Privacy policy

Privacy policy

Who are we?

KELA’s role as data controller

We would like to use this Statement (hereinafter the ‘Statement‘) to inform you why and how your personal data is being collected and processed by the KELA GROEP, comprising the Belgian KELA affiliates (hereinafter jointly referred to as ‘we‘ or ‘KELA‘). Your personal data is centrally collected and stored at KELA. The Belgian KELA affiliates, which are not regarded as third parties in relation to each other, shall process your personal data in accordance with this Statement.

You can find our contact details in Section 10 of this Statement.

We are responsible for the processing of any personal data that we request and use. As the data controller, we take the appropriate measures to ensure that you:

  • remain informed about our processing of your personal data and about your rights;
  • maintain control over the personal data that we process;
  • can exercise your rights regarding your personal data. More information about your rights can be found in Section 9 of this Statement.

What information do we collect about you?

Personal data

‘Personal data’ should be understood to mean all information that refers to a certain living natural person. The type of personal data that we collect depends on the services you request, and includes, where applicable, data about you and/or your representatives, staff, independent employees and/or directors (hereinafter together also referred to as ‘you’ or ‘your’).

If we receive any personal information from you relating to your representatives, personnel, independent employees and/or directors, you are required to inform them of the existence and content of this Statement, including our duties, their rights and the way in which they can exercise these rights.

In particular, we collect administrative information and contact details. This information allows us to identify you, contact you, or do business with you if you are a customer, supplier or business partner. This personal data may include contact details such as your name, address, telephone number, email address, or your bank account number.

As to so-called sensitive data, we only collect and process personal health data, if you voluntarily provide us with it. More information about this subject can be found in our privacy statement for patients.

Minors

It is not our intention to process the personal data of minors.

What do we need your data for?

Service and customer relationship

What does this purpose mean?

We need personal data to:

  • enter you as a prospect, customer, supplier or business partner and manage this information in our internal management system;
  • contact you as a customer, supplier or business partner and coordinate with you in connection with the delivery of the requested products and/or execution of the services that you have requested;
  • invoice you for our products and/or services, or to make settlements for delivered products / services.

Which personal data do we process for the above purposes?

We collect and process your name, email address, telephone number, street address and national  insurance number / company number / VAT number.

Information and commercial communications

What does this purpose mean?

We would like to be able to inform you about our products, services, events or relevant news items. This may be done at your explicit request, or if we suspect that you might be interested in or benefit from a service.

You will receive our direct marketing communications if you have given us your explicit permission to send it to you. We will specifically ask you for explicit permission if you do not have an existing business relationship with us.

But even if you do not give us permission, you can still receive offers or advertisements from us, especially if you already have an existing relationship with us. We will provide this information on the basis of our legitimate interest.

If you do not want any advertising at all, use your right of opposition to direct marketing, as stated in Section 9.2 of this Statement.

Which personal data do we process for the above purposes?

We collect and process your name, email address, telephone number, street address, as well as data relating to the areas of interest that you have indicated.

Because it is necessary to be able to function as a company

What does this purpose mean?

This purpose amounts to what is called ‘legitimate interest’. We do indeed have a number of additional legitimate interests that justify the processing of personal data. Such processing only occurs after we have duly considered that the balance between our legitimate interests and the potential impact on your privacy will not be disturbed.

Should you have any objections to such processing operations, you can exercise your right to object, as stated in Section 9.3 of this Statement.

Personal data shall be processed in various situations, such as when:

  • Personal data can serve as evidence (archives);
  • Personal data can be used for the determination, exercise, defence and safeguarding of our rights or those of the persons who may represent us (e.g. in case of disputes);
  • Personal data can be used for the administration, (risk) management and auditing of our organisation, with regard to such concerns as compliance (e.g. money laundering and fraud prevention and investigations, and privacy), risk management, risk functions and inspection, complaints management, internal and external audits;
  • Personal data can be used to support and simplify the purchase, use and termination of services by the customer by, for example, not having to re-enter information that you have already provided.

Profiling

Your personal data will not be used for profiling purposes.

Cookies

The KELA websites make use of cookies. These are small text files that are stored on your device, and similar technologies. More information can be found in our cookie statements on the relevant websites.

Do we ask for your permission to process?

General

Your personal data can only be used and processed by us lawfully if one of the following conditions is met:

  • the use of your personal data is required for the execution of an agreement that you have concluded with us or, at your request, in order to take the necessary steps to reach an agreement with us;The processing purposes mentioned in Section 3.1 of this Statement are based on this foundation.
  • we have your explicit and free consent to use your personal data for a specific purpose;We will therefore request your consent to contact you for direct marketing purposes, as mentioned in Section 3.2 of this Statement, if you do not yet have a customer relationship with us.
  • the use of your personal data is necessary for the representation of our legitimate interests, to the extent that this outweighs your interests and rights;We base the processings that are necessary to function as a company on our legitimate interest, as stated in Section 3.3 of this Statement, and to be able to write to our existing relations based on direct marketing considerations, as mentioned in Section 3.2 of this Statement.
  • we may be required by law to process certain data and, in particular, submit it to the relevant authorities.
  • we may be required by law to process certain data and, in particular, submit it to the relevant authorities.

With whom do we share your personal data?

  • Only our employees who require actual access for the effective performance of their duties will have access to your data. These persons act under our supervision and responsibility.
  • In addition, we also engage external suppliers, which carry out certain processing tasks for us so that we can offer our products and activities to you, such as: IT services, financial, accounting and other similar services. Since these third parties have access to personal data within the framework of the services that we have requested, we have taken technical, organisational and contractual measures to ensure that your personal data is only processed and used for the purposes mentioned in Section 3 of this Statement.
  • Your personal data may be provided to supervisory agencies, tax authorities and investigative services only if we are legally required to do so.

Where is the data stored and processed?

Your data will not be transmitted outside the EU, and we shall unquestionably ensure that legal minimum requirements and safety standards are respected at all times.  If we foresee that your data will be stored and processed outside the EU, we will explicitly indicate this and ensure that the level of security implemented matches that used in the EU.

Your personal data will never be transferred or made available to third parties outside the above circumstances and will only be used for our benefit. Other companies will not be able to use your data to send you advertising, for example.

How long do we keep your personal data?

We will only keep your data for the period required to achieve the purpose for which the data is used as indicated in Section 3 of the Statement. Any deviations or clarifications of this principle are explicitly mentioned in the descriptions of the various purposes in Section 3 of this Statement.

Since the need to store data may vary by data type as well as by processing purpose, actual retention periods may vary considerably.

We can hereby inform you that the following criteria are taken into consideration when determining retention periods:

  • How long is the personal data needed to be able to provide the requested service?
  • Have we established and announced a specific retention period?
  • Have we received permission for a longer retention period?
  • Do we have a legal, contractual or similar obligation to keep the data?

As soon as your data is no longer required and provided we do not have a legal obligation to retain it, we will permanently delete it or, if this is not possible, make it anonymous in our systems.

However, your personal data will be retained and used for as long as necessary to comply with our legal obligations, to settle disputes or to enforce our agreements.

How do we secure your personal data?

Your personal data is considered strictly confidential. We take the appropriate technical and organisational measures to protect supplied and collected personal data against destruction, loss, unintended alteration, damage, accidental or unauthorised access, or any other unauthorised processing of personal data.

What are your rights?

Right to access, rectification, erasure and portability of data, as well as of objection

Right to access your personal data

You always have the right to access and inspect your personal data processed by us. We will provide you with a free copy of this personal data in this connection, should you so request.

Please refer to Section 9.3. of this Statement for more information about the exercise of your rights.

Right to correct your personal data

You always have the right to have incorrect, incomplete, inappropriate or outdated personal data removed or rectified.

Please refer to Section 9.3. of this Statement for more information about the exercise of your rights.

Should you dispute the accuracy of personal data, you may request a limitation of processing during a period sufficient to enable us to check the correctness of the data. If you have obtained the right to limit processing, we will no longer carry out any transactions with the personal data concerned, aside from storing it.

Right to withdraw your consent

If the processing is based on your consent as stipulated in Section 4.1, you have the right to withdraw this consent at any time.

Please refer to Section 9.3. of this Statement for more information about the exercise of your rights.

Right to object to certain processing operations

If your personal data is being processed for statistical purposes, you have the right to object to the processing of your personal data for reasons related to your specific situation.

Please refer to Section 9.3. of this Statement for more information about the exercise of your rights.

If you have objected to a processing procedure, you have the right to ask us to limit the processing until a determination is made of whether our justified grounds outweigh those that motivate you. If you have obtained the right to limit processing, we will no longer carry out any transactions with the personal data concerned, aside from storing it.

Right to transferability of your personal data

With regard to the processing of your personal data on the basis of your consent or because this is necessary for the delivery of the requested products or services, you can ask us to send your personal data to you in a structured, current and digital form, so that you can store it for personal (re-)use, or to forward it directly to another data controller, providing this is technically possible for us.

Please refer to Section 9.3. of this Statement for more information about the exercise of your rights.

Right to portability of your personal data

With regard to the processing of your personal data on the basis of your consent or because this is necessary for the delivery of the requested products or services, you can ask us to send your personal data to you in a structured, current and digital form, so that you can store it for personal (re-)use, or forward it directly to another data controller, providing this is technically possible for us.

Please refer to Section 9.3. of this Statement for more information about the exercise of your rights.

Right to object to direct marketing

As stated above in Section 4.1, we ask your permission to address commercial information, advertising or personal proposals to you (via direct marketing campaigns or electronic newsletters). You have the right to object to the processing of your data for direct marketing purposes if you do not or no longer wish to receive such communications from us. We will then no longer process your data for direct marketing purposes. Your request will be executed as soon as possible.

Please refer to Section 9.3. of this Statement for more information about the exercise of your rights.

If you have previously exercised your right of objection, you can, if you so wish, use the same channels to later permit us to again perform direct marketing activities.

We draw your attention to the fact that your exercise of the right of objection does not prevent us from contacting you for any other purpose in accordance with this Statement, including the execution of the contract.

How to exercise your rights?

To exercise the aforementioned rights, please address a written request to us in the following manner:

  • by email: privacy@kela.health
  • in writing to the following postal address:
    Kela NV
    For the attention of Privacy@Kela
    Sint Lenaartseweg 48
    2320 Hoogstraten
    Belgium

When exercising your right, we request that you clearly state the right that you wish to invoke and the processing procedure(s) to which you object or for which you wish to withdraw your consent.

Points to note when exercising rights

We would like to inform you that an objection to certain processing operations or the withdrawal of your consent for certain manners of processing of your personal data may mean that you are no longer informed about or able to use our offered activities or services.

How can you submit questions or complaints?

If you have a question or complaint about our processing of personal data, you can contact us via the following channels:

  • by email: privacy@kela.health
  • in writing to the following postal address:
    Kela NV
    For the attention of Privacy@Kela
    Sint Lenaartseweg 48
    2320 Hoogstraten
    Belgium

If you are not satisfied with our reply, if you have comments about the exercise of your rights or if you believe that our processing of your personal data is not in line with legislation, you have the right to submit a complaint regarding this matter to the Data Protection Authority. All information on this subject can be found at https://www.gegevensbeschermingsautoriteit.be/.

Changes to this Statement

This Statement may be amended or supplemented by us whenever we consider it necessary.

In the event of major changes to this Statement, its amendment date will be recorded and we will inform you about it.

We also encourage you to periodically review this Statement to remain informed about the ways in which we are processing and protecting your personal data.