Privacy policy

This policy is effective from may 25, 2018

Your privacy is important to us. We want to be transparent about the personal data we collect, why we collect it and what measures we install to thoroughly protect this personal data. Read this Privacy Statement carefully, because it contains essential information about your rights as a data subject and about the way in which your personal data are processed by the Flemish Environmental Agency (hereafter the VMM).

The VMM wishes to emphasize that at all times it tries to act in accordance with the 2016 European Regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data, also called the General Data Protection Regulation (abbreviated GDPR). The VMM therefore endeavors to comply at all times with the principles and requirements under the GDPR regarding the processing of personal data. This means that:

• The VMM processes the personal data of data subjects in a lawful, fair and transparent manner;
• The VMM processes the personal data of those involved only for defined and justified purposes;
• The VMM processes only those personal data that are necessary to realize these purposes. The VMM will therefore not collect and use any unnecessary personal data;
• The VMM processes only correct and up-to-date personal data. If the personal data turns out not to be correct, you can have it modified. How you can do this, you can read under 'Article 10 - Where can you go with your request to exercise your rights?' Of this Privacy Statement.

Article 1 – Definitions

• "We", "Our", "Us" refers to the Flemish Environment Agency (hereafter the VMM) with registered office at Dokter De Moorstraat 24-26, 9300 Aalst, Belgium.
• "You", "Your" refers to: a visitor to one of our websites, as well as you as an individual whose personal data VMM processes in the performance of its activities (also referred to as the person concerned).
• "Personal data" refers to all information that can identify you as a person (directly or indirectly).
• "Website" refers to https://www.vmm.be, https://www.milieurapport.be, https://www.zonderisgezonder.be, https://www.integraalwaterbeleid.be, https://www.waterinfo.be, as well as all web pages, platforms, interactive functions, applications, widgets, blogs, social networks or other documents that link to this Privacy Statement and are thereby subject to this Privacy Statement.

Article 2 - Who is responsible for your personal data (controller)?

The VMM with registered office at Dokter De Moorstraat 24-26, 9300 Aalst, Belgium, is responsible for the processing of your personal data. The VMM has appointed a data protection officer (DPO) who advises the VMM on compliance with the AVG. You can contact the DPO via informatieviligheid@vmm.be.

Article 3 - What personal information do we collect about you and why?

• Personal data that you provide to us: we collect, store and process personal data that you have provided to us in a way. You can communicate such information during the following actions:
• When you sign up for our newsletter, we collect your name, first name and e-mail address to send our newsletter in a personal way to the correct e-mail address.
• When you register for one of our events and /or seminars, we collect name, first name and e-mail address so that we can put you on our guest list and keep you informed about the details of the event/seminar.
• If you have a question or complaint in connection with one of our services or in connection with your drinking water company or sewer company, we collect your name, first name, e-mail address, telephone number and address to answer your question or complaint.
• If you wish to participate in our recruitment and selection procedures, you must complete a questionnaire on the basis of which we can select the most suitable candidate according to the guidelines within the Flemish Government and to be able to communicate with you about the procedure. We ask for the following personal data: name and first name, address, telephone number, e-mail, national register number, nationality, information about language skills, education and work experience.
• Automatic information: when you visit our website or receive a newsletter from us, we collect information via cookies and other techniques. For more information about cookies, we refer you to our cookie policy.
• Information that we request from authentic sources: In order to properly carry out the tasks imposed by law and /or decree, the VMM processes personal data. The VMM only requests these from the authentic source of the personal data, such as the National Register, the ‘kruispuntbank van de sociale zekerheid’ or other Flemish government agencies. Prior to receiving this personal data, the VMM must formally request the access and use of this personal data from the authentic source itself or from the Flemish Supervisory Committee (for personal data requested from other Flemish government agencies). These applications are thoroughly and rigorously assessed so that the VMM does not request any unnecessary personal data, does not pursue unlawful processing purposes and that the VMM can guarantee that it will protect the personal data. More information about the tasks of the VMM can be found here.

Article 4 - What are we using your personal data for (purpose and lawfulness of processing)?

If you provide us with your personal data, these will be included in our database with the aim of:

• Improving the quality of our services and information;
• Informing you about new developments within our area of competence;
• Informing you about events and seminars that we organize;

The aforementioned processing purposes are justified because of the permission requested by the VMM before processing the personal data.

• complying with our statutory and /or decretally imposed tasks and powers.

The aforementioned processing purpose is then justified because of a legal obligation on the VMM to process the personal data.

Article 5 - The VMM and the use of processors

For processing personal data, the VMM sometimes uses other service providers that will act as processor. These processors may not use the personal data for their own (commercial) purposes. The VMM carefully selects these partners and expects them to handle your personal data as dutifull as the VMM itself. The processing is governed by a contract by which the processor is obliged to comply with the obligations from this Privacy Statement, as well as the applicable provisions from the AVG.

Article 6 - What information does our organization share?

The personal data will not be passed on to third parties, unless you have given an additional explicit permission for this ("opt-in").
You can withdraw this permission at any time, without justification and free of charge by sending an e-mail to informatieveiligheid@vmm.be.

Article 7 - How long do we keep your personal data?

The VMM has developed a policy on the storage of personal data. We ensure that the data is kept secure and that we do not keep it for longer than necessary to achieve the above mentioned purposes. The retention period of the data therefore depends on the purpose for which they were collected. If you do not want the VMM to keep your personal details or you would like more information about the retention periods we use, you can contact us. How to do this exactly, you can read under 'Article 10 - Where can you go with your request to exercise your rights?' Of this Privacy Statement.

If you are registered for our newsletter, we will retain your personal data as long as you do not opt out.

When the VMM processes your personal data in order to fulfil  its statutory tasks and obligations, your personal data will not be kept longer than necessary to realize these tasks and obligations. Depending on the task, this storage period may be several years. This retention period is necessary because the VMM has to determine evolutions over time for certain of its tasks.

Article 8 - The security of your personal data

The VMM recognizes its responsibility to provide an appropriate level of security for the personal data it processes. The VMM has therefore taken various measures to protect personal data against loss, misuse and unauthorized access, disclosure, alteration or destruction, taking into account the risks associated with the processing. On the organizational level, measures are, among other things, implemented with regard to limited access to and monitoring of buildings, systems and files; But also technical measures including firewalls and encryption, protection through personal passwords and verification, as well as verification requirements for access to personal data on a need-to-know basis.

The effectiveness of the implemented measures is tested, assessed, evaluated and adjusted if necessary at regular intervals.

The VMM applies the AVG principles for the processing of personal data from the start of new projects and processing activities (data protection by design) and will, if necessary, carry out a data protection impact assessment (DPIA) in accordance with article 35 of the AVG in order to assess the impact of a processing activity on the rights and freedoms of data subjects. Depending on the outcome of this DPIA, the VMM will take the appropriate measures to develop the new processing activity as well as possible in accordance with the AVG.

Article 9 - Your rights with regard to your personal data

The VMM wants to be as transparent and clear as possible regarding the activities for which we collect, use and secure your personal data. Consequently, the VMM has developed a policy so that you can exercise your rights with regard to the personal data that you have entrusted to us. You have different rights in accordance with applicable privacy legislation.

Right to information and access;

You have the right to access your personal data at any time, as well as the use we make of your personal data and you can request a copy of this. In this way you can also ask how long we store your data, on which legal basis we process your data, etc. By exercising this right you can also check whether the data we have is correct. How you can exercise this right can be read under 'Article 10 - Where can you go with your request to exercise your rights? of this Privacy Statement.

Right to have your data corrected

If you find that the personal information we have about you is incorrect or incomplete, you can have it corrected or supplemented. How you can exercise this right can be read under 'Article 10 - Where can you go with your request to exercise your rights?' of this Privacy Statement.'

Right to have your data erased

You have the right to request that the VMM remove the personal data it holds from you. Note, this right is not absolute. The AVG determines under which conditions this right can be exercised. The DPO will assess whether one of the conditions is met. If it is judged that one of these conditions applies, we will delete your personal data. If your data has been passed on to our processors for certain purposes, the VMM will inform all these processors that the data must also be removed from them. You acknowledge that when requesting the removal of personal data, certain services and products are no longer available.

How you can exercise this right can be read under 'Article 10 - Where can you go with your request to exercise your rights?' of this Privacy Statement.

Right to request the limited processing of your personal data

By requesting the limited processing of your personal data, it is possible for the VMM to keep the data up to date, but the use of the data is limited. The exercise of this right applies only in limited cases. If the VMM still wants to do other things with your data than merely storing the data, this will only be possible in limited cases (for example by asking your permission again for the processing of your data). How you can exercise this right can be read under 'Article 10 - Where can you go with your request to exercise your rights?' of this Privacy Statement.'

Right of objection against the processing

You have the right to object to the processing of your data if this processing is based on a general interest of the VMM. If you invoke this right, the DPO of the VMM will investigate whether the public interest invoked by the VMM weighs heavier than your interests, rights and freedoms for that processing. If this is not the case, the VMM will no longer process your data for that purpose.

Right to transfer your data

This right means that you get back the data that you have given to the VMM. An additional aspect of this right is that you can go to another processor with the data that you receive without the VMM being able to resist. Note, this applies only to the data that you have delivered directly to the VMM. How you can exercise this right can be read under 'Article 10 - Where can you go with your request to exercise your rights?' of this Privacy Statement.'

Right to withdraw your consent

For all processing operations for which the VMM requests your permission, you can revoke this permission at any time. Note, the withdrawal of your permission has no impact on and does not affect the processing that the VMM did when your permission was not withdrawn. You can withdraw your consent in various ways:

• You can unsuscribe for newsletters, invitations to events and study days and surveys via the unsubscribe link that is mentioned at the bottom of the sent communication.
• You can contact our DPO and request to withdraw your permission for a specific activity. You can direct your request to informatieveiligheid@vmm.be.

Keep in mind that a certain processing time is required to handle your request and that there is a chance that in the meantime you will still receive the communication. This processing time is kept to a minimum.

Article 10 - Where can you go with your request to exercise your rights?

If you wish to exercise your rights under the AVG or have a question about this Privacy Statement, you can contact us:

• by e-mail: informatieveiligheid@vmm.be;
• by post: to the DPO, Vlaamse Milieumaatschappij, Dokter De Moorstraat 24-26, 9300 Aalst, Belgium;

We will do everything in our power to answer or resolve your questions and complaints as well as possible. If afterwards, you should be dissatisfied with the way we handle your personal data, you can find more information about the steps you can take on the website of the Belgian Data Protection Authority.

Article 11 - Cross-border processing of personal data

The VMM guarantees that no transfer of personal data will take place outside Europe or the European Economic Area (EEA).

Article 12 - Changes to this Privacy Statement

The VMM reserves the right to amend and update this Privacy Statement at any time by posting a new version on our websites. We encourage you to consult this Privacy Statement regularly, so that you are always aware of the content of the applicable Privacy Statement. The VMM works together with other partners for various services. The VMM is not responsible for the privacy policies of these partners and does not guarantee the content of their privacy statement. We therefore advise you to consult the privacy statements of these partners for more information.