Privacy Policy
Data Protection Notice - Training Participants
This “Data Protection Notice” deals with the processing of personal data by Excentis, Gildestraat 8, 9000 Ghent (hereafter: “Excentis”).
Read this Data Protection Notice carefully because it contains essential information about how your personal data are processed as part of using our training services.
1. General
Excentis recognizes the importance of maintaining your privacy and is committed to protecting personal data of training participants. Excentis will treat your personal data in a careful, secure and confidential manner and only for specific purposes. Furthermore, Excentis only processes personal data that are necessary for this purpose and only for the necessary duration.
Excentis explicitly confirms that all personal data will be processed in accordance with both the Belgian law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data and the European Regulation 2016/679 of 27 April 2016 on the protection of natural persons regarding the processing of personal data and the free movement of such data (hereinafter GDPR).
Excentis acts as a data controller in this capacity as it determines both the purposes and the means of processing personal data.
2. Types of Personal Data collected
Personal data are any information which are related to an identified or identifiable natural person (“data subject”). An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Excentis can process the following data, which may be personal data of the data subject:
· Last name, first name
· Title
· Company
· Phone number
· Certificates
· Data on nutrition of the registered person for the purpose of providing meals
· Personal data of the person performing the registration such as last name, first name, title, e-mail
3. Use of Your Personal Data / Purposes
We process your personal data for the following purposes:
· Administrative and organizational tasks related to the registration of the person for one of the training courses;
· To invite the data subject to events organized by Excentis;
· Management of the student database;
· The delivery and management of a certificate issued by Excentis;
· Direct marketing purposes: Where you have explicitly given consent, your personal data may be used for sending newsletters and marketing emails related to the products and services that Excentis provides to the data subject.
We will only process this personal data for the above purposes unless explicit permission has been requested from the data subject to use it for purposes other than the purposes for which they were originally collected.
You are not obliged in any way to disclose your personal data, but in that case, the provision of certain services will become impossible.
4. Transfer of Your Personal Data
Excentis will not sell, rent, distribute or otherwise make your personal data commercially available to third parties, unless you have given your explicit consent or in the event of a corporate restructuring. In the latter case, this is subject to prior notification unless it is not feasible due to technical or commercial circumstances.
Depending on the purposes described above, certain personal data may be transferred to third parties.
More Specifically:
· We may provide personal information to course instructor(s);
· We may provide personal information to third-party platform providers in association with virtual course delivery and remote labs (Microsoft Teams, Zoom[BN1] );
· We may provide personal information to third-party companies providing invoicing and/or marketing services (Mailchimp, Odoo).
Excentis will, in any event, strive to keep the transfer to a minimum.
If data are transferred outside the European Economic Area (EEA), Excentis will provide appropriate safeguards by making sure that:
· The recipient of the data is established in a country where the EEA recognises that there is sufficient protection; or
· The recipient of the data has agreed to process the personal data according to the “Standard Contractual Clauses” for data controllers or processors approved by the European Commission.
Accredible
We use Accredible Certificate Cloud Services to issue digital certificates. Accredible has its headquarters in the United States, which means your personal data will be processed in the United States. The United States has not sought nor received a finding of “adequacy” from the European Union under Article 45 of the GDPR. Pursuant to Article 46 of the GDPR, Accredible is providing for appropriate safeguards by entering binding, standard data protection clauses, enforceable by data subjects in the EEA. The personal data we provide to Accredible is limited to your name, email address, issue date and the training type. The processing of your personal information by Accredible is restricted and governed by their privacy policy https://www.accredible.com/privacy-policy/ and Data Processing Agreement including Standard Contractual Clauses https://www.accredible.com/legal/dpa.
If you have any objection to this transfer and you do not want us to transfer your data to Accredible, you can contact us via gdpr@excentis.com.
5. Retention of Your Personal Data
Excentis will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Notice.
If the training participant receives a certificate of completion, the relevant data will be kept for 10 years after the last contact with the aim of demonstrating and proving the certification (we mean administrative data, data about the evaluation, attendance, date of issue certificate and attendance certificate) .
Personal data used for invoicing and accounting are kept for 7 years in accordance with the legal retention period.
For all other purposes, the retention period is 3 calendar years.
6. Data Subject Rights
You have the following rights regarding your personal data:
· Right to access: you have the right to request a copy of the Personal Data we are processing about you (including processing purposes, categories of personal data, estimated retention period). Exam questions do not belong to the category of personal data and are therefore never provided to students.
· Right to correction: you have the right to request us to correct or supplement your personal data when incomplete or inaccurate.
· Right to restriction: in some cases you may not want your personal data to be used any longer, but you also do not want it to be erased. The right to restriction of processing is meant for that purpose. Instead of being deleted, your data is ‘frozen’ and will no longer be used until further notice. You can invoke this right if you:
– believe that the Personal Data we hold about you is incorrect;
– believe that we are using your Personal Data unlawfully;
– want to secure the Personal Data for, for example, a lawsuit.
· Right to erasure (to be forgotten): if you believe the personal data we have about you is no longer necessary for the purpose for which it was collected or believe the processing of your personal data is unlawful, you can request to delete your Personal Data. Please, acknowledge that if you request the erasure of your Personal Data, some services and products will no longer be able to be supplied.
· Right to object: you have the right to object to the processing of your personal data for serious and legitimate reasons. In addition, you always have the right to oppose the use of personal data for direct marketing purposes; in such a case, you do not have to provide a justification.
· Right to data portability: you have the right to obtain your personal data processed by us in a structured, commonly used, and machine-readable form and/or to transfer them to other controllers for processing.
· Right to withdraw consent: to the extent that the processing is based on your prior consent, you have the right to withdraw such consent.
You can always contact Excentis to exercise these rights via gdpr@excentis.com or via the contact form on the website.
The rights set out above apply to you with regard to the processing of your own Personal Data. For example, you cannot ask to look at someone else’s personal data . For this reason, we need to verify your identity before responding to a request. If we don’t do this, there is a chance that we provide your data to a complete stranger, which would be an invasion of your privacy.
We will always process requests regarding your rights as quickly as possible. In any case, we will respond to your request within 30 days.
If you want to file a complaint about the infringement of your personal data, you should contact the supervisory authority. For this, please contact the data protection authority: Drukpersstraat 35, B-1000 Brussels, tel.: +32 (0)2 274 48 00, email: contact@apd-gba.be or www.gegevensbeschermingsautoriteit.be