Cubby BV privacy policy

1. Data controller

Cubby BV, also referred to as ‘Cubby’, ‘we’ or ‘us’, is responsible for processing your personal data. Our company number is 1017.176.246 and our registered office is at Kerkstraat 108, 9050 Ghent, Belgium.

You can reach us at cubby.be or arne@clubcubby.be.

Cubby is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR). This privacy policy forms one whole with our general terms and conditions. We recommend reading it carefully when you interact with Cubby through a QR code, our website or in any other way.

This policy describes which personal data Cubby processes, how it does so and which safeguards apply. It may be amended following a software update, an expansion of our activities or a change to our legal, administrative or contractual obligations.

2. Which data does Cubby process?

When you use a smart locker, Cubby collects the personal data you enter after scanning the QR code, such as your name, email address and telephone number. Cubby also retains transaction data, including the locker location and the times at which it is opened and closed again. You may be asked to take a photograph before and after using an item. You may also choose to verify yourself through Google.

When you contact us by email or through the contact form on our website, we process everything you enter or send. This always includes details such as your first name, surname, email address and, where applicable, your organisation.

For ambassadors, we process their email address, name and any information they provide during contact with us. Ambassadors are people selected by Cubby who supervise one particular locker in their neighbourhood, replace damaged toys and act as the contact person for that locker.

We use Stripe and MultiSafepay for locker payments. The payment service provider processes the transaction details; Cubby only receives confirmation of payment.

In accordance with the GDPR, we only process accurate and necessary data.

3. Purposes and legal grounds for processing

We rely on a valid legal ground for each processing activity:

• Legitimate interest: photographs are used to monitor the correct use of lockers and equipment.
• Legitimate interest: photographs, name and telephone number may be used to establish misuse, damage, loss or vandalism.
• Consent: email address and telephone number are collected to contact users about use or follow-up.
• Legitimate interest: the content of your correspondence and the name of your organisation are processed to facilitate the conversation and answer your questions.
• Legitimate interest: users’ and members’ email addresses are processed for the operational and technical management of the UrbanCubby system, as this is necessary for its operation.

Where processing is based on consent, you give that consent freely and may withdraw it at any time.

4. Who does Cubby share your data with?

Cubby is selective about the parties to whom we disclose personal data and chooses them carefully. In all cases, we seek sufficient safeguards for the protection and confidentiality of your data.

Cubby may disclose personal data to service providers and other parties that perform certain processing services on our behalf.

• Processors acting on our behalf, such as partners, suppliers, subcontractors and external service providers.
• IT service providers offering technical support.
• Supervisory authorities, police, judicial or other public authorities where applicable laws or regulations, or another lawful request or order, require us to do so.

5. Processing personal data outside the EEA

Some data may be stored or transferred outside the European Economic Area (EEA) for the purposes described above. This may occur through service providers established outside the EEA, because data is stored on a server outside the EEA, or because it can be accessed from outside the EEA.

Cubby is committed to ensuring an appropriate and adequate level of protection for your data by applying the appropriate safeguards provided for in Chapter V of the GDPR.

6. Which safeguards do we provide?

Cubby takes reasonable security measures to protect your personal data against destruction, loss, alteration or any other unauthorised processing.

To safeguard our legitimate interest in adequately securing our business assets, incoming and outgoing emails are monitored, including to detect spam, viruses and ransomware.

Cubby does not retain your personal data for longer than necessary for the purposes described in this privacy policy. A legal or contractual obligation, or a dispute, may require a longer retention period.

• Photographs of equipment are retained for one month. If images are needed to investigate potential problems or irregularities, we retain them until the investigation has been completed.

7. What rights do you have?

You have several rights concerning the processing of your personal data:

• You may request free access to the personal data Cubby processes about you and receive a copy.
• You may ask us to correct your data if you believe it is inaccurate.
• You may ask Cubby to erase your data or restrict its processing.
• You may object to processing at any time. For direct marketing, no reason is required; in other cases, you must state your reason.
• You may request data portability, ask not to be subject to profiling, and object to processing under the conditions of the GDPR.
• You may lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, at contact@apd-gba.be.

To exercise your rights, send a request to arne@clubcubby.be. Cubby will respond within one month of receiving your request.

8. Children’s privacy

Our services are not intended for children below the minimum age for digital consent. In Belgium, this age is 13. Under national law and the GDPR, no one below that age may provide information to or through our services.

We do not knowingly collect personal data from children below that minimum age. If we learn that such data has nevertheless been collected or received, we will delete the account and the related personal data.

9. Changes to our privacy policy

We reserve the right to amend this privacy policy. The most recent version is always available on our website, which we ask you to consult regularly.

10. How can you contact us?

For questions or complaints, you can reach us at cubby.be or arne@clubcubby.be.