Merchandise Essentials BV (hereinafter "Sunday", "we", "us") respects your privacy and strives to always treat your personal data with the necessary care and confidentiality. We hereby undertake to always comply with the General Data Protection Regulation ("GDPR") and other applicable regulations.
Sunday is a company incorporated under Belgian law. As a company we specialize in the offer and supply of qualitative and personalized merchandise, and the provision of related services such as consulting and product development. This Privacy Statement therefore applies to the personal data that we process from you in this regard as a data controller.
You will find all our relevant details below and can also contact us at any time using the contact details provided for further questions or comments regarding how we handle your personal data.
Name and legal form: Merchandise Essentials BV
Company number: 0539.854.587
Address seat: Hof ter Weze 5
E-mail address: info@teamsunday
Processing of personal data (hereinafter "data") includes any processing of data that can identify you as a natural person. This can include, for example, your contact details or order history. You can read more about which data exactly this involves in this Privacy Statement. The term "processing" is very broad and covers, among other things, the collection, storage, use of your data, or the sharing thereof with third parties. Sunday processes your personal data only in the context of its commercial activities as an enterprise.
3. To whom and when does this Privacy Statement apply?
This Privacy Statement applies where Sunday is responsible for processing your data. This means that Sunday determines for what purposes (why) and by what means (how) your data is processed. However, when our customer decides on these factors, this Privacy Statement does not apply. At Sunday, in the course of our activities, we sometimes act as a data controller, and sometimes as a processor of our customer. Therefore, we briefly clarify below when, specifically, this Privacy Statement applies.
Sunday as a data controller: does apply
With respect to the data of the persons listed below, Sunday acts as a data controller. This includes persons who belonged to these categories in the past (e.g. former customer), or persons who may belong to these categories in the future (e.g. potential customer).
Our customers, to whom we deliver our merchandise and provide our services;
Our business partners, who assist us in operating our business;
prospective employees, who submit an application to us;
other persons who would contact us, e.g. after visiting our website www.teamsunday.com, as long as we do not act as a mere processor with respect to your data.
If any of the persons referred to above is a legal entity, we still process data of our contacts at these entities and the GDPR continues to apply.
Sunday as processor: not applicable
In specific circumstances, we act as our customer's processor. In fact, customers often engage us to produce merchandise and then deliver it directly to its employees, customers and business partners. In order to fulfill such orders, the customer will provide us with some data about you, such as your name, address details, and the correct size and any personalized features of the merchandise intended for you. In this case, we will process your data purely as a processor of our customer and in doing so we must at all times comply with our customer's instructions. After successful delivery of the order, we are contractually obligated to delete your data after a limited period of time. Since the customer bears ultimate responsibility for this processing, we refer you to our customer for any questions you may have in this regard regarding the way your data is processed. This situation will be relevant to you if you are an employee, customer or business partner of one of our customers and, on behalf of this customer, receive merchandise that has been produced by us.
Below we clarify what data we may process from you. Depending on the specific situation, your preferences and the way in which you contact us, we may not process all of the data below. For the sake of clarity, we will first explain below what data we generally process about all our contacts. Then we will explain which data we additionally process for specific categories of contacts, namely our customers and business partners and our candidate employees.
From all our contacts we may process the data below:
|Type of data||Examples (non-exhaustive)|
|Id. at||A copy of your identity card (solely to verify your identity if you wish to exercise any of your rights as a data subject under the GDPR).|
|Contact details and history||Name, first name, address, email address, phone number, communications sent and received (e.g., email messages, messages sent via the contact form on our website, letters, etc.).|
From our customers and business partners we may additionally process the following data:
|Type of data||Examples (non-exhaustive)|
|Data on merchandise to be produced or services to be provided
(to the extent that we are not merely acting as a processor)
|Clothing size, shoe size, gender, personalized text to be printed on the merchandise or any other personalized features, concepts and designs, photos and video footage you would provide to us to clarify the desired product, quotes and orders, signed agreements.|
|Payment and billing information||Payment card details, bank account number, invoices.|
|Account details||Login credentials for our platform Merchbot with web address www.app.merchbot.me, the transactional data located on this account.|
|Aftersales and feedback||Order or transaction history, your reviews and experiences in connection with merchandise delivered or services provided, or in connection with our cooperation.|
Of candidate employees we may additionally process the following data. Of course, this will largely depend on what data you wish to provide us with in connection with your application.
|Type of data||Examples (non-exhaustive)|
|Personal details||Age, gender, date of birth, nationality.|
|Work related data||Curriculum vitae, education, certificates and credit lists, language skills, professional career, publications, portfolio.|
|Personality Profile||Motivation letter, hobbies, social activities, personality, interview notes.|
|Image and sound||Photographs and video footage that you yourself would provide to us as part of your application.|
We only process your data for legitimate purposes that are part of our commercial activities as a company. The processing is always based on the legal grounds listed in the GDPR.
For the sake of clarity, we first provide below an overview of the purposes and legal bases of the general processing operations within our company. Then we list the processing operations that are relevant to specific categories of contacts, specifically our customers and business partners and our candidate employees.
The processing steps below are potentially relevant to all of our contacts.
|Processing purpose||Legal basis|
|Answering your question when you contact us, should this not be (or no longer be) part of an existing, former or potential future relationship with you as our customer, business partner, or candidate employee, including when this is done through one of the forms on our website.||Legitimate interest|
|Offer you the opportunity to download various free templates and brochures from our website.||Legitimate interest|
|Promoting the business of Sunday, by using your contact information to send newsletters or other marketing materials to you, if you give your express consent to do so, via email or via the registration form on our website, or if it is possible based on our legitimate interests (after weighing this up and if you are not a customer, only for non-electronic marketing, such as shipping merchandise to your address).
You have the right to withdraw your consent at any time by using the unsubscribe link at the bottom of any such message you receive from us. You also have an absolute right to object to such processing, after which we must cease such processing.
Legitimate interest if possible, after consideration and only for non-electronic marketing if not a customer
|To provide a website that functions properly on a technical level by using strictly necessary cookies, so that we can provide you with a safe and well-functioning website.||Legitimate interest|
|The use of analytical cookies on our website to understand how you use our website, for the purpose of, among other things, detecting navigation problems, and making the website more user-friendly and attractive.||Consent|
|The use of marketing cookies on our website, for the purpose of displaying ads, implementing features on our website provided by social media, and measuring how often these ads and features are displayed and used respectively.||Consent|
|Fulfilling our legal obligations as a company, such as data protection and tax/accounting obligations.||Legal obligation|
|To ensure the possibility of exercising or defending the interests of Sunday in court, and to actually do so, if we believe that our interests are being harmed and legal proceedings are imminent (e.g., judicial collection of an unpaid invoice), or if legal action should be taken against us by a person who feels aggrieved by us (e.g., for defense if you would like to hold us liable for defects in the delivery of our merchandise or in our services).||Legitimate interest|
From our customers and business partners we process the data additionally for the following purposes:
|Processing purpose||Legal basis|
|Entering into, performing or terminating the agreement with you as our customer including responding to your request for a quote or product inquiry, requesting all relevant information prior to the delivery (or potential delivery) of our merchandise or provision of our services, fulfilling our pre-contractual obligations, establishing the customer agreement, managing the customer relationship, communicating with Sunday employees and invoicing and collecting the amounts you owe us as a result of the delivery of our merchandise and provision of our services.
Entering into, performing or terminating the specific agreement with you as our business partner, especially supplier agreements or any other cooperation agreement, including negotiating a potential cooperation, establishing the cooperation agreement, managing our relationship as business partners, paying the amounts we owe you as your business partner, or invoicing and collecting the amounts you owe us as a result of the cooperation.
|Necessity for the formation or performance of a contract.
Legitimate interest (for contacts at our customer or business partner who are not a party to the contract)
|Providing access to our online platform for customers and business partners called Merchbot, with web address www.app.merchbot.me, for the purpose of easy management of our relationship and the secure transmission and storage of the data relevant to it, such as orders you transmit on behalf of your company and agreements you enter into with us on behalf of your company.||Necessity for the formation or performance of a contract
Legitimate interest (for contacts at our customer or business partner who are not a party to the contract)
|Promoting Sunday' commercial activities, by using your contact information to send marketing materials (including promotional gifts) to you, via email or other channel, as part of our existing customer relationship and for similar products than the ones you have already purchased or requested from us, up to a reasonable time after your last purchase or use of our services.
You have an absolute right to object to this processing, after which we must stop this processing.
Consent if you have explicitly requested it (e.g. via the website, see under general processing)
|The improvement of our products based on your feedback on them as our current or former customer or business partner, the possible publication of your review of our products, or the investigation of your interest in products not yet offered with a view to the possible expansion of our offerings as a company. We pursue these purposes by:
- Conducting market research;
- verify your satisfaction and request your valuable feedback on our products;
- Publish your review on our website or our pages on social media channels.
Consent for the publication of reviews if personal data is involved, if applicable granted to the social media platform through which the review is posted
From our prospective employees, we process the data additionally for the following purposes:
|Processing purpose||Legal basis|
|Assessing whether Sunday wishes to enter into an employment, internship or partnership agreement with you.||Necessary for the formation of a contract.|
|Keeping for a maximum of 2 years the data you provided us with in the context of a job application, if you have an interesting profile, but we could not make you an initial proposal because a suitable position was not available. If a suitable position should become available, we will use your data to contact you again and gauge your interest in further discussions.||Consent|
We do not pass on your data to third parties, unless this is strictly necessary in view of the above-mentioned purposes (e.g. in function of the production and delivery of ordered merchandise), or if we are legally obliged to do so.
Where necessary, we use external service providers, so-called "processors", to support our operational purposes such as managing our IT systems. These external service providers carry out certain data processing operations on our behalf where appropriate. We will only share your data with these external service providers to the extent necessary for the respective purpose. The data may not be used by them for other purposes. In addition, these service providers are contractually bound to guarantee the confidentiality of your data by means of a so-called "processor agreement" concluded with these parties.
Specifically, this means that we share your data, to the extent relevant in your situation, with the following third parties for the following purposes, with these third parties in certain cases acting as processors on our behalf:
|Potential category of recipients of your data||Legal basis|
|Postal, transportation and delivery companies with respect to your contact information for the purpose of sending merchandise or mail to you as our current, former or potentially future customer or business partner.
Payment service providers for the data relevant for processing your payments to Sunday as our customer or business partner, or for processing (back) payments by Sunday to such persons, for the purpose of efficient management of payment administration within our company.Our own branch offices in the Netherlands, Poland and Germany, when necessary for the purpose of delivering our merchandise and providing our services. In addition, our external business partners may also receive your data, such as suppliers, manufacturers or subcontractors that we engage, solely to enable them to deliver the ordered merchandise directly to you or to take on part of the design or production thereof.The processors who assist us in operating our business, such as:
In the IT field: for the purpose of efficient digital data management within our company, including the digital preservation of your data, sending transactional emails to customers such as scheduling meetings and fulfilling orders, and invoicing for merchandise delivered and services provided; managing our calendar, and hosting and managing our website and mailboxes.
Other processors in connection with the delivery of our merchandise and the provision of our services such as subcontractors.
|Necessity for the conclusion or performance of a contract, if you are our customer, business partner or prospective employee.
Legitimate interest if no (direct) contract between us applies or is contemplated, e.g. if you are merely our contact at our customer or business partner.
Your consent where relevant, e.g. when subscribing to the newsletter.
|Governmental bodies, judicial authorities and practitioners of regulated professions such as accountants and lawyers, for the purpose of fulfilling our legal obligations as a company, and the efficient defense of our interests in the context of any legal dispute, for the data strictly necessary for this purpose.||Legal obligation if the transfer is in line with a legal obligation or government order.
Legitimate interest for any other transfer
We will not retain your data longer than necessary for the purpose for which the data was collected and is processed, as specified above.
With respect to our customers, this primarily concerns the offering and delivery of our merchandise and the provision of our related services (whether or not after delivery). With respect to our business partners, this concerns managing our cooperation.
In this regard, we will keep your data after your last order or after the termination of the cooperation for a reasonable period of time in order to safeguard our evidence in case of a dispute, or in response to potential defects related to the merchandise in light of our liability for defective delivery, non-delivery or late delivery.
For your data that may appear in our accounting records from you, as our customer or business partner, to a limited extent, they are kept for 7 years within the framework of our legal obligations in this regard.
With regard to the data we hold on you as a candidate employee, we undertake to delete your data within a reasonable period of time if it does not initially lead to a cooperation proposal. However, if in this case you give your specific consent for us to keep your data so that we can contact you again later, we will keep your data for a maximum of 2 years.
For the digital preservation of your data, we mainly rely on external specialized service providers who store it in the cloud. However, our websites are hosted in-house through our servers located in Belgium.
We outsource much of our processing in the context of our business as a company to third parties, as clarified under Title 5. Any external service providers act as data processors on our behalf, where appropriate.
We and our processors have taken the necessary physical and appropriate technical and organizational (precautionary) measures to secure your data against loss or any form of unlawful processing. We only grant access to the data to our own employees and third parties if they need access for legitimate, relevant business purposes.
Your data is hereby stored as much as possible within the European Economic Area. Our own servers and those of our cloud service providers are therefore located in Belgium. However, it is possible that your data may be processed outside the EEA in connection with the use of specific functions on our website. This will only be done to countries where the European Commission has confirmed that they guarantee an adequate level of protection for your data, or where other measures have been taken to ensure the lawful processing of your data in these third countries
We mainly obtain your data directly from you, as a result of the contact we have with each other with a view to the (possible) delivery of our merchandise or the provision of our services, or with a view to a (possible) cooperation. However, we cannot rule out obtaining certain of your data indirectly in specific circumstances, from public sources or from third parties.
When we obtain your data from public sources, this involves, for example, consulting the Crossroads Bank of Enterprises (CBE), in order to verify your order or proposal for cooperation on behalf of a company. It is also possible that we obtain your data through your company, if the company in which you work is our customer or business partner and we need your data in this context (e.g. for the purpose of discussing potential merchandise designs with you as marketing manager, or for the purpose of submitting the terms of our cooperation to you as legal manager, or for invoicing purposes if you take care of the accounting at the customer or business partner).
In addition, we may receive your data from our customers because they wish to deliver merchandise to you as their employee, customer or business partner. As explained above under Section 2, in this case we are merely acting as a processor of your data and you should contact our customer who commissioned the production of this merchandise and the delivery thereof to your address for further clarification. Should we nevertheless receive questions or requests from you in this regard, we will pass them on to the relevant customer.
For prospective employees, we may consult your profile on professional social media channels or receive your data from an interim or recruitment company when you apply to us in this way.
You have several rights concerning the data we process about you. If you wish to exercise any of the rights set out below, please contact us using the contact details provided in the first heading of this Privacy Statement.
Right of access and Copy
You have the right to access your data and to obtain a copy thereof. This right also includes the possibility of requesting further information on the processing of your data, including on the categories of data processed about you and for what purposes.
Right to rectification
You have the right to have your data amended if you believe we have incorrect data.
Right to erasure (right to be forgotten)
You have the right to request that we delete your data without unreasonable delay. However, we will not always be able to comply with such a request, including when we still need the data in function of a current contract, or when the retention of certain data for a certain period is required by law.
Right to restriction of processing
You have the right to restrict the processing of your data. In this way, the processing is temporarily stopped until, for example, there is certainty about its accuracy.
Right to withdraw your consent
Where processing is based on your consent (see above under titles 5 and 6), you have the right to withdraw this consent at any time by contacting us. For marketing messages, you receive from us via email based on your consent, you can easily withdraw this consent by clicking 'Unsubscribe' at the bottom of each such message.
Right to object
You have the right to object to the processing of your data based on our legitimate interests. This should be based on reasons specific to your situation. In this case, we must stop processing unless we provide compelling legitimate grounds to continue processing.
However, you can always object to the use of your data for direct marketing purposes, after which we are obliged to stop the processing for these purposes.
Right to data portability
You have the right to obtain your data, which you have provided to us yourself, in electronic form. In this way, they can be easily transferred to another organization. You also have the right to request us to transfer your data directly to another organization, if this is technically possible.
Right to complain to your supervisory authority
If you should believe that we are improperly processing your data, you always have the right to lodge a complaint with your data protection supervisory authority. You can do this with the supervisory authority of the EEA member state where you usually reside, where you have your place of work or where the alleged infringement has taken place. Since we conduct our business primarily from Belgium, please refer below to the contact details of the Belgian Data Protection Authority.
Belgian Data Protection Authority (GBA)
+32 (0)2 274 48 00
Website GBA - filing a complaint
For further information and the contact details of the supervisory authority of each EEA member state, please refer to this website page of the European Data Protection Board with all relevant contact details. In addition, you may always apply to the competent civil court to make a claim for compensation.
11. How can you exercise your rights?
You can exercise the rights set forth in Section 10 simply by contacting us using the contact information set forth in the first heading of this Privacy Statement.
When you make a request to exercise your rights, if we have any doubts about your identity, we will ask you to verify it. In this case, we will request the transmission of documents that enable your identification beyond a reasonable doubt, such as a copy of the front of your identity card. We do this to prevent your data from falling into the wrong hands. It is sufficient for such a copy to show your name and date of birth clearly. You may then also delete the other data.
The exercise of your rights is in principle free of charge. However, where your request is manifestly unfounded or excessive, we may charge you a reasonable fee in light of the administrative costs incurred by us. In the same case, however, we may choose not to act on your request. You will be informed of the reasons if we do so.
In any event, we will always inform you of the action taken on your request at the latest within 1 month of receipt. In the case of complex or frequent requests, this period may be extended to 3 months. In the latter case, you will be informed of the extension of the response period.
We reserve the right to change this Privacy Statement. The most recent version is available on our website at all times. The date on which this Privacy Statement was last amended can be found at the top of this page. In the event of a substantial change in the Privacy Statement, we will inform the data subjects on whom this may have an impact, directly if possible.