quality of the event by managing crowds as effectively as possible. This may allow for reduced waiting times in queues, adaptation of facilities to meet visitors' needs, increased visibility for exhibitors, better communication of information to visitors according to attendance levels at specific locations, etc. This processing is carried out, among other things, using equipment belonging to third-party companies.

Where applicable, the data collected are, on the one hand, the MAC addresses of your mobile device, which are encrypted almost immediately, and, on the other hand, images captured through visual sensors which do not allow a visitor to be identified, as the images are blurry and in greyscale. Please note that the collection of these data does not allow you to be identified. These data are encrypted, aggregated, and used for the purpose of producing a statistical report enabling us to better understand visitor movements and to respond as effectively as possible to their needs and those of the organisers/exhibitors.

You naturally have the possibility to opt out of this processing by registering your MAC address on the following website: https://smart-places.org/mobil...

Please note that some mobile devices use a technology that involves the regular modification of the MAC address. Our opt-out system should allow your device to be opted out despite this change of MAC address. In any event, you can avoid this tracking by simply switching off your Wi-Fi.

8. On what legal bases do we process your data?

● Performance of a contract: By purchasing a ticket on our website, you are bound by a contractual relationship that justifies the collection of your personal data for the purpose of performing the contract: communicating your ticket to you, granting you access to the event and/or one of our car parks as applicable, communicating event-related information to you, managing the venues, delivering the gift card to its recipient, etc.

● Legitimate interests: It is in our legitimate interests to process your personal data for purposes that go beyond the scope of the contract binding us. It is in our legitimate interests to promote our activities in pursuit of our mission. We endeavour to process your data on the basis of our legitimate interests in a responsible manner and by minimising the risks of infringement of your privacy. For example, we commit to contacting only persons who have already purchased a ticket for one of the events organised on our site, with the exception of gift card recipients, and we offer you the possibility to object to this type of processing at any time and with ease. In the context of sending a gift card, we have a legitimate interest in ensuring that the recipient receives their gift card, in accordance with what was agreed with the gift card purchaser.In order to ensure that our direct marketing campaigns do not infringe your right to privacy, we have carried out a careful balancing exercise between our legitimate interests and the risk of infringement of your privacy in order to assess the legitimacy of our interest. You may object to this processing at any time.

● Legal obligation: We may be required to process your data in order to comply with a legal obligation arising from European Union law or Belgian law. You may not object to this processing.

● Consent: We may request your consent for certain processing operations involving your personal data. This is notably the case for the transmission of your data (first name, last name, e-mail address and phone number) to the exhibitor of the event to whom you voluntarily show the QR code on your access ticket. You may withdraw your consent at any time.

9. How do we protect your data?

We have implemented the necessary technical and organisational measures to protect your data, proportionate to the risks of infringement of your rights. Our security measures are regularly assessed and adapted in order to permanently guarantee a high level of protection.

10. With whom do we share your data?

We undertake not to transmit or sell your personal data to any third parties other than our subsidiaries, processors or direct partners whose involvement is necessary for the achievement of the above-mentioned purposes.

In the context of organising an event, we share your personal data with:

● The event organiser for whose event you have ordered an access ticket. The event organiser is also a controller of your personal data. We only communicate your personal data to event organisers for whose events you have ordered an access ticket, and we make the organiser's privacy policy available to you at the time of data collection, where available.Furthermore, where Brussels Expo collects personal data at the request of an event organiser, beyond what is necessary for its ticketing operations, Brussels Expo acts as a processor on behalf of that organiser. In that case, and as stated above, Brussels Expo only processes these data on the instructions of the organiser. We once again invite you to consult the relevant organiser's privacy policy for any information relating to these processing operations.

● The exhibitor at the event to whom you have voluntarily shown the QR code on your access ticket. This exhibitor is also a controller of your personal data.

● Processors: We have engaged companies that facilitate the organisation of our activities. These companies process your personal data solely on the basis of our express instructions. We take all possible and reasonable steps to ensure that our processors process your data in compliance with applicable legal data protection standards. Access to your personal data is limited to the data they strictly need for the performance of their tasks. All our processors are located in the European Economic Area and are subject to the aforementioned legal standards on data protection.

Your personal data are only transferred to a third country to the extent that the event organiser has its registered office in a third country, with no representative within the Union. As of the date of publication of this privacy policy, all the organisers with whom we collaborate have an establishment within the European Union. You will be informed of any potential transfer outside the European Union at the time of ordering your event access ticket.

11. How long do we retain your data?

The retention period for data depends on the processing operation concerned. Brussels Expo will retain your data for a period of 5 years from the date of your last purchase, except for processing operations based on our legitimate interests (5 years from the date of last contact) and processing operations justified by legal obligations to which we are subject. We do not retain your payment data.

12. What are your rights?

You are in control of your data. We take all necessary steps to ensure that your rights are respected. For better management of your personal data, please be aware that you have:

A right to information: The right to be informed in a fully transparent and clear manner of the processing of your personal data and of the rights recognised to you in this regard, which we endeavour to fulfil through the publication of this privacy policy and by remaining available to you for any further information.

A right of access: You have the right to obtain confirmation as to whether or not personal data concerning you are being processed by us and to access those data as well as all relevant information relating to their processing.

A right to rectification: Where you find that the personal data concerning you are inaccurate or incomplete, you have the right to request that we complete or rectify them, where applicable by providing us with an additional statement.

A right to erasure: In certain circumstances, you have the right to request that we erase the personal data concerning you.

A right to restriction of processing: In certain situations, you have the right to obtain the restriction of the processing of your personal data to mere storage.

A right to object: Where the processing of your personal data is based on the legitimate interests of Brussels Expo, you have the right to object to such processing at any time.

A right to data portability: Where the processing of your personal data is based on your consent or on a contract and is carried out by automated means, you have the right to receive those data in a structured, commonly used and machine-readable format. You may request that these data be communicated to another controller.

We endeavour to respond to your requests to exercise your rights as promptly and efficiently as possible. However, we inform you that in certain situations described in the applicable legal standards, we have the right to refuse the exercise of certain rights where the circumstances so justify. We will therefore endeavour to communicate a reasoned refusal to you in order to enable you to understand why we are unable to respond favourably to your request.

We invite you to exercise your rights by e-mail at the following address: privacy@brussels-expo.com.

Important: before communicating your personal data to us, please bear in mind that in the event of a request to exercise a right, we are required to communicate the personal data concerning you. To that end, our ability to verify the identity of the person making the request is limited. In accordance with our principle of limiting data collection to data strictly necessary for the achievement of our purposes, we endeavour not to collect more data for identity verification than those already in our possession. We therefore consider that any request to exercise your rights made from your registered account or registered e-mail address sufficiently demonstrates your identity. We invite you to register with an e-mail address that is personal to you and to be vigilant about the protection of that address.

13. Where can you lodge a complaint in the event of an infringement?

Should a problem arise, we naturally invite you to contact us at privacy@brussels-expo.com so that we may assist you as effectively as possible. In any event, you have the right to lodge a complaint with the data protection authority. More information at https://www.autoriteprotection....

14. Updates to our privacy policy

Our privacy policy may be subject to future expansions or adaptations, for example in the event of new developments. We recommend that you consult this privacy policy on a regular basis.

Date of last update: 09/04/2026