Privacy policy

Katoen Natie International (“we”, “us” or “KTN”) is committed to protecting the personal data of individuals with whom we interact in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”). Personal data is any information that can identify an individual, such as your e-mail address, name or IP-address.

This privacy policy applies to personal data we process about you when you, as an individual:

are a customer, prospective customer, or contact person of a customer;
are a supplier, contractor, or contact person of a supplier or contractor;
are a job applicant (as an employee, you receive a separate staff privacy notice);
subscribe to our newsletters or other marketing communications;
contact our customer service;
visit one of our sites, premises or buildings;
visit one of our websites; or
If you are an individual we contact in connection with our broader business interests (e.g. art sector).

This privacy policy will explain how we collect, use, share, retain and protect personal data and what rights individuals have in relation to their personal data. More specifically, it will describe, for each category of data subject identified above:

the categories of personal data we collect;
where we obtain that personal data;
the purposes for which we use it and the legal basis we rely on;
how long we retain it;
to whom we may disclose it; and
your rights in relation to your personal data and how to exercise them.

The data controller for the purposes of this privacy policy is Katoen Natie International, with registered office at Boulevard Joseph II 15, L-1840 Luxembourg, Grand Duchy of Luxembourg and registered under company number B57367.

If you have any questions, comments or requests regarding this privacy policy or our processing of your personal data, you can contact us via e-mail: privacy@katoennatie.com.

General purposes for which we process your personal data

Irrespective of the capacity in which we interact with you, and in addition to the specific purposes described below, we may process your personal data for the following general purposes:

to comply with legal, regulatory and tax obligations incumbent upon us, for which we rely on our legal obligations (Article 6(1)(c) GDPR);
to respond to any reasonable request or order from competent authorities, regulators, police or judicial authorities, for which we rely on our legal obligations (Article 6(1)(c) GDPR);
to transfer your personal data, at our initiative, to the police, judicial authorities or our advisers as evidence or in the event of a reasonable suspicion of an unlawful act or offence, for which we rely on our legitimate interest to defend our interests (Article 6(1)(f) GDPR);
to establish, exercise or defend legal claims and to enforce our agreements and policies, for which we rely on our legitimate interest to protect our rights (Article 6(1)(f) GDPR);
to prepare and carry out corporate transactions such as mergers, acquisitions, reorganizations or divestments, including sharing your personal data with advisers and prospective counterparties, for which we rely on our legitimate interest to engage in such transactions (Article 6(1)(f) GDPR);
to protect the rights, safety and property of KTN, our staff, our contacts and third parties, for which we rely on our legitimate interest to act as a responsible business (Article 6(1)(f) GDPR).

Where a general purpose warrants a longer retention period than the one indicated for a specific processing activity below, we will retain your personal data for as long as necessary to achieve that purpose.

When do we process your personal data?

1. If you are a (prospective) customer, supplier or contractor

If you are a customer, prospective customer, or supplier/contractor, we may process certain personal data, including the following categories of personal data:

identification data, such as name, surname, title, signature;
contact detail, such as phone number, e-mail address, business address, language preference;
professional data, such as job title or role, employer name;
financial data, such as bank details, billing references, credit status, but only where relevant for invoicing or payment;
other data relevant for our commercial relation, such as business interests, products or services purchased, opinions expressed in customer surveys.

We may process the abovementioned information for the following purposes:

for the performance of the contract, allowing us to process orders, deliver goods or services, manage payments and provide customer service (Article 6(1)(b) GDPR);
in light of our legitimate interest, so we can inform you about new products, services or events, and to manage and improve our business relationship with you, including through customer satisfaction surveys (Article 6(1)(f) GDPR);
in case of a legal obligation, to comply with applicable law, including accounting, tax and economic sanctions legislation (Article 6(1)(c) GDPR).

We have received this personal data:

directly from you, when you purchase or supply goods or services, or are designated by your employer as a contact person;
from publicly available sources, e.g. the Belgian Official Gazette (“Belgisch Staatsblad/Moniteur belge””), to confirm signing authority; or
from our affiliated companies within the group, where relevant.

We retain this personal data for as long as the business relationship continues, and subsequently for the duration of the applicable statute of limitations for contractual claims (in principle 10 years), unless a longer period is required or permitted by law.

2. If you receive our newsletters or other marketing communications

If you are a (prospective) customer or business lead, we may collect and use your personal data to keep you updated of our business activities, products and services. This may be done through a recurring newsletter. This processing activity relates to the following categories of personal data, which we received directly from you, when you use our products or services, register for an event, or subscribe to our communications:

identification and contact data, such as name, surname, company name, role, phone number, e-mail address, professional address, language;
engagement data, such as purchase history, product preferences, event attendance, provided feedback.

If you are an existing customer, we may sent you marketing communications based on our legitimate interest in informing you of our products, services, promotions or events that may be of interest to you (Article 6(1)(f) GDPR), subject to your right to object at any time (soft opt-in).

If you are a prospect or business lead, we will only contact you for commercial purposes if you gave your explicit consent (Article 6(1)(a) GDPR), which we may have obtained through an opt-in mechanism.

We retain this personal data for as long as you wish to continue receiving such communications. If you unsubscribe or withdraw your consent, we will stop using your personal data for this purpose, save where we are required to retain it for another purpose (e.g. to record an existing customer relationship).

You can withdraw your consent or unsubscribe from our marketing communications at any time by contacting us at privacy@katoennatie.com.

3. If you are a job applicant

If you apply to one of our vacancies or contact us for a spontaneous application, we can process the following categories of personal data:

basic identification and contact data, such as name, address, e-mail address, phone number;
application data (being any personal data you have included in your application), such as CV, cover letter, education, qualifications, skills, work experience;
where relevant for the role, such as copy of driving license, right-to-work documentation;
any information you shared during interviews, such as compensation expectations;
information you have made publicly available on business-oriented websites and/or social media such as LinkedIn.

We process the abovementioned information for the following purposes:

to process your application, assess candidate suitability, decide on recruitment, monitor the effectiveness of our recruitment process and, if successful, to enter into an employment contract (performance of a (pre-)contractual relationship pursuant to Article 6(1)(b) GDPR);
to verify eligibility to work in Belgium and compliance with applicable employment and sanctions legislation or sectoral regulations (legal obligation pursuant to Article 6(1)(c) GDPR);
where we retain your application in our candidate pool for future opportunities beyond the standard retention period, we do so on the basis of your consent (Article 6(1)(a) GDPR).

Where we carry out reference checks with previous employers, we do so on the basis of our legitimate interest in assessing your suitability for the role (Article 6(1)(f) GDPR), and only where reasonable in light of the position.

In light of applications, we have obtained your personal data:

directly from you, via your application, CV or interview; and/or
from recruitment agencies, previous employers (references, only with your consent), or publicly available sources such as professional social media profiles, where applicable.

If your application is unsuccessful, we retain your personal data for 4 months after the end of the recruitment process. With your consent, we may retain your data for an additional period of 3 years to consider you for future opportunities and include you in our candidate pool, or earlier if you wish to withdraw your consent. If your application is successful, your data will be transferred to your employee file and retained for the duration of your employment, in accordance with the applicable legislation.

4. If you communicate with us via e-mail, telephone, text message, our website’s contact form or another channel

Independently of any customer, supplier, applicant or other relationship, we process personal data whenever you communicate with us, whether by e-mail, telephone, text or instant messaging, video call, social media or any other communication channel. This is often a separate processing activity in its own right.

In that context we may process the following categories of personal data, which we receive directly from you:

identification and contact data, such as name, surname, telephone number, e-mail address and, where relevant, the organization you represent and your role;
the content of your communication and the technical metadata of that communication, such as the channel used, the date and time and the person communicating on our side, including call recordings when, for example, calling our customer service;
order and delivery details, such as product choices, delivery address, delivery time;
in case of suppliers, this may also include registered address, VAT-number, employer name;
any other personal data you choose to include in your communication, or necessary for us to appropriately handle your request.

We process these personal data for the following purposes:

to receive, handle and respond to your communication and to follow up on it, for which we rely on our legitimate interest to be able to communicate with our contacts and to handle their requests (Article 6(1)(f) GDPR), or, where the communication relates to an existing or prospective contract with you, on the necessity of the processing for that contract (Article 6(1)(b) GDPR);
to keep a record of our communications and to ensure the security of our communication channels, for which we rely on our legitimate interest (Article 6(1)(f) GDPR);
to train and improve the quality of our customer service (Article 6(1)(f) GDPR).

We retain these communications for as long as necessary to handle your request and thereafter for the duration of the applicable limitation period (in principle 10 years), where we may need them to establish, exercise or defend legal claims. Call recordings are retained for the duration of the applicable limitation period for commercial disputes (10 years), unless required to be retained longer (e.g. in the context of a dispute). Recordings are no longer used for training purposes after 1 month.

5. If you visit our sites, premises or buildings, for site access and security

During your visit to one of our premises, we may process your personal data. We may collect and request from you the following information:

reception/visitor log data, such as first name, surname, professional contact details (telephone number and/or e-mail address), company name, vehicle registration plate, time of arrival and departure, host name, signature, date of visit;
for employees or contractors of third-party companies accessing our sites, relevant information is first name, surname, employer name, role, phone number, department or site to be accessed;
badge information: on some occasions, you will receive a badge to use for entering our premises. We keep a log for every use of such badge;
CCTV images: from the moment you enter our premises until you leave, you may enter zones with camera surveillance, as signposted at the relevant entrances;

We process your personal data for the following reasons:

to comply with our contractual obligations towards service providers and contractors so we can fulfil our contractual obligations (Article 6(1)(b) GDPR);
to comply with applicable health and safety legislation, including managing and reporting workplace accidents pursuant to our legal obligations (Article 6(1)(c) GDPR);
to ensure the security of our sites and buildings in accordance with our terminal-rules and to monitor production processes, pursuant to our legitimate interest (Article 6(1)(f) GDPR).

The period for which we retain your personal data might vary, in accordance with the requirements of the applicable camera legislation and, where applicable, sector or workplace-specific rules (e.g. in collective bargaining agreements). Camera recordings will be retained for one (1) month, whereas sign-in and badging records will be retained for 6 months. Notwithstanding the foregoing, any personal data that may give rise to legal effects, can be archived for evidentiary purposes for a period equal to the statute of limitation (most often 10 years). All personal data which is no longer required for any of the above mentioned purposes or any other (legal) purpose will be anonymized and/or permanently removed.

6. If you visit our website(s) and/or social media

When you visit our website(s) and/or social media, we automatically collect certain technical information transmitted by your browser, including:

browser type and version;
operating system used;
referring URL (the site previously visited);
IP address;
date and time of the server request.

This information is used by KTN for the following purposes in line with our legitimate interest (Article 6(1)(f) GDPR):

for statistical purposes;
to improve the content and overall experience on our websites and social media;
to allow us to detect and prevent malware, illegal content and other types of misuse.

We do not use this information to identify you individually, unless you have voluntarily provided additional personal data (e.g. through a registration form, survey, contest, or request for information). In such case, we refer to section 4. “If you communicate with us via e-mail, telephone, text message, our website’s contact form or another channel”.

For more information on how we use cookies, we kindly refer you to our cookies policy.

When you interact with us on our social media pages (for example by following, liking, commenting or sending us a message), we process the personal data visible on your public profile and the content of your interaction, in order to manage our social media presence and to respond to you, for which we rely on our legitimate interest (Article 6(1)(f) GDPR). The relevant social media platform acts as an independent controller, and in some cases as a joint controller with us, for the processing it carries out through its own tools; we refer you to the privacy policy of the platform concerned for further information on that processing.

7. If you attend an event, conference or fair

When we invite you to, organize, or take part in an event, conference or fair, or when we meet you there, we may collect the following personal data from you or from the organizer:

identification and contact data, such as name, surname, e-mail address, telephone number and professional address;
professional data, such as the organization you represent and your role;
your image and voice, where we take photographs or make audio or video recordings during the event;
any other information you share with us in connection with your registration for or participation in the event.

We process these personal data for the following purposes:

to organize the event and to manage invitations, registrations and attendance, and to carry out related statistical analysis, for which we rely on our legitimate interest to participate in and organize professional events and to invite our business contacts (Article 6(1)(f) GDPR);
to report on our participation in the event on our websites, social media or in the press, where we publish your personal data in an identifiable manner, for which we rely on your consent (Article 6(1)(a) GDPR), which you may withdraw at any time.

We retain this personal data for as long as necessary for the purposes described above and, for identifiable images published with your consent, until you withdraw that consent.

8. If you are an individual we contact in connection with our broader business interests (e.g. art sector)

We may collect and process your personal data if you are active in areas of particular interest to us, such as the artistic and cultural fields or other fields connected to one of our business units. We base ourselves on our legitimate interest in order to foster connections relevant to our business activities and values (Article 6(1)(f) GDPR). We may collect the following information:

identification and contact data, such as name, surname, phone number, e-mail address, professional address;
contextual information, such as field of activity or expertise, and any other information you have voluntarily shared with us, for example through the contact form on our website, or that is publicly available in connection with your professional activities.

We collect such personal data:

either directly from you, during meetings, events, e-mail communications or other interactions;
from publicly available sources, such as professional websites, catalogues or event programs.

We retain this personal data for as long as our relationship is active. If we have not been in contact with you for a period of 5 years, your personal data will be deleted, unless you have requested otherwise or we are entitled to retain it on another basis.

Exceptional retention periods

Please note that we might be obligated to store your personal data for longer than mentioned in this privacy, if we have to comply with statutory retention periods or to bring legal claims or defend against legal claims within the framework of the statutory limitation periods.

To whom do we disclose your personal data?

Subject to applicable law, we may disclose your personal data to:

other entities within the Katoen Natie group, for purposes consistent with this privacy policy, on a need-to-know basis;
external service providers acting as processors on our behalf, such as IT service providers, HR or other professional service providers (accountants, insurance brokers, etc.), payment or billing processors, website hosting providers, and security or audit service providers, under a data processing agreement in accordance with Article 28 GDPR;
competent authorities, regulators, courts or law enforcement bodies, where such disclosure is required by law, necessary to establish or defend our legal rights, or ordered by a court;
our auditors, legal counsel and similar advisors, in connection with advisory services provided to us.

Given the international nature of our activities, we may transfer your personal data to recipients located outside the European Economic Area (EEA), including to other entities of the Katoen Natie group and to our service providers. Where we do so, we ensure an adequate level of protection, in principle on the basis of an adequacy decision of the European Commission or of appropriate safeguards such as the European Commission’s Standard Contractual Clauses, complemented where necessary by additional measures. In the absence of such a mechanism, we may rely on one of the derogations provided for in Article 49 GDPR, in particular where:

you have given your explicit consent to the transfer;
the transfer is necessary for the performance of a contract between you and us, or for pre-contractual measures taken at your request;
the transfer is necessary for the conclusion or performance of a contract concluded in your interest between us and another natural or legal person;
the transfer is necessary for important reasons of public interest;
the transfer is necessary for the establishment, exercise or defense of legal claims;
the transfer is necessary to protect your vital interests or those of other persons, where you are physically or legally incapable of giving consent;
the transfer is covered by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses;
the transfer is authorized by the competent data protection authority.

How do we protect your personal data?

We implement appropriate technical and organizational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, in accordance with Article 32 GDPR. These measures include, among others, access controls, encryption, firewalls, security patching, and confidentiality obligations imposed on our staff. We continuously review and improve these measures in line with technical developments.

What are your rights?

Under the GDPR, you have the following rights in relation to your personal data:

Right to information: to be informed about how we process your personal data, as set out in this privacy policy (Articles 13-14 GDPR);
Right of access: to obtain confirmation as to whether we process your personal data, and if so, to obtain a copy of that data and information about how it is used (Article 15 GDPR);
Right to rectification: to have inaccurate or incomplete personal data corrected (Article 16 GDPR);
Right to erasure: to have your personal data deleted, subject to certain conditions (Article 17 GDPR);
Right to restriction of processing: to request that we limit the processing of your personal data, subject to certain conditions (Article 18 GDPR);
Right to data portability: to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller, where technically feasible (Article 20 GDPR);
Right to object: to object to processing based on our legitimate interest, including profiling, and to object at any time to processing for direct marketing purposes (Article 21 GDPR);
Right not to be subject to automated decision-making: not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR);
Right to withdraw consent: where processing is based on your consent, to withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Article 7(3) GDPR).

These rights are not absolute and may be subject to conditions and exceptions under applicable law. To exercise any of these rights, please contact us using the contact details specified below. We may ask you to provide proof of identity (e.g. a copy of your identity card) before processing your request.

In the event that you believe we have infringed your rights related to the processing of your personal data, you have the right to lodge a complaint with the data protection authority of your habitual residence, place of work, or place of the alleged infringement, or with the Luxembourg Data Protection Authority (CNPD, https://cnpd.public.lu/fr.html

Contact

If you have any questions, comments, or wish to exercise any of your rights, you can contact us at:

Katoen Natie International

Boulevard Joseph II 15,

L-1840 Luxembourg,

Grand Duchy of Luxembourg

privacy@katoennatie.com.

Updates to this privacy policy

We may update this privacy policy from time to time. The revised version will apply from the date of revision, indicated at the top of this document. We recommend that you review this privacy policy periodically to stay informed of how we protect your personal data.

This privacy policy was last updated in July 2026.