Privacy Policy (GDPR)

We collect personal information about you from various sources including:

• Information that you give us directly;


• Information collected automatically when you use ESU websites;


• Information we may receive from third parties (e.g. when receiving answers to surveys for events).

We may collect the following categories of information about you:

Information that you give us directly

We may collect information from you directly when you provide us with personal information, e.g. when you sign up to receive information, attend an event, use applications, fill out a survey, or make an inquiry. The types of information we may collect from you directly include your:

• Personal contact details such as name, title, address, telephone number and personal email addresses


• Date of birth or age


• Gender


• Any other personal information that you voluntarily provide to us

• Information about the type of browser you use


• Details of the web pages on our websites which you have viewed


• Your IP address


• The hyperlinks you have clicked


• Your user name, profile picture, gender, networks and any other information you choose to share when using Third Party Sites (such as when you use the “Like” functionality on Facebook)

• Personal contact details such as name, title,  address, telephone number and personal email addresses


• Date of birth


• Gender

We may use your information for the following purposes:

• To administer the relationship you have with ESU, and to provide you with information about ESU activities and for other related purposes


• If applicable, to administer financial relationships with you and provide you with information that you require to continue that relationship.


• To administer peer to peer network forums for sharing best practice amongst both staff and elected representatives from members and non-members.


• To administer your attendance at an ESU event to ensure that your requirements are accommodated so that you can fully participate in the event in an accessible way.


• To use your responses for statistical purposes in policy making or in advocacy.

Under data protection legislation we are only permitted to use your personal information if we have a legal basis for doing so as set out in the General Data Protection Regulation. The legal basis that permits us to use your information depends on the basis that we are using that information for.  We rely on the following legal bases to use your information you consent us to process:

• Where we need information to perform the contract we have entered into with you.


• Where we need to comply with a legal obligation.


• Where it is necessary for our legitimate interests (to collect data for statistical purposes in policy making or in advocacy) and your interests and fundamental rights do not override those interests.


Some information is classified as “special” data under data protection legislation. This includes information relating to health, racial or ethnic origin, religious beliefs or political opinions, sexual orientation and trade union membership. This information is more sensitive and we need to have further justifications for collecting, storing and using this type of personal information. There are also additional restrictions on the circumstances in which we are permitted to collect and use criminal conviction data. We may process special categories of personal information in the following circumstances:



• In limited circumstances with your explicit consent, in which case we will explain the purpose for which the information will be used at the point where we ask for your consent.


• We will use information about your physical and mental health or disability status to comply with our legal obligations, including to ensure your health, safety and wellbeing at an event.

We share your personal information in the following ways:

• When we use third party services providers who process personal information on our behalf in order to provide services to us. This includes IT systems providers and IT contractors.


• We will share your personal information with regulators where we are required to do so to comply with our regulatory obligations.


• We will share your personal information with third parties where we are required to do so by law.

We take all reasonable precautions to keep your personal information secure and require any third parties that handle or process your personal information for us to do the same. Access to your personal information is restricted to prevent unauthorised access, modification or misuse and is only permitted among our employees and elected representatives on a need-to-know basis.

When data is transferred to countries outside of Belgium and the European Union,  those countries may not offer an equivalent level of protection for personal information to the laws in the EU. Where this is the case we will ensure that appropriate safeguards are put in place to protect your personal information.

As a general rule we retain your information for the duration of the time that we need to use it.  For example, if you are attending an event, the information required is only required until the event has finished.  Within 1 year of the event finishing, the information that is not necessary for other reasons (for example the name of the participants for reporting to external funding authorities such as the European Commission) will be deleted.

However, where we have legal or contractual obligations to keep personal information for a longer period or where we may need your information for a longer period in case of a legal claim, then the retention period may be longer.

You have a number of rights in relation to your personal information, these include the right to:

• be informed about how we use your personal information;
  
• obtain access to your personal information that we hold;


• request that your personal information is corrected if you believe it is incorrect, incomplete or inaccurate;


• request that we erase your personal information, in any circumstances, without any justification.


• ask us to restrict our data processing activities.


• request a copy of certain personal information that you have provided to us in a commonly used electronic format. This right relates to personal information that you have provided to us that we need in order to perform our agreement with you and personal information where we are relying on consent to process your personal information;


• object to our processing of your personal information where we are relying on legitimate interests or exercise of a public interest task to make the processing lawful.


• not be subject to automated decisions which produce legal effects or which could have a similarly significant effect on you.


If you would like to exercise any of your rights or find out more, please contact secretariat[at]esu-online.org

Contact details

Our contact details are as follows:

Address:   Rue de la Charite 22, Bruxelles, B-1040

Telephone:  +32 (2) 893 25 47

We have appointed a person with responsibility for data protection matters. You can contact our GDPR officer using the following details: secretariat[at]esu-online.org 

Complaints

If you have any complaints about the way we use your personal information please contact secretariat[at]esu-online.org who will try to resolve the issue. If we cannot resolve your complaint, you have the right to complain to the data protection authority in your country (the Information Commissioner in Belgium).