Privacy Policy of GIMBER

1. General

This Privacy Policy describes how we process your personal data ("Data") in order to provide you with the products and services we offer.

We attach paramount importance to the confidentiality and security of your Data, in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and the Act of 30 July 2018 on the protection of individuals with regard to the processing of personal data.

By using our site, by communicating your Data to us when requesting information or commercial offers, whether directly or through our partners, by using our services or by working with GIMBER, you accept the practices described in this Privacy Policy. If you do not accept the provisions of this policy, please do not use our site and do not communicate your Data to us. In this case, you nevertheless agree not to benefit from all the services and other advantages offered by GIMBER.

2. Contact details of the controller

GIMBER SRL (hereafter: "GIMBER"), whose registered office is at Boulevard du Roi Albert II 4, 1000 Brussels (Belgium) and which is registered with the Crossroads Bank for Enterprises under the number (BE) 0717.702.307, is the data controller for the processing of personal data that you provide to us directly via our website www.gimber.com.

3. What data do we collect, for what purpose, on what legal basis and for how long?

This is the Data that you communicate to us on the one hand through the forms offered on the www.gimber.com website and on the other hand through cookies deposited by us or more generally by third party services.

We only use this Data for the processing purposes described below and we only collect the Data that is strictly necessary for these purposes.

We will keep the Data only for as long as is necessary for the processing operations for which it was collected and in accordance with the periods stipulated by the applicable legal provisions. At the end of this period, we will make every effort to ensure that the Data has been made unavailable.

3.1. Contact form

The purpose of this form is to allow you to send questions about our products. We will use the data collected through this form solely in connection with your request and for the time necessary to provide an appropriate response.

The data collected as part of this processing are:

• Identification data, namely first name and last name;
• Contact data, namely the email address or telephone number;
• The content of your message.

The legal basis justifying the collection of personal data is the legitimate interest as referred to in Article 6(1)(f) of the GDPR.

The data will only be retained for the period necessary to process your request.

3.2. Recruitment form

When you apply for a job vacancy via our online form, we collect and process your personal data in order to manage your application.

The data collected as part of this processing are:

• Identification data, namely first name and last name;
• Contact data, namely the email address or telephone number;
• The content of the Curriculum Vitae (CV);
• The content of the cover letter.

The legal basis justifying the collection of personal data is the performance of pre-contractual measures as referred to in Article 6(1)(b) of the GDPR.

With regard to the data retention period:

• For unsuccessful candidates, the data will be retained for 30 days from the closure of the recruitment process. Upon expiry of this period, the data will be anonymised.
• For successful candidates, the data will be retained for the period necessary for the performance of the employment contract and for 5 years from the end of the employment contract (unless legal proceedings are initiated).

3.3. Marketing emails (newsletters and commercial communications)

The purpose of marketing emails is to send you communications intended to help you discover our brand and its values, to keep you informed about our news, events and useful content, as well as our periodic newsletter.

The personal data collected as part of this processing includes:

• Identification data, namely first name and last name;
• Contact data, namely email address and telephone number.

The legal basis for the collection and processing of personal data is your consent, as provided for in Article 6(1)(a) of the GDPR.

The data are retained for a period of three years from the last contact or until you withdraw your consent.

3.4. Creation of a customer account

Creating an account on the GIMBER website allows you to place orders via the website.

The data collected as part of this processing are:

• Identification data, namely first name and last name, postal address;
• Contact data, namely the email address.

The legal basis justifying the collection of personal data is the performance of the contract as referred to in Article 6(1)(b) of the GDPR.

The data are retained for as long as the account remains active and thereafter for a maximum period of 3 years following its inactivity, in compliance with our legal obligations.

3.5. Placing an order

When you place an order on the GIMBER website, certain information is requested in order to ensure the proper processing and delivery of your order.

The data collected as part of this processing are:

• Identification data, namely first name and last name, postal address;
• Contact data, namely the email address and/or telephone number;
• Banking data, namely the payment method and bank details;
• Order-related data, namely the products ordered.

The legal basis justifying the collection of personal data is the performance of the contract as referred to in Article 6(1)(b) of the GDPR.

The data are retained for as long as the account remains active and thereafter for a maximum period of 3 years following its inactivity, in compliance with our legal obligations.

In the context of payment processing, GIMBER relies on external payment service providers. These providers process payment data as independent controllers, in accordance with their own terms and legal obligations. GIMBER does not have access to full banking details (such as card numbers or bank account information) and only receives a payment confirmation together with limited transaction information, strictly necessary for order management.

As part of sales carried out via the Amazon and Bol.com platforms, these marketplaces act as data controllers for the collection of your personal data. However, for orders shipped directly by us, GIMBER acts as a separate data controller for the purposes of order preparation, shipping and delivery tracking. In this context, GIMBER receives only the data strictly necessary for the performance of the order (e.g. name, delivery address) and transfers them to its own logistics service providers in order to ensure delivery. GIMBER undertakes to process this information exclusively for the performance of the sales contract. For any information regarding the initial collection of your personal data, we invite you to consult the privacy policies of Bol.com and Amazon.

3.6. Emailing related to order management

This processing concerns the handling and follow-up of your order, including the sending of order and payment confirmations, preparation and shipping notifications (tracking information, delivery time slots), as well as immediate customer service communications (returns, exchanges).

The personal data collected as part of this processing includes:

• Identification data, namely first name, last name and postal address;
• Contact data, namely email address;
• Order details;
• Purchase history.

The legal basis for the collection and processing of personal data is the performance of a contract, as provided for in Article 6(1)(b) of the GDPR.

The data are retained for as long as the account remains active and, thereafter, for a maximum period of three years following its inactivity, in compliance with our legal obligations.

3.7. Referral programme

When you are a GIMBER customer, you have the possibility to invite a friend via a referral link. GIMBER provides you with a link to share with the person you wish to refer. The referred person then receives an invitation message allowing them to discover GIMBER and, where applicable, to register or place an order. GIMBER therefore only collects the referred person's data when they voluntarily interact.

The data collected as part of this processing are:

• Identification data, namely first name and last name;
• Contact data, namely the email address.

The legal basis justifying the collection of personal data is consent as referred to in Article 6(1)(a) of the GDPR.

The data are retained for three years from the last contact or until you withdraw your consent.

3.8. Contests

This processing allows users to participate in contests on social media. GIMBER collects the data necessary for participation, verifies compliance with the conditions, contacts the winners and manages the allocation of prizes. The data are used solely for the organisation and follow-up of the contest.

The data collected as part of this processing are:

• Identification data, namely first name and last name, postal address;
• Contact data, namely the email address and/or telephone number.

The legal basis justifying the collection of personal data is consent as referred to in Article 6(1)(a) of the GDPR.

We retain your Data for the period necessary to carry out the contest or until consent is withdrawn.

3.9. Cookie management

This website uses cookies.

A cookie is a small file that is distributed with the pages of a website and stored by the browser on the hard drive of your computer, tablet or phone. The information it contains can be sent back to the site's servers during a subsequent visit and thus allow the author of this site to establish a trace of the internet user's activity. It should be noted that behind the term "cookies" we also consider any other technical tracing process such as "scripts" in general. A script is a piece of programming code used to make a website work interactively. Finally, "web beacons", "pixel tags" and "social media cookies" are also cookies.

Cookies allow us to personalise content and to offer functionalities necessary for the proper functioning of a website, such as the control of a shopping cart or the memorisation of a language choice.

Certain cookies may be placed or controlled by third parties. These third-party cookies are used to improve your experience on our site, analyse the use of our services and offer you personalised advertising. These cookies are placed by trusted external partners and make it possible to collect information such as your browsing behaviour, the pages you have visited and your interactions with advertisements.

3.9.1. Technical cookies

These cookies are essential for the website to function properly. They enable you to browse the site and use its basic functions. This type of cookie does not collect personal information and is temporary, disappearing when you leave the site. These cookies cannot be deactivated as this would affect the proper functioning of the site.

3.9.2. Preference cookies

These cookies enable the website to remember the choices you have made and provide enhanced and more personal functionality. We use some cookies to remember your settings and preferences (such as your chosen region or language). They may also be used to provide services you have requested, such as watching a video or commenting on a blog.

3.9.3. Statistical cookies (analytical or audience measurement)

These cookies collect information about how you interact with the website, including which pages you visit most often and whether error messages are displayed. We use them to analyse and improve the performance and operation of the website. We use tools that collect, for example, your IP address when you connect, the date and time you access the website, the pages you visit, the type of browser you use, and the platform and/or operating system you use. These cookies are only used on the site if you have given your consent.

3.9.4. Marketing cookies

These cookies are used to track visitors through the website. The aim is to display advertising that is relevant and targeted to the individual user, based on their profile and interests. These cookies are only used on the site if you have given your consent.

3.9.5. Managing cookie preferences

Your consent can be changed or withdrawn at any time through the cookie preferences panel, which remains accessible from the footer of every page of our site.

You can also set your browser to block cookies or alert you when cookies are being sent. However, please note that if you disable cookies, some parts of our website may not function properly.

3.9.6. Categories of cookies used on this site and third parties involved

Rather than listing each individual cookie — a list that changes as our tools evolve — we describe below, for each category, the purpose pursued, the retention periods applied and the third parties involved. You can consult the exact list of cookies currently placed, and change your choices at any time, through our cookie preference centre.

a) Strictly necessary cookies

These cookies are required for the website to operate. They allow you to browse the site, keep the contents of your basket, stay signed in to your account, record your cookie choices and protect the site against fraudulent or automated traffic. They are placed on the basis of our legitimate interest and are exempt from the consent requirement under Article 129 of the Belgian Act of 13 June 2005 on electronic communications.

These cookies are placed by our e-commerce platform (Shopify), our content delivery and security provider (Cloudflare) and our customer service tool (Zendesk). Their retention period ranges from the duration of your visit to twelve months.

b) Preference cookies

These cookies allow the site to remember the choices you have made — in particular your country and your language — so that you do not have to set them again on each visit. They are placed by our e-commerce platform (Shopify) and are retained for a maximum of twelve months.

c) Statistical cookies

These cookies allow us to measure the audience of the site, understand how it is used and identify malfunctions, so that we can improve it. They record, for example, the pages you visit, the time spent on them, the type of browser and device used and your approximate geographical origin.

These cookies are placed by our analytics and audience measurement providers, namely Google (Google Analytics), Hotjar, Omniconvert and Lifetimely. They are retained for a maximum period of twenty-five months.

These cookies are placed only if you have given your consent.

d) Marketing cookies

These cookies allow us to measure the performance of our advertising campaigns, to recognise you across our communication channels and to present you with advertisements adapted to your interests, on our site and on third-party platforms.

These cookies are placed by our advertising and marketing providers, namely Google (Google Ads), Meta (Facebook, Instagram), Klaviyo, Stamped and ReferralCandy. They are retained for a maximum period of twenty-five months.

These cookies are placed only if you have given your consent.

e) Third-party privacy policies

The third parties listed above process the data collected through these cookies as controllers or joint controllers in respect of their own processing operations. We invite you to consult their respective privacy policies for further information on their practices, the retention periods they apply and the rights you may exercise directly with them.

Some of these providers are established outside the European Economic Area. Where this is the case, the transfer is governed by appropriate safeguards, in particular the Standard Contractual Clauses adopted by the European Commission, as described in section 4 of this policy.

4. To whom can your data be transmitted?

In the course of our activities, we may share your personal data with the various companies within the GIMBER group, as well as with selected third-party partners chosen for their expertise. To ensure the proper processing of your orders and the optimal functioning of our services, we rely on specialised technical service providers acting as data processors. These providers are involved, in particular, in the preparation and shipment of your parcels by our logistics services and carriers, as well as in the management of our IT infrastructure and marketing communication tools.

GIMBER contractually ensures that each of these service providers offers sufficient guarantees in terms of security and confidentiality, and that they act solely on our instructions. Furthermore, we may be legally required to disclose certain data to administrative or judicial authorities if required under applicable law.

Some of our partners may operate outside the European Economic Area. In such cases, we carefully ensure that these transfers are governed by appropriate legal mechanisms, such as the European Commission's Standard Contractual Clauses, in order to guarantee a level of protection equivalent to that within the European Union.

For any questions regarding our partners or to obtain a detailed list of categories of recipients, you may contact us directly at: dpo@gimber.com.

We do not sell or disclose your Data to third parties for commercial purposes.

In certain circumstances, our website and applications will provide you with plug-ins from different social networks. If you choose to interact with a social network site such as Facebook or LinkedIn, your activity on our site or through our applications will also be accessible on that social network. Please read the privacy policies of those social networks for detailed information about the collection and transfer of personal information, your rights and how you can obtain satisfactory privacy settings.

5. What are your rights?

• Right of access: you have the right to have confirmation that your Data is being processed, to have access to your Data at any time and free of charge and to obtain a copy of your Data.
• Right to rectification: you have the right to demand that incorrect Data be corrected, that incomplete Data be completed and that inappropriate or needless Data be deleted. We draw your attention to the fact that you are at all times obliged to check the accuracy of the Data you provide us with.
• Right to erasure: when you no longer wish your Data to be processed and you are in a position to request the right to erasure, we will then delete your Data from our database.
• Right to portability: where appropriate, you will also have the right to portability of your Data in accordance with applicable data protection legislation.
• Right to object: you have the right to object to the use of your Data where the processing is based on GIMBER's legitimate interest or on the performance of the public interest mission with which it is entrusted.
• Right to restriction of processing: finally, you have the right to obtain from GIMBER the restriction of the processing of your Data, in accordance with the applicable data protection legislation.
• Right to withdraw your consent at any time.

6. How to assert your rights?

By sending an email to dpo@gimber.com or a letter to:

GIMBER SRL
Boulevard du Roi Albert II 4
1000 Brussels
Belgium

You can also contact our Data Protection Officer (DPO) by email at dpo@gimber.com or by post at:

GDPR Agency
Chemin du Cyclotron 6
1348 Louvain-la-Neuve
Belgium

7. What happens in the event of a dispute?

If you believe that we are in breach of any of our legal and/or contractual obligations, we invite you to contact us by email at dpo@gimber.com. We will do our utmost to ensure you a follow-up as soon as possible.

Any claim, complaint or grievance is addressed to GIMBER.

In the event that you are not satisfied with our response, you have the right to submit a complaint to a supervisory authority.

The Belgian supervisory authority is:

Data Protection Authority
Rue de la Presse 35
1000 Brussels
Email: contact@apd-gba.be

8. Information concerning children

As a general rule, we do not intentionally collect personal information from children under the age of 13. If we discover that we have inadvertently collected information from children under the age of 13, we will take steps to delete the information as soon as possible, unless we are required by law to retain it.

If, however, we collect information from children under the age of 13, we will obtain the consent of the holder of parental responsibility for that child before using their personal information.

9. Links to other websites and services

Our sites may contain links to third party sites, and some of our services give you access to third party services (such as social networking sites).

We have no control over how third party sites and services treat your personal information. We do not audit third party sites and services, and we are not responsible for those third party sites and services or their privacy practices. Please read the privacy statements of any third party sites or services you access from our sites or services.

10. Security

We have developed technically and organisationally appropriate security rules to prevent the destruction, loss, falsification, alteration, unauthorised access, accidental disclosure to third parties and any other unauthorised processing of Data.

11. Limitation of liability clause

GIMBER's liability shall be limited to direct damages, to the exclusion of any indirect damages. GIMBER will never be held liable for damages deemed indirect such as, without this list being exhaustive, loss of Data, financial or commercial prejudice, loss of profits, increase in overheads, or disruption of planning.

In addition, GIMBER cannot be held liable for any damage resulting from illegitimate manipulation of Data by third parties (data theft, viruses, phishing or other computer offences).

We would also like to point out that links to the website may contain hypertext links and other references to other sites that we do not manage or control and to which the present provisions do not apply. We are not responsible for the content of these websites nor for the offers, products and services offered by them. We therefore recommend that you carefully read the privacy protection rules of each site you visit, as these rules may differ from these terms and conditions.

12. Applicable law and jurisdiction

These provisions shall be governed, interpreted and executed in accordance with Belgian law, the only applicable law, in the event of a dispute.

Any dispute that cannot be settled amicably within a period not exceeding one month from its occurrence, this period being extendable by mutual agreement, may be brought by the most diligent party before the French-speaking Courts and Tribunals of the judicial district of Brussels, which shall have sole jurisdiction.

13. Date of entry into force

This policy was created and came into force on 17 September 2026. We reserve the right, at our sole discretion, to change, modify, add or remove portions of this policy at any time.

14. Translation

The parties acknowledge that the translation of the above provisions into English is offered for the purpose of clarification and that, notwithstanding the accuracy of the translation, the basic text was drafted in French and that this language prevails for the interpretation or the scope of the words, terms and/or expressions and of the whole text.