DATA PROTECTION NOTICE – OMBUDSMAN SERVICE FOR RAIL PASSENGERS
The Ombudsman Service for Rail Passengers, address: Koning Albert II-laan 8 bus 5, 1000 Brussels, attaches great importance to the secure, transparent and confidential collection and processing of your personal data. In particular, we want to protect the data of persons who lodge a complaint to our service regarding, inter alia, loss, leaks, errors, unauthorised access or unlawful processing.
Via this Data Protection Notice, we want to inform you about the collection and processing of your personal data.
We kindly ask you to read this Data Protection Notice carefully, as it contains essential information about how your personal data are processed and for what purpose.
This Data Protection Notice applies to all services provided by us and generally to all activities we perform.
3. DATA CONTROLLER AND ITS OBLIGATIONS
The Ombudsman Service for Rail Passengers, Koning Albert II-laan 8, bus 5, 1000 Brussels, is the data controller as regards the processing of your personal data.
When collecting and processing your personal data, we respect the Belgian data protection regulations as well as the General Data Protection Regulation ("GDPR") as of its entry into force on 25 May 2018.
You can always contact our Data Protection Officer (DPO) at email@example.com.
4. PERSONAL DATA
In order to perform our role as mediator, you provide us with the following personal data: your identity and contact details (name, title, address, e-mail address, telephone and mobile number). You also provide us with all information pertaining to your complaint.
We kindly remind you that you are responsible for all information you provide us with and that we rely on the accuracy of this information. If your data are no longer up to date, please let us know by return.
You are not required to provide your personal data, but you must understand that the provision of certain services or cooperation will become impossible if you do not consent to the collection and processing of this data.
5. PROCESSING PURPOSES AND LEGAL GROUNDS
In the context of our service provision, we collect and process the identity and contact details of persons who contact our service.
This information is necessary to perform our task of general interest, entrusted to us by the Law of 28 April 2010 containing various provisions (BOG 10 May 2010). Article 11, §2 of this law stipulates our powers (translation):
"1. investigating all complaints from passengers and users regarding the services provided by railway companies or railway managers;
2. mediating in disputes between railway companies or railway managers on the one hand and their passengers or users on the other, in order to reach a satisfactory outcome;
3. making a recommendation to the railway companies or managers if no satisfactory outcome can be reached;
4. informing passengers or users who contact it orally or in writing, regarding their rights and interests;
5. issuing opinions in the context of its duties, at the request of the Minister responsible for transport".
Furthermore, Article 16 of the same law requires us to draw up an annual report on our activities. This report covers the various complaints or types of complaints, and the action taken in this regard, without revealing the identity of the complainant, either directly or indirectly. This report is made available to the public.
We may also process your personal data for the purpose of statistical research and internal evaluation of our services.
We will only process your personal data for these purposes.
6. DURATION OF THE PROCESSING
We store and process personal data for the period necessary for the purposes of the processing.
In any case, this data will be removed from our systems after a period of maximum 10 years after the closure of your case for all cases resulting from an admissible complaint and after a period of 3 years for all other cases.
Personal data collected in cases in which an opinion is issued to the railway company are permanently kept in all confidentiality for archiving in the public interest, scientific or statistical research, in accordance with Article 89 of the General Data Protection Regulation.
In accordance with and subject to the terms of Belgian privacy laws and the provisions of the General Data Protection Regulation, we inform you that you have the following rights:
- Right of access: you have the right to consult the information we hold about you free of charge and to enquire what it is being used for.
- Right to rectification: you have the right to obtain rectification (correction) of your incorrect personal data, as well as to complete incomplete personal data.
- Right to erasure: you have the right to request us to delete or limit the processing of your personal data in the circumstances and under the conditions set out by the General Data Protection Regulation. We can refuse to erase or limit the personal data that are necessary for us to perform our legal obligations, for as long as these data are necessary for the purposes for which they were collected.
- Right to data portability: you have the right to obtain the personal data you have provided us with in a structured, common and machine-readable form. You have the right to transfer this data to another controller.
- Right to object: you have the right to object to the processing of your personal data for serious and legitimate reasons. Please note, however, that you cannot oppose the processing of personal data that are necessary for us to perform a legal obligation, for as long as these data are necessary for the purposes for which they were collected.
- Right to withdraw consent: If the processing of personal data is based on prior consent, you have the right to withdraw this consent. These personal data will then only be processed if we have another legal basis in this regard.
- Automated decision-making and profiling: we confirm that the processing of personal data does not include profiling and that you are not subject to fully automated decision-making.
You can exercise these rights by contacting the Board of Ombudsmen: firstname.lastname@example.org - 0800/25 095.
We make every effort to handle your personal data in a diligent and legitimate manner in accordance with the applicable regulations. If nevertheless you believe that your rights have been breached and you cannot find an answer to your concerns within our service, you are free to lodge a complaint at:
The Data Protection Authority
Rue de la Presse 35, 1000 Brussels
Tel. 02 274 48 00
Fax. 02 274 48 35
You can also take additional action before a court if you believe that you would suffer harm as a result of the processing of your personal data.
8. TRANSFER TO THIRD PARTIES
In the course of our mediation role, the railway company or railway manager, just like you, has a legal right of access to your case. In order to reach a solution, the details of the case are also exchanged with both parties.
Certain personal data collected by us may be processed by external agencies, such as an IT supplier or audit service, in the context of security purposes. No personal data are transferred to countries outside the European Union.
The employees, managers and/or representatives of the above-mentioned service providers or institutions, and the specialised service providers appointed by them, must respect the confidential nature of your personal data and may only use this data for the purposes in the context in which it was provided.
We will never pass on your personal data to other third parties without your prior consent.
We will not sell or make your personal data commercially available to direct marketing agencies or similar service providers under any circumstances.
9. TECHNICAL AND ORGANISATIONAL MEASURES
We take the necessary technical and organisational measures to process your personal data to an adequate level of security and to protect them against destruction, loss, falsification, alteration, unauthorised access or inadvertent notification to third parties, as well as any other unauthorised processing of these data.
Under no circumstances can the Ombudsman Service for Rail Passengers be held liable for any direct or indirect damage resulting from wrong or unlawful use of the personal data by a third party.
10. FURTHER QUESTIONS?
If, after reading this Data Protection Notice, you have any further questions or comments regarding the collection and processing of your personal data, please contact the Ombudsman Service on 0800/25 095, either by post to Koning Albert II-laan 8, box 5, or by e-mail to email@example.com.