Privacy Policy

1. Who are we?

1.1.    VLUHR as data controller

With this statement (hereinafter the “Statement”), we wish to inform you about why and how your personal data are collected and processed by the Flemish Universities and Colleges Council, with its headquarters at Ravensteingallerij 27/3&6, 1000 Brussels, registered with the CBE under number 0832.132.118 (hereinafter referred to as ‘we’ or “VLUHR”).

We are responsible for the processing of personal data requested and used by us. As the controller, we take the measures that ensure that you:

• remain informed about our processing of your personal data;
• retain control over the personal data we process;
• can exercise your rights in relation to your personal data. 

1.2.    Data Protection Officer 

We have also appointed a data protection officer. This is an expert in personal data protection who provides an additional guarantee for the correct processing of your personal data by us.

You can contact the officer through the channels mentioned in point 11 of this Statement. 

2. Scope of this statement

This statement does not apply to the processing of personal data of our students, our (candidate) staff and the participants in our surveys. The aforementioned processing operations are governed by separate and specific privacy statements. You will be informed accordingly when applicable.

3. What information do we collect about you?

By “personal data” we mean any information that refers to a particular living natural person. Depending on the purpose of the processing, we process different types of personal data.

It is not our intention to process so-called “sensitive personal data,” such as personal data revealing racial or ethnic origin, religious or philosophical beliefs, or data concerning health.

4. What do we need your personal data for?

4.1.    Information and commercial communication

•    What does this goal imply?

We wish to be able to inform you about our activities, events, services or relevant news items. This may be at your express request, or if we suspect it may interest or benefit you.

If you already have an existing relationship with us, you should not consent to receive direct marketing communications. We base this on our legitimate interest. If you do not yet have a relationship with us, you will receive our direct marketing communications if you have given express consent.

If you do not want any communication at all, please exercise your right to oppose direct marketing, as further stated in sections 10.2 and 10.3 of this Statement.

•    What personal data do we process for this purpose?

For this purpose, we collect and process your name, e-mail address, telephone number, address, as well as data related to your areas of interest.

4.2.    Service, customer relationship and supplier policy

•    What does this goal imply?

We may use your personal data to create you as a relationship, event participant, customer or supplier in our systems and to fulfill our commitments and/or agreement with you.

•    What personal data do we process for this purpose?

We collect and process your name, e-mail address, phone number and address for this purpose.

4.3.    Because it is necessary to function as an organization

•    What does this goal imply?

This purpose amounts to what is called a “legitimate interest.” Indeed, we still have a number of legitimate interests that form the basis for processing personal data. This is done only after we have weighed up that in each case the balance between our legitimate interests and their possible impact on your privacy will not be disturbed.

If you nevertheless object to these processing operations, you may exercise your right to object, as stated in section 10.3 of this Statement.

Thus, personal data are processed in different situations:

• Personal data may be used as evidence (archives);
• Personal data may be used for the establishment, exercise, defense and indemnification of our rights of or the persons who may represent us, for example in litigation;
• Personal data may be used for governance, (risk) management and control of our organization, such as compliance (such as money laundering and fraud prevention and investigations, and privacy), risk management, risk functions and inspection, complaint management, internal and external audit;
• Personal data may be used to support and facilitate the purchase, use and termination of services by and/or from our partners (customers, supplier,…) and this, among other things, in order to avoid having to re-enter information that you previously provided.

•        What personal data do we process for this purpose?

We collect and process your name, e-mail address, phone number and address for this purpose.

4.4.    Legal obligations

We will also collect and process those personal data when necessary to enable us to comply with our legal obligations.
    
4.5.    Profiling

Your personal data will not be used for profiling purposes.

4.6.    Cookies on our website

Our websites use cookies. Cookies are small text files stored on your device, and similar technologies. More information on this can be found in our cookie statement which can be found on the relevant websites.

5. For processing operations, do we ask for your consent?

Consent is only one possible legal basis for the lawful processing of your personal data. More specifically, your personal data can only be lawfully used and processed by us if one of the following conditions is met:
   

• We have your express and free consent to use your personal data for a specific purpose. For example, we may request your consent to write to you from direct marketing purposes, as stated in section 4.1 of this Statement.
• The use of your personal data is necessary for the performance of a contract you have entered into with us or, at your request, to take the necessary steps to reach a contract with us. The processing purposes stated in section 4.2 of this Statement are based on this basis.
• The use of Your personal data is necessary for the protection of Our legitimate interests, to the extent that this outweighs Your interests and rights. We base the processing operations necessary to operate as a business on our legitimate interest, as stated in section 4.3 of this Statement.
• We may be required by law to process certain data, and in particular to pass it on to the relevant authorities.

6. With what other individuals do we share your personal data?

Your personal data will not be passed on to other persons, with the exception of the following:

• only our employees who effectively need access for the performance of their duties are granted access to your data. These persons act under our supervision and responsibility.
• In addition, we also use specialized external suppliers who perform certain processing operations for us, such as IT services, lawyers and bailiffs. Since these third parties have access to personal data within the scope of the services requested by us, we have implemented technical, organizational and contractual measures to ensure that your personal data is only processed and used for the purposes mentioned under point 3 of this Statement.
• Only if we are required to do so by law will your personal data be provided to police and investigative services and the courts.
• If you participate in specific publicly subsidized events, we may be required to share participant lists, which may include personal data, with the subsidy channel. However, this is done only for the purpose of proving the number of participants in the event.

7. Where will the data be stored and processed?

Your data will not be transported outside the EU and, in any case, we will ensure that minimum legal requirements and security standards are respected at all times.

If we foresee that your data will be stored and processed outside the EU, we will explicitly state this and ensure that the same level of protection is applied as applicable within the EU.

8. How long do we keep your personal data?

We retain your data only for as long as is necessary for the purposes for which the data are used as stated in Section 4 of this Statement.

Because the need to retain data may vary by data type as well as by the purpose of processing, the actual retention periods may vary significantly. We can hereby inform you that our criteria for determining retention periods include the following:

• How long is the personal data needed to provide the requested service?
• Have we established and announced a certain specific retention period?
• Have we obtained consent for a longer retention period?
• Do we have a legal, contractual or similar obligation to retain the data?

Once your data is no longer needed and we also have no legal obligation to retain it, we will permanently delete it or, if this is not possible, anonymize it in our systems.

Your personal data will, however, be retained and used for as long as necessary to comply with our legal obligations, settle disputes or enforce our agreements.

9. How do we secure your personal data?

Your personal data is considered strictly confidential. We take appropriate technical and organizational measures to protect personal data provided and collected from destruction, loss, inadvertent alteration, damage, accidental or unlawful access or any other unauthorized processing of personal data.

10. What are your rights and how can you exercise them?

10.1.    Right of access, correction, deletion, transfer of data and objection

10.1.1.    Right to access your personal data

You always have the right to access and inspect w personal data processed by us. In this regard, we will provide you with a copy of such personal data free of charge if you so request.

10.1.2.    Right to correct your personal data

You always have the right to have erroneous, incomplete, inappropriate or outdated personal data removed or rectified.

10.1.3.    Right to withdraw your consent

If the processing is based on your consent, you have the right to withdraw this consent at any time.

10.1.4.    Right to object to certain processing operations

If your personal data are processed on the basis of a legitimate interest, you have the right to object to the processing of your personal data in case of reasons related to your specific situation.

10.1.5.    Right to erasure of your personal data

You have a right to erasure of your personal data. On this basis, if you no longer wish to have a relationship with us, you may ask us to stop using your personal data. However, we may retain personal data required for evidentiary purposes.

Under this deletion right, you also have the right to ask us to stop using your personal data processed on the basis of your consent or our legitimate interest at any time. Due to legitimate interests, we may still continue to process your personal data after balancing your interests with ours, unless you decide to terminate the relationship with us.

10.1.6.    Right to transfer personal data

Regarding the processing of your personal data on the basis of your consent or because it is necessary for the provision of the requested products or services, then you may ask us to forward your personal data – in a structured, common and digital form – to you so that you can save them for personal (re)use, or to forward these personal data directly to another data controller, insofar as this is technically possible for us.

10.1.7.    Right not to be subject to automated decision-making

You will not be subjected by us to automated individual decision-making, including profiling.

10.2.    Right to object to direct marketing

You have the right to object to the processing of your data for direct marketing purposes, if you do not or no longer wish to receive such communications from us. In this case, we will no longer process your data for direct marketing purposes. Your request will be implemented as soon as possible.

We draw your attention to the fact that your exercise of the right to object does not prevent us from contacting you, where appropriate, for any other purpose, including contract performance, in accordance with this Notice.

10.3.    How to practice?

To exercise the aforementioned rights, you may send a written request to us in the following manner:

• by email: info@vluhr.be;
• in writing to the following address: Ravensteingallerij 27/3&6, 1000 Brussels, to the attention of the Data Protection Officer VLUHR.

When exercising your right, please indicate clearly which right you wish to invoke and which processing(s) you possibly oppose or which consent you wish to withdraw.

11. How can You submit questions or complaints?

If you have a question or complaint about our processing of personal data you may contact us through the following channels:

by email: info@vluhr.be;

in writing to the following postal address: Ravensteingallerij 27/3&6, 1000 Brussels, for the attention of the Data Protection Officer VLUHR.

If you are not satisfied with our answer, if you have any comments concerning the exercise of your rights or if you consider that our processing of your personal data does not comply with the law, you have the right to lodge a complaint with the Data Protection Authority. All information in this regard can be found at https://www.gegevensbeschermingsautoriteit.be/.

12. Adaptation of this Statement

This Statement may be amended or supplemented by us as we deem necessary.

If significant changes are made to this Statement, the date of updating will be updated and we will also notify you through normal information channels.Suggested text:Our website address is: https://centenvoorstudenten.be.