Bluesquare SA
Hive5 – Rue des Francs 79, 1040 Brussels, Belgium
Version: 1.0
Effective Date: 28 January 2026
Review Date: 28 January 2027
We are Bluesquare (legally known as Blue Square SA), located at Hive5 – Rue des Francs 79, 1040 Brussels, Belgium.
We value individuals’ right to privacy and strive to protect personal data in accordance with applicable data protection legislation, and more specifically with the EU General Data Protection Regulation (“GDPR”) and its national implementing legislation.
At Bluesquare, we adhere to the following GDPR principles:
This policy applies to all employees, contractors, and third parties who process personal data on behalf of Bluesquare.
From time to time, we need to update this Data Protection Policy. The most recent version is available on our website. You may also ask us to send you a copy of the most recent version.
In the context of our activities, we collect and process certain personal data. Pursuant to EU data protection and privacy legislation, we sometimes act as a ‘data processor’, and sometimes as a ‘data controller’:
We act as a data processor on behalf of our clients/customers (who act as data controllers) in the following scenarios:
Important: For those activities for which we only act as a ‘data processor’, our clients/customers are responsible for providing adequate data processing information to all individuals whose personal data are collected.
We act as a data controller in the following scenarios:
Important: For those activities for which we act as ‘data controller’, this Data Protection Policy sets forth how we collect personal data, how and for what purposes we may use personal data, and to whom personal data may be disclosed by us. Further, this Policy includes important information regarding individuals’ rights with respect to the processing of their personal data.
In the context of the services we provide to our clients/customers, we collect personal data relating to individuals who participate in surveys about services received through government or NGO programs in countries around the world.
The following information is typically collected and processed:
This information is generally collected via mobile questionnaires. Local interviewers are requested to complete these questionnaires together with the person and to duly inform the person on the collection and processing of their data, so that they can validly consent hereto. Such consent is then confirmed before the actual survey starts.
Other information can also be collected by us through access to health facilities or other public registries and government databases, subject to the legal requirements governing access to such databases.
We collect information from interviewees, as described above, for the purposes specified by our clients/customers, generally relating to the administration and follow-up of grants and subsidies to hospitals, healthcare service providers, and schools.
For statistical and research purposes: We aggregate and anonymize interviewees’ information for statistical and research purposes (e.g., to generate geographical maps indicating with geo-codes where interviews have taken place).
We rely on grounds of public interest and statistical research for the anonymization process. Insofar as this would not suffice, we have also put in place an opt-in consent mechanism. In any case, as soon as it is fully anonymized, the information can no longer be linked back to the patients concerned and is not ‘personal data’ anymore.
For client and partner communications: We collect information from clients, partners, and suppliers (name, function, organization, contact details) in order to (i) share news and updates about what we do and (ii) ask about their level of satisfaction with our product and services. We do not share clients’ information to third parties without their explicit consent.
In the context of the purposes listed above, we may share personal data with third parties, such as:
The anonymous/aggregated data sets generated by us may also be shared with third parties. These data sets do not, however, contain any personally identifiable information.
Where relevant, we will ensure that contractual safeguards (Data Processing Agreements) are implemented to ensure the protection of personal data in case of disclosure to a third party.
If any party to whom we may disclose personal data would be located outside the European Economic Area (EEA), we will ensure that measures are taken to ensure adequate protection of personal data in accordance with applicable data protection legislation.
These measures include:
Your personal data will not be stored for longer than is necessary in relation to the purposes for which we process them.
Insofar as we would act as data controllers ourselves, we will anonymize any personal data obtained from patients via the surveys we perform as soon as possible, so that we do not retain any personal data in our data sets.
| Data Type | Retention Period |
| Survey participant data (as processor) | As determined by our clients/customers (data controllers) |
| Patient data (as controller) | Anonymized as soon as possible; no retention of personal data |
| Customer/supplier contact data | Duration of relationship + 3 years |
| Financial/billing records | 7 years |
| Application logs | 90 days (unless needed for investigation) |
We will implement the necessary administrative, technical, and organizational measures for ensuring a level of security appropriate to the risks that we have identified.
We also protect personal data against destruction, loss, alteration, unauthorized disclosure of or access to personal data transmitted, stored, or otherwise processed.
Individuals have the following rights:
Finally, individuals also have the right to lodge a complaint with the Belgian (or any other competent) Data Protection Authority.
To read more about these rights, and circumstances under which they can be exercised, see the Annex below.
A data breach is unauthorized access, loss, or disclosure of personal data.
Immediately:
1. Alert the Data Protection Contact and your manager
2. Email: security@bluesquarehub.com
3. Don’t delay – report within 2 hours for serious incidents
Include:
Within 24 hours: Assess severity and risk, contain breach (isolate systems, revoke access), preserve evidence
Within 72 hours (if required): Notify data protection authority for breaches posing risk to individuals; notify affected individuals directly if high risk to their rights
Documentation: Record all breaches in our breach register, document actions taken and lessons learned
Contact: Martin De Wulf, Rue des Francs 79 – 1040 Etterbeek
Email: info@bluesquarehub.com
Responsibilities:
All team members must:
Topics covered: This policy and GDPR principles, recognizing sensitive data (especially health data), handling data subject requests, reporting breaches, secure data handling practices and anonymization procedures.
This policy will be reviewed periodically and updated as necessary to reflect changes in data protection laws, best practices, and business operations.
Quarterly: Review data subject requests, breaches, training completion
Annual: Comprehensive policy review, external security assessment
Non-compliance with this policy may result in:
We protect those who report violations in good faith. Retaliation is prohibited.
If you have any questions, comments or complaints in relation to this Data Protection Policy or the processing of your personal data by us, please feel free to contact us:
By mail: Attention of Martin De Wulf, Rue des Francs 79 – 1040 Etterbeek, Belgium
By email: info@bluesquarehub.com
Security issues: security@bluesquarehub.com
To file a complaint with authorities:
DO:
DON’T:
REPORT IMMEDIATELY:
| Right | Description |
| Right to Information and Access | You may at any time request more information on our processing activities and the personal data that we are keeping from you. Response provided within 30 days, free of charge (reasonable fees for excessive requests). |
| Right to Rectification | You have the right to require us to, without undue delay, rectify or complete any of your personal data that is inaccurate or incomplete. |
| Right to Deletion (‘Right to be Forgotten’) | You may request us to delete (part of) your personal data in the following situations:- When the processing is no longer necessary for achieving the purposes- When the processing was based on your consent and you have decided to withdraw that consent- When you have other reasonable grounds to object to the processing- When we would unlawfully process your personal data- When your personal data have to be erased in compliance with a legal obligationWe may refuse deletion for: (i) exercising freedom of expression; (ii) legal obligations; or (iii) legal claims. As far as deletion applies, we will anonymize your personal data. |
| Right to Restriction of Processing | You may request us to (temporarily) restrict the processing of your personal data in the following situations:- When you have contested the accuracy, for a period enabling us to verify- When processing appears unlawful and you request restriction instead of deletion- When we no longer need the data but you need them for legal claims- Pending verification whether our legitimate grounds override yours |
| Right to Object | You may under certain circumstances object to the processing of your personal data, in particular if you choose to withdraw the consent on which our data processing activity is based. You can revoke your consent at any time, by sending written notice to us at the address indicated above. Once you have revoked your consent, your data will be anonymized, so that we can no longer make a connection between you and the data. |
| Right to Data Portability | In some cases, you have the right to receive all your personal data in a structured, commonly used and machine-readable format (CSV, JSON) and have the right to transmit that data to another controller. This right applies: (i) when processing is based on consent or contract; and (ii) when processing is carried out by automated means. |
By adhering to this Data Protection Policy, Bluesquare is committed to safeguarding personal data and upholding the privacy rights of all individuals. All team members must read and comply with this policy. Acknowledgment required during onboarding.
