Privacy Notice

Veolia privacy policy

Last updated: 06/10/2026

Veolia Environmental Services Belux SA (hereinafter referred to as "we" or "Veolia") informs you that we process certain personal data about you, in our capacity as data controller. We will process and protect your personal data in accordance with the provisions of the General Data Protection Regulation 2016/679 of April 27, 2016 (hereinafter "GDPR") and applicable national legislation.

This notice sets out:

1. Identity of the data controller;

2. How we collect your personal data;

3. The scope of the processing of your personal data (what personal information we collect, for what purposes and on what legal basis);

4. How long we keep and process your personal data;

5. To whom your personal data may be transmitted;

6. The measures we take to protect your personal data;

7. Your rights in relation to such processing;

8. Information on cookies and similar technologies;

9. Contact details for our privacy officer and data protection authorities;

This Privacy Policy may change from time to time. If material changes are made, we will notify you.

Identity of the data controller

The legal entity responsible for processing your personal data is:

Veolia Environmental Services Belux SA

Boulevard Poincaré 78-79, 1060 Saint-Gilles, Belgium

Enterprise Number (CBE/KBO): 0403.316.397

Email: dataprotection.be@veolia.com

How we collect your personal data

We may collect personal data:

• Directly from you when we interact with you, including when you access our digital platforms or websites (see also website privacy notice); or our platform application (app.circpack.eu)

• Indirectly from third-party sources or platforms

Please note that, when users register or sign in via Google Sign-In or Microsoft Sign-In SSO, we receive their verified name and email address. These identity providers act as independent data controllers for their own credentials.

Please note that, subject to obtaining your express consent, in certain cases and with prior notice, we may record and process telephone calls for the purposes set out below.

We do not intend to collect, process or retain personal data from third parties under the age of 16, unless we are legally permitted to do so. If we become aware that we hold personal data of persons under the age of 16 (except as required by law), we will delete such data from our files.

Scope of personal data processing

Below you will find an overview of (i) what personal data we process, (ii) for what purposes and (iii) on what legal basis:

Purpose of processing

• Type of information

• Use/treatment objective

• Legal basis

Identify yourself

• Identification data (name, customer number, computer login and passwords, e-mail address, identification data of the devices you use (mac address, ip address, personal identification data of your device), domain names, professional data, company login credentials, SSO tokens, etc.)

• Access to our websites or digital tools (see also website privacy notice) and platform application (app.circpack.eu) via Supabase (London/Frankfurt) and SSO providers (Google/Microsoft).

  Correspondence with you.

• Performance of our contracts.

  Compliance with legal obligations.

  Legitimate interest in controlling access to our websites/IT tools and where we provide our services.

  Legitimate interest in performance monitoring linked to the use and monitoring of our IT tools.

Purpose of processing

• type of information

• Use/treatment objective

• Legal basis

Account Creation & Platform Authentication

• Identification data (name, email address, company login credentials, SSO tokens).

• Managing user registration, login access, and authentication on app.circpack.eu via Supabase (London/Frankfurt) and SSO providers (Google/Microsoft).

• Performance of our contracts (to provide account access) and Legitimate interest in controlling access to our IT tools.

Purpose of processing

• Type of information

• Use/treatment objective

• Legal Basis

Ensure and improve the quality of our services and image

• Identification data, Personal preference, platform usage event data, IP addresses.

• Consumer profile of our services . Market and customer satisfaction survey.

  Sending information about our services and/or activities.

  Monitoring the quality of our services and/or perception of our image.

  Determining usage profiles (how each user uses the platform) to tailor support, reminders and offers.

  Monitoring user activity on our platforms via PostHog to provide support, facilitate platform engagement, send automated service emails via Brevo (reminders to activate an account that has not yet been activated, reminders after a period of inactivity, and requests for feedback), and suggest features, free trials or upgrades that match how you use the platform (for example, a free trial of the EPR calculator).

• Performance of our contracts and/or pre-contractual measures.

  Compliance with legal requirements.

  Legitimate interest in providing information about our services.

  Legitimate interest in monitoring perception.

  Performance of our contracts (to ensure active delivery and utility of platform services) and Legitimate interest in maintaining active customer engagement and providing proactive user support. Legitimate interest in promoting our services to existing users. You may object at any time to the use of your platform activity for offers, including the related profiling (see point 7 "Your rights").

Platform Security & System Stability

• Identification data, application error logs, diagnostic data.

• Monitoring system performance and capturing crash error logs via Sentry to maintain software security, fault-tolerance, and platform stability.

• Legitimate interest in maintaining secure, functional, and fault-tolerant software infrastructure.

Platform Services & Packaging Calculations

• Identification data, professional data, customer packaging data uploaded to the platform.

• Processing packaging datasets to execute recyclability assessments, PPWR compliance checks, and EPR calculations; storing customer packaging data securely in Frankfurt (Supabase Customer).

• Performance of our contracts (executing platform services requested by the customer).

Identify Yourself (Direct Marketing & Upsells)

• Identification data, Personal preferences (language, interest in our products or services)

• Contact with you, specifically in connection with (the negotiation of) our contracts . Sending invoices and correspondence relating to contracts . Invitation and organization of events and direct marketing to existing customers (including cross-product promotions, upselling, and invitations to try new digital tools such as a free trial of our EPR calculator) . Customer prospecting (including "direct marketing") directed at potential customers (including promotions and free trial opportunities for our digital tools) . Requesting call preferences

• Fulfillment of our contracts . Compliance with legal obligations . Legitimate interest in sending you information about our services and activities and in promoting them . Your consent, which you may withdraw at any time (see point 7 "Your rights") . Requesting references from our customers and service providers on the basis of a justified interest

Purpose of processing

• Type of information

• Use/treatment objective

• Legal Basis

Evaluation of applications for employment

• Identification details

  .

• Evaluation of requests

• Performance of our contracts or pre-contractual measures

  Compliance with legal obligations

  Legitimate interest in the follow-up and conservation of job applications.

Billing and payments

• Identification details

  Financial data (specifically, account number)

• Payment of our financial obligations and recovery of sums due to us

• Performance of our contracts or pre-contractual measures

  Compliance with legal obligations

  Legitimate interest in the recovery of sums due to us.

Purpose of processing

• Type of information

• Use/treatment objective

• Legal Basis

Follow-up of legal obligations, disputes or legal proceedings

• Identification data and all data relating to the dispute or lawsuit

• Administrative follow-up of information required by Veolia to comply with legal obligations, or follow-up of claims and/or litigation.

• Compliance with legal obligations in terms of labor law, social security and social welfare.

  Legitimate interest in the proper administrative management of our business in relation to company law.

  Legitimate interest in the possible follow-up of claims or disputes involving third parties, or involving the exercise, determination or defense of a right before the courts.

Your personal data will only be used for the purposes for which it was collected. If we need your personal data for a new purpose, unrelated to the original purpose for which it was used, we will inform you of this and also ask for your consent if the arrangement so requires.

In general, the processing of your data does not give rise to automated, individual decision-making and, if this is the case, you will be informed and will therefore have the right to object.

Refusal to provide us with the personal information necessary for the performance of a contract and/or to access and/or use our digital tools or platforms may result in refusal to enter into a contract with you and/or to provide the services for which access to such personal information is required, more particularly with regard to identification purposes.

How long will your data be stored and processed?

Your data will be kept for a period of time that depends on the needs of the processing operation, and will be recorded, for each processing operation, in the processing register or in accordance with the legal retention period. To define this period, we take into account the nature and quantity of the information concerning you that is in our possession, as well as the purpose for which it was collected.

In particular, we apply the following storage guidelines:

• The starting point for the retention of your personal data is the legal retention period (often up to 10 years after the end of a contract or the completion of a transaction). For the exercise of our rights, this period may be longer, such as the statutory limitation period. If the law does not prescribe a retention period, the retention period may be shorter.

• We use the personal data of (employees of) potential new customers for 5 years, unless contact with the prospect has taken place in the meantime. In this case, a new 5-year period begins. Prospects may request the deletion of their personal data at any time (see point 7 "Your rights").

• We use the personal data of job applicants and telephone callers for a maximum period of one year.

• Packaging data and formats saved on the platform are kept until the user deletes them, asks us to delete them, or asks us to close their platform account.

• We keep the calculation history logs for 24 months after the last platform calculation, then it is permanently deleted. A manual delete option features a 30-day grace period.

After the retention period has expired, your personal data may still be stored in our backups or archives, but will no longer be actively processed in the file.

Further information on our retention periods is available on request.

Transfer of personal data and processing by external service providers

In most cases, Veolia processes personal data itself. For certain activities, it uses a limited number of external subcontractors, such as IT and cloud service providers.

We may transfer your data to:

• Customers, suppliers, public authorities, where necessary;

• Other Veolia Group companies for centralized administrative purposes;

• Trusted infrastructure providers that process data strictly under our instructions and are contractually bound to maintain confidentiality and technical security, including:

  • Vercel: Application hosting and compute routing in the US East region; primary databases remain in Europe.

  • Supabase (Main): User account database and login credential management in London, UK.

  • Supabase (Customer): Customer packaging data storage and calculation records in Frankfurt, Germany.

  • Brevo: Email delivery for sign-in links, platform invitations, transactional alerts, direct marketing campaigns, and automated account-activation, inactivity and feedback emails, in the EU.

  • Google Sign-In: Federated single sign-on (SSO) authentication and internal operational alerts.

  • Microsoft Sign-In: Federated single sign-on (SSO) authentication.

  • PostHog: Product analytics and platform usage monitoring in Frankfurt, Germany. Event data is retained for 12–24 months before being deleted or anonymized.

  • Sentry: Application error monitoring, system diagnostics, and stability logging in Frankfurt, Germany.

  • Cloudflare: Bot protection on our sign-in service and the human check (Turnstile) on the public trial sign-up page.

  • [Alerting service: name, purpose and location to be confirmed by the product team].

  • Sanity: Content delivery infrastructure.

• Our professional advisers and lawyers.

International Data Transfers: Where personal data is transferred to third parties outside the European Economic Area (EEA) - such as compute hosting via Vercel (US East), user database management via Supabase Main (London, UK), global SSO authentication via Google and Microsoft, or bot protection via Cloudflare - such transfers are protected using recognized EU Standard Contractual Clauses (SCCs), UK adequacy decisions, or equivalent legally approved safeguards.

Security and confidentiality

Only authorized persons have access to personal data, and only if such data is relevant to the performance of their duties.

We have taken the necessary administrative, technical and organizational security measures to preserve the confidentiality of your personal data and to prevent any loss, misuse and/or unauthorized access or modification of personal data.

We may sometimes anonymize your personal data to the extent that it can no longer be associated with you. In this case, this information loses its character as personal data.

We also make every effort to ensure that your personal data is accurate and up-to-date. To this end, we kindly ask you to inform us of any changes to your personal data (such as a change in your contact details).

Further information on our protection measures is available on request.

Your rights

We make every effort to ensure that your personal data is correct and up-to-date.

Within the limits of articles 15 to 22 GDPR, you have the following rights:

• Right of access to your personal data;

• Right to information (in particular on the purposes for which your personal data is processed, how long it is held, the origin of personal data in our possession, to whom your personal data may be disclosed and whether your personal data may be processed automatically);

• The right to modify or correct your personal data;

• The right to delete your personal data ("right to be forgotten"),

• Right to object to and/or restrict the processing of your personal data;

• Right to receive your personal data in a structured, commonly used and machine-readable format and to provide (or have provided) your personal data to another organization;

• Right to revoke your consent to processing.

If you no longer wish to receive mailings of our newsletters or other commercial information about Veolia (including "direct marketing" such as cross-product upsell offers or free trial invitations to tools like our EPR calculator), you may at any time exercise your right to object to "direct marketing"/your right to revoke your consent by contacting us or by following the instructions indicated on the marketing documents themselves, in particular by clicking on the "unsubscribe" link indicated on each mailing of our marketing leaflets. You can also choose which emails you receive, and how often, in the platform under [Settings › Notifications]. Objecting to direct marketing also stops us from using your platform activity to select offers for you.

Finally, you have the right to lodge a complaint about our processing of your personal data with the competent data protection authority (see point 9).

You can exercise your rights in this case by sending an e-mail to the following address: dataprotection.be@veolia.com

We strive to respond to your requests or inquiries as quickly as possible. We may ask for proof of identity in advance to verify your request, insofar as your identity may reasonably be doubted.

Cookies and similar technologies

Our website (www.circpack.eu) and platform application (app.circpack.eu) use cookies and similar technologies which may collect personal data about you. You can accept or decline their use through the cookie banner on our website and, in the platform, under Settings › Privacy (“Manage My Cookies”). You may withdraw this consent at any time. For more information, please consult our cookie policy.

Data privacy officer and data protection authorities

If you have any questions, concerns, or wish to exercise any of your data protection rights, we encourage you to contact our Data Privacy Compliance Officer (DPCO) first : Email: dataprotection.be@veolia.com.

If you feel we have not addressed your concerns in a satisfactory manner, you have the right to lodge a complaint with a data protection authority :

For Residents of the EU/EEA: Under the GDPR, you have the right to complain to the supervisory authority in the Member State of your habitual residence, place of work, or where the alleged infringement took place. A complete list of all EU/EEA national data protection authorities and their contact details can be accessed via the European Data Protection Board (EDPB) directory.

For Residents of the United Kingdom: You have the right to contact the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF (website: https://ico.org.uk).

For Global Customers Outside the EU/EEA and UK: If you are located outside of these regions, please contact our DPCO at dataprotection.be@veolia.com. You may also have the right to lodge a complaint with your local data protection regulator under your country's local laws.