Privacy and cookie policy
Privacy and Cookie Statement
Version 1.0 – valid as of 18/08/2026
This privacy and cookie statement aims to explain transparently how Storm Management NV and Storm CV process personal data collected through the website www.storm.be. Storm ensures that such processing is always carried out in accordance with the General Data Protection Regulation (GDPR) and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data. Where this statement refers to “Storm”, this means the entity acting as the data controller in the specific case concerned.
The website is managed by Storm Management NV, with its registered office at Borsbeeksebrug 22, 2600 Antwerp. For processing activities relating to cooperative members, Storm CV, with its registered office at the same address in Antwerp, acts as the data controller, while Storm Management NV acts as the data processor in this context. In accordance with Article 37 of the GDPR, Storm has appointed a Data Protection Officer, who can be contacted independently at dpo@storm.be.
Storm processes personal data that you actively provide, for example when you contact us or use forms on the website, as well as personal data that is automatically collected during your visit. This includes identification and contact details, data relating to your communications, and technical information such as your IP address, browser and device data, timestamps, and data relating to your use of the website. Storm does not process special categories of personal data unless you voluntarily provide such data and the processing is necessary for a specific and legitimate purpose.
Personal data is processed exclusively for specified, explicit and legitimate purposes. These purposes include the technical operation and security of the website, handling questions and requests, improving our services, fulfilling contractual or pre-contractual obligations, complying with legal obligations, and preventing or detecting fraud, misuse and security incidents. An appropriate legal basis is used for each of these processing activities. Processing necessary for the operation and security of the website is based on Storm’s legitimate interests. Processing in the context of communications or service provision is based on the performance of a contract or on pre-contractual measures. Prior consent is requested for marketing and analytics purposes. Where Storm relies on a legitimate interest, a balancing test is always carried out to determine whether the interests or fundamental rights and freedoms of the individuals concerned override Storm’s interests. Where processing is based on consent, this consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before the withdrawal.
Storm does not retain personal data for longer than is necessary for the purposes for which it is processed. Contact and communication data is generally retained for a maximum of two years after the last contact. Marketing-related data is retained until consent is withdrawn. Technical and analytical data is retained for a maximum of 26 months. Contractual and administrative data is retained for the period prescribed by law.
In carrying out its activities, Storm may transfer personal data to carefully selected service providers acting as data processors, including IT, hosting, cloud and security service providers. These parties process personal data exclusively on Storm’s instructions and on the basis of written data processing agreements that comply with the requirements of the GDPR. Personal data may also be shared with other entities within the Storm group or with competent public authorities where required by law. Storm does not sell personal data or make it available to third parties for their own purposes. Where personal data is transferred to countries outside the European Economic Area, Storm ensures that such transfers take place in accordance with the GDPR and that appropriate safeguards, such as standard contractual clauses, are applied.
The website uses cookies and similar technologies that store information on or access information from the user’s device. Essential cookies are necessary for the technical operation of the website and do not require consent. Analytics and marketing cookies are only placed after you have given your free, specific, informed and unambiguous consent. Your consent is managed through the cookie tool that appears when you first visit the website and can be changed or withdrawn at any time. An up-to-date overview of all cookies used, including their category, purpose and retention period, is always available through this cookie tool and forms an integral part of this statement. Where cookies result in the processing of personal data, such processing is carried out exclusively for the purposes for which consent has been given or for which the cookies are strictly necessary.
Storm does not use automated decision-making or profiling within the meaning of Article 22 of the GDPR that produces legal effects concerning individuals or similarly significantly affects them.
Data subjects have all the rights granted to them under the GDPR, including the right of access, rectification, erasure, restriction of processing, objection and, where applicable, data portability. These rights can be exercised by contacting privacy@storm.be or the Data Protection Officer. Storm handles such requests within the statutory period of one month. If you believe that your personal data is being processed unlawfully, you may lodge a complaint with the Belgian Data Protection Authority, located at Rue de la Presse 35, 1000 Brussels (www.dataprotectionauthority.be).
This privacy and cookie statement may be amended to take account of developments in legislation, case law or internal processing activities. The most recent version is always available on the website and replaces all previous versions. For further questions about this statement or the processing of personal data, please contact privacy@storm.be.
