We are On IT collects only the personal data that is strictly necessary.
Most recent update: October 19, 2026
This privacy policy has been drafted in accordance with applicable laws regarding the protection of personal data, including Regulation (EU) 2016/679 (General Data Protection Regulation or GDPR).
This privacy statement applies to the processing of personal data in connection with the use of www.weareonit.com/smb and to the specific processing activities described in this statement.
When a change relates to processing that requires consent, valid consent will be requested again, if necessary. Other changes will be communicated in a manner appropriate to the nature and impact of the change.
At any time, you may request additional information from the data controller regarding the collection or processing of personal data:
On IT
Jan van Gentstraat 7, 302
2000 Antwerp
Belgium
info@weareonit.com
The website www.weareonit.com/smb processes personal data that users provide themselves—for example, when they contact us via the contact form—as well as data that is automatically collected when users visit the website.
Depending on the features and services used, this data may include, among other things, first name, last name, email address, phone number, company name, IP address, cookies, and usage data. The specific categories of data processed for each processing activity are explained in more detail in the relevant sections of this privacy statement.
When certain personal data is necessary to process a request or fulfill a contract, this will be indicated where relevant. Failure to provide this data may result in the request not being processed, or not being processed in full, or in the contract not being fulfilled. Optional information may be omitted without this in itself affecting the processing of the request.
If users are unsure which personal data they are required to provide, they may contact the data controller.
The use of cookies—or other tracking tools—by www.weareonit.com/smb or by the owners of third-party services used by www.weareonit.com/smb is intended to provide the service requested by the user, in addition to the other purposes indicated in this document and in the Cookie Policy, if applicable.
The data controller implements appropriate security measures to prevent unauthorized access to, disclosure, alteration, or destruction of the data without authorization. Data processing is carried out using computers and/or IT tools, in accordance with organizational procedures and practices that are closely aligned with the specified purposes.
Personal data may be accessible to authorized employees and external service providers involved in carrying out the processing activities. When these service providers process personal data on behalf of the data controller, they act as data processors, and the applicable contractual and legal obligations regarding data protection are complied with. Access to personal data is limited to what is necessary for the performance of their duties.
The data controller processes personal data only when there is a valid legal basis for doing so in accordance with Article 6 of the General Data Protection Regulation (GDPR). Depending on the purpose of the processing, this may include, among other things:
If processing is based on consent, the data subject may withdraw that consent at any time. The withdrawal does not affect the lawfulness of the processing that took place prior to the withdrawal.
The applicable legal basis is explained in more detail, where relevant, in the description of the specific processing activity.
To ensure the operation, security, and maintenance of the website, www.weareonit.com/smb and the relevant technical service providers may record system logs and process technical data, such as IP addresses, the times of requests, and information about the browser or operating system used. This data is processed to the extent necessary for the operation and security of the website and is not retained for longer than is necessary for these purposes, taking into account any legal obligations.
Personal data is processed at the locations where the data controller and the relevant service providers carry out their activities. The processing location may vary depending on the service used and the data involved.
When personal data is transferred to countries outside the European Economic Area (EEA), this is done in accordance with the provisions of Chapter V of the GDPR. Depending on the circumstances, this may occur, for example, on the basis of an adequacy decision by the European Commission or appropriate safeguards, such as standard contractual clauses.
Data subjects may request additional information from the data controller regarding any international transfers and the applicable safeguards.
Personal data will not be retained for longer than is necessary for the purposes for which it was collected or further processed, taking into account applicable legal obligations and any need to initiate, exercise, or substantiate legal claims.
Therefore, the following principles apply:
At the end of the applicable retention period, the personal data will be deleted or, if further retention is necessary for a legitimate purpose and anonymization is sufficient, irreversibly anonymized.
The rights of data subjects, including the right of access, rectification, and erasure, are exercised in accordance with the conditions and exceptions set forth in the GDPR.
Personal data is processed to the extent necessary to ensure the proper functioning of the website and the features it offers, to handle questions and requests, to prepare or execute agreements, to comply with legal obligations, to ensure the security of the website, and to prevent misuse or fraudulent activities.
The processors, their locations, specific purposes, and, where applicable, the legal basis and retention period are described in more detail in the table below.
Incidentally, On IT has a complete and detailed register of data processors available upon request.
| name | purpose | personal data processed | legal basis | retention period | Processing Location | Privacy Policy |
|---|---|---|---|---|---|---|
| About IT Online contact form |
Responding to and following up on information requests, requests for quotes, and other requests submitted via the contact form. | first name, last name, email address, company name, and phone number, to the extent that this information is provided | the performance of precontractual measures at the request of the data subject when the request relates to a potential contract, or the legitimate interest in processing and acting on other requests, provided that the applicable conditions are met. | Personal data will be retained for as long as necessary to process and follow up on the request, taking into account any future contractual relationships and applicable legal retention requirements. | Belgium | link |
| ActiveCampaign | managing and sending marketing communications, automating and personalizing communications, and, where applicable, analyzing interactions with these communications. | name, email address, company name, and other information necessary for sending, personalizing, and managing communications. If tracking is used, data regarding the opening of emails, clicking on links, and other interactions with the communications may also be processed. | consent or another applicable legal basis, depending on the type of communication and the circumstances. The applicable Belgian rules governing electronic marketing communications are complied with. | The data will be retained for as long as necessary for the relevant marketing purposes, taking into account the withdrawal of consent, unsubscription, or objection, as well as any legal obligations. | link | |
| WebinarGeek | Organizing, hosting, and following up on webinars; managing registrations; communicating with participants; and analyzing participation and interaction during webinars. | name, email address, company name, job title, and other information provided via the registration form. In addition, technical data, registration data, and data regarding attendance, viewing behavior, and interaction with the webinar may be processed. | consent, the performance of precontractual measures at the request of the data subject, or the legitimate interest in organizing webinars and handling requests from participants, depending on the purpose and circumstances of the processing. Consent is requested, where required, for the separate sending of marketing communications. | The data will be retained for as long as necessary for the organization and follow-up of the webinar and for the purposes for which the data was collected, taking into account any withdrawal of consent, unsubscription, or objection, as well as any legal obligations. | link |
See the cookie policy for more information.
For the purposes of the selection process, only the application data necessary to support the legitimate interest in assessing the candidate’s suitability and, where applicable, to comply with legal obligations will be processed.
After hiring, personal data is processed for the purpose of fulfilling the employment contract and to comply with legal obligations as an employer.
Personal data of candidates who were not selected may include, among other things, identification and contact information, resumes, cover letters, correspondence, interview notes, and assessment results.
This data is retained throughout the selection process and for up to 12 months after the conclusion of the relevant application process, to the extent that this period is necessary and justified for the completion of the selection process and the potential defense against legal claims. Thereafter, the data will be deleted or irreversibly anonymized, unless further retention is required by law or is based on another valid legal ground.
The above information is retained, along with the employment contract, Dimona declaration, payroll and compensation data, performance evaluations, training certificates, absence and leave records, and other documents necessary for personnel administration.
Special categories of personal data are not collected for specific purposes, unless this is necessary and the processing complies with the applicable conditions of Article 9 of the GDPR and relevant Belgian legislation. When such data is provided unsolicited, we assess whether and to what extent further processing is necessary and lawful.
Personal data in personnel files is retained for the duration of employment and for up to 2 years after the end of the employment contract, or for as long as further retention is necessary for personnel administration, to comply with legal obligations, or to initiate, exercise, or substantiate legal claims. Separate statutory retention periods may apply to specific documents. As soon as retention is no longer necessary or required by law, the data will be deleted or irreversibly anonymized.
Job application and personnel data are stored in a secure HR environment and treated as confidential. Access is limited to HR staff, the directly involved managers, and executive management, to the extent that access is necessary for the performance of their duties, compliance with applicable legal obligations, and the relevant service.
Some HR administrative tasks are outsourced to a social secretariat.
| name | purpose | personal data processed | legal basis | retention period | Processing Location | Privacy Policy |
|---|---|---|---|---|---|---|
| Acerta (Social Secretariat) | HR administrative processes | Belgium | link | |||
| Bullhorn | Storing job application and employee data. | link |
For questions regarding the processing of job application and personnel data, or to exercise rights under the GDPR, the data subject may contact the HR manager at Hradmin@weareonit.com. Requests will be processed in accordance with the procedure set forth in Section 7.2 of this privacy statement and the applicable statutory time limits.
Data subjects may, in accordance with the conditions and exceptions set forth in the GDPR, exercise the following rights with respect to their personal data:
Requests to exercise your rights may be submitted free of charge to the data controller using the contact information provided in this privacy statement.
The data controller will provide information regarding the action taken in response to the request, in principle within one month of receipt. If necessary, this period may be extended by up to two months in accordance with the GDPR, taking into account the complexity and number of requests. The data subject will be informed of any extension and the reasons for it within one month of receiving the request.
If the data controller has reasonable doubts about the identity of the requester, additional information necessary to confirm the identity may be requested.
When personal data is processed on the basis of legitimate interests, the data subject may object to such processing on the grounds of his or her specific situation. The controller shall cease the processing unless there are compelling legitimate grounds that override the interests, rights, and freedoms of the data subject, or unless the processing is necessary for the establishment, exercise, or defense of legal claims.
When personal data is processed for direct marketing purposes, the data subject may object to such processing at any time and without providing a reason. Following such an objection, the personal data will no longer be processed for direct marketing purposes.
The data controller may process personal data when necessary to initiate, exercise, or substantiate legal claims, or to defend against legal claims.
In addition, personal data may be disclosed to competent government agencies or judicial authorities when required by law or when there is another valid legal basis for doing so.
The website www.weareonit.com/smb uses cookies and, where applicable, other tracking technologies. More information about the cookies and trackers used, their purposes, retention periods, the service providers involved, and how to grant, deny, or withdraw consent is available in the separate Cookie Policy.
Cookies and trackers that are not strictly necessary are placed or read only after the required valid consent has been obtained.
Camera footage is processed for the purpose of ensuring the safety of people and property, protecting company premises, and preventing, detecting, and investigating incidents, such as theft or unauthorized access. The footage is used exclusively for these purposes and for other purposes permitted by law.
In principle, camera footage is retained for a maximum of 30 days, in accordance with applicable Belgian regulations. When footage is necessary for the investigation of an incident, legal proceedings, or to support a legal claim, the relevant footage may be retained for a longer period to the extent permitted by law and as long as it remains necessary. The extended retention is limited to the footage in question and the period necessary for the specific purpose.
Access to camera footage is limited to authorized individuals who require such access for security purposes, incident investigation, or other legally permitted purposes. Access to and use of the footage are limited to what is necessary for the specific purpose.
Data subjects may exercise their rights under the GDPR by contacting the data controller using the contact information provided in this privacy statement. The exercise of these rights is subject to the applicable conditions and exceptions under the GDPR.
Data subjects may also file a complaint with the Belgian Data Protection Authority if they believe that their personal data is not being processed in accordance with applicable regulations.
Personal data: Any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the GDPR.
Usage Data: Technical data and information regarding the use of the website that may be collected automatically, such as IP addresses, the times of requests, pages accessed, browser and operating system data, and information about navigation on the website, to the extent that this data is actually processed.
User: Theperson who uses www.weareonit.com/smb, who, unless otherwise specified, is the same as the data subject.
Data Subject: The natural person to whom the personal data relates.
Data Processor: The natural or legal person, public authority, agency, or other body that processes personal data on behalf of the data controller, as described in this privacy policy.
Data Controller: The natural person or legal entity, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data. The identity of the data controller is specified in Article 2 of this privacy statement.
www.weareonit.com/smb (or this Application): The means by which the user’s personal data is collected or processed.
Cookies: Cookies are trackers that consist of small data sets stored in the user’s browser.
Tracker: Technology used to store or retrieve information on a device, or to track users’ behavior or interactions, such as cookies, web beacons, or similar technologies.
"*" indicates required fields
