Privacy Policy DigiChambers

v2

This Privacy Policy governs the processing of your personal data by your Chamber of Commerce (hereinafter: “Chamber”) when you register on, request certificates of origin via and in general make use of the DigiChambers application (“DigiChambers”).

1 WHO IS RESPONSIBLE?

Short: While the DigiChambers application is offered by DigiChambers NV, your personal data are in fact processed under the responsibility of your Chamber. All your requests regarding the processing of your personal data should be made directly to your Chamber.

1. DIGICHAMBERS NV, having its registered seat at Belliardstraat 2, 1040 Brussels, RPR Brussels 0898.600.080, makes DigiChambers available to you on behalf of your Chamber. Your Chamber is responsible for the processing of your personal data. You can find the contact details of your Chamber in the list at the end of this Privacy Policy. Any question or request you may have regarding to processing of your personal data via DigiChambers, is to be directed at your Chamber.

If you are unsure who to contact, please send an e-mail with your request to digichambers@belgianchambers.be, indicating your identity, function and organization you belong to and DIGICHAMBERS NV will refer your request to the responsible Chamber.

2. This Privacy Policy can be modified, changed or amended from time to time. Such modification, change or amendment shall be communicated via DigiChambers. If you do not accept the modifications, changes or amendments, you are to inform DIGICHAMBERS NV, acting on behalf of your Chamber, by sending an e-mail to digichambers@belgianchambers.be. If DIGICHAMBERS NV does not receive such an e-mail from you within three (3) business days after the changes to the Privacy Policy have been announced in a visible manner on DigiChambers, you will be deemed to have unambiguously accepted all such changes.

2 WHAT SORT OF PERSONAL DATA ARE PROCESSED?

Short: The types of personal data which are processed via DigiChambers largely depend on your role as user of DigiChambers. For users who request certificates of origin on behalf of, or manage such certificates for, their company or organization, different categories of personal data are processed than for users who are employees of Chambers issuing certificates. Indeed, of the former category of users the processing is limited to personal identification data and current employment, while for the latter category signatures are also processed.

1. If you are a user who uses DigiChambers for and on behalf of your organization for requesting and managing certificates of origin (“Organization User”), the following personal data categories are processed:

• personal identification data, such as your name and e-mail address;
• electronic identification data associated with the device you use, such as your IP address, browser type and operating system;
• information concerning your browsing behaviour, such as how long you visit, what links you click on, what pages you visit and how many times you visit a page;
• current employment, such as the organization you work for.

2. If you are a user who uses DigiChambers on behalf of a Chamber (“Chamber User”), the following personal data categories are processed:

• personal identification data, such as your name and e-mail address;
• electronic identification data associated with the device you use, such as your IP address, browser type and operating system;
• information concerning your browsing behaviour, such as how long you visit, what links you click on, what pages you visit and how many times you visit a page;
• current employment, such as the organization you work for;
• your signature;
• personal data related to the number of requests processed.

3 WHY ARE YOUR PERSONAL DATA PROCESSED?

Short: Your personal data are processed for a number of reasons, which again depend on which type of user you are. If you are an Organization User, then your personal data are mainly processed to allow you to use the DigiChambers application for your organization. If you are a Chamber User, your personal data are processed to allow you to issue certificates of origin as well as to follow up on service delivery. In this section you can find an overview of all the reasons why your personal data are processed.

1. As an Organization User your personal data mentioned in 2.1 are processed for the following reasons:

1. to allow you to request and manage certificates of origin for your organization;
2. to communicate with you regarding your use of DigiChambers;
3. for invoicing and evidence purposes;
4. for statistical reasons;
5. to improve the DigiChambers platform and its related services;
6. for security reasons and misuse detection, prevention and reporting;
7. to inform any third party in the context of a possible merger with, acquisition from/by or demerger by that third party, even if that third party is located outside the EU;
8. to comply with legal obligations as well as with any valid request from police, judicial or governmental authorities.

2. As a Chamber User your personal data mentioned in 2.2 are processed for the following reasons:

1. to allow you to perform your tasks concerning issuing and following up on certificates of origin;
2. to allow you to communicate with other users via DigiChambers;
3. for evidence purposes;
4. for statistical reasons;
5. to improve the DigiChambers platform and its related services;
6. for security reasons and misuse detection, prevention and reporting;
7. to inform any third party in the context of a possible merger with, acquisition from/by or demerger by that third party, even if that third party is located outside the EU;
8. to comply with legal obligations as well as with any valid request from police, judicial or governmental authorities.

4 WHAT MAKES THE PROCESSING OF YOUR PERSONAL DATA LEGITIMATE?

Short: The law obliges your Chamber to specify which legal basis it relies on to process your personal data (e.g. your consent). In this section it is specified per purpose as listed above which such basis is used.

1. The data protection laws require the Chamber to precisely indicate to you which legal option it relies on to make the processing of your personal data legitimate. This needs to be clarified for each of the purposes listed in section 3 above.

2. For purposes 3.2 (a) and (b) your personal data are processed because it is necessary to perform the agreement with you.

3. For the purposes under 3.1 (a) to (g) and those under 3.2 (c) to (g) your personal data are processed for the legitimate interests of your Chamber, which in this case concern:

• to be able to provide the use of DigiChambers and allow for associated communications;
• to be able to report to the International Chamber of Commerce;
• to retain the necessary data in case of possible disputes;
• gaining insights in how DigiChambers is used;
• your Chamber’s interests to improve its services;
• security and safety interests;
• being able to conclude corporate transactions.

4. For purpose 3.1 (h) and 3.2 (h) your Chamber needs to process your personal data to comply with its legal obligations.

5 RECIPIENTS AND TRANSFERS

Short: Your personal data are shared with a limited number of parties, such as yourself and your Chamber’s own service providers, as well as the federations and international organizations to which your Chamber retains a membership. In this section it is specified to whom your personal data are sent and how it is ensured that your personal data are kept safe when sent abroad

1. Your personal data will be sent to the following categories of recipients:

• yourself;
• your contacts or business relations upon your request;
• our partners and service providers;
• our federation (which is the Federation of Belgian Chambers of Commerce) and the International Chamber of Commerce;
• governmental, judicial and other competent bodies.

2. Your personal data are transferred to the International Chamber of Commerce based in Paris. Your personal data will be processed in accordance with the requirements of the General Data Protection Regulation 2016/679

6 HOW LONG ARE YOUR PERSONAL DATA RETAINED?

Short: You Chamber will only retain your personal data as long as required to achieve the purposes listed in section 3.

1. Your personal data are only processed for as long as needed to achieve the purposes listed in section 3 above. Your Chamber will de-identify your personal data when they are no longer necessary for these purposes, unless there is:

• an overriding interest of your Chamber in keeping your personal data identifiable;
• a legal or regulatory obligation or a judicial or administrative order that prevents your Chamber from de-identifying them.

7 WHAT RIGHTS DO YOU HAVE?

Short: You have a right to access, correct or erase your personal data or limit or oppose the processing of your personal data. You also have a right to data portability. In this section you will find out how and under which conditions you may exercise these rights

1. You have the right to request access to all personal data processed by your Chamber via DigiChambers insofar it pertains to you. Your Chamber reserves the right to refuse multiple requests for access that are clearly submitted for causing nuisance or harm to your Chamber or others.

2. You have the right to ask that any personal data pertaining to you which are inaccurate, are corrected free of charge. If a request for correction is submitted, such request must be accompanied of proof of the flawed nature of the data for which correction is asked.

3. You have the right to request that personal data pertaining to you will be deleted if they are no longer required in light of the purposes outlined above. However, you need to keep in mind that a request for deletion will be evaluated by your Chamber against:

• your Chamber’s overriding interests;
• legal or regulatory obligations or administrative or judicial orders which may contradict such deletion.

Instead of deletion you can also ask that your Chamber limits the processing of your personal data if and when (a) you contest the accuracy of that data, (b) the processing is illegitimate or (c) the data are no longer needed for the purposes which are outlined above, but you need them to defend yourself in judicial proceedings. You have the right to oppose the processing of personal data for the purposes listed in article 3.1 (a) to (g) and 3.2 (c) to (g) in section 3, but you are required to explain your particular circumstances on which your request for opposition is based.

4. You have the right to request that the personal data you have provided to us for the purposes 3.2 (a) and (b), will be made available to you in a machine-readable format.

5. Each request can be sent via e-mail to your Chamber via the e-mail address listed below.

An e-mail requesting to exercise a right will not be understood as consent with the processing of your personal data beyond what is required for handling your request. Such request should clearly state and specify which right you wish to exercise and the reasons for it, if such is required. It should also be dated, signed and accompanied by a digitally scanned copy of your valid identity card proving your identity.

Your Chamber will promptly inform you of having received this request. If the request proves valid, your Chamber will notify you as soon as reasonably possible and at the latest thirty (30) days after having received the request.

If you have any complaint regarding the processing of your personal data by your Chamber, you may always contact your Chamber via the e-mail address mentioned in the first paragraph of this clause. If you remain unsatisfied with the response, you may file a complaint with the competent data protection authority, i.e. the Belgian data protection authority

Chambers of Commerce in Belgium