VVV Zuid Limburg respects your personal data and ensures that the personal information supplied to us or otherwise obtained by us is treated in confidence. By ‘personal data’ we mean all information about a person – including information that indirectly tells us something about someone. This privacy statement implements the requirements of the EU General Data Protection Regulation (the ‘GDPR’) concerning the duty to inform data subjects whose personal data is processed by VVV Zuid-Limburg.
VVV Zuid-Limburg is a foundation established under civil law registered in the trade register under number 14063449. Its principal business address is at Walramplein 6, 6301 DD Valkenburg aan de Geul. We are designated the controller by virtue of the fact that we receive and process personal data as defined by the GDPR. If you have any questions about the way we process personal data, we invite data subjects to contact us at VVV Zuid-Limburg.
What personal data does VVV Zuid-Limburg process?
VVV Zuid-Limburg processes various sorts of personal data for various purposes. By ‘personal data’ we mean information by which a person can be identified, such as name, address, date of birth, or bank account number. In some circumstances an IP address or user name may also be regarded as personal data.
When we supply services, consisting primarily of providing information for tourism and recreation purposes, VVV Zuid-Limburg processes various kinds of personal data. For example, we use the name and contact details of our business relations so that we can put them in contact with customers. We process a range of personal data of visitors (consumers) to Zuid-Limburg, to act as agent in making agreements with the organisers of activities in Zuid-Limburg or to inform them about such activities. In some cases we also have to share this personal data with third parties. We must always register this so that we can inform data subjects about this matter if subsequently requested.
Acquisition and direct marketing
To be able to expand our services and offer new products we sometimes use direct marketing, for which purposes we will process personal data. This personal data may only be processed by a select group of employees within our organisation who are involved in the search for potential new business relations, clients, etc. This form of data processing is based on the statutory principle of justified commercial interests.
Obviously, VVV Zuid-Limburg also processes personal data concerning our own employees. This form of processing is based on the underlying contractual relationship and the statutory obligations placed on employers.
Potential new employees
In the context of recruitment procedures VVV Zuid Limburg is also required to process the personal data of job applicants. This involves the processing of personal data such as name, address, telephone number, education and work experience, and so forth. We need this personal data so that we can carefully assess each job applicant. The data will not be stored for longer than six months following a decision regarding appointment for the vacancy. Should the need arise, VVV Zuid-Limburg will only store personal data for any future vacancies and/or job solicitations with the consent of the relevant data subject.
VVV Zuid-Limburg uses social media (LinkedIn, Facebook, twitter, Instagram). It is therefore possible that we process the personal data of third parties via these channels.
In providing our service we may have access to the personal data of third parties with whom we have no direct relationship. The staff of VVV Zuid-Limburg will always handle this personal data with care and only process it in accordance with the rights and obligations arising from the relevant privacy regulations. This processing will then be carried out in the performance either of a legal obligation or in promoting the justified interests of a third party.
Recipients of personal data
VVV Zuid-Limburg will send its processed personal data to other parties only in limited cases, for example where it acts as agent in bringing about a contract between a consumer and the organizers of activities. In such a case, the personal data of the consumer has to be forwarded so that the organizer knows with whom they have entered into a contract.
On the basis of consent
One can think of situations in which we forward personal data to third parties with the consent of the data subject. This consent is only valid if the data subject has freely given their consent having first been clearly informed of the purposes for which the consent is given.
Necessary external processing
VVV Zuid-Limburg cannot provide its services without the assistance of third parties, such as ICT providers. In some cases these external parties will also have to process personal data for the benefit of VVV Zuid-Limburg. This processing will only be performed in accordance with data processor agreements which set out the parties’ mutual rights and obligations with regard to careful processing.
In other cases we may be compelled by laws and regulations, or the statutory procedures or requests of government bodies, to forward personal data to third parties. In such cases, VVV Zuid-Limburg will seek guarantees from such third parties as far as possible that they will treat the personal data as confidential and ensure it is sufficiently secured.
VVV Zuid-Limburg stores personal data in compliance with the current statutory storage terms. Personal data may not be stored for longer than to achieve the purpose for which it was processed. This period will differ from case to case. As soon as there is no ground for continued storage of the data it will be deleted or anonymised.
Forwarding to countries outside the EU
The rights of data subjects
Data subjects whose personal data is processed by VVV Zuid-Limburg can exercise the following statutory rights:
- erasure of data
- restriction of processing
- data portability
To ensure that the data subject is able to exercise the above rights, we explain each of them below.
Right of access
In principle, if a data subject so requests, VVV Zuid-Limburg will supply an overview of the personal data that it has processed. The request for access by the data subject must be accompanied by a valid proof of identity.
In responding to the request, VVV Zuid-Limburg will in principle provide access to the processed personal data, and disclose the purposes for which the data is processed, to whom it has been provided, the period during which it will be stored, and what other rights the data subject has.
If VVV Zuid-Limburg has incorrectly processed personal data, the data subject has the right to have any incorrect personal data concerning them rectified. If any personal data is incomplete, the data subject may require this to be made complete.
Erasure of data
Under strict circumstances the data subject may require VVV Zuid-Limburg to erase personal data that it has processed. In the following situations VVV Zuid-Limburg must comply with this request:
- if the personal data is no longer required for the purpose for which it was obtained;
- if the data subject withdraws their consent to the processing of personal data for which they initially gave their consent, and there is no other basis on which we are permitted to process that data;
- if the data subject objects to the processing of the personal data and there are no compelling justified grounds for processing that outweigh this objection;
- the personal data was unlawfully processed;
- the personal data must be erased by virtue of a statutory obligation.
Restriction of processing
If a data subject has requested the rectification of personal data processed by VVV Zuid-Limburg, the same data subject may also request that the processing be restricted for the period during which VVV Zuid-Limburg investigates the request. Furthermore, if a data subject believes that we are unlawfully processing personal data or no longer need it, or if the data subject objects to the processing of the data, the data subject may request the processing of data to be temporarily restricted.
If VVV Zuid-Limburg considers the request for restriction of the data processing to be justified, we will only continue to process the data with the consent of the data subject or if there is a justified interest in doing so (including, but not limited to, the drawing up or exercise of, or evidential support for, a legal claim).
A data subject is entitled to require VVV Zuid-Limburg to provide their personal data in a systematic, generally accepted, and machine-readable form if this data has been processed on the basis of the consent of the data subject, or in the performance of a contract. The data subject is also entitled to require such personal data to be transferred to another controller.
The data subject always has the right to object to the processing of personal data by VVV Zuid-Limburg, including where this data processing has occurred on the basis of profiles drawn up by VVV Zuid-Limburg in connection, for example, with direct marketing. In such a case, VVV Zuid-Limburg will cease data processing, unless we can provide such justified grounds for the processing that these outweigh the interests, rights and freedoms of the data subject.
The data subject always has the right to object to the processing of personal data for the purposes of direct marketing. In every such a case, VVV Zuid-Limburg will immediately cease the processing of data for this purpose.
Exercise of rights
A data subject wishing to exercise any of the above rights should contact VVV Zuid-Limburg. VVV Zuid-Limburg will respond to the request within the statutory period of four weeks. It is not impossible that VVV Zuid-Limburg will not be able to respond in substance to the request within the said period. In that case, we will indicate why more time is needed to respond to the request and within what further period we will respond.
Withdrawal of consent
If VVV Zuid-Limburg processed the personal data of a data subject on the basis of their consent, then this data subject may withdraw that consent at any time. If in that case VVV Zuid-Limburg has no additional ground for processing this personal data, the processing of the data will cease from the moment that the consent is withdrawn.
If a data subject complains about the processing of data by VVV Zuid-Limburg and this data subject believes that VVV Zuid-Limburg has not taken the complaint seriously, the complaint may be referred to the Dutch Data Protection Agency (the ‘DPA’). The DPA may then possibly institute an investigation. Furthermore, the data subject can file a relatively simple claim with the court. Further information about this procedure can be found on the DPA website.
Questions or comments
If you have any questions or comments concerning the processing of personal data please contact VVV Zuid-Limburg.
This privacy statement has been drawn up in accordance with the GDPR. VVV Zuid-Limburg reserves the right to update this privacy statement from time to time.
Version dated June 2018