Privacy policy

This Policy informs you of the manner in which CERHUM treats your personal data collected in connection with the provision of its website (https://www.cerhum.com/).

This privacy policy can be summarised as follows:

CERHUM mainly processes your data for the preparation of quotations relating to our products (manufacture of bone implants), for the management of customer files, the management of supplier or prospect files, to carry out our commercial development (in particular through trade fairs and commercial events), to confirm an order, an appointment or other transactions with you, for staff recruitment, to improve the performance of its services (audience for our site, satisfaction surveys, etc.), for the storage of photographs relating to you, processed mainly as part of our internal and external communications (for example in the case of testimonials published on our site) as well as the implementation of technical and organisational measures for the protection of your personal data..), for the storage of photographs of you, processed mainly in the context of our internal and external communications (for example in the case of testimonials published on our site) as well as the implementation of technical and organisational measures for the security of your data ;
Your personal data is normally held within the European Economic Area (EEA). Where we work with third parties outside the EEA, we have provided the necessary safeguards to ensure that your data is properly secured and that you can exercise your rights ;
CERHUM complies with the General Data Protection Regulation (known as GDPR). The chapters below describe in detail why CERHUM uses your data, for how long, to whom we pass it on and what security measures are in place.

If you have any questions about this policy, please contact us using the form below :

1. The data controller

The party responsible for processing personal data is CERHUM SA, whose registered office is at Rue des Pôles 1, 4000 Liège and which is registered with the Banque-Carrefour des Entreprises under number BE 0640.975.802.

2. The Data Protection Officer (DPO)

CERHUM has appointed a Data Protection Officer, who ensures compliance with the RGPD, provides advice and is the point of contact for the Data Protection Authority.
If you have any questions about the processing of your personal data, please contact our Data Protection Officer using the form below :

3. Types of data processed

Within the framework of its website and its processing operations, CERHUM collects the following personal data (i.e. information concerning an identified or identifiable natural person :

Identification data, such as your surname, first name, date of birth, place of birth, gender, age, etc.
Contact details (address, telephone, mobile phone, etc.)
Personal characteristics
Your professional activity
Financial data
Images (photos, videos)
Data on complaints, questions and comments
Health data (Dicom image for the manufacture of our customers' implants)
Electronic identification data (IP addresses, cookies, etc.)

4. On what basis do we process your data?

CERHUM collects and uses your data for :

Specific, explicit, legitimate purposes, and will not use the data for other purposes that are not compatible with the initial purposes
The performance of a contract you have concluded with it, or for the performance of pre-contractual measures taken at your request.
Compliance with a legal obligation imposed on it.
For legitimate interests. In this case, we will check that your interests, freedoms and fundamental rights do not prevail over CERHUM's interests.
CERHUM may use your data where you have given your consent. Where we process your data on the basis of your consent, you have the right to withdraw that consent at any time.

5. For what purpose

We process your data in accordance with the applicable legislation, in an appropriate manner and limited to what is necessary for the intended purposes.

The objectives are as follows:

5.1. Commercial management and management of existing customers

Developing and maintaining CERHUM's commercial relations with its customers and suppliers. Preparing quotations. Prospecting for new customers.
Legal basis: performance of pre-contractual measures. Data retention period: for the duration of the (pre)contractual relationship.

5.2. IT security and management

CERHUM processes data and must therefore ensure that it is properly secured. This includes, for example, monitoring information systems, creating communication traces, access logs, access management, backup management and archiving.

Legal basis:

CERHUM's legal obligation to protect data and ensure adequate security of personal data;
CERHUM's legitimate interests in protecting all data.

Data retention period:

Communication and access logs are kept for 12 months.
Backup data follows a 6-month rotation cycle.
Logical access: until the end of the contractual relationship.

5.3. Financial and accounting management

Your data is used for billing purposes, accounting and financial management.
Legal basis for processing: performance of a service contract.
Data retention period: between 7 and 10 years, depending on our legal obligations.

5.4. Recruitment management

CERHUM processes your application data in order to meet its recruitment needs. Legal basis for this processing: performance of pre-contractual measures. Data retention period: 1 year, except in the event of litigation.

5.5. Dispute management

CERHUM may in some cases have to deal with disputes.

Legal basis: CERHUM's legitimate interests in managing disputes.
Data retention period: for the duration of the dispute.

5.6. Statistics, analyses and satisfaction surveys

CERHUM analyses its performance, finances and internal processes in order to improve the quality and efficiency of its services. CERHUM also carries out customer satisfaction surveys.

Legal basis :

For satisfaction surveys: consent
For internal analysis, performance and statistics: legitimate interest

The data analysed is anonymised prior to analysis or, if anonymisation is not possible, the data is pseudonymised.

Data retention period:

Data is kept for the duration of the analysis if it is no longer required. The results are kept for 10 years.
Data from satisfaction surveys is kept for 3 years.

5.7. Managing requests for information

CERHUM handles your various requests for information concerning: prospects, collaborations with future partners, ....

Legal basis: (pre-)contractual performance.

Data retention period: Questions and answers are kept on our system for 5 years for follow-up purposes.

5.8. Managing customer Dicom files

On its website, CERHUM provides an interface for sending DICOM files for implants.

Legal basis: contractual performance.
Data retention period: 5 years.

5.9. Social media

CERHUM uses social media (LinkedIn) to transmit information. The terms and conditions of the providers of these social networks apply. CERHUM will not publish photos or videos of you on social networks if you have not given your consent.

CERHUM also uses social networks to contact you for customer prospecting and recruitment campaigns.

Legal basis: consent for contact via social networks.

Data retention period: where applicable and as communicated to you with consent.

5.10. Use of cookies on our website

CERHUM uses cookies. You can find more information in the cookies policy.

6. Who will receive your data?

Depending on the processing, we may share your data with :

The customer support team ;
The business team ;
CERHUM management ;
External consultants working on behalf of CERHUM ;
Suppliers of IT systems and applications ;
Web analysis tools. You can find more information on this subject in our cookies policy.

With your consent, we share data with :

Social media platforms;
Third parties for whom you have given your explicit consent to share your personal data with them (e.g. newsletters, brochures, satisfaction surveys).

Occasionally, we may need to pass on your personal data. This is the case when a law, regulation or legal procedure (such as a court ruling) requires us to do so, for example:

Law enforcement authorities in the event of a finding or suspicion that an offence has been committed against you in accordance with or as required by applicable law;
The courts and tribunals of the judicial order in the event of a dispute concerning you;
Government bodies authorised to access and/or obtain your personal data in accordance with applicable law;
Our legal advisers and/or lawyers, for example in connection with corporate reorganisations and litigation. In the event of a corporate reorganisation (e.g. mergers or acquisitions) or financing, we may transfer some of your personal data (in a format that prevents such data from being linked to you) to a third party involved in the transaction (e.g. a buyer or investor) in accordance with applicable data protection law.

7. Transfers outside the European Economic Area

In general, we try as far as possible to store data within the European Economic Area (as is the case with our website), but some data may be transferred to servers outside the European Economic Area on our behalf and at our direction. By providing your personal data to CERHUM, including by using its website, you consent to the transfer of such data abroad. Where your data is transferred to a country outside the European Economic Area ("EEA") and the level of data protection in that country is not considered adequate by the European Commission, we will provide the necessary safeguards to protect your data (we use the European Commission's standard contractual clauses) together with security measures to ensure that your data is adequately protected.

8. Your rights

We undertake to reply within one month of receiving your request.
If you have a large or multiple application, this one-month period may be extended by a further two months.

To exercise your rights, you must contact our service using the form below :

8.1. Right to information

You have the right to receive clear, transparent and comprehensible information on how we use your personal data and on how to exercise your rights. This is why we provide you with the most comprehensive information in this policy.

8.2. Right of access to your data

You have a right of access to the personal data we hold about you.

8.3. Right to rectify, limit and delete your data

You have the right to ask for your data to be corrected if it is incorrect.

You have the right to request the restriction of the processing of your data. This means asking us to stop processing your data, but not to delete it.

In certain cases, you have the right to request the deletion of your data, except where we are subject to legal obligations.

8.4. Right to portability of your data

You have the right to receive the personal data you have provided to CERHUM (processed by automated means), in a readable format where it is based on consent.

8.5. Right to object to the use of your data for other purposes

You have the right to object at any time, on grounds relating to your particular situation, to the use of your data where we are using it for our legitimate interests. We will then stop processing your data, unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms or where the data is necessary for the establishment, exercise or defence of legal claims.

8.6. Right to lodge a complaint with a supervisory authority

If you consider that the provisions of this policy are not being respected or if you have any other reason to complain about issues relating to the protection of your personal data, you may contact the Data Protection Authority by regular mail (Rue de la Presse 35, 1000 Brussels) or using the form below (note : the message will be sent directly to the DPA and not to Cerhum).

9. Securing your data

In particular, your personal data is protected:

Through organisational measures;
Logical access controls to our Information System;
Thanks to backup systems;
Thanks to the management and monitoring of computer traces;
Thanks to encryption mechanisms;
Thanks to a certified data centre;
Through strict contractual clauses with our subcontractors.

10. Modification of this declaration

This policy may be updated by CERHUM in order to better inform you about the processing of your personal data.

You can always find the latest version on the CERHUM website.

Effective date: 16 June 2025
Update date: 16 June 2025