Privacy Policy – Oncue agency

ONCUE PRIVACY POLICY

Below you will find the privacy policy of Olla bv, with registered office at Dendermondsesteenweg 213, 2870 Puurs-Sint-Amands, VAT BE 0465.763.316 (hereinafter “Oncue Agency”), agency@oncue.be, +32 491 74 76 37, +32 483 02 02 32.

This privacy policy explains how Oncue Agency handles, collects, shares, protects and uses your personal data in the context of your use of the website oncue.be (hereinafter the “Website”) and the services that Oncue Agency offers. It should be read together with our Cookie Policy [https://oncue.be/cookie-policy/], which explains how Oncue Agency uses cookies and similar technologies on the Website.

Each reference to the GDPR in this privacy policy is a reference to the General Data Protection Regulation EU/2016/679 of 27 April 2016.

Oncue Agency may change this privacy policy from time to time. We encourage you to review this privacy policy from time to time to stay up to date about how we handle and protect your personal data.

This privacy policy was last modified on: 15/01/2026

1. When does this privacy policy apply?

This Privacy Policy applies when Oncue Agency acts as a data controller, meaning that Oncue Agency determines the purposes and means of the processing.

This includes the situations where you:

- visit or navigate the Website;

- request information regarding our services or submit enquiries;

- subscribe to our newsletter;

- receive an invitation to a webinar or event;

- consent to cookies and tracking technologies on our Website;

- communicate with us via email, telephone or social media;

- apply for a career within Oncue Agency.

This privacy policy does not apply to third-party websites linked from our website or when Oncue Agency acts as a processer, meaning that Oncue Agency does not determine the purposes and means of the processing.

2. Contact

For any questions, comments or complaints regarding this privacy policy, the processing of your personal data by Oncue Agency, or if you wish to exercise your rights mentioned in section 6, please contact Oncue Agency via email: agency@oncue.be.

To prevent abuse, Oncue Agency asks you to (1) convincingly identify yourself, and (2) provide a motivation for exercising your rights. When Oncue Agency wants to be certain of your identity or the validity of your request, Oncue Agency may ask for additional information. Oncue Agency reserves the right not to comply with a request if there is a valid reason for doing so. This includes, for example, requests that are manifestly unfounded or excessive, or requests where you do not sufficiently identify yourself as the data subject.

We will respond to your request without undue delay and in any event within one month of receipt. That period may be extended by two further months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receipt of the request, together with the reasons for the delay.

If you believe that Oncue Agency has not adequately addressed your complaint or has unjustifiably refused a request, you may file a complaint by email or post with the Data Protection Authority:

Data Protection Authority (Gegevensbeschermingsautoriteit)
Drukpersstraat 35
1000 Brussels
contact@apd-gba.be
www.gegevensbeschermingsautoriteit.be
Tel: +32 2 427 48 00

3. Processing activities and purposes

Oncue Agency processes personal data for the following purposes and on the following legal bases foreseen in the GDPR. Each subsection below provides a table which includes an explanation of the processing activity, the personal data processed, the legal basis relied upon and the retention period.

1. Services

Processing activity	Personal data	Legal basis	Retention
Providing marketing services Delivering contracted marketing services including strategy development, content creation, campaign management, social media management, branding, and advertising services	Name, company name, VAT number, contact details (email, phone, address), project details.	Performance of contract (Article 6(1)(b) GDPR)	Duration of contract + Up until 7 years
Invoicing and financial administration Processing invoices, payments, and maintaining financial records for tax and accounting compliance	Name, company name, VAT number, billing address, bank account details (IBAN), invoices.	Performance of contract (Article 6(1)(b) GDPR) Legal obligation (Article 6(1)(c) GDPR)	Duration of contract + Up until 7 years
Enquiries and quote requests Responding to service enquiries, preparing proposals and quotes, initial consultation	Name, company name, VAT number, contact details (email, phone, address), message content.	Consent (Article 6(1)(a) GDPR) Legitimate interest (Article 6(1)(f) GDPR)	Up to 24 months

1. Communication

Processing and purpose	Personal data	Legal basis	Retention
Newsletter subscription Sending our own marketing newsletters with industry insights, tips, company news, and service updates to subscribers	Name, address, email address, consent status.	Consent (Article 6(1)(a) GDPR)	Until withdrawal of consent
Marketing to existing clients Sending relevant marketing about similar services to existing or recent clients	Name, address, email address, business relationship.	Legitimate interest (Article 6(1)(f) GDPR)	Until objection
Event invitations and webinars Inviting contacts to industry events, workshops, webinars, and networking opportunities hosted or attended by Oncue Agency	Name, email address, company name, job title.	Consent (Article 6(1)(a) GDPR) for new contacts Legitimate interest (Article 6(1)(f) GDPR) for existing clients	Until withdrawal of consent
Media requests Press enquiries and media requests sent via the Website, social media or other platforms.	Name, email address, company name, message content.	Consent (Article 6(1)(a) GDPR) Legitimate interest (Article 6(1)(f) GDPR)	Up to 24 months

1. Job application processing

Processing and purpose	Personal data	Legal basis	Retention
Recruitment and job applications Processing applications, conducting interviews, assessing candidates.	Name, photo, date of birth, resume, cover letter, work experience and contact details.	Consent (Article 6(1)(a) GDPR) Pre-contractual performances (Article 6(1)(b) GDPR)	Up until 24 months

1. Website security

Processing and purpose	Personal data	Legal basis	Retention
Security monitoring and threat detection Monitoring for security threats, detecting suspicious activity, preventing unauthorized access and cyber-attacks.	IP addresses, access logs, user agent, request, login attempts, threat indicators.	Legal obligation (Article 6(1)(c) GDPR)	Up until 180 days

1. Cookies

Processing and purpose	Personal data	Legal basis	Retention
Essential cookies Enabling basic website functionality, maintaining sessions, remembering cookie consent choices, security features	Session IDs, cookie consent preferences, authentication tokens (if logged in), security tokens	Legitimate interest (Article 6(1)(f) GDPR)	Session-based or up to 12 months depending on the type of cookie
Functional cookies Enhancing user experience by remembering preferences and settings	Session IDs, cookie consent preferences, technical browser	Consent (Article 6(1)(a) GDPR)	Session-based or up to 12 months depending on the type of cookie
Analytics cookies Understanding website usage, visitor behaviour, and performance to optimize user experience	IP address (anonymized), device data and browser data	Consent (Article 6(1)(a) GDPR)	Session-based or up to 12 months depending on the type of cookie
Tracing cookies Delivering targeted advertising, measuring campaign effectiveness, retargeting, building audience profiles	Cookie ID’s, browsing behaviour, advertising ID’s	Consent (Article 6(1)(a) GDPR)	Session-based or up to 12 months depending on the type of cookie

For more information regarding cookies, please visit our Cookie Policy (https://oncue.be/cookie-policy/).

4. Who receives your personal data?

Oncue Agency may share your personal data with third parties. Any disclosure is made only when necessary to deliver our services, comply with legal obligations or to improve your experience of the Website. Oncue Agency never sells your personal data.

In certain circumstances, Oncue Agency may be required to disclose personal data to public authorities, financial institutions, regulators, courts or external legal or accounting advisers when this is necessary to comply with a legal obligation or to defend legitimate interests.

5. International data transfers

Oncue Agency does not store, process, transfer, personal data to entities in countries outside of the European Economic Agency (EEA).

6. Your rights and how to exercise them

You have various rights regarding the processing of personal data by Oncue Agency. However, please note that certain conditions, limitations and procedures may be attached to the exercise of each right.

Right of access and copy	You have the right to ask Oncue Agency for a copy of the personal data that Oncue Agency processes about you.
Right to rectification	You have the right to obtain the rectification of inaccurate personal data concerning you. You also have the right to have incomplete personal data completed.
Right to erasure	You have the right to ask Oncue Agency to delete personal data about you when: 1. The personal data is no longer necessary for the purposes for which it was collected; 2. You withdraw the consent on which the processing is based, and there is no other legal ground; 3. Your personal data has been processed unlawfully; 4. Deletion is necessary to comply with EU or Belgian law. Exceptions: You do not have the right to erasure when processing is necessary for: 1. Exercising the right to freedom of expression and information; 2. Reasons of public interest in public health; 3. Archiving purposes in the public interest or statistical purposes; 4. Compliance with a legal obligation; 5. Establishing, exercising or defending legal claims.
Right to restriction of processing	You have the right to restrict the processing of personal data when you believe that the data is not accurate, or when you exercise your right to object. Oncue Agency may then only process your personal data for establishing, exercising or defending legal rights, protecting the rights of another person, or with your consent.
Right to data portability	You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us.
Right to object	You have the right to object to the processing by Oncue Agency based on our legitimate interests, including profiling linked to such interests. We will then no longer process the data unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing is required for legal claims.
Right to object to direct marketing	You have the right to object at any time the processing of your personal data for direct marketing.
Right to withdraw consent	Where Oncue processes your data based on your consent, you have the right to withdraw that consent at any time. The withdrawal of consent does not affect the lawfullness of processing based on consent before its withdrawal

7. Security measures

Oncue Agency implements several technical and organizational security measures designed to protect your personal data. These technical and organization security measures include:

- encryption: data is encrypted both in transit using SSL/TLS protocols and at rest using industry standard encryption algorithms;

- access controls: Oncue Agency limits access to personal data on a need-to-know basis;

- authentication: multi-factor authentication requirements for systems containing personal data;

- physical security: resitricted access to facilities where data is stored;

antivirus and malware protection: up-to-date antivirus software and anti-malware solutions to detect and prevent malicious software.