1.    Introduction

At VVA Brussels sprl, avenue des Arts, 10-11, 1210 Brussels, Belgium (VVA), we dedicate significant global resources to ensure compliance with applicable data protection laws. We are committed to comply with any data protection regulations that may apply in processing personal data, including the GDPR.

This privacy policy is part of our privacy and data protection efforts and describes how VVA and its affiliates (hereafter jointly referred to as “VVA“, “we“, “us” or “our”) collect and use your personal data as described below.

2.    What personal data we process about you

We may come into possession of your personal data through all kinds of channels.

We collect personal data when you subscribe to or use the services or solutions we provide, when you visit our website, office or other locations. Certain data may be provided by you directly, while others may be collected passively, for instance through the use of cookies.

We may also collect data from other legitimate sources such as third party data aggregators, business and promotional partners, public sources and third party social networks.

The personal data you may actively provide or which we may collect from public sources further to applicable terms (e.g. Linkedin based on your terms with them) or our legitimate interest, include the following :

• your first and last name
• (professional) contact details (e-mail and address, phone and fax number)
• ID card number
• demographic data (age, gender, preferred language)
• company-related information (company name, your position, VAT and company number)
• skills and expertise, CV, position, professional experience
• membership in professional organisations
• interviews
• payment data

Passively collected information as regards the use of our website may include :

• your IP address
• geographical location
• browser type and version
• operating system
• referral source
• page views and website navigation paths
• information about the timing, frequency and pattern of your use.

We take reasonable steps to make sure that the information is accurate, complete, current, relevant and otherwise reliable and not excessive in relation to its intended use. VVA further commits to minimize the amount of personal data collected.

3.    How we use your personal data and on which legal grounds

We only use your personal data to the extent permitted by law. Depending on your relationship with us and the channels used to collect personal data, our use of such data will differ.

Use of supplier or customer personal data

If you supply or purchase products or services to or from us, we process your personal data as part of our supplier or customer management, based on the need to perform our contract with you, carry out transactions, process and perform requested services or support and keep sufficient records of the same. Without your personal data, we will not be able to execute the contract.

We also use personal data to perform essential business operations based on our legitimate interest. This includes maintaining and improving the performance of our services, developing new services, aggregate analysis and business intelligence that allow us to make informed business decisions.

Use of visitor personal data

If you visit one of our offices or other locations, we will process your personal data:

• for visitor management (fire safety, confidentiality and organisation events/meetings) on the basis of our legitimate interests;
• to send you commercial information subject to your consent.  You can withdraw your consent at any time.

Use of personal data of website visitors

When you visit our website, we process your personal data :

• to reply to your questions or request for information;
• to send you commercial information with your consent;
• on the basis of our legitimate interest in research and development in order to deliver the content of our website correctly and analyze and improve the use and operation of the website, ensure the long-term viability of our information technology systems and website technology and ensure its security or maintain back-ups. Research and development can lead to improvement and innovation, including a better user experience and increased online safety and security.

During your visit to our website, cookies may be placed in accordance with the cookie section below.

Use of personal data of stakeholders

If you took part to interviews or surveys managed by us or which were contracted out to third parties, we process your personal data based on a contract, your consent or our legitimate interest:

• to build databases of stakeholders as a part of our project contracts inter alia for further contact
• for analysis

Use of personal data of current and previous partners and experts as a reference for future projects or tenders requiring their skills, based on your consent or our legitimate interest

Use of personal data of job / contract applicants

The provision of your personal data is necessary in order to be able to assess your application or interest and, as the case may be, to offer you a job or to participate to a project or contract. If you apply to us, we will process your personal data as an applicant:

• for the management and evaluation of your (job) applications in the context of the pre-contractual relationship;
• to maintain a (recruitment) reserve on the basis of the legitimate interest.  Maintaining a (recruitment) reserve allows us to contact you later for a job or contract opportunity if there is no immediate vacancy. If you do not wish to be included in the recruitment reserve, you may let us know by contacting us via any of the means indicated below.

Use of personal data for direct marketing purposes

We may process your personal data to send you relevant newsletters and information regarding services that may be of interest to you, provided you have given us consent if you are not a customer of ours, or on the basis of our legitimate interest if you are.

You can withdraw your consent or unsubscribe from further receipt of direct marketing messages at any time.

General

In addition to the specific purposes for which we may process your personal data set out in the previous sections, we may also process personal data for:

• the detection, prevention and combating of fraud and abuse on the basis of our legitimate interest.  Less fraud and abuse benefits us, our customers and suppliers,
• managing disputes on the basis of our legitimate interest, because we must be able to safeguard and defend our rights,
• to provide law enforcement authorities with the information necessary for criminal prosecution or where such processing is otherwise necessary for compliance with a legal obligation to which we are subject, in order to protect your vital interest as data subject or those of another natural person or for the purpose of any other legitimate interest pursued by VVA or a third party that is not overridden by your fundamental rights and freedoms as data subject.

4.    Automated processing

VVA does not make decisions which produce legal effects concerning you, or similarly significantly affect you solely by automated means and without human involvement, for instance when evaluating certain personal aspects relating to you, such as your performance at work, creditworthiness, reliability or conduct.

5.    Sharing of personal data

We may share your personal data with Third Parties with your consent or as necessary for the performance of a contract to which you are a party or in order to take steps, at your request, prior to entering into a contract.

Parties or entities we may share your personal data with include VVA’s affiliated companies, officials, clients, external contractors we work with or have access to your organization’s personal data, service providers engaged by us to perform certain services such as management of our customer database, website and/or app, processing of orders, cloud services, online payment, providing professional advice, managing risks, health services, pensions, insurance and legal disputes.

In addition to the specific purposes of disclosure set out in this section, we may also share your personal data whenever necessary for compliance with a legal obligation to which we are subject, to comply with a court order, to protect your vital interest as data subject or those of another natural person or for the purpose of any other legitimate interest pursued by VVA or a third party that is not overridden by your fundamental rights and freedoms as data subject.

6.    Transferring personal data outside the EEA

Certain personal data that you submit or for which you have given your consent for publication through our website or services may be available, via the internet, around the world. VVA cannot prevent the use (or misuse) of such personal data by others.

We may transfer personal data to persons or entities in countries outside the EEA. To ensure that your personal data receives an adequate level of protection, we only transfer your personal data to countries that benefit from an adequacy decision issued by the Commission. If no such decision is available, we may put in place contractual agreements based on the EU Commission’s standard contractual clauses, which seek to ensure that your personal data is treated by those third parties and entities outside the EEA in a way that is consistent with and which respects the EU laws on data protection, including the GDPR.

You will be informed whenever we intend to transfer your personal data outside the EEA, the existence of an adequacy decision or the appropriate safeguards and how to obtain a copy of them or where they have been made available prior to such transfer taking place.

7.    Data retention

VVA shall not store personal data that we process for any purpose for longer than is necessary for that purpose as may be detailed in our data processing register. After expiration of that period, the personal data are routinely deleted, unless retention is necessary (i) to ensure compliance with a legal obligation to which VVA is subject, (ii) to protect your vital interests or the vital interests of another natural person, or (iii) for the purpose of any other legitimate interest pursued by VVA or a third party that is not overridden by your fundamental rights and freedoms as data subject.

8.    Security

VVA takes reasonable and appropriate measures to maintain the confidentiality and integrity, prevent the unauthorized use or disclosure, of personal data and to protect personal data from loss, misuse and unauthorized access, disclosure, alteration and destruction.

We maintain a system of appropriate administrative, physical and technical safeguards to secure such information. We have made contractual arrangement with our third party service providers which require them to take appropriate security measures to ensure the confidentiality and security of your personal data and process your personal data for specified purposes only and in accordance with our instructions and comply with applicable privacy laws.

We take reasonable steps to make sure that the information is accurate, complete, current and otherwise reliable with regard to its intended use. However, VVA expects that you will provide VVA with updated personal data as necessary as described in section 10.

9.    Cookies

VVA uses cookies and similar technologies.  Cookies are small text files that a website saves on your computer or mobile device when you visit our website. They allow us make our website work, to measure and keep track of activity on our website, improve your user experience by, for example, remembering your viewing preferences and allowing you to visit any member-only parts of the website without having to re-register.

Learn more 

There are different types of cookies which may be distinguished on the basis of their origin, function and lifetime:

• First party cookies are cookies that are stored by the website you are visiting, while third party cookies are stored by a website other than the one you are visiting.
• Necessary cookies enable you to move around on a website and to use its features.
• Performance cookies collect data on the performance of a website such as the number of visitors, the time spent on the website and error messages.
• Functionality cookies increase the usability of a website by remembering you choices (eg language, region, login).
• Targeting/advertising cookies enable a website to send you personalized advertising.
• Session cookies are temporary cookies that are erased once you close your browser while persistent or permanent cookies stay on your device until you manually delete them or until your browser deletes them based on the duration period specified in the persistent cookie file.

More information on all aspects of cookies can be found on www.allaboutcookies.org.

An overview of the cookies most commonly used by VVA is given below:

• _ga:
  • Registers a unique ID that is used to generate statistical data on how the visitor uses the website
  • Used to enhance the performance of the website
  • Expires after 2 years
  • Data is sent to France
• _gat:
  • Used by Google Analytics to throttle request rate
  • Used to enhance the performance of the website
  • Session
  • Data is sent to France
• _gid:
  • Registers a unique ID that is used to generate statistical data on how the visitor uses the website
  • Used to enhance the performance of the website
  • Session
  • Data is sent to France
• Collect
  • Used to send data to Google Analytics about the visitor’s device and behavior, tracks the visitor across devices and marketing channels
  • Used to enhance the performance of the website
  • Session
  • Data is sent to the Netherlands

Most web browsers automatically accept cookies but provide controls that allow you to block or delete them. Instructions for blocking or deleting cookies can be found in each browser’s privacy or help documentation. Certain features of VVA’s website and services depend on cookies. Please be aware that if you choose to block or delete cookies, you may have to manually adjust settings and preferences controlled by those cookies every time you visit and some services and functionalities may not work. If you use different devices to access a website, you will need to ensure that each browser of each device is set to your cookie preference.

VVA web pages may also contain electronic images know as web beacons. These are miniature, single-pixel graphics or gifs that we use to help deliver cookies on our websites, understand the behaviour of visitors of our website or count website visitors. More information on web beacons can be found on http://www.allaboutcookies.org/web-beacons/. We may also include tracking pixels in e-mails to determine whether an e-mail was opened and acted upon, enable log file recording and analysis. The data so collected may be used by VVA in order to optimize the shipping of the newsletter, as well as to adapt the content of future mailings even better to your interests.

With both cookies and web beacon technology, the information that we collect is anonymous and not personally identifiable. Cookies and web beacons cannot retrieve any other data from a hard drive or obtain an email address.

10.    Data subject rights

Under the GDPR you have a number of rights with regard to your personal data. You have the right to:

• Request from us access to your personal data;
• Request a rectification of your personal data, e.g. if it is incomplete or inaccurate;
• Request the erasure of your personal data where one of the following grounds applies and where there is no other legal ground for the processing:
  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • you withdraw your consent on which the processing is based;
  • you object to the processing of your personal data (see hereafter);
  • your personal data have been unlawfully processed;
  • your personal data must be erased for compliance with a legal obligation under EU law or the laws of a member state to which VVA is subject.
• Request restriction of processing of your personal data in any of the following cases:
  • you contest the accuracy of your personal data: processing shall be restricted for a period enabling VVA to verify the accuracy of the personal data.
  • The processing is unlawful but you oppose the erasure of your personal data and request the restriction of their use instead.
  • VVA no longer needs the personal data for the purposes of our processing, but you require the personal data for the establishment, exercise or defense of legal claims.
  • You have objected to the processing (see hereafter), pending verification whether the legitimate grounds of VVA override your rights as data subject
• Object to processing for reasons relating to your particular situation and where the legal ground for processing is that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of any official authority vested in VVA, or for the purposes of the legitimate interests pursued by us or by a third party. In case you raise an objection, we shall no longer process the personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms as the data subject, or for the establishment, exercise or defense of legal claims.
• Where processing is based on consent or on a contract, and is carried out by automated means, receive personal data that has been provided to us in a structured, commonly used and machine-readable format and to transmit or have such data transmitted to another Controller
• If you have provided consent for the processing of your personal data, withdraw that consent at any time which will not affect the lawfulness of the processing before your consent was withdrawn.

You may file your request by sending an e-mail to contact_Brussels@vva.it or reach out to us in writing at VVA, Kunstlaan 11, 1210, Sint-Joost-ten-Node. Responses to requests shall normally be made within one month of receipt, however this may be extended by up to two months if the request is complex and/or numerous requests are made. If such additional time is required, we will inform you of the same.

11.    Complaint

Without prejudice to your rights to lodge a complaint with the competent data protection authority, we encourage you to approach us directly if, in connection with your personal data, you consider that there is an infringement of the applicable data protection laws. To do so, you can either send an e-mail to contact_Brussels@vva.it or reach out to us in writing at VVA, Kunstlaan 11, 1210, Sint-Joost-ten-Node.

We will investigate the complaint and respond to it as soon as possible and within one month of the sending of the acknowledgement of receipt. If the complaint is particularly complex, we will provide you with an estimate of when the response, which will in any event not be later than two (2) months of the sending of the acknowledgement of receipt. If the complaint is upheld, VVA commits to take appropriate remedial measures as necessary to resolve the complaint.

If you are not satisfied with our response, you can lodge a complaint with the competent data protection authority.

12.    Amendments

This policy may be modified from time to time, for instance to take into account modifications of the regulatory environment or the company structure. We will provide you with a new privacy policy when we make any substantial updates. Where a change affects the processing conditions of personal data by a third party processor acting on our instruction, we will notify such party in a timely fashion so as to ensure compliance of the modified terms.

Last updated : 15 August 2018