Privacy statement for professional partners – due diligence regarding chain liability

Overview

Context

This privacy statement sets out how imec processes personal data in accordance with its legal due diligence, which applies to clients, contractors, and intermediary contractors (subcontractors) in specific high-risk sectors (including construction, cleaning, the meat industry, and parcel delivery). Imec complies with the relevant Belgian and European legislation at all times.

This short overview of imec’s privacy statement provides a brief summary of how imec processes your personal data in the context of your professional relationship with imec. For more information, read the full privacy statement, which explains everything in greater detail.

What personal data does imec collect from our professional partners?

The following data is processed from both contact persons at the organizations concerned and the employees/self-employed persons concerned (third-country nationals: persons whose nationality is not of the EEA or Switzerland):

• personal data: last name, first name.

For a more detailed description, see below.

For what purposes does imec collect this personal data?

Imec only processes personal data insofar as is necessary to fulfill its legal due diligence regarding chain liability and the recruitment of foreign workers. This requires us to collect, check, record, and retain certain documents from the direct (sub)contractors.

How long does imec retain this personal data?

Imec processes and retains your personal data for as long as it is legally obligated to do so, or for as long as is necessary for the purposes of processing said data.

Personal data and supporting documents processed in accordance with due diligence requirements are generally retained for up to five years following the conclusion of the working relationship with the direct contractor concerned, provided that this period is consistent with applicable legal obligations.

If you do not wish for your personal data to be stored for this retention period, you may, in certain cases, exercise your right to erasure by completing the contact form or sending an email to privacy@imec.be. 

Who has access to this personal data?

At imec, your personal data will only be accessible to employees who require access in order to ensure that your collaboration with imec runs smoothly. In addition, imec may make your personal data available to specific third parties where this is necessary to facilitate the collaboration. Imec shall not sell, rent out, distribute, or otherwise make your personal data commercially available to any third party, unless expressly provided for in this privacy statement or where you have given your express consent.

How does imec protect this personal data?

Find more information on imec’s technical and organizational security measures.

What are your rights as a data subject?

Whenever your personal data is processed, you may exercise the following rights by completing the contact form:

• Right of access: you have the right to request a copy of your personal data retained and processed by imec;
• Right to rectification: you have the right to correct your personal data if it is inaccurate;
• Right to object to processing: you may ask imec to cease certain processing at any time;
• Right to withdraw your consent: you have the right to withdraw any consent you have previously given for the processing of your personal data;
• Right to lodge a complaint with the competent data protection authority: you have the right to lodge a complaint with the competent data protection authority if you suspect that imec is not processing your personal data correctly;
• Right to erasure: you may request that imec erases your personal data;
• Right to restriction of processing: you may request that imec restrict the processing of your personal data.

The Privacy Office will handle your request to the best of their ability and facilitate the exercising of your rights to the extent possible, depending on the nature of the personal data and your request.

Any questions?

For any queries regarding imec’s privacy statement, contact the Privacy Office. Email privacy@imec.be, fill out the contact form, or send a letter to the Privacy Office:

imec
t.a.v. Privacy Office
Kapeldreef 75
3001 Leuven

Privacy statement for professional partners – due diligence regarding chain liability 

Article I – General

I.1. Purpose of this privacy statement

At imec, protecting your data is of the utmost importance. This privacy statement sets out how imec handles your personal data in accordance with its legal due diligence, which applies to clients, contractors, and intermediary contractors (subcontractors) in specific high-risk sectors (including construction, cleaning, the meat industry, and parcel delivery). 

We recommend that you read this privacy statement carefully and familiarize yourself with your rights and obligations in relation to imec. If you have any questions about imec’s privacy statement, contact the Privacy Office using the contact form.

Imec always processes your personal data in accordance with European Regulation 2016/679 of 27 April 2016 on the protection of personal data (GDPR) and other applicable legislation.

I.2.    Changes

This privacy statement may be amended or supplemented. You should therefore check regularly to see if there are any changes that are – or may be – relevant to you.

Article II – Personal data collected

Personal data of contact persons at the organization concerned

• identification data: name, capacity, and position or role (contractor, main contractor, intermediary contractor)
• contact information such as email address, telephone number
• name and company registration number of the organization

Personal data of the employees/self-employed persons concerned (third-country nationals: persons whose nationality is not of the EEA or Switzerland)

• identification data: last name, first name, INSZ number (national registration number or BIS number), nationality, date of birth, place of residence;
• data and documentation relating to residence status, such as details concerning residence permits and the validity of residence in Belgium (passport, visa, proof of valid residence);
• employment‑related data and documents such as work authorization, work permit or single permit, professional card (for self‑employed workers), proof of Limosa notification (L1) or Dimona declaration, A1 certificate, and the start and end date of the professional activity.
• details of the nature and location of the work done or services rendered;
• start and end dates of the professional activity; 
• results of the monitoring and follow‑up, including any findings that documents are missing, incomplete, or no longer valid

Article III – Purposes of data processing

Imec processes personal data only to the extent that is necessary to:

• receive, record and manage the required information and documents from its direct (sub)contractors; 
• to verify the completeness, validity and conformity of the information and documents received; 
• to follow up on missing, incomplete, or out-of-date information and documents; 
• to check whether people working for your organization hold the necessary residence and employment documents; 
• to demonstrate that imec has complied with its statutory due diligence obligations; and to deal with any investigations, disputes, or proceedings relating to these obligations.
• where required by law, to notify the competent social inspection services in order to safeguard chain liability; to report missing, clearly falsified, or invalid documents to the Flemish Social Inspection through the reporting portal so that imec can demonstrate that it has complied with its due‑diligence obligation (in accordance with Article 12/4 of the Act of 30 April 1999). This prevents imec from being held criminally or administratively liable for infringements committed by direct contractors or subcontractors.

Article IV – Legal basis for processing data

The processing of personal data by imec is based on the legal provisions set out in Article 6(1)(c) of the General Data Protection Regulation (GDPR), which stipulates that the processing of data is necessary to comply with a legal obligation to which imec is subject regarding the employment of foreign workers and the statutory due diligence obligation relating to chain liability.

Article V – Retention periods

Imec processes and retains your personal data for as long as it is legally obligated to do so, or for as long as is necessary for the purposes of processing said data. 

Personal data and supporting documents processed in accordance with due diligence requirements are generally retained for up to five years following the conclusion of the working relationship with the direct contractor concerned, provided that this period is consistent with applicable legal obligations.

If, at the end of this period, legal proceedings, an administrative investigation, or a dispute are still ongoing, the retention period shall be extended until the date upon which a final decision has been taken that has become legally binding and all avenues of appeal have been exhausted.

Article VI – Access to and disclosure of personal data

VI.1. Access to personal data

At imec, your personal data will only be accessible to employees who require access to it to enable imec to provide you with the best possible service. Your personal data may also be shared within the imec group. As a result, your personal data may be transferred within the imec group to entities outside the EU. This is always done in accordance with relevant GDPR stipulations.

You can find more information on how imec protects your personal data in Article VII of this privacy statement.

VI.2. Sharing with third parties

Imec may appoint third parties to process your personal data in the context of our professional relationships. For example, imec uses external service providers, mailing service providers, IT service providers, and other suppliers to ensure you have the best possible experience with imec.

Imec shall not sell, rent out, distribute, or otherwise make your personal data commercially available to any third party, unless expressly provided for in this privacy statement or where you have given your express consent.

Imec has implemented all appropriate technical and organizational measures to prevent unauthorized access and use. They also guarantee a similar level of protection for your personal data by imposing contractual obligations on these third parties that are in line with those set out in this privacy statement.

In the event of a full or partial restructuring whereby imec reorganizes or transfers its activities, or in the event of imec being declared bankrupt, your personal data may be transferred to new entities or third parties. Imec will inform you of this in advance.

VI.3. Legal obligations

Imec may be required to disclose your personal data pursuant to a court order or in order to comply with other applicable laws or regulations, e.g. to competent social inspectorates and other government or judicial bodies, lawyers, and other professional advisors when this is necessary for an investigation, dispute, or legal proceedings.

Imec shall make reasonable efforts to inform you of this in advance, unless this is subject to legal restrictions.

VI.4. Transfer of personal data outside the European Union

Your personal data may be transferred outside the European Economic Area (European Union + EFTA countries: Iceland, Liechtenstein, Norway, and Switzerland), for example in conjunction with the use of cloud service providers. In such cases, every possible measure will be taken to ensure that your data is protected in accordance with European, federal, and Flemish legislation.

Article VII – Security measures

Imec has implemented various technical and organizational measures to ensure that your personal data is protected against unauthorized access, alteration, disclosure, or erasure.

The key technical and organizational measures are:

• Imec is committed to protecting the data it holds or generates, as well as the data entrusted to it by our partners, on condition that such data is kept confidential and/or may only be used in specific circumstances.
• Imec has incorporated security, privacy by design, and privacy by default into its internal procedures for new initiatives. This ensures that imec addresses security and privacy risks right from the outset. 
• Imec carries out regular checks and evaluations of its procedures to prevent data loss, which includes the loss of personal data.
• Imec has implemented various security technologies and techniques to defend itself against attacks from both within and outside the organization. 
• Imec regularly evaluates its procedures related to the collection, storage, and processing of information, including logical and physical security measures, such as protection against unauthorized access to information (systems).
• Imec personnel receive regular training on the handling of personal data in their daily activities, as well as on the privacy and security policies and procedures followed within imec.

Imec is regularly audited regarding the implementation of these measures, both from an external and an internal perspective. If the audit reveals that certain aspects of imec’s policies, processes, or procedures do not meet our standards, we take immediate action.

Article VIII – Your rights

VIII.1. Right of access and inspection

You have the right to access your personal data and to know how imec is using your it at any time.

VIII.2. Right to rectification, erasure, and restriction

You are free to choose whether to share certain personal data with us, and you always have the right to request that we correct your personal data if you believe it is inaccurate, provided you subsequently notify imec of this.

Where possible, you can also request that the processing of your personal data be restricted. In addition, you have the right to request that imec erase your personal data, provided that imec is unable to anonymize it. However, if you refuse to provide certain personal data, or if you ask us to erase it, imec may no longer be able to provide you with certain information or services (in full).

VIII.3. Right to object

You have the right to object to the processing of your personal data if you have compelling and legitimate reasons to do so. You also have the right to object to the use of your personal data for direct marketing purposes. In this case, no specific justification is required.

VIII.4. Right to withdraw consent

You have the right to withdraw your prior consent to the processing of your personal data.

VIII.5. How to exercise your rights

If you wish to exercise your rights as a data subject, contact imec’s Privacy Office, who will process your request within the legally prescribed timeframes. You can fill out your request and contact information using the contact form on the imec website.

If you have a complaint regarding imec’s processing of your personal data, you may also contact the Privacy Office, who will handle your complaint in a confidential manner.

VIII.6. Complaints to the competent data protection authority

If you believe that imec has insufficiently followed up on your request to exercise your rights as a data subject, or has handled it incorrectly, you may lodge a complaint with the Belgian Data Protection Authority (GBA) or the Dutch Data Protection Authority (AP). This is without prejudice to any civil court proceedings. On the GBA and AP websites, you can find all the information you need to initiate mediation or file a complaint.

Data Protection Authority
Drukpersstraat 35
1000 Brussels
Tel +32 (0)2 274 48 00
Fax +32 (0)2 274 48 35
Email: contact@apd-gba.be

Dutch Data Protection Authority
Hoge Nieuwstraat 8
2514 EL Den Haag
Tel +31 (0)88 1805250
Fax +31 (0)88-0712140
https://autoriteitpersoonsgegevens.nl/en/contact

If you are a resident of an EU member state other than Belgium or the Netherlands, you may also file a complaint with your national data protection authority (find a list of all data protection authorities within the EU here).