Privacy policy

Content

1. Definitions
2. For whom does this privacy policy apply?
3. Contact details
4. Controller
5. What personal data RCA processes?
6. With whom do we share your personal data?
7. Security of your personal data
8. Storing your personal data
9. Cookies
10. What are your rights and how can you exercise them?

Definitions

Processing of personal data: Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly.

A processor: A processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

A controller: A controller is a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

For whom does this privacy policy apply?

This Privacy Policy applies to all direct customers, visitors, suppliers, applicants and all other persons who are not employees of RCA and of whom RCA processes personal data as controller. For the remainder of this Privacy Policy, an individual belonging to one of these groups is referred to as a “data subject”.

Contact details

Name: RCA GROUP NV 
KBO number: 0432.741.843 
Address: Koningin Astridlaan 38, 3500 Hasselt 
E-mail: info [at] rca.be (info[at]rca[dot]be)  
Phone number: +32 11.59.05.90 

Our Data Protection Officer (DPO) is registered with the Data Protection Authority and ensures that the processing of personal data by RCA is carried out in accordance with this Privacy Policy and the applicable data protection and privacy regulations. The Data Protection Officer can be reached by e-mail at dpo [at] rca.be (dpo[at]rca[dot]be).

Controller 

Only when RCA is acting in the capacity of data controller, points 5 to 10 of this Privacy Policy shall apply. 

If, as data subject, you want to exercise your rights, you must always address the data controller (responsible for the processing).

What personal data RCA processes?

Based on the performance of a contract  

RCA processes personal data necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to the conclusion of a contract. 

When requesting a quote 

When you request more information about the services or products of RCA you can request a quote through different channels (telephone, website, social media, …). RCA processes personal identification data (e.g. name and email) to provide you with an adequate proposal.  

When processing an order, following up on invoices and commercial agreements 

When you order services or products from or deliver to RCA, RCA processes personal identification data and professional data to correctly follow up the order or delivery. 

When applying for a job 

RCA regularly seeks new enthusiastic and motivated employees to join our team. During the job application procedure RCA processes the following categories of personal data:  personal identification data, personal characteristics (e.g. birthdate, language, …), competences, educational history, career, curriculum vitae, image, work references.   

When participating in an event 

RCA organises events. In the organisation of such an event, we process personal identification data, professional data at registration. 

When participating in a training course 

RCA organises training courses. We process your personal identification data and professional data for administrative follow-up. 

Based on consent 

When processing personal data based on your consent, you always have the right to withdraw your consent. (see 10. What are my rights and how can I exercise them?)  

When you subscribe to our newsletter. 

When you subscribe to our newsletter you give permission for sending a newsletter. RCA gives you the opportunity to unsubscribe from the newsletter. 

When completing a customer satisfaction survey 

RCA asks permission to link personal data (identification data and professional data) with the results of a customer satisfaction survey. We only use this data to improve our services. RCA uses a research agency as processor for this purpose, but it will not use the data for other purposes and will not pass it on to third parties for its own use. 

When creating a recruitment reserve 

If RCA does not hire you after a job application, but would like to keep you CV for future opportunities, RCA will ask for your permission to keep your CV. 

Use of targeted visual material on social media and the website. 

When publishing targeted images on social media and the website,  RCA will ask for your permission. With targeted images we mean images in which the person is clearly identifiable (close-up, image focused on a certain person, posed photo, ...). 

When indicating eating preferences if you register for an event and/or training course. 

If you wish, when registering for an event or training you can indicate your food preferences, so that we can provide suitable food for catering. Only quantities and no personal details are passed on to the catering company. 

When improving the quality of the website 

RCA uses tools to gather statistics and gain insights about the use of the website. This information is anonymised and not linked to your personal information. Analytics tools use cookies. These are text files that are placed on your computer to collect standard internet logging information and behavioural information. More information can be found in our cookie statement. 

Based on the legitimate interest  

RCA processes personal data based on a legitimate interest in which RCA has made a balancing of interests. 

When using security cameras 

In and around the buildings of RCA cameras are installed for the purpose of preventing, detecting or identifying nuisances or crimes against persons and goods and maintaining public order. Images are collected, processed and stored for this purpose. 

When dealing with a question, offering help or offering information at your request 

You can contact RCA through various channels (telephone, correspondence, email, chat, contact form website, social media). We will only use the personal data you provide to answer your questions. 

When sending direct marketing 

RCA sends direct marketing and thereby processes personal identification data. RCA respects related regulations, whereby only direct marketing is sent if there is a customer relationship, with regard to the similar products or services that RCA itself provides. As a data subject, you always have the possibility to unsubscribe. 

When inviting a customer satisfaction survey 

RCA invites customers to participate in a customer satisfaction survey. For this purpose we work together with a research agency. 

When carrying out competency tests during the application period 

In order to screen an applicant, RCA conducts an assessment of the candidate’s competences and personality. RCA will use an assessment agency as a processor, but we will not use the data for other purposes and will not pass them on to third parties for their own use. 

When creating an application summary list showing the status for each data subject involved 

Due to the many applications that RCA processes and the different channels through which new candidates are introduced, there is a legitimate interest in creating a list so that candidates we refuse do not re-examine after a few weeks. This list only contains personal identification data. 

When keeping contact details to notify you as a friend or family member of our employee in the event of an emergency 

We ask our employees to provide contact details of an acquaintance and/or family member so that we can notify them in the event of an emergency. 

When using images for public relations and/or journalistic purposes 

When RCA organises a company event, RCA  has a legitimate interest in doing public relations in order to attract new employees and/or new customers. The visitors of the event are informed in advance and have the opportunity to oppose taking the photo: at the event itself against the photographer or after the event by sending an email to dpo [at] rca.be (dpo[at]rca[dot]be). 

Compatible purpose 

If we have collected your personal data under a legitimate interest or agreement, we may also use this data in the future for another purpose that is compatible with the original purpose. In doing so, we consider the following aspects: 

• The link between the original purpose and the new/future purpose; 
• The context in which the data has been collected (what is the relation between you and Biobest); 
• The type and nature of the data (does it concern sensitive data?); 
• The possible consequences of the intended processing (what are the consequences for the data subject?); 
• The existence of adequate guarantees (such as encryption or pseudonymisation).

With whom do we share your personal data? 

RCA does not share your personal data with third parties, unless: 

• RCA has received your prior consent; 
• RCA is obliged to do so in the context of a regulation or legal procedure; 
• RCA is requested to do so by legislative or judicial authorities; 
• RCA organises an event together with partners or suppliers. The list of participants will also be communicated to the partners or suppliers; 
• RCA is taken over in whole or in part or split up. In that case, RCA will impose on the third party the obligation to process the personal data only in accordance with the provisions of this Privacy Policy. 
• RCA makes use of certain subcontractors such as consultants, study agencies (e.g. for conducting satisfaction surveys, tools (e.g. CRM system, mailing tool) and this in order to outsource some of our services to them. These subcontractors are not considered third parties but processors. We ensure that these subcontractors take the necessary technical and organisational measures to process your personal data legally and lawfully and under no circumstances disclose your personal data to third parties.

Security of your personal data 

RCA recognises that the security of personal data is part of data protection. Therefore, RCA takes appropriate technical and organisational measures to protect your personal data against unauthorised processing or unauthorised access in order to prevent misuse. 

Whenever personal data is transferred to a processor outside the European Economic Area (EEA), RCA will always do so in accordance with the terms of this Privacy Policy and RCA will follow applicable data protection laws and regulations to ensure adequate safeguards. 

Storing your personal data

RCA bewaart je persoonlijke gegevens alleen voor de minimumperiode die nodig is om de, in deze Privacyverklaring uiteengezette, doeleinden te vervullen, tenzij (i) een langere bewaartermijn nodig is bij het oplossen van geschillen of (ii) als een langere bewaartermijn wettelijk verplicht is. Niet-persoonlijke informatie kan zonder beperking in de tijd worden bewaard in functie van statistische doeleinden. 

Cookies 

RCA will only keep your personal information for the minimum period necessary to fulfil the purposes set forth in this Privacy Policy unless (i) a longer retention period is required to resolve disputes or (ii) a longer retention period is required by law. Non-personal information may be retained indefinitely for statistical purposes. 

You can find more information about our cookie policy here.

What are your rights and how can you exercise them? 

Wat are your rights?

• Right of access: You can ask us which personal data we process about you, for which we process it, which categories of personal data we process, with which categories of third parties we share your personal data, the origin of the processed data and - if applicable - what logic we use in the automatic processing of personal data. 
• Right to rectification: If information is incorrect, you can ask us to correct it. 
• Right to delete your data: If data is not processed lawfully or if your data is no longer necessary for the purpose for which it was collected, you can ask us to delete your data. 
• Right to restrict processing: By restricting the processing of your personal data, your personal data can still be kept but its use is limited. When you have requested a processing restriction, we may only store your data. This means that no other transactions can take place with your data. 
• Right to object: You have the right to object to the fact that your data is processed if that processing is based on a general interest or the legitimate interest of the person processing your data. Moreover, you can also exercise this right of objection if your personal data are processed for direct marketing purposes. This right of objection also applies to profiling, which forms the basis for processing for direct marketing purposes. 
• The right to withdraw consent: If the processing of your personal data is based on consent, you have the right to withdraw your consent at any time. 
• The right to transfer data: You have the right to obtain the personal data provided by you in a standard, structured and machine-readable form and you have the right to transfer these personal data to another controller if the processing is based on the legal grounds of consent or contractual relationship. 

How can you exercise you rights?

You can exercise your rights by sending an e-mail to dpo [at] rca.be (dpo[at]rca[dot]be).  In order to prevent any unauthorised disclosure of your personal information RCA may request more information to verify your identity. 

• RCA has one month to answer your request. This period will begin when RCA has received your request and has all the necessary information to fulfil your request. The period of one month can be extended after a notification and explanation of RCA. 
• RCA will provide the requested information free of charge. If requests are unfounded or excessive, in particular because of their repetitive nature, RCA may charge a reasonable fee or RCA may refuse the request. 

If for any reason you assume that RCA did not handle your request correctly, you may contact RCA again and we will work with you to find a solution. 

For the sake of completeness, we inform you that if RCA does not respond to your request, refuses it or if our response does not meet your expectations, you always have the right to file a complaint with the Data Protection Authority (GBA), Drukpersstraat 35, 1000 Brussel, Tel +32 (0)2 274 48 00, or contact [at] apd-gba.be (contact[at]apd-gba[dot]be).