IDEWE Group privacy policy

IDEWE Group consists of:

• IDEWE vzw, Interleuvenlaan 58, 3001 Leuven, Belgium (CBE enterprise number 0409 862 612), represented by Prof. Lode Godderis, Managing Director
• IBEVE vzw, Interleuvenlaan 58, 3001 Leuven, Belgium (CBE enterprise number 0436 612 044), represented by Prof. Lode Godderis, Managing Director

Contact details of the Data Protection Officer (DPO): privacy@idewe.be

1. Personal data processing: legal grounds

IDEWE

As an external health and safety service for prevention and protection at work, IDEWE vzw complies with the following:

• The Act of 4 August 1996 regarding employee wellbeing at work, also referred to as the Welfare Act
• The Code on Wellbeing at Work
• The Patients’ Rights Act of 22 August 2002
• The General Data Protection Regulation, hereinafter referred to as ‘GDPR’ 
• the Quality Act of 22 April 2019 on the quality of healthcare practice
• The Personal Data Protection Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data
• The service agreement with the customer or the data subject’s request

If the employer is affiliated with IDEWE vzw, we receive the employees’ employment information via the Crossroads Bank for Social Security in the majority of cases. This is administrative data only, such as the name, place of residence, social security identification number, date of birth, status, gender, nationality and employment start and end dates.

IBEVE

In addition to IDEWE vzw, IDEWE Group includes IBEVE vzw, which operates on a contractual basis. The services of IBEVE vzw are closely aligned with the statutory tasks of an external health and safety prevention service and include asbestos research, environmental management, occupational hygiene, occupational safety, safety coordination and energy management.

2. For what purposes do we process your personal data?

IDEWE

IDEWE vzw processes personal data in accordance with the aforementioned legislation for the following purposes as part of its general wellbeing policy:

• Measures relating to health monitoring

• Prevention of psychosocial risks 
• Measures relating to risk management and accidents at work
• Workplace ergonomics
• Organising training courses
• Scientific research (KIR)

Conducting scientific research is one of the duties of an external health and safety service for prevention and protection at work. IDEWE vzw is therefore actively involved in scientific research. 
We are transparent about which data we process in the context of research and strictly adhere to the regulations on the use of personal data in scientific research. 
That means we always use anonymised or pseudonymised information in this context. Identifiable personal data is only used in exceptional cases and only if strictly necessary for a particular type of research or with the consent of the data subjects. 

IDEWE vzw may collaborate with partners and academic institutions in this context. IDEWE vzw will take the necessary security measures regarding such collaborations. In case of identifiable personal data, these are only shared with the consent of the data subjects.

• Provision of information and marketing

IDEWE vzw has a legal obligation to inform the employer and can use your contact details to meet this obligation. In addition, IDEWE vzw may use your data in that context or with your consent for commercial purposes such as direct marketing, e.g. in order to send you information about its products and services or to keep you informed via newsletters. You can opt out of such data usage at any time.

IDEWE vzw can also use this data to create a specific profile for you. The creation of a profile has no negative consequences and supports a better customer experience and tailored offers. 

Contact details obtained solely for health monitoring or psychosocial risk prevention measures will never be used for information provision or marketing. 

• Partner services

IDEWE does not process any personal data in the context of Partner Services, unless expressly stipulated otherwise.

The Client shall conclude a direct data processing agreement with the Partner insofar as is required by the applicable laws and regulations, such as the General Data Protection Regulation (GDPR). 

IBEVE

IBEVE vzw processes personal data for the following purposes:

• Services relating to:

  • Asbestos testing

  • Environmental management

  • Occupational hygiene 

  • Occupational Safety

  • Safety coordination

  • Energy management

• Organising training courses
• Marketing

IBEVE vzw may process its contacts’ data for commercial purposes such as direct marketing, e.g. in order to send you information about its products and services or to keep you informed via newsletters. You can opt out of such data usage at any time.

IBEVE vzw may also use this data to create a specific profile for you. The creation of a profile has no negative consequences and supports a better customer experience and tailored offers. 

3. Legal basis for data processing 

IDEWE

• Measures relating to health monitoring

  The processing is necessary or desired in the context of the legal mandate that IDEWE vzw has or is based on informed consent by the data subject.

• Prevention of psychosocial risks

  The processing is necessary or desired in the context of the legal mandate that IDEWE vzw has or is based on informed consent by the data subject.

• Measures relating to risk management and accidents at work

  The processing is necessary or desired in the context of the legal mandate that IDEWE vzw has or is based on informed consent by the data subject. In certain cases, processing may also take place in support of the legitimate interests of IDEWE vzw.

• Workplace ergonomics

  The processing is necessary or desired in the context of the legal mandate that IDEWE vzw has or is based on informed consent by the data subject. In certain cases, processing may also take place in support of the legitimate interests of IDEWE vzw.

• Scientific research (KIR)

  The processing is necessary to fulfil the legal mandate that IDEWE vzw has or is based on informed consent by the data subject. Furthermore, the data is processed for historical, scientific and statistical purposes. This is considered compatible with the original purposes, provided that the researcher follows the rules as described in Article 89.1 of the GDPR ((Article 5.1.b) GDPR).

• Organising training courses

  The processing is necessary or desirable in the context of the statutory mandate entrusted to IDEWE vzw, for the performance of a contract to which the data subject is a party, or is based on the data subject’s explicit consent. In certain cases, processing may also take place in support of the legitimate interests of IDEWE vzw.

• Provision of information and marketing

  The processing is necessary to fulfil a statutory mandate entrusted to IDEWE vzw or is based on the consent of the data subject, a legitimate interest or a soft opt-in. 

IBEVE

Services in the context of asbestos testing, environmental management, occupational hygiene, occupational safety, safety coordination and energy management

The processing is necessary to implement an agreement to which IBEVE vzw is a party, or is based on the data subject’s express consent. 
In certain cases, processing may also take place in support of the legitimate interests of IBEVE vzw.

• Organising training courses

  The processing is necessary to implement an agreement to which IBEVE vzw or the data subject is a party, or is based on the data subject’s explicit consent. 
  In certain cases, processing may also take place in support of the legitimate interests of IBEVE vzw.

• Marketing

  Consent by the data subject, legitimate interest or based on a soft opt-in. 

4. What types of personal data do we process?

IDEWE

IDEWE vzw receives all data directly from the employer, the data subject themselves and via the Crossroads Bank for Social Security. IDEWE vzw only uses the information obtained for the above purposes, unless explicitly agreed otherwise with the employee.

We process this personal data to comply with our administrative and legal obligations as an external service for prevention and protection at work.

Furthermore, our internal organisation and quality assurance require us to create and maintain records to ensure the transferability, traceability and verifiability of data, for example in the context of supervision by the competent authorities. This processing ensures the efficient, reliable and compliant fulfilment of our legal mandate as an external service.

It is important that IDEWE vzw has the following data to ensure it can correctly perform its tasks as an external health and safety service for prevention and protection at work:

• Measures relating to health monitoring

  • Identification data such as your surname, first name, date of birth, place of birth, country of birth and national registration number

  • Contact details such as your phone number, personal address and possibly the address of an emergency contact
  • Employment data, such as previous jobs, risks associated with these jobs, employment start and end dates (if your employer or employers are affiliated with IDEWE vzw)
  • Private information about matters that may affect the employee’s health or job performance, such as hobbies, sports, smoking, drinking and drug use
  • Health information such as personal and family histories, pregnancies, medication, medical history and biometrics
  • Psychosocial data relating to employees’ exposure to psychosocial risks at work, as defined in the Code on Wellbeing at Work
  • Content of communications about the employee with the customer or other healthcare practitioners
  • Customer contact details
     
• Prevention of psychosocial risks 
  • Identification data such as your surname, first name, date of birth, place of birth, country of birth and national registration number
  • Contact details such as your phone number, personal address and possibly the address of an emergency contact
  • Psychosocial data relating to employees’ exposure to psychosocial risks at work, as defined in the Code on Wellbeing at Work. This includes data that could provide information about the work organisation, job content, working conditions, living conditions at work and interpersonal relationships at work, as well as the potential impact of these factors on the psychological and, if applicable, physical wellbeing of employees.
  • Content of communications about the employee with the customer or other healthcare practitioners
     
• Measures relating to risk management and accidents at work

  • Identification data such as your surname, first name, date of birth, place of birth, country of birth and national registration number

  • Contact details such as your phone number, personal address and possibly the address of an emergency contact
  • Employment data, such as previous jobs, risks associated with these jobs, employment start and end dates (if your employer or employers are affiliated with IDEWE vzw)
  • Private information about matters that may affect the employee’s health or job performance, such as hobbies, sports, smoking, drinking and drug use
  • Data relating to accidents at work, as defined in the Code on Wellbeing at Work
  • Data necessary for risk management purposes 
     
• Workplace ergonomics

  • Identification data such as your surname, first name, date of birth, place of birth, country of birth and national registration number

  • Contact details such as your phone number, personal address and possibly the address of an emergency contact
  • Ergonomics – and health data relating to workers’ exposure to ergonomic risks at work, as defined in the Code on Wellbeing at Work.
     
• Scientific research (KIR)
  • IDEWE vzw exclusively uses information that has been anonymised or pseudonymised. Identifiable personal data will only be used in exceptional cases and only if strictly necessary for a particular type of research.
     
• Organising training courses

  • Identification data such as your surname, first name and date of birth

  • Contact details such as your telephone number and email address
  • Training results and certificates
     
• Provision of information and marketing

  • Identification data such as your surname, firstname and job

  • Contact details such as your telephone number and email address
  • Information provided by cookies in accordance with the cookie policy and analytics tools
     

IBEVE

• Services in the context of asbestos testing, environmental management, occupational hygiene, occupational safety, safety coordination and energy management

  • Identification data such as your surname, first name, date of birth, place of birth and country of birth

  • Contact details such as your phone number, personal address and possibly the address of an emergency contact
  • Employment data such as previous jobs, risks associated with these jobs, employment start and end dates (if your employer or employers have a contract with IBEVE vzw)
  • Customer contact details
     
• Training

  • Identification data such as your surname, first name and date of birth

  • Contact details such as your telephone number and email address:
  • Training results and certificates
     

• Marketing 

  • Identification data such as your surname, firstname and job

  • Contact details such as your telephone number and email address
  • Information provided by cookies in accordance with the cookie policy and analytics tools

5. Who has access to the personal data?

• Authorised staff at IDEWE Group We distinguish between different types of personal data (e.g. administrative data, medical data) to determine access rights. For example, medical data is only available to medical staff. For a number of specific administrative tasks (e.g. allocation of incoming mail), supporting administrative staff also receives temporary and restricted access to the medical data required for that task only.
• Professionals who must be consulted, e.g with regard to health or psychosocial files (with the employee’s consent only)
• The customer themselves for administrative, non-medical personal data
• Organisations or inspectorates to which IDEWE Group is legally obliged to disclose personal data 

If it is necessary to give a third party such as a software supplier access to certain personal data for specific reasons, IDEWE Group will take the necessary measures to guarantee the data’s security and confidentiality. In that case, IDEWE Group will conclude a processor agreement with the third party as determined by the GDPR.

Subject to pseudonymisation and aggregation, IDEWE also processes a limited set of data together with other external services and the umbrella organisation Co-Prev, with a view to compiling statistics at industry level and formulating policy proposals regarding employee wellbeing.

We never share electronic health files with employers or third parties. If your employer switches to another external health and safety service for prevention and protection at work and the contract with IDEWE vzw is terminated, IDEWE vzw will forward the information from the health file to your employer’s new external service in accordance with the Welfare Act and the Code on Wellbeing at Work.

6. Security of your personal data

The IDEWE Group security plan takes into account all domains described in the ISO 27000 principles. IDEWE Group guarantees a risk-appropriate level of security with the associated technical and organisational measures, e.g.:

• The encryption of personal data

• A permanent guarantee of:

  • the confidentiality, integrity and availability of the processed data;

  • the resilience of our processing systems and services

• Rapid intervention in the event of a physical or technical incident

• An extensive testing procedure

IDEWE Group uses data classification to protect the information properly. This means that the more sensitive the information, the more security is provided.

All IDEWE Group staff have signed a confidentiality clause, and this is an integral part of the employment contract.

For some processing operations, IDEWE Group uses a subcontractor, such as a software supplier and printer. In that case, a processor agreement will be concluded. This is how IDEWE Group ensures that everything is carried out in accordance with the GDPR and the associated organisational and technical security measures and obligations.

7. Retention periods

IDEWE Group does not store personal data for longer than necessary for the purposes for which we received it, to implement a contract or to fulfil a legal obligation. The duration depends on the purpose for which the data is used and the type of service, as certain aspects are determined by law. Access to the archived data is restricted. After the retention period has expired, your personal data will be permanently deleted or anonymised.

IDEWE vzw is also obliged to retain health files of employees who are no longer staff subject to health monitoring for at least 15 years after the employee’s departure. IDEWE vzw retains information about an employee for a minimum of fifteen years after their departure; this retention period also applies to administrative data. 

In doing so, we are deviating from the right to data deletion. The reason for this is continued medical monitoring, as the impact of certain risks only becomes visible after an extended period. The specific period is laid down in the legislation on employee wellbeing.

IDEWE vzw retains psychosocial data for at least 15 years. Formal and informal requests relating to psychosocial aspects are subject to a 20-year statutory retention period. Surveys are subject to a 15-year retention period as part of a risk assessment of psychosocial aspects.

8. Use of National Registration Number for identification purposes

IDEWE vzw has received permission from the Data Protection Commission to use the national registration number for the unique identification of employees and for communication with employers. 

9. What are your rights?

1. Right to view personal data in possession of IDEWE Group

You have the right to obtain information regarding whether your personal data is being processed, including the processing purposes, categories of personal data and estimated retention period, and, if applicable, to access the following types of information, among others:

• Administrative records: you are entitled to a copy of your administrative records.
• Psychosocial records: you are entitled to copies of your interviews with the health and safety prevention advisor on psychosocial aspects.
• Health file: you are entitled to a copy of your health file. With your consent, we may also share documents from your health file with your attending physician.

This right is without prejudice to statutory exceptions or the rights and freedoms of others. 

2. Right to rectification

If you find that some of your personal data is incorrect, you are entitled to have this data corrected.

3. Right to erasure

In most cases, the right to erasure is very limited or lapses entirely because IDEWE vzw is bound by statutory retention obligations.

4. Right to restrict processing

5. Some personal data (such as your health file) is subject to legal provisions that regulate its transfer.

6. Right to object

IDEWE vzw is bound by legal processing obligations. This means that in many cases the right to object lapses. You can always object to the use of your personal data for direct marketing purposes.

7. Right to withdraw consent

If data processing requires your explicit consent, you can withdraw this consent at any time. Please note that such withdrawal shall only have a legal impact on future data processing operations, never on past data processing operations.

8. Automated individual decision-making

If a decision is ever made based on automated individual decision-making, we offer the necessary guarantees. If you disagree with the automated decision, we will also provide you with a specific explanation of the decision-making process and your right to human intervention.

9. Right to file a complaint with a data protection authority

If you have any questions about our Privacy Policy or about how IDEWE Group, as the data controller, collects, uses or processes your personal data, or if you feel that IDEWE Group is not fully or correctly respecting your rights with regard to your personal data, you can contact our data protection officer at any time by email: privacy@idewe.be. 

You also have the right to lodge a complaint with the Belgian Data Protection Authority (www.gegevensbeschermingsautoriteit.be) at Drukpersstraat 35, 1000 Brussels, on +32 (0)2 274 48 00 or via contact@apd-gba.be. 

10. Exercise of individual rights

Unless the procedure for making a request is laid down by law – such as the portability of medical records – you may exercise your individual rights by submitting a dated request.

As this often concerns sensitive data, IDEWE Group wants to be absolutely sure of your identity. In case of a health file, for example, a change or viewing can have major consequences.

If the identification data sent to us is not conclusive, we will require additional proof of your identity.

In extreme cases, we may request a copy of your identity card. You can cover up any data not required for identification such as your identity card number. 

You can also submit a dated request with an electronically signed email. This may also include a copy of the identity card as described above.

IDEWE Group may amend this privacy statement at any time and will always post the current version on its website.