- PRIVACY POLICY -

Purpose. This Policy is prepared by Theissen Arno, having its registered office at Hédomont Route de la Gotale 9, B 4960 Malmedy, registered under registration number: BE0598971931 Theissen Arno “the Controller”. The purpose of this policy is to inform visitors to the website hosted at the following address: www.hh-concept.com "Website" about how data is collected and processed by the controller. This policy is in line with the Data Controller's desire to act in full transparency and in accordance with its national regulations and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to processing personal data and the free movement of data and to repeal Directive 95/46/EC (hereinafter referred to as "General Data Protection Regulation"). The person responsible pays particular attention to the protection of the privacy of its users and therefore undertakes to take the necessary reasonable precautions to protect the personal data collected against loss, theft, disclosure or misuse. Unauthorized Use. "Personal data" means all personal data of the user, i.e. all information that makes it possible to directly or indirectly identify him as a natural person. If the user wishes to respond to any of the practices described below, they may contact the data controller at the postal address or email address provided in the “Contact Information” section of this Policy. What data do we collect?Purpose.The Data Controller collects and processes, according to the methods and principles described below, the following personal data: • its domain (automatically recognized by the Data Controller's server), including the dynamic IP address; • His e-mail address if the user has previously disclosed it, for example by sending messages or questions on the site, by communicating with the data controller by e-mail, by participating in discussion forums, by accessing the restricted part of the website subject to identification, etc.; • all information about the pages that the user has visited on the website; • Any information that the user provides voluntarily, for example as part of information surveys and/or registrations on the site or when accessing the protected part of the site by means of identification. In addition, we collect the following data: It is possible that the person responsible also collects non-personal data. This data is considered non-personal data as it does not directly or indirectly identify a specific individual. They can therefore be used for any purpose, for example to improve the website, the products and services offered or the advertising of the person responsible. If non-personal data is linked to personal data so that the person concerned can be identified, this data will be treated as personal data until it can no longer be assigned to a specific person. Collection methods The person responsible collects personal data as follows: Purposes of processing Personal data is only collected and processed for the purposes stated below:

• To ensure the management and control of the performance of the services offered; • Sending and tracking orders and billing; • sending promotional information about the Controller's products and services; • sending promotional material; • Respond to user requests; • create statistics; • improve the quality of the Website and the products and/or services offered by the Data Controller; • Submit information about new products and/or services from the Data Controller; • with regard to commercial prospecting activities; • Enable better identification of user interests. We also collect and process personal data for the following purposes: The controller may be asked to carry out processing that is not yet provided for in this policy. In this case, he will contact the user before the further use of his personal data in order to inform him of the changes and, if necessary, to give him the opportunity to refuse this further use. Legitimate Interests Some of the processing operations carried out by the Data Controller have the legal basis of the latter's legitimate interests. These legitimate interests are proportionate to respect for the rights and freedoms of the user. If the user would like to be informed about the details of the purposes on the basis of the legal basis of legitimate interests, he is recommended to contact the person responsible for processing (see point "Contact data"). Retention period In general, the Controller will only store personal data for as long as is reasonable for the purposes pursued and in accordance with legal and regulatory requirements. The personal data of a customer is kept for a maximum of 10 years after the end of the contractual relationship between this customer and the person responsible. After the retention period has expired, the controller will make every effort to ensure that the personal data is no longer available and inaccessible. Assertion of rights For all of the rights listed below, the person responsible reserves the right to verify the identity of the user in order to assert the rights listed below. This request for additional information will be made within one month of the user submitting the request. data access The user can receive the written communication or a copy of the personal data concerning him free of charge. For additional copies requested by the User, the Controller may require payment of a reasonable fee based on administrative costs. If the user submits this request electronically, the information will be provided in a commonly used electronic form, unless the user requests otherwise. Unless the general data protection regulations state otherwise, the user will be provided with a copy of their data no later than one month after receipt of the request. Right to rectification The user may, as soon as possible and at the latest within one month, request the rectification of their personal data that would be inaccurate, incomplete or irrelevant, free of charge, as well as their completion if they are incomplete. Unless otherwise provided by the General Data Protection Regulations, the request to exercise the right to rectification will be processed within one month of its introduction. Right to object to the processing The user can object to the processing of his personal data at any time for reasons arising from his particular situation, free of charge, if: the processing is necessary to fulfill a task of public interest or in connection with the exercise of public authority delegated to the controller; The processing is necessary to safeguard the legitimate interests of the person responsible or a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data prevail (especially if the data subject is a child ). ). The person responsible may refuse to exercise the user's right to object if he demonstrates the existence of compelling and legitimate reasons for justifying the processing that take precedence over the interests or rights and freedoms of the user, or if he recognizes, exercises or defends a serves legal claim. In the event of a dispute, the User may lodge an appeal in accordance with the “Complaints and Complaints” section of this Policy. The user can also object at any time, without giving reasons and free of charge, to the processing of personal data concerning him if his data is collected for the purposes of commercial customer acquisition (including profiling). When processing personal data for scientific or historical research purposes or for statistical purposes within the meaning of the General Data Protection Regulation, the user has the right to object to the processing of personal data concerning him for reasons arising from his particular situation. unless the processing is necessary for the performance of a task in the public interest.

Unless the general data protection regulations provide otherwise, if the person responsible intends not to comply with such a request, the person responsible is obliged to respond to the user's request as soon as possible, but at the latest within one month, and to justify its response. Right to restriction of processing: The user may request the restriction of the processing of their personal data in the cases listed under c1:

0, when the user disputes the accuracy of the data, and only for the time that the data controller can control ;

0 if the processing is unlawful and the user wishes to limit the processing instead of erasing it;

0 when it is no longer necessary for the pursuit of the purposes of the processing, but the user needs it for the recognition, exercise or defense of his rights in court;

0 for the time required to examine the merits of an objection request submitted by the user, i.e. The person responsible will inform the user about the lifting of the restriction of processing. Right to erasure (right to be forgotten) The user can request the erasure of personal data concerning him if one of the following reasons applies: the data are no longer necessary for the purposes of processing;

0 The user has revoked his consent to the processing of his data and there is no other legal basis for the processing.

0 the user objects to the processing and there is no overriding legitimate ground for the processing and/or the user exercises their specific right to object in relation to direct marketing {including profiling};

0 the personal data have been processed unlawfully;

0 Die Löschung der personenbezogenen Daten ist zur Erfüllung einer rechtlichen Verpflichtung {des Unionsrechts oder des Rechts eines Mitgliedstaats} erforderlich, der der Verantwortliche unterliegt;

0 The personal data was collected in connection with the provision of information society services to children. However, the deletion of the data is not applicable in the following cases:

0 when the processing is necessary for the exercise of the right to freedom of expression and information; 0 if processing is necessary to fulfill a legal obligation that requires processing under Union law or the law of the Member State to which the person responsible is subject, or to perform a task that is in the public interest or is associated with the exercise of the delegated authority to those responsible; 0 when the processing is necessary for reasons of public interest in the field of public health; 0 if the processing is necessary for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes and the right to erasure is likely to make it impossible or seriously impair the realization of the purposes of the processing 0 if the processing is for the assertion, exercise or defense of legal claims is required. Unless the general data protection regulations provide otherwise, if the person responsible intends not to comply with such a request, the person responsible is obliged to respond to the user's request as soon as possible, but at the latest within one month, and to justify its response. Right to "data portability" The user can request at any time that he receives his personal data free of charge in a structured, common and machine-readable format, in particular with regard to transmission to another person responsible, if:

0 the data is processed using automated procedures; and if

0, the processing is based on the user's consent or on a contract between the user and the controller. Under the same conditions and using the same methods, the user has the right to request the data controller to transfer the personal data concerning him/her directly to another personal data controller, if this is technically possible.

The right to data portability does not apply to processing that is necessary for the performance of a task that is in the public interest or in the exercise of official authority that has been assigned to the person responsible.  Recipients of the data and disclosure to third parties Recipients of the collected and processed data are, in addition to the person responsible himself, his employees or other subcontractors, his carefully selected business partners who are based in the European Union and work with the data controller in the context of marketing products or  the provision of services.  In the event that data is communicated to third parties for the purpose of direct marketing or commercial acquisition, the user will be informed in advance so that he can authorize the communication of his data to third parties.  As soon as this transfer is based on the user's consent, they can revoke their consent for this specific purpose at any time.  The data controller will comply with applicable legal and regulatory requirements and in any case will ensure that its partners, employees, subcontractors or other third parties who have access to such personal data comply with this policy.  The person responsible will pass on the personal data of the user if a law, a court proceeding or an official order requires such a transfer.  No transfer of personal data!  Data processing outside the European Union is carried out by the person responsible.  Security The person responsible uses appropriate technical and organizational measures to ensure a risk-adjusted level of security of the processing and the data collected in view of the risks associated with the processing and the type of data to be protected.  li takes into account the state of knowledge, the implementation effort and the type, scope, circumstances and purposes of the processing as well as the risks for the rights and freedoms of the users.  The controller always uses encryption technologies that are recognized as industry standards in the 1T area when transmitting or receiving data on the website.  The data controller has implemented appropriate security measures to protect and prevent the loss, misuse or alteration of the information obtained on the website.  Should the personal data that the controller controls become compromised, it will act quickly to determine the cause of this breach and take the appropriate remedial action.  The data controller will inform the user of this incident if legally obliged to do so.  Claim and Complaint If the user responds to any of the provisions of this Policy If you wish to respond to the practices described, you should contact the data controller directly. The user can also lodge a complaint with his national supervisory authority, whose contact details are given on the official website of the European Commission http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080. In addition, the user has the possibility to lodge a complaint with the competent national courts. Contact Information For questions and/or complaints related to this Policy, the User may contact the Data Controller: By email: arno.theissen@gmail.com. By mail: Hédomont Route de la Gotale 9. Modifications The person responsible reserves the right to modify the provisions of this policy at any time. The changes will be published directly on the controller's website. Applicable Law and Competent Jurisdiction This policy is governed by the national law of the head office of the controller. Any dispute relating to the interpretation or execution of this Policy shall be subject to the jurisdiction of that national law. This version of the Policy is dated 08/12/2023.

​