Privacy policy

1. Introduction

This privacy policy aims to inform you about how Binders Media collects and processes Personal Data via its Manual.to platform (the platform through which a client of Binders Media’ and/or you (as end user) can, create, share and read visual instructions, manuals and other content, hereinafter “Platform“) and via its website.

Binders Media refers to Binders Media BV, having its registered office at 9000 Ghent, Volmolenstraat 29, Belgium and with company number 0657.817.970. Binders Media deems the protection of privacy of the utmost importance and wishes to enable you – as user of its Platform – to maintain full control over what happens to your Personal Data and your privacy and to inform you accordingly.

Binders Media respects your privacy and is committed to protecting your Personal Data in accordance with the Belgian and European regulations on the protection of privacy, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the Processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (“General Data Protection Regulation” or “GDPR”) (together the applicable “Data Protection Legislation”). All capitalized terms that are not defined in this Policy shall have the meanings as ascribed to them in the GDPR.

Please read this privacy policy carefully. It describes not only your rights, but also the way in which you can exercise these rights.

On specific occasions, we may provide you with additional privacy notices so that you are fully aware of how and why we are using your Personal Data. This privacy policy supplements other more specific notices and privacy policies and is not intended to override them.

By using our Platform, our website, disclosing your Personal Data, or accepting this Policy, you acknowledge the manner in which Binders Media collects and Processes your Personal Data as described in this Policy.

We keep our privacy policy under regular review. This version was last updated on February 16h 2022.

2. Controller vs. Processor

This privacy policy describes our data Processing activities as Processor on behalf of our clients when you are using our Platform. Processors act on behalf of, and only on the lawful instructions of, the relevant Controller.

Binders Media has entered into an agreement (the “Agreement”) with your employer or principal to grant you access or use the Platform.

References in this privacy policy to “your employer” or “your principal” shall refer to the entity who has entered into the Agreement with us. You will typically be an employee, officer, freelancer, contractor or consultant of a Binders Media client. Your employer or principal is the Controller under this privacy policy. Binders Media will process your Personal Data as a Processor on behalf of your employer or principal and in accordance with its lawful instructions.

However, in some circumstances, we may also act as a Controller. As a result this privacy policy also describes our data Processing activities as Controller when you are using our website (and to a limited extent also our Platform), when and limited to the extent we are determining the purposes and means of the Processing activities as set forth in this privacy policy.

3. How to contact us

Binders Media has appointed a Data Protection Officer, whom you can always contact for questions about your privacy and the Processing of your Personal Data. The Data Protection Officer can be reached at:

• Name: Olivier Dupont
• E-mail: dpo@manual.to
• Telephone: +32 497 68 94 01

4. How we process Personal Data

We process your Personal Data as a Processor on the basis of the instructions of your employer or principal as defined in the Agreement, when you sign up or are signed up by your employer or principal to our Platform when you complete your user account, and where applicable when uploading content on the Platform, as further explained below.

In relation to the above uses, we shall Process your Personal Data on the legal basis determined by your employer or principal, including to enable us to perform our contractual obligations under the Agreement. If you wish to receive more information regarding the legal grounds for processing, we recommend to directly contact your employer or principal, who is, as Controller, solely responsible to foresee such legal grounds in its own privacy policy. Depending on the functionalities you use on our website and the Platform and as deemed relevant by your employer or principal, the following Personal Data might be Processed by Binders Media:

4.1. Contact information and account data

4.2. End user data

4.3. Analytical and statistical and configuration, system generated and technical information

Additionally, each time you visit our website and/or Platform we may process your personal data as Controller. For instance we may automatically collect information in order to improve our services and for other analytical purposes. The relevant legal basis for Processing this Personal Data is, depending on the relevant situation: (i) Binder Media’s legitimate interests or (ii) your consent.

Depending on the functionalities you use on our website and the Platform, the following Personal Data might be Processed by Binders Media:

4.4. Analytical, configuration, system generated and technical information

4.5. Contact information

4.6. Business administration and legal compliance

Where Personal Data of third parties are disclosed via the Platform, the person communicating the Personal Data guarantees that he or she has informed those third parties and that he or she has received all necessary consents to communicate the third parties’ Personal Data to Binders Media.

5. Cookies

Our website and Platform use cookies and similar technologies. For more information, we refer to our cookie policy.

6. Legal Ground

In relation to the above mentioned purposes, we shall process your Personal Data on the legal basis determined by your employer or principal. If you wish to receive more information regarding the legal grounds for Processing, we recommend to directly contact your employer or principal.

The legal ground on which your Personal Data is being Processed mainly depends on the category of Personal Data concerned. Below you will find an overview of the possible legal grounds on which we Process Personal Data.

• Consent

Where we rely on your consent to Process your Personal Data, the consent you provide is always free and you have the right to withdraw your consent at any time by sending an email to dpo@manual.to.

Withdrawal of consent does not affect the Processing of Personal Data (i) prior to such withdrawal, (ii) based on another legitimate ground for Processing Personal Data, and (iii) based on a legitimate interest. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case, at the time you withdraw your consent

• Performance of an agreement

Under this legal ground we Process your Personal Data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract. This legal ground only applies when you are the natural person with whom we enter into a contract.

In most cases, we enter into agreements with companies or other types of organizations. When we process the Personal Data of the persons acting on behalf of legal persons, we rely on our legitimate interests.

• Legitimate interests

Our legitimate interests refer to our interest to conduct and manage our business.

Additionally, legitimate interest as a legal basis for the lawfulness of Processing is justified with regard to the Personal Data to improve your user experience and the Binders Media Platform and website. The fact that Binders Media Processes this Personal Data also benefits you as a user of the Platform and/or website. Moreover, such Processing of Personal Data shall not create any risks to the fundamental rights and freedoms of any users of the Platform and website.

We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we Process your Personal Data for our legitimate interests. We do not use your Personal Data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you by contacting us.

• Legal obligation

Sometimes we need to process your Personal Data where it is necessary for compliance with a legal obligation.

The above reasons are not exhaustive, and Binders Media may at any time Process your Personal Data for any other legitimate reason. In such cases, Binders Media will notify you as soon as possible of the reason. Updates of this Policy may constitute such a notification.

7. Disclosures of Personal Data

Binders Media may share your Personal Data for the purposes set forth in section 4, with third parties, for storing, hosting and processing your Personal Data under this Privacy Policy, responding to your queries, sending content to you, host the Platform, for optimizing our Platform, providing marketing assistance, sending content to you, responding to your queries and providing customer service and to IT service providers and professional advisers (including lawyers, bankers, auditors and insurers) and with the Binders Media group.

Additionally, Binders Media may share your Personal Data with any third party you have asked us to share your Personal Data with – such as Facebook or any other social media Platform – if you have asked us to connect with your account.

We may also share certain Personal Data with third parties to whom we intend or choose to sell, transfer or merge (parts of) our shares, business or assets.

In addition, we may disclose your Personal Data if this is required by law, or if we determine in good faith that such disclosure is required in order to comply with any pending judicial inquiry, judicial order or litigation and/or to safeguard our rights. For example, we may respond to a request by a law enforcement agency or regulatory or governmental authority if Binders Media deems this useful or necessary, in its sole discretion, for the investigation of fraud, intellectual property infringement or any other harmful activity, or if Binders Media reasonably suspects that such activity may expose Binders Media or you to any liability. We may also disclose data in connection with actual or proposed litigation, or to protect our property, security, people and other rights or interests.

In particular, your Personal Data may be shared or transferred to the following entities:

Upon request, Binders Media shall, as soon as possible after the request, inform you of the third parties with whom your Personal Data have been shared by providing you a more detailed list.

Processors and Sub-processors of Binders Media always act under the responsibility of Binders Media. If Binders Media engages Sub-processors, this will always be done in accordance with a data processing agreement that meets the requirements of the GDPR. We require all our Sub-processors to take appropriate technical and organizational (including security) measures to protect your Personal Data in line with our policies. We do not allow our Sub-processors to use your Personal Data for their own purposes. Such Processors and Sub-processors will only have access to your Personal Data on a “need-to-know” basis and limited to the extent necessary to perform their services. In the event we disclose your Personal Data as described above, we will implement appropriate safeguards to ensure the integrity and confidentiality of your Personal Data.

This listing may evolve and shall be updated from time to time.

8. Direct Marketing

Binders Media will use your Personal Data for direct marketing purposes. It is possible that your Personal Data will be subject to profiling for marketing purposes. This enables Binders Media to keep you informed about its products, updates, events, etc. You give your explicit consent for this, but you may at any time withdraw this consent and object to the Processing of your Personal Data for direct marketing purposes, including profiling, to the extent that it is related to such direct marketing (free of charge).

You shall have the right at any time to object to the Processing of your Personal Data for direct marketing purposes, including profiling to the extent that it is related to such direct marketing, free of charge, by sending an e-mail to: dpo@manual.to.

9. International transfers

In principle, Binders Media does not transfer your personal data to third countries located outside the European Economic Area. It is, however, possible that Binders Media – through its Processors or Sub-processors – does transfer your Personal Data to countries outside the EEA. In this case, Binders Media shall only transfer your Personal Data outside the EEA in accordance with applicable law (for instance by using or relying on model contract clauses, binding corporate rules, codes of conduct, adequacy decisions, etc.).

Whenever we transfer Personal Data out of the EEA, we ensure that a similar degree of protection is afforded to it by implementing appropriate safeguards as specified in Chapter V of the GDPR.

Please contact us if you want further information on the specific mechanism(s) used by us when transferring Personal Data out of the EEA.

10. Data security

Binders Media is committed to trying to make sure that your Personal Data is secure and makes all reasonable and appropriate efforts to protect the confidentiality of your Personal Data. We have implemented appropriate technical and organizational measures, safeguards and assurances to process your Personal Data in accordance with applicable Belgian and European regulations, in particular to protect your Personal Data against loss, misuse, or unauthorized alteration or destruction. Binders Media maintains a team of technicians, automated systems, and advanced technologies, following the industry best practices. Examples of such implemented security measures include:

• Access control (physical access): The server room and racks that hold Binders Media’s servers and switches are locked. Additionally, access to this server room and racks is limited to IT-staff.
• Availability: The Platform utilizes extensive features of the cloud environment to ensure high availability, such as full redundancy, load balancing, automatic capacity scaling, continuous data backup and geo-replication along with a traffic manager for automatic geographical failover on datacenter level disasters. All failover mechanisms are fully automated. No Personal Data is stored permanently outside Binders Media’s cloud platforms. The physical security is thereby maintained by Binders Media’s subcontractors. Microsoft’s datacenters comply with industry standards such as ISO 27001 for physical security and availability, e.g. by using security staff around the clock, two-factor access control using biometric and card readers, barriers, fencing, security cameras and other measures.
• Integrity: In order to ensure integrity, all data transits are encrypted to align with best practices for protecting confidentiality and data integrity. For data in transit, industry-standard transport protocols between devices and Microsoft datacenters and within datacenters themselves are used. Binders Media uses the extensive range of built-in logging features and audits trails provided by Microsoft on its Azure cloud platform. Binders Media also logs all system updates, configuration changes and access to provide an audit-trail if unauthorized or accidental changes are made.
• The Platform is login-protected. It is accessible through a standard web browser, automatically using an encrypted https-connection for all communications between your browser and Binders Media’s server to protect any Personal Data from being intercepted during network transfers.
• If requested, a login via Microsoft Single Sign On can be enabled.
• Only password hashes are stored. The hashes are calculated using a salted, slow hashing algorithm.
• Interactions between end users’ browser and the manual.to servers are encrypted using TLS 1.2 and industry best practice cipher suites. When AD SSO is enabled, the manual.to servers additionally interact with Active Directory using the encrypted SAML 2.0 SSO protocol.
• Confidentiality: All personnel are subject to full confidentiality and any subcontractors and (sub-)processors are required to sign a confidentiality agreement. When accessing the data in a database, the IP address of the person accessing the Personal Data must also be pre-authorized to obtain access.
• Transparency: Binders Media will at all times keep you informed about changes to the processes to protect data privacy and security, including practices and policies. You may at any time request information on where and how data is stored, secured and used. Binders Media will also provide the summaries of any independent audits of its services.
• Isolation: All access to Personal Data is blocked by default, using a zero privileges policy. Access to Personal Data is restricted to individually authorized personnel. Binders Media’s Security and privacy officer issues authorizations and maintains a log of granted authorizations. Authorized personnel are granted a minimum access on a need-to-know basis.
• The ability to intervene: Binders Media enables your rights of access, rectification, erasure, blocking and objection mainly by providing built-in functions for data handling in the Platform and website, by offering the option to send instructions through Binders Media’s helpdesk and also by informing you about and offering the Binders Media’s client and end user the possibility of objection when Binders Media is planning to implement changes to relevant practices and policies.
• Monitoring: Binders Media uses security reports to monitor access patterns and to proactively identify and mitigate potential threats. Administrative operations, including system access, are logged to provide an audit trail if unauthorized or accidental changes are made. System performance and availability is monitored from both internal and external monitoring services.
• Personal Data breach notification: In the event your Personal Data is compromised and in accordance with the applicable Data Protection Legislation, Binders Media will (to the extent required) notify you and the competent Supervisory Authority(ies) within 72 hours by e-mail with information about the extent of the breach, affected data, any impact on the services and Binders Media’s action plan for measures to secure the data and limit any possible detrimental effect on the data subjects.
• Development Environments: Binders Media uses different environments for product development so their Software Engineers have no access to customer data by default. Only Engineers who require access to the customer data for support purposes are granted access.
• Backup: Binders Media takes daily backups of their databases. These backups are kept in a different location than the source location. Both locations are within the EU. Backups are retained for 30 days.
• Penetration testing: Binders Media will contract an external security firm to perform penetration testing every six months.
• All data is stored in encrypted Azure Disks and Blobs. We take advantage of the Storage Service Encryption (SSE) which guarantees that all data at-rest is encrypted using 256-bit AES encryption.

We make all reasonable and appropriate efforts to protect the confidentiality of your Personal Data.

Despite the above measures taken by us, you should be aware that there are always risks associated with sending Personal Data over the internet. The security and protection of your Personal Data can never be fully guaranteed, nor can we guarantee that unauthorized third parties will never be able to defeat those measures or use your personal data for improper purposes.

11. Data retention

We will only retain your Personal Data for as long as reasonably necessary to fulfil the purposes determined in the Agreement or in Section 4 of this privacy policy, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your Personal Data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you or the organization you work for.

The applicable retention periods are set out in the table above under section 4.

12. Data location

All data are stored in databases and file repositories hosted in an Azure data center at Binders Media’s cloud vendor, Microsoft in the Netherlands. Databases are continuously backed up to enable restore to any point in time within a retention period of thirty-five (35) days. Backups are stored on file storage at the same geographical location as the database.

13. Your legal rights

If and in as far as provided for in the applicable Belgian and European legislation, you have the right:

• to receive confirmation as to whether we Process your Personal Data and, where this is the case, to access such Personal Data;
• to have any inaccurate or incomplete Personal Data corrected without undue delay;
• to have your Personal Data deleted by us under certain circumstances, namely when one of the following applies:

1. if the Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
2. if you withdraw your consent on which the processing is based, and where there is no other legal ground for the processing;
3. if you object to the processing in case the processing is for direct marketing purposes;
4. if the Personal Data have been unlawfully processed; or
5. if the Personal Data have to be erased for compliance with a legal obligation in EU or national law;

• to obtain your Personal Data and to transfer them to another Controller or Processor,
• to obtain a limitation of the Processing of your Personal Data to the extent possible and subject to the applicable Data Protection Laws, at any time request Binders Media to restrict the processing of Personal Data when one of the following applies:

1. if you contest the accuracy of the Personal Data, for a period enabling Binders Media to verify the accuracy of the Personal Data;
2. if the processing is unlawful and you oppose the erasure of the Personal Data and request the restriction of their use instead; or
3. if Binders Media no longer needs the Personal Data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims;

• to receive your Personal Data in a structured, common and machine-readable format;
• to prevent the Processing of your Personal Data and the use of your Personal Data for direct marketing purposes; and
• where the Processing of your Personal Data is based on points (e) and (f) of article 6(1) of the GPDPR, to object to the Processing of Personal Data.

In the event you request a copy of your Personal Data being processed by Binders Media, your data will be delivered within ten (10) working days by Binders Media as spreadsheet files in Microsoft Excel-format. Logical relations between datasets will be preserved in form of unique identifiers. Binders Media may either (i) charge a reasonable fee, taking into account the administrative costs of providing such a copy, or (ii) refuse to act on such a request, when the request for a copy is manifestly unfounded or excessive. Binders Media will inform the Data Subject of the applicable fee before charging it.

You can exercise these rights by contacting our Data protection Officer by sending an e-mail to dpo@manual.to. However, please note that if your request relates to Processing activities where we act as Processor, we do not have the right to handle such request ourselves. We will forward your request to the applicable Controller (your employer or principal) and provide him/her the necessary assistance if this would be requested by the latter. Please contact your employer or principal directly if you would like to exercise any of your privacy rights or have any privacy inquiries.

We may require you to provide verification of your identity to ensure that you have a legitimate right to make any request and to verify that we provide the answer to the person that has the legitimate right to send us one of the abovementioned requests and to obtain the Personal Data. For these purposes, Binders Media reserves the right to request a copy of the front side of your identity card if Binders Media is unable to identify you or if Binders Media has reason to doubt your identity. You may, however, blackline any information which is not necessary for identification or verification purposes.

If and to the extent provided for in the applicable Belgian and European legislation, you have the right to file a complaint with the competent supervisory authority should the Processing of your Personal Data violate the applicable regulations. In Belgium the competent authority is the Data Protection Authority (“Gegevensbeschermingsautoriteit”):

www.gegevensbeschermingsautoriteit.be
Drukpersstraat 35, 1000 Brussels, Belgium
+32 (0)2 274 48 00
contact@apd-gba.be.

We would, however, appreciate the chance to deal with your concerns before you approach the authority, so please contact us in the first instance.

14. Third party links

Our website and Platform may contain links to third party websites. Binders Media is not responsible for the content of these websites and is not responsible for the privacy standards and practices of that third party. We recommend you to read the relevant privacy policies of these third parties and their websites before you accept their cookies and visit their website to ensure yourself that your Personal Data is sufficiently protected. Nonetheless, we seek to protect the integrity of our website and welcome any feedback about these websites.

15. Consent for disclosure

You acknowledge that we may disclose your Personal Data if this is required by law, or if Binders Media determines in good faith that such disclosure is required in order:

1. to comply with any pending judicial inquiry, judicial order or litigation pertaining to the Platform;
2. to respond to claims against Binders Media regarding Personal Data that violate any rights of third parties;
3. to safeguard the rights, property and safety of Binders Media, its employees, users, and the general public.

16. Liability

If Binders Media has legitimately transmitted your Personal Data to a third party (not being its Sub-processor), Binders Media shall not be liable for any unlawful Processing or unlawful use by that third party.

Under no circumstances does Binders Media accept responsibility for any direct or indirect damages resulting from faulty or unlawful use of the Personal Data by a third party (not being its Sub-processor).

Binders Media is in any case only liable for the damage caused by Processing of Personal Data if it did not comply with its specific obligations under the GDPR. Binders Media shall in no event be liable for any special, incidental, indirect or consequential losses or damages.

17. Changes to this privacy policy

Binders Media may amend this privacy policy at all times. Any changes we may make to our privacy policy will be indicated on the Platform and when proportionate in line with the significance of the changes, may be notified to you by e-mail or advised to you on your next log-in to the Platform or website-visit. The date of the most recent version is shown in the top right-hand corner of the privacy policy. Please review Binders Media’s privacy policy periodically to stay informed of changes that may affect you.

Amended versions of this privacy policy take effect ten (10) days after their publication on the Platform. Where required they will always be submitted for approval.

18. Applicable law and competence

This privacy policy shall be governed, interpreted, and implemented in accordance with Belgian laws.

The Ghent Courts (department Ghent) are exclusively competent to decide on any dispute that may arise from the interpretation or implementation of this privacy policy, without prejudice to the consumer’s right to present a dispute before a competent court on the basis of a mandatory statutory provision.