Our policy: looking after your data
A range of activities and data
Rode Kruis-Vlaanderen is active in a range of areas. We give First Aid training, our volunteers help with preventative aid campaigns, we look for family members who have been separated through war or disaster, we assist in donor recruitment and blood collection to be able to provide hospitals with a stable blood supply, etc.
We gather and use a lot of data in this respect. These are wide-ranging in nature.
Treating your data correctly
Treating your data correctly is a first priority for us, certainly because a lot of data are sensitive or are provided to Rode Kruis-Vlaanderen by vulnerable persons.
A second priority is to explain in a clear manner what precisely we will do with the data. We will inform you at the time that you provide us with your data. For example, when registering for an activity, if you come to donate blood or if you register on the website. There is a specific data policy depending on the capacity in which you provide the data. This is because your capacity (as volunteer, vacationers , donor, etc.) determines for what purposes these data are processed, how long we save your data, who will receive it, etc.
Legal framework
Our data policy complies with:
- the rules of Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data of 27 April 2016 (General Data Protection Regulation);
- the national legislation relating to data protection which would be applicable.
An answer to your questions
On the basis of the following questions and answers we wish to inform you as to how we deal with your data.
Who is responsible for the processing of your personal data?
The data controller of your data is in the first place Rode Kruis-Vlaanderen (Belgian Red Cross Flanders). Rode Kruis-Vlaanderen is based in Motstraat 40, 2800 Mechelen and is the Flemish Community of the Belgian Red Cross, an institution of public utility with legal personality pursuant to the Law of 30 March 1891.
Depending on the purpose(s) of the processing, the non-profit associations (NPAs) affiliated with Rode Kruis-Vlaanderen will, together with Rode Kruis-Vlaanderen, process your personal data. These NPAs are: VZW Vormingsinstituut Rode Kruis-Vlaanderen, VZW Jeugd Rode Kruis, VZW Zorgbib Rode Kruis-Vlaanderen, VZW Rode Kruis-Vlaanderen Internationaal, and/or VZW Rodekruisvakanties, all based at Motstraat 40, 2800 Mechelen, and also VZW Rode Kruishotel, based at Polderwind 4, 8377 Zuienkerke.
If processing is carried out together with an affiliated NPA, Rode Kruis-Vlaanderen and the affiliated NPA will act as ‘joint data controller’. Rode Kruis-Vlaanderen will always act as central contact point when you wish to exercise your rights or if you have questions about your privacy.
You will find more information about Rode Kruis-Vlaanderen and the NPAs here.
What are the purposes and legal grounds for processing your personal data?
If we collect your data, this is to process the data for a specific purpose. We always do this on the basis of a legal ground. A ‘legal ground’ is the legal basis which permits your personal data to be processed. The purposes and legal grounds for processing your personal data differ depending on the activity in which you are participating or the service which is being provided to you.
For example, if you register yourself for a training course or reserve a training course, we will process your data with the purpose of providing the training course. Without processing your data, we cannot offer you the training course. We process your data here because this is necessary for the performance of the agreement which is made between you and our organisation.
Which personal data does Rode Kruis-Vlaanderen process?
We process the personal data which you provide us with via the website or another communication channel within the framework of the activity for which you contact us or the service which has been provided to you. Depending on the activity, service or your interest, these can be: identification data, health data, genetic data, judicial data and/or other data such as financial data.
Who receives your personal data?
We make use of ‘processors’ for certain processing actions. These are external parties which support Rode Kruis-Vlaanderen in the provision of services. They are only allowed to process your data in the manner we have agreed with them. This involves such processors as an external data platform, call centres, sms and email services and software suppliers.
In addition, it is possible that we also transfer your personal data to ‘other recipients’. This can be, for example, to the government if we have a duty to report about the participants who followed training with Rode Kruis-Vlaanderen.
If we process data with an affiliated NPA, this NPA will naturally also receive your data.
When we transfer your data to ‘processors’ or ‘other recipients’ this will be explicitly stated in the data policy. We will inform you about this at the time when you provide us with your data. The data policy for the most important activities which you participate in and services which are provided by Rode Kruis-Vlaanderen can be found here.
How long does Rode Kruis-Vlaanderen retain your personal data?
We can only store your data as long as is necessary for the purpose for which we collected your data. What is ‘necessary’ depends on the activity in which you participate or the service which is provided to you. If you ask Rode Kruis-Vlaanderen a question via the website, we naturally do not have to store your data for as long as we do when you have donated blood. Sometimes these storage terms are determined by the legislator, such as in the legislation relating to blood.
The storage terms for our most important activities and services can be found here.
Does Rode Kruis-Vlaanderen transfer your data to countries or organisations outside of the European Economic Area?
The European Economic Area (EEA) encompasses the countries of the European Union together with Norway, Liechtenstein and Iceland. The European legislation requires additional safeguards should we transfer data to countries other than EEA countries. These countries have different legislation in the area of privacy and data protection so that often a lower protection level is offered than is provided for in the EEA.
Although this does not happen often, such a transfer of specific processing can be necessary. For example, for locating a missing family member in Syria, we will have to contact the Syrian Red Crescent Society. This will then be permitted for significant reasons of public interest.
The headquarters of the International Red Cross are based in Switzerland. We must sometimes transfer data to them too. The European Commission guarantees that Switzerland offers a sufficient adequate protection level.
Finally, we sometimes use processors established outside the EEA. This mainly concerns processors that provide support services such as an external data platform and portal and software suppliers. We provide appropriate safeguards through standard data protection clauses or other appropriate safeguards. These are available at Rode Kruis-Vlaanderen.
What are your rights as data subject?
You have various rights:
- You have a right to access your personal data. This allows you to determine what personal data we process about you.
- You have a right to rectification of your personal data. This allows you to rectify incorrect personal data we process about you.
- You have a right to erasure of your personal data. This right allows you to have Rode Kruis-Vlaanderen ‘forget’ you and have us erase all data we have about you. We are not always obliged to erase your data when you request such. This is only required in the cases stipulated by law.
- You have a right to restriction of the processing relating to you. This allows you to ask us to restrict the processing we carry out. We will thus continue to store your data but the use thereof will be subject to stricter rules. We are not always obliged to grant such a request. This is only required in the cases determined by law.
- You have the right to object to the processing. This allows you to object to the further processing of your data by Rode Kruis-Vlaanderen. We are not always obliged to grant such a request. This right can only be exercised if we process your data on the basis of a legitimate interest or to perform a task of public interest.
- You always have a right to withdraw your consent if the processing takes place on the basis of your consent.
- You have a right to object to the processing of your personal data for recruitment and communication purposes.
- You have a right to data transferability. This gives you the possibility of easily moving, copying or forwarding personal data from one data controller to another. This right supplements the right of access. It offers you a way to manage your personal data yourself easily and use it again. This right can only be exercised if the processing is based on your consent or on an agreement which you have made with us (or one of the NPAs).
You can address your request with regard to your rights or questions about privacy in writing to: Rode Kruis-Vlaanderen, attn. DPO, Motstraat 40, 2800 Mechelen or by email dpo@rodekruis.be.
You can always view your contact data and communication preferences online and adjust them via www.rodekruis.be/mijngegevens
Does Rode Kruis-Vlaanderen have a Data Protection Officer?
Yes, we have appointed a Data Protection Officer (DPO). This person has the special task of monitoring in what manner your data can be used and must be protected when we process it.
You can contact the Data Protection Officer:
- By post: Rode Kruis-Vlaanderen, attn. DPO, Motstraat 40, 2800 Mechelen;
- By email: DPO@rodekruis.be
Do you wish to lodge a complaint with the Data Protection Authority?
If you wish to lodge a complaint you can lodge it with the supervisory authority. For Belgium this is:
Gegevensbeschermingsautoriteit / Belgian Data Protection Authority
Drukpersstraat 35
1000 Brussels
Belgium
contact@apd-gba.be
tel 0032 2 247 48 00
Does Rode Kruis-Vlaanderen make decisions about you using technological resources without human intervention?
No. We do not use your data for automated individual decision making with legal consequences.
We do assemble the information which we receive via various channels (e.g. the website, registration forms, etc.). This enables us to know what activities or training you have participated in, whether you wish to donate blood, whether you are a volunteer with us, etc. This enables us to keep you informed of the activities of Rode Kruis-Vlaanderen and the affiliated NPOs which might be relevant for you.
You can always view and modify your data and communication preferences online via www.rodekruis.be/mijngegevens.