This Privacy Statement was last amended on: 25/01/2023

CONTENT

•     Definitions
•     To whom does this privacy statement apply?
•     Contact details
•     Data controller
•     What personal data does ITZU process?
•     With whom do we share your personal data?
•     Security of your personal data
•     Retention of your personal data
•     Cookies
•     What are your rights and how can you exercise them?

1    DEFINITIONS
Processing of personal data: Data processing is defined as an operation or set of operations involving personal data or a set of personal data, whether carried out by automated means or not, such as the collection, recording, organisation, structuring, retention, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction of data. Personal data is defined as any information relating to a natural person, by which that person can be directly or indirectly identified.
A data processor: A data processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the data controller.
A data controller: A data controller is a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data.

2    TO WHOM DOES THIS PRIVACY STATEMENT APPLY?
This Privacy Statement applies to all direct customers, visitors, suppliers, job applicants and all other persons who are not employees of ITZU and whose personal data ITZU processes as a data controller. For the remainder of this Privacy Statement, we will refer to an individual who belongs to one of these groups as a "data subject".

3    CONTACT DETAILS
ITZU is a cluster of strong partners in the people business: Itzu is a total partner for various services, from temporary employment to recruitment and selection, from career guidance to outplacement. ITZU includes the following entities:
 

Our Data Protection Officer (DPO) is registered with the Data Protection Authority and ensures that ITZU's processing of personal data is done in accordance with this Privacy Statement and applicable data protection and privacy regulations. The Data Protection Officer can be reached by email at privacy@itzu.eu 

4    DATA CONTROLLER
Points 5 to 10 of this Privacy Statement apply only when ITZU acts in the capacity of a data controller. 
If, as a data subject, you wish to exercise your rights, you must always turn to the data controller.

5    WHAT PERSONAL DATA DOES ITZU PROCESS?
5.1    Based on the performance of an agreement 
ITZU processes personal data necessary for the performance of an agreement to which you are a party, or to take measures at your request prior to the conclusion of an agreement.

• When requesting a quote
  If you would like more information about ITZU's services or products, you can request a quote through various channels (telephone, website, social media, etc.). To this end, ITZU processes personal identification data (such as name and e-mail) to be able to make you the most accurate proposal possible. 
• When processing an order, following up invoices and commercial agreements
  If you order products or services from or deliver them to ITZU, ITZU processes personal identification data and professional data for the correct handling and follow-up of the order or delivery.
• When providing services with associated payroll administration
• When providing services, payroll information is collected for the purpose of payroll administration.
• When applying for a job
  ITZU regularly seeks new enthusiastic and motivated employees. During the application procedure, ITZU processes the following categories of personal data: personal identification data, personal characteristics (such as language, date of birth, etc.), competences, educational history, career path, curriculum vitae, image, work references.
•   When participating in an event
  ITZU organises events. When organising such an event, we process personal identification data and professional data when registering.
• When participating in a training course
  ITZU organises training courses. To ensure a smooth process and administrative follow-up, we process your personal identification details and professional data. 
• When handing over an attestation or certificate
  To obtain certain subsidies (e.g., SME portfolio, Flemish Training Leave) we will issue a personalised attestation as proof of enrolment in or attendance at the training course. 
  If the training includes an exam or test, we will keep a record of your results. We will also use your contact details to deliver the attestation or certificate.

5.2    Based on your permission
When processing personal data based on your consent, you always have the right to withdraw it (see section 10. What are your rights and how can you exercise them)?

• When you subscribe to our newsletter
• When you subscribe to our newsletter, you consent to the sending of a newsletter. ITZU gives you the opportunity to unsubscribe from the newsletter.
• When completing a customer satisfaction survey
  ITZU will ask permission to link personal data (identification data and professional data) with the results of a customer satisfaction survey. We only use this data to improve our services. ITZU uses a research agency as a data processor for this purpose, but it will not use the data for other purposes or pass it on to third parties for their own use.
• When creating a recruitment pool
  If ITZU does not hire you after an application, but would like to keep your CV for future opportunities, ITZU will ask your permission to keep your CV.
• When using targeted photos for publicity purposes
  ITZU will ask your permission when publishing targeted images on its social media and website. By targeted images we mean images in which the person is clearly recognisable in the picture (close-up, image focused on a specific person, posed photo, etc.).
• When communicating eating preferences when registering for an event and/or training course
  If you wish, you can communicate your food preferences when registering for an event or training course, so that we can provide suitable food for you at the catering. Only numbers will be communicated to the catering company and no personal data.
• When improving the quality of the website
  ITZU uses tools to collect statistics and gain insight about its website usage. This information is anonymised and is not linked to your personal data. Analytical tools use cookies. These are text files placed on your computer that collect standard internet logging information and behavioural information. More info can be found in our cookie statement.

5.3    Based on legitimate interest
ITZU processes personal data based on a legitimate interest in which ITZU has made an assessment of interests. 

• When using security cameras
  There are cameras in and around ITZU's buildings with the aim of preventing, establishing or detecting nuisance or crimes against persons and property and maintaining public order. For this purpose, footage is collected, processed and stored.
• When dealing with a question, offering assistance and offering information at your request
  You can contact ITZU through various channels (telephone, letter, email, chat, contact form on the website, social media). We will only use the personal data you provide to answer your questions.
• When passing on leads within ITZU
  There are several entities within ITZU. Itzu mainly operates within the 'people business' with HR and Facilities services as its spearheads. Itzu attaches great importance to further developing the relationship with its clients and prospects (so-called 'Customer Relationship Management'), beyond what is strictly necessary for the execution of an agreement or taking pre-contractual measures. That is why the different ITZU entities can potentially pass on opportunities intra-group. An example: someone applies to Itzu Select for a particular position and is transferred to Itzu Career for career guidance.
• When sending direct marketing
  ITZU sends direct marketing communications and processes personal identification data in the process. ITZU respects corresponding regulations, whereby direct marketing is only sent if there is a customer relationship, regarding similar products or services provided by ITZU itself. As a data subject, you always have the option to unsubscribe.
•  When inviting you to take part in a customer satisfaction survey
  ITZU invites customers to participate in customer satisfaction surveys. To this end, we cooperate with a research agency.
• When carrying out competency tests during the application period
  In order to screen an applicant, ITZU carries out an assessment of the candidate's competencies and personality. ITZU uses an assessment agency as a data processor for this purpose, but we will not use the data for other purposes or pass it on to third parties for their own use.
• When creating an application summary list with the status for each person involved
  Due to the many job applications ITZU processes and the various channels through which new candidates are presented, there is a legitimate interest in creating a list so that we do not re-process candidates we reject after several weeks. This list contains only personal identification data.
• When passing on a CV intra-group
  If someone applies for a job at ITZU, ITZU may distribute this application among its entities. If, as an applicant, you only wish to apply to a specific entity within ITZU, please communicate this explicitly.
• When keeping contact details to notify you as an acquaintance/family of our employee in case of emergency
  We ask our employees to provide contact details of an acquaintance and/or family member so that we can notify them in case of emergency.
• When using visual material for public relations and/or journalistic purposes
  When ITZU organises a major corporate event, ITZU has a legitimate interest to engage in public relations in order to attract new employees and/or new customers. Visitors to the event are informed in advance and have the opportunity to express their opposition to having their photo taken: at the event itself to the photographer or after the event by sending an email to marketing@itzu.eu
• We save your personal data (albeit anonymously) for scientific research. 

5.4    Based on legal obligation
ITZU may need to process personal data because it is necessary to comply with a legal obligation to which ITZU is subject.

• When making use of Flemish Training Leave
  If you indicate to ITZU that you want to make use of Flemish Training Leave (VOV), we will provide you with an enrolment certificate and have to draw up an attendance list for each training course on a daily basis. As a result, we process personal identification data (name, first name), national register number, your employer and details about the training course. We are obliged by law (Ministerial Decree of 8 July 2019) to process this information.
• Taking a satisfaction survey for training under the SME portfolio
  Since ITZU provides training that falls under the SME portfolio, we are required to conduct a satisfaction survey among our course participants. 
• As trainer of a training course
  For training courses that fall under the SME portfolio or the Flemish Training Leave, we are obliged to mention the name of the trainer and the trainer's employer on the attestations and attendance lists. These attestations will be passed on to the participants, their employers and the government in order to claim the subsidy.

5.5    Compatible purpose
If we collected your personal data under a legitimate interest or an agreement, we may also use this data in the future for another purpose that is compatible with the original purpose. In doing so, we pay attention to the following points:

• the relationship between the original purpose and the new/future purpose;
• the context in which the data was collected (what is the relationship between you and ITZU);
• the type and nature of the data (is it sensitive data?);
• the possible consequences of the intended further processing (what are the consequences for the data subject?);
• the existence of appropriate safeguards (such as encryption or pseudonymisation).

6    WITH WHOM DO WE SHARE YOUR DATA?
ITZU will not share your personal data with any third parties unless:

• ITZU has received your prior consent to do so;
• ITZU is required to do so as part of regulations or legal proceedings;
• ITZU is requested to do so by legislative or judicial bodies;
• ITZU organises an event together with partners or suppliers. The list of participants is also communicated to the partners or suppliers; 
• ITZU is wholly or partly taken over or split up. In that case, ITZU will oblige the third party to process the personal data only in accordance with the provisions of this Privacy Statement.
• ITZU uses certain subcontractors such as, among others, consultants, research agencies (e.g., for conducting satisfaction surveys), tools (e.g., CRM system, mailing tool) in order to outsource part of our services to them. These subcontractors are not considered third parties but data processors. We will ensure that these subcontractors take the necessary technical and organisational measures to process your personal data in a legal and legitimate manner and also not to disclose it to third parties under any circumstances.

7    SECURITY OF YOUR PERSONAL DATA
ITZU recognises that the security of personal data is part of data protection. Therefore, ITZU will take appropriate technical and organisational measures to protect your personal data from unauthorised processing or unauthorised access to prevent misuse.
Whenever personal data is transferred to a data processor outside the European Economic Area (EEA), ITZU always does so in accordance with the terms of this Privacy Statement and in compliance with applicable data protection laws and regulations to ensure adequate safeguards. 

8    RETENTION OF YOUR PERSONAL DATA
ITZU will retain your personal data only for the minimum period necessary to fulfil the purposes set out in this Privacy Statement, unless (i) a longer retention period is required in resolving disputes or (ii) if a longer retention period is required by law. Non-personal information may be retained over time without limitation for statistical purposes.

ITZU applies a retention period of 3 years and a validity of reports of 2 years.
9    COOKIES
Cookies are text files that are placed on your computer to collect standard internet logging information and behavioural information. This information is used to track visitor behaviour on the website and to compile statistical reports on the website.
More information about our cookie policy can be found at www.itzu.eu/nl-be/talent-solutions/cookies.

10    WHAT ARE YOUR RIGHTS AND HOW CAN YOU EXERCISE THEM?
10.1    What are your rights?

• Right of access: You can ask us what personal data of yours we process, what we process it for, which categories of personal data we process, with which categories of third parties we share your personal data, the origin of the data processed and - when applicable - the logic we use when automatically processing personal data.
• Right to rectification: If any of your information is incorrect, you can ask us to correct it.
• Right to erase your data: If data is not processed lawfully or if your data is no longer needed for the purpose for which it was collected, you can ask us to delete your data.
• Right to restrict processing: By restricting the processing of your personal data, your personal data can still be stored but its use will be limited. Once you have requested a processing restriction, we will only be allowed to store your data. This means that no other operations can take place with your data.
• Right to object: You have the right to object to your data being processed if such processing is based on a public interest or a legitimate interest of the person processing your data. Moreover, you can also assert this right to object if your personal data is processed for direct marketing purposes. This right to object also applies to profiling that forms the basis of processing for direct marketing purposes.
• Right to withdraw consent: If the processing of your personal data is based on the basis of consent, you have the right to withdraw this consent at any time. 
• Right to data portability: You have the right to obtain the personal data you provided in a common, structured and machine-readable form and you have the right to transfer this personal data to another data controller if the processing is based on the legal grounds of consent or contractual relationship.

The above rights are only a summary and remain subject to the limitations of applicable data protection laws at all times.

10.1.1    Right of inspection for Talent Solutions' services

• In case of Assessment/development assignments, Itzu will act as a data processor and the request for inspection will be directed to the data controller, it being the contractor who must comply with this request. 
• If the contractor passes the request on to Itzu as data processor, Itzu will provide you with the fullest possible overview of the personal data held about you after the contractor has received the report: 
  • Personal data provided by you personally
  • Processed results of tests, trials and evaluations. You will not have access to the methodology of tests, trials and evaluations and no right to know the 'correct' answers to questions asked since these are not personal data.
• The right to inspect can take place at one of Itzu's offices or online but NOT over the phone. 
• You can obtain a copy of the assessment report after the feedback session with one of our consultants. Further disclosure of this confidential information or careless storage of it would then be entirely your responsibility. The right to a copy of the assessment report is only possible if you have exercised your right of inspection. If the feedback interview is conducted online, you will obtain a copy of the assessment report in an encrypted e-mail. 
• We can already confirm that no special categories of personal data are kept (such as race, ethnic origin, health data, data concerning sexual orientation, etc.).

10.2    How can you exercise your rights?

You can exercise your rights by sending an email to privacy@itzu.eu. To prevent any unauthorised disclosure of your personal data, ITZU may request further information to verify your identity.
ITZU has one month to respond to your request. This period starts when ITZU has received your application and has all the required information to comply with your request. The one-month period may be extended upon notice and explanation from ITZU.
ITZU will provide the requested information free of charge. Where requests are unfounded or excessive, in particular due to their repetitive nature, ITZU may charge a reasonable fee or may refuse the request.
If for some reason you believe that ITZU has not handled your request correctly, you may contact ITZU again. We will then work with you to find a solution.
For the sake of completeness, we inform you that if ITZU does not respond to your request, refuses it or if our response does not meet your expectations, you always have the right to lodge a complaint with the Data Protection Authority, Rue de la Presse 35, 1000 Brussels, Belgium, Tel +32 (0)2 274 48 00, or via the e-mail address contact@apd-gba.be.