Privacy policy

Who are we?

KELA’s role as data controller

We would like to use this Statement (hereinafter the ‘Statement‘) to inform you why and how your personal data is being collected and processed by the KELA GROEP, comprising the Belgian KELA affiliates (hereinafter jointly referred to as ‘we‘ or ‘KELA‘). Your personal data is centrally collected and stored at KELA. The Belgian KELA affiliates, which are not regarded as third parties in relation to each other, shall process your personal data in accordance with this Statement.

You can find our contact details in Section 10 of this Statement.

We are responsible for the processing of any personal data that we request and use. As the data controller, we take the appropriate measures to ensure that you:

remain informed about our processing of your personal data and about your rights;
maintain control over the personal data that we process;
can exercise your rights regarding your personal data. More information about your rights can be found in Section 9 of this Statement.

What information do we collect about you?

Personal data

‘Personal data’ should be understood to mean all information that refers to a certain living natural person. The type of personal data that we collect depends on the services you request, and includes, where applicable, data about you and/or your representatives, staff, independent employees and/or directors (hereinafter together also referred to as ‘you’ or ‘your’).

If we receive any personal information from you relating to your representatives, personnel, independent employees and/or directors, you are required to inform them of the existence and content of this Statement, including our duties, their rights and the way in which they can exercise these rights.

In particular, we collect administrative information and contact details. This information allows us to identify you, contact you, or do business with you if you are a customer, supplier or business partner. This personal data may include contact details such as your name, address, telephone number, email address, or your bank account number.

As to so-called sensitive data, we only collect and process personal health data, if you voluntarily provide us with it. More information about this subject can be found in our privacy statement for patients.

Minors

It is not our intention to process the personal data of minors.

What do we need your data for?

Service and customer relationship

What does this purpose mean?

We need personal data to:

enter you as a prospect, customer, supplier or business partner and manage this information in our internal management system;
contact you as a customer, supplier or business partner and coordinate with you in connection with the delivery of the requested products and/or execution of the services that you have requested;
invoice you for our products and/or services, or to make settlements for delivered products / services.

Which personal data do we process for the above purposes?

We collect and process your name, email address, telephone number, street address and national insurance number / company number / VAT number.

Information and commercial communications

What does this purpose mean?

We would like to be able to inform you about our products, services, events or relevant news items. This may be done at your explicit request, or if we suspect that you might be interested in or benefit from a service.

You will receive our direct marketing communications if you have given us your explicit permission to send it to you. We will specifically ask you for explicit permission if you do not have an existing business relationship with us.

But even if you do not give us permission, you can still receive offers or advertisements from us, especially if you already have an existing relationship with us. We will provide this information on the basis of our legitimate interest.

If you do not want any advertising at all, use your right of opposition to direct marketing, as stated in Section 9.2 of this Statement.

Which personal data do we process for the above purposes?

We collect and process your name, email address, telephone number, street address, as well as data relating to the areas of interest that you have indicated.

Because it is necessary to be able to function as a company

What does this purpose mean?

This purpose amounts to what is called ‘legitimate interest’. We do indeed have a number of additional legitimate interests that justify the processing of personal data. Such processing only occurs after we have duly considered that the balance between our legitimate interests and the potential impact on your privacy will not be disturbed.

Should you have any objections to such processing operations, you can exercise your right to object, as stated in Section 9.3 of this Statement.

Personal data shall be processed in various situations, such as when:

Personal data can serve as evidence (archives);
Personal data can be used for the determination, exercise, defence and safeguarding of our rights or those of the persons who may represent us (e.g. in case of disputes);
Personal data can be used for the administration, (risk) management and auditing of our organisation, with regard to such concerns as compliance (e.g. money laundering and fraud prevention and investigations, and privacy), risk management, risk functions and inspection, complaints management, internal and external audits;
Personal data can be used to support and simplify the purchase, use and termination of services by the customer by, for example, not having to re-enter information that you have already provided.

Profiling

Your personal data will not be used for profiling purposes.

Cookies

The KELA websites make use of cookies. These are small text files that are stored on your device, and similar technologies. More information can be found in our cookie statements on the relevant websites.

Do we ask for your permission to process?

General

Your personal data can only be used and processed by us lawfully if one of the following conditions is met:

the use of your personal data is required for the execution of an agreement that you have concluded with us or, at your request, in order to take the necessary steps to reach an agreement with us;The processing purposes mentioned in Section 3.1 of this Statement are based on this foundation.
we have your explicit and free consent to use your personal data for a specific purpose;We will therefore request your consent to contact you for direct marketing purposes, as mentioned in Section 3.2 of this Statement, if you do not yet have a customer relationship with us.
the use of your personal data is necessary for the representation of our legitimate interests, to the extent that this outweighs your interests and rights;We base the processings that are necessary to function as a company on our legitimate interest, as stated in Section 3.3 of this Statement, and to be able to write to our existing relations based on direct marketing considerations, as mentioned in Section 3.2 of this Statement.
we may be required by law to process certain data and, in particular, submit it to the relevant authorities.
we may be required by law to process certain data and, in particular, submit it to the relevant authorities.

With whom do we share your personal data?

Only our employees who require actual access for the effective performance of their duties will have access to your data. These persons act under our supervision and responsibility.
In addition, we also engage external suppliers, which carry out certain processing tasks for us so that we can offer our products and activities to you, such as: IT services, financial, accounting and other similar services. Since these third parties have access to personal data within the framework of the services that we have requested, we have taken technical, organisational and contractual measures to ensure that your personal data is only processed and used for the purposes mentioned in Section 3 of this Statement.
Your personal data may be provided to supervisory agencies, tax authorities and investigative services only if we are legally required to do so.

Where is the data stored and processed?

Your data will not be transmitted outside the EU, and we shall unquestionably ensure that legal minimum requirements and safety standards are respected at all times. If we foresee that your data will be stored and processed outside the EU, we will explicitly indicate this and ensure that the level of security implemented matches that used in the EU.

Your personal data will never be transferred or made available to third parties outside the above circumstances and will only be used for our benefit. Other companies will not be able to use your data to send you advertising, for example.

How long do we keep your personal data?

We will only keep your data for the period required to achieve the purpose for which the data is used as indicated in Section 3 of the Statement. Any deviations or clarifications of this principle are explicitly mentioned in the descriptions of the various purposes in Section 3 of this Statement.

Since the need to store data may vary by data type as well as by processing purpose, actual retention periods may vary considerably.

We can hereby inform you that the following criteria are taken into consideration when determining retention periods:

How long is the personal data needed to be able to provide the requested service?
Have we established and announced a specific retention period?
Have we received permission for a longer retention period?
Do we have a legal, contractual or similar obligation to keep the data?

As soon as your data is no longer required and provided we do not have a legal obligation to retain it, we will permanently delete it or, if this is not possible, make it anonymous in our systems.

However, your personal data will be retained and used for as long as necessary to comply with our legal obligations, to settle disputes or to enforce our agreements.

How do we secure your personal data?

Your personal data is considered strictly confidential. We take the appropriate technical and organisational measures to protect supplied and collected personal data against destruction, loss, unintended alteration, damage, accidental or unauthorised access, or any other unauthorised processing of personal data.

What are your rights?

Right to access, rectification, erasure and portability of data, as well as of objection

Right to access your personal data

You always have the right to access and inspect your personal data processed by us. We will provide you with a free copy of this personal data in this connection, should you so request.