AquaConsult Privacy Policy
Privacy Policy
AquaConsult is a division and registered trademark of GroupConsult BV, a company incorporated under Belgian law with its registered office at 2970 Schilde, Vogelsanck 2A (KBO 715653231).
As part of its activities, GroupConsult BV processes personal data relating to its customers, website visitors, partners and employees. GroupConsult BV is the data controller.
In principle, GroupConsult BV does not process sensitive data (such as race, political or religious beliefs, etc.). The data it processes is necessary for offering its products and services and for offering new products or services, for fulfilling its contracts, for the accounting and banking processing of data relating to the contract, and to comply with statutory and contractual obligations regarding liability and warranty.
Data is not retained for longer than is necessary (warranty period) and data that is no longer required is deleted (data minimisation). In principle, data is not transferred to or made available to third parties. Certain data is transferred to third parties for the purpose of performing the contract (place of performance, name and telephone number of the client, …), for administrative support (transfer to an accountancy firm) or to support the company’s activities (external data storage, website and newsletter management, …).
The collection and processing of personal data is done in accordance with the Data Protection Regulation 2016/679. This Regulation is generally referred to as "GDPR" (General Data Protection Regulation). Executive decisions and regulations are also taken into account.
Principles
GroupConsult BV is guided by the following principles when processing personal data:
Legality
For all processing of personal data for which GroupConsult BV is responsible, the lawfulness of such processing is managed and assessed in accordance with the conditions set out in the GDPR.
Proper and transparent
GroupConsult BV applies the ‘fair use’ principle when processing personal data. GroupConsult BV will communicate clearly, honestly and transparently regarding the processing of personal data.
Justifiable purpose
The processing of personal data is carried out in accordance with specific and clearly defined purposes, which are recorded in a register of processing activities. GroupConsult BV ensures that these purposes are always legitimate. Where personal data is further processed for purposes other than those originally specified, GroupConsult BV ensures that these purposes are compatible with the original purposes.
Minimal data processing
When processing personal data, GroupConsult BV ensures that the personal data it processes is adequate, relevant and necessary for the intended purpose. In all processing operations, GroupConsult BV will verify that the principles of data minimisation are being upheld.
The accuracy
GroupConsult BV is committed to the careful storage and processing of personal data.
The storage restriction
GroupConsult BV will not retain personal data for longer than is necessary.
The integrity and confidentiality
GroupConsult BV takes the appropriate technical and organisational measures to ensure that personal data is adequately protected.
Accountability
As the data controller, GroupConsult BV will always be accountable for all processing it carries out. GroupConsult BV will provide the Data Protection Authority with all supporting documents upon request.
Obligations of GroupConsult BV as the data controller
A number of tasks have been defined in order to achieve the policy objectives. These tasks are in line with all the legal obligations that GroupConsult BV is required to fulfil (processing principles) and for which GroupConsult BV can demonstrate compliance (accountability).
Appointing a data protection officer (DPO)
GroupConsult BV is not required to appoint a DPO. Nevertheless, GroupConsult BV has entrusted a certified DPO with a remit comprising duties comparable to the rights and obligations of a DPO appointed in accordance with the criteria laid down by law.
Taking measures to secure processing
GroupConsult BV has implemented appropriate technical and organisational measures to ensure the availability, integrity and confidentiality of the personal data processed.
Keeping a record of processing activities
GroupConsult BV maintains a register of all activities involving the processing of personal data. This management involves drawing up the register, keeping it permanently up to date and implementing the relevant control measures. This register serves as a tool in the context of accountability to the GBA (Data Protection Authority), but is not intended for data subjects or the general public.
Carry out a data protection impact assessment
GroupConsult BV does not process any personal data which, given its nature, scope, context and purposes, is likely to pose a high risk to the rights and freedoms of data subjects. Consequently, no data protection impact assessment (DPIA) has been carried out.
Compliance with data subject's rights
GroupConsult BV provides the necessary business processes to ensure that the data subject is informed about the processing and that the data subject’s rights are upheld (the right of access, the right to a copy of the data, the right to erasure, portability, rectification, restriction of processing, notification and data portability).
Setting up an incident reporting system
GroupConsult BV provides an incident reporting system for the internal recording of breaches relating to the processing of personal data.
Working with processor agreements
Where processing is carried out on behalf of GroupConsult BV, GroupConsult BV will only engage processors who provide sufficient guarantees regarding the implementation of appropriate technical and organisational measures.
Supervision of the execution of tasks under the responsibility of GroupConsult
GroupConsult BV provides clear instructions and guidelines in line with the responsibilities that GroupConsult BV employees have in relation to data processing. Where processing is carried out on behalf of GroupConsult BV by an employee, GroupConsult BV will only engage employees who provide sufficient guarantees regarding the implementation of appropriate technical and organisational measures.
Exercise by data subject of his rights
The data subject (customer, prospective customer) has a statutory right to access, verify and, where necessary, correct or delete their personal data. Provided proof of identity is supplied (copy of identity card – with national registration number redacted), the data subject may submit a written, dated and signed request to GroupConsult BV (AquaConsult), Vogelsanck 2 A, 2970 Schilde, or office@AquaConsult.be, obtain a written copy of your personal data free of charge. If necessary, you may also request that any data which is incorrect, incomplete or irrelevant be corrected, and that it be deleted insofar as it is no longer necessary for the performance of any contract that GroupConsult BV may have with you.