Privacy policy of Mediahuis

Each Mediahuis Entity processes personal data for specific purposes.

The Mediahuis Entity always acts based on a legal basis set out by law. This is a legal ground that allows the use of personal data. Examples of such legal bases include: consent, execution of an agreement, legal obligation and legitimate interest.

The purposes and legal bases for the processing of your personal data differ depending upon your capacity and relationship with us. More information about the applicable purposes and legal grounds can be found in Part 4 – Specific information about the processing of personal data by each Mediahuis Entity.

Each Mediahuis Entity processes your personal data in the first place because you yourself pass on your personal data in the context of the provision of a Service.
Sometimes one of your contacts may have provided us with your personal data, e.g. to let you (temporarily) enjoy our Services.

A Mediahuis Entity further receives personal data from public sources, such as official government publications (e.g. the Belgian Official Gazette, CBE, NIS (social class)).

For each of the specific processing operations listed in Section 4, a Mediahuis Entity will transfer your personal data to:

• subcontractors who work on its behalf and its account (processors);
• its employees in the context of the exercise of their function.

Mediahuis ensures that these recipients only have access to personal data that is relevant, adequate and necessary for the processing.

The European Economic Area (EEA) includes all countries of the European Union together with Norway, Liechtenstein and Iceland. EU legislation requires additional safeguards if a Mediahuis Entity transfers personal data to other countries situated outside the EEA. In such a case, the Mediahuis Entity will warrant that the transfer is covered by the appropriate safeguards, including a European Commission adequacy decision, or the European Commission’s standard contractual clauses, to ensure the same level of protection for your personal data.

You can always request access to the appropriate safeguards provided by the Mediahuis Entity. See section 3.5 below.

Subject to the terms, limitations and conditions provided for by applicable law, you may always contact a Mediahuis Entity to exercise the following rights:

• You have a right of access to your personal data. This allows you to verify which personal data a Mediahuis Entity processes about you.
• You always have the right to have your personal data corrected. This allows you to rectify or correct, inaccurate or incorrect personal data a Mediahuis Entity processes about you.
• You have the right to have your personal data erased. This allows you to permanently delete personal data that a Mediahuis Entity processes about you.
• You have the right to limit the processing of personal data related to you. This allows you to ‘freeze’ the use of your personal data by a Mediahuis Entity, without deleting it.
• You have the right to object to a processing of your personal data. This allows you to object to the further processing operations by a Mediahuis Entity of your personal data.
• You always have the right to withdraw your consent whenever the processing of your personal data takes place on the basis of your consent.
• You always have the right to object to the processing of your personal data for direct marketing purposes. Registered Users can amend their newsletter preferences in their account.
• You have the right to data portability. This allows you to easily move, copy or transfer your personal data from one controller to another.

For all processing operations set out in this privacy policy, you may exercise your rights via this specific web form.

Please note – This web form does not apply to amendments, corrections or deletion of data in online publications of journalistic content. For this, we refer you to the charter for online publications. There you will find the options available to you in case you are mentioned in an online publication, be it an article, an audio or video clip.

A data protection officer (DPO) has been appointed for all processing operations carried out by each Mediahuis Entity.

To contact the DPO, click here.

You are entitled to file a complaint with the supervising authority. For Belgium this is:
Data Protection Authority, Drukpersstraat 35, 1000 Brussels, Belgium, contact@apd-gba.be, https://www.gegevensbeschermingsautoriteit.be/, tel: +32 2 427 48 00.

If you use any one of the Services of a Mediahuis Entity or visit any of them through your account on social media (e.g. login through your Facebook account) or interact on our social media channels or through buttons or other techniques, then the Mediahuis Entity can receive from the social media entity data (e.g. page statistics). These can be used by Mediahuis to evaluate its marketing actions or to display Targeted Advertisements on the social media channels.

The use of or interaction with social media is subject to the social media channel’s own rules – no Mediahuis Entity has any influence over such rules. Consult the user terms and the privacy policy of the social media network concerned to understand how such networks deal with your personal data. Information about data on page insights data for Facebook can be found here.

4.1.1 Processing operations for a User or Registered User

If you are a User or Registered User, then a Mediahuis Entity processes your personal data:

• For providing the Service(s) to you based on the need to execute the agreement with you. Here you will find an overview of the different Services for each Mediahuis Domain and Mediahuis Entity.
  When providing the Services we may also use cookies.
  This applies in particular when we offer you the opportunity to view VRT content on Mediahuis Domains. In such case, we place certain cookies for VRT so that VRT can carry out measurements within the framework of its legal reporting obligations under the management agreement with the Flemish Government and under the Flemish Media Decree.
  You can find more information about this use in our cookie policy.

Additional recipients:

• Entities to whom you disclose your data when using the Services (e.g. future employers within Jobat, buyers and sellers within Zimmo, etc.);
• VRT nv of public law (Auguste Reyerslaan 52, 1043 Brussels, KBO 0244.142.664), when VRT content is displayed on a Mediahuis Domain. In such case, VRT and Mediahuis act as joint data controllers. VRT’s DPO acts as the central contact. Click here for VRT’s privacy policy.

Retention period: up to 10 years after the end of the customer relationship.

• For its client administration based on the need to take pre-contractual measures (recording of orders, follow-up of abandoned shopping cart, etc.) and/or the need to execute the agreement (creation and management of an account, invoicing, collection, etc.).

Retention period: up to 10 years after the end of the customer relationship.

• To invite you to participate in surveys or market research based on its legitimate interest. You are, of course, free to decide whether or not to do so: see section 4.3.
• For sending commercial information (direct marketing): see section 4.5.
• To participate in a competition, promotion or event: see section 4.2.
• To contact us with a question, request or complaint: see section 4.4.

4.1.2 Processing operations for Registered Users

If you are a Registered User, then a Mediahuis Entity will also process your personal data:

• For showing Recommended Content: if you give your consent through your privacy preferences in your account, then we use Registered Data (i.e. your gender, age and address postal/zip code) to personalise your digital experience and content. These settings are completely optional and separate from settings related to cookies. You can change your choice at any time within your account.

Additional recipients: /

Retention period: up until the moment you withdraw your consent. Click Behaviour will then be kept for a maximum of 13 months.

• To enable single sign on across Mediahuis Domains: This is a functionality we are introducing so that a Registered User can access all Mediahuis Domains (which offer this functionality – see here) with one unique user account and password. This is regardless of the Mediahuis Entity to which the Mediahuis Domain belongs. This ensures that if, as a Registered User, you read an article on e.g. De Standaard, you can then surf to e.g. Gazet van Antwerpen and log in there with the same account and password.This processing takes place on the basis of the legitimate interest of the Mediahuis Entities to increase the convenience of Registered Users and to better secure personal data.The involved Mediahuis Entities collect and use your e-mail address for this purpose.
  Additional recipients: the other Mediahuis Entity(ies) involved in its/their capacity as joint controllers.

Retention period: up to a maximum of 10 years after the end of the customer relationship.

4.1.3 Processing operations for Registered Users of Jobat

Finally, if you are a Registered User of Jobat, the Mediahuis Entity, HORS, will also process your personal data in accordance with its legal obligations under the Flemish decree of 10 December 2010 on private employment services, e.g. to inform candidates in writing of the decision taken about them.

Additional recipients: /

Retention period: up to 10 years after inactivity or closure of your Jobat account.

If you participate in a competition, promotional action or event of a Mediahuis Entity, then such an entity processes your personal data for the management of the competition/action/event and, where appropriate, the designation of the winner on the basis of the contract with you. The processing of your personal data is necessary to manage the competition or action, to organise the event and to contact the winners to hand over the prize.

Participation in a competition, promotional action or event may be subject to competition rules or action or subscribing terms.

Additional recipients: companies or organisations with which the Mediahuis Entity would cooperate for the organisations of the competition, promotional action or event.

Retention period: up to 10 years after the end of the competition, promotional action or event.

When you participate in a survey or market research, the Mediahuis Entity concerned processes your personal data on the basis of your consent. You are always entitled to withdraw your consent.

Additional recipients:

• Companies or organisations with which the Mediahuis Entity would collaborate to conduct the survey or market research;

Retention period: up to a maximum of 3 years after the end of the market research or survey.

If you contact a Mediahuis Entity regarding a question, a request for information or a complaint, then that Mediahuis Entity processes your personal data to take pre-contractual measures at your request so as to answer or help you.

Additional recipients: /

Retention period: up to 10 years after your question, request for information or the answer to your complaint has been made.

A Mediahuis Entity may process your data for direct marketing purposes, in particular:

• To send you the newsletter of the webshop of a Mediahuis Domain. This happens on the basis of your consent.
• To provide you with commercial information about the Mediahuis Entity with which you have a relationship (e.g. you are a Registered User, you are participating in a competition or promotional action of that Mediahuis Entity, etc.) based on our legitimate interest in keeping you informed of our activities. If you give us consent through your privacy preferences in your account, then we may use Registered Data (e.g. your gender, age and zip code, current subscriptions, etc.) to more accurately deliver our information to you. We combine this Registered Data with Click Behaviour, where available, to best understand your interests. You can change your selection at any time within your account.
• To send you other commercial information (from other Mediahuis Entities or partners). This action will only happen on the basis of your consent. To be clear: Mediahuis receives the commercial information from the partner and then decides who to send it to. The partners are not informed of this and, in the case of partner emails, these partners do not receive any information about you.

You always have the right to withdraw your consent. You can do this via your account page or by contacting the Mediahuis Entity from which you received this information.

Additional recipients: /

Retention period: up to 10 years after the end of the relationship with the Mediahuis Entity that sends you commercial information.

4.6.1 Targeted Advertisements that we show in partnership with Ads&Data

In the context of a cooperation between several partners, the Mediahuis Entities, each process your personal data separately with Ads&Data (Harensesteenweg 226, 1800 Vilvoorde, Belgium, ECB: 0809.309.701) as joint controllers.

Ads&Data? This is an organisation that ensures cooperation between Belgian providers of advertising space that jointly build target groups for advertisements and show personalised advertisements on digital media and television.

The categories of personal data that these Mediahuis Entities and Ads&Data collect and use for the purposes are: Registered Data and Click Behaviour.

The collaboration includes, among other things, that, subject to your consent, these Mediahuis Entities will collect and communicate such personal data to Ads&Data in an encrypted form. Due to this encryption, Ads&Data will not be able to identify you directly. Ads&Data will then use this data to build a personalised advertising profile (e.g. sports fans). Ads&Data uses this to automatically display, with the help of service providers, targeted advertisements on the Mediahuis Domains of these Mediahuis Entities.

More specifically, this means that these Mediahuis Entities each separately process your personal data with Ads&Data for the following purposes and on the basis of the following legal grounds:

• To create personalised online advertising profiles, based on your consent.
• For selecting personalised advertisements, based on your consent.
• To measure advertising performance, based on your consent.

You can withdraw your consent for the above-mentioned purposes at any time in the footer of the page or in the settings of your account.

For these purposes, these Mediahuis Entities will communicate your personal data to Ads&Data in its capacity as the joint controller who will process your personal data to create an advertising profile.

Ads&Data shares your advertising profile with:

• Processors who process data on our behalf (e.g. IT companies);
• advertisers who wish to use Ads&Data’s services to display advertising on our websites and applications.

Ads&Data also shares an identification number from your browser with platforms that offer support services for selecting and displaying targeted advertisements. An overview of these platforms can be found here.

Some recipients may be located in countries outside the Economic European Area (EEA). If your encrypted data is transferred to them, then this transfer is covered by appropriate safeguards, including European Commission model clauses, to continue to guarantee an adequate level of protection. You can always ask the DPO for access to the appropriate safeguards.

Ads&Data continuously updates and stores your personal data for a maximum of 13 months.

As a data subject, you have various rights. These are explained later in this privacy policy. You can exercise all these rights regarding both the Mediahuis Entity and Ads&Data, but the Mediahuis DPO acts as a central point of contact.

>4.6.2 Job-related Targeted Advertisements that we show in partnership with HORS

The Mediahuis Entities, HORS BV and Mediahuis NV, work together as joint controllers to show you job-related Targeted Advertisements on Mediahuis Domains.

HORS? That is the abbreviation for House of Recruitment Solutions. This is the Mediahuis Entity that provides Jobat’s services.

The categories of personal data that Mediahuis NV and HORS collect and use for the purposes are: Registered Data (age, postcode, gender, email address and certain information from your CV) and Click Behaviour.

This cooperation implies that, with your consent, Mediahuis NV and HORS will collect personal data on their Mediahuis Domains. Mediahuis NV will transmit the data it collects to HORS in an encrypted form. Due to the encryption, HORS will not be able to identify you directly. HORS then uses this data to build a personalised advertising profile and segments (e.g. whether there is an interest in IT jobs). HORS uses this to show targeted advertisements in an automated way on the Mediahuis Domains of these Mediahuis Entities, with the help of service providers.

Specifically, this means that Mediahuis NV and HORS process your personal data for the following purposes and on the basis of the following legal grounds:

• To create personalised online advertising profiles, based on your consent.
• For selecting personalised advertisements, based on your consent.
• To measure advertising performance, based on your consent.

You can withdraw your consent for the above-mentioned purposes at any time in the footer of the page or in the settings of your account.

For these purposes, the Mediahuis Entities will communicate your personal data to HORS as the joint data controller who will then process them to create an advertising profile.

HORS will share your advertising profile with

• Processors.

HORS also shares an identification number from your browser with platforms that provide support services for selecting and displaying targeted advertisements. You can find a list of these platforms here.

Some recipients may be located in countries outside the Economic European Area (EEA). If your encrypted data is transferred to them, then this transfer is covered by appropriate safeguards, including the European Commission model provisions, to continue to guarantee an adequate level of protection. You can always ask the DPO for access to the appropriate safeguards.

HORS constantly updates your personal data. Click Behaviour will be kept for a maximum of 13 months. Registered Data will be retained in accordance with the retention period set out in section 4.3.

As a data subject, you have various rights. We will explain these rights later in this privacy policy. You can exercise these rights regarding both the Mediahuis Entity and HORS.

If you are a visitor to a Mediahuis Entity, then each Mediahuis Entity processes your personal data, in the context of visitor management based on its legitimate interests (e.g. guided tours for schools, a meeting with a Mediahuis business contact, inspection of the archive, etc.).

Additional recipients: /

Retention period: up to 1 year after your last visit.

If you supply products or services to a Mediahuis Entity, then this Mediahuis Entity processes your personal data in the context of supplier management based on the need to perform the agreement with you.

Additional recipients: /

Retention period: up to 10 years after the last delivery.

If you apply for a job at one of the Mediahuis Entities, then this Mediahuis Entity processes your personal data for:

• The management and evaluation of the application in the context of the pre-contractual relationship;
• Maintaining a recruitment reserve list based on its legitimate interest. Our justified interest consists of contacting you later for a job opportunity if there is no vacancy immediately available. If you do not wish to be included in the recruitment reserve list, then you can always object to this.

For these processing purposes, we may receive personal data from: the recruitment agency. This concerns the following categories of personal data: contact details, CV, work history, diplomas, training, references and other relevant information for the application.

Additional recipients:

• Contracting agencies;
• Previous employers (to verify references provided).

Retention period: each Mediahuis Entity will retain your personal data for up to 5 years after the application process has ended.

If a Mediahuis Entity processes your personal data for one of the purposes set out above, then that entity processes your personal data as well for the following purposes:

• the detection of, prevention of and fight against fraud and abuse based on its legitimate interest. Less fraud and abuse benefits the Mediahuis Entity, its customers and its suppliers.

Additional recipients:

• judicial, police or administrative authorities if the law or the circumstances require it;
• professional advisers (lawyers, consultants, etc.).

Retention period: up to 10 years after the establishment of the facts of fraud or abuse, unless the detection or fight would take longer.

• dispute management based on the law of 30 July 2018 (art. 10§1,1°) and our legitimate interest, as each Mediahuis Entity must be able to safeguard and defend its rights.

Additional recipients:

• judicial, police or administrative authorities if the law or the circumstances require it;
• professional advisers (lawyers, consultants, etc.).

Retention period: up to 10 years after the end of the dispute, unless the management of a specific dispute requires personal data to be kept for a longer period.

• company law transactions and co-operations: personal data may always be processed in the context of discussions, investigations, evaluations, negotiations and implementing measures in connection with a cooperation or corporate transaction (acquisition, merger, sale of shares or assets, joint venture, etc.) by a Mediahuis Entity. This is done based on our legitimate interest to i) enable the legal entities contemplating such an operation to become acquainted with each other’s personal data and ii) for the merger or acquisition to actually take place.

Additional recipients:

• third parties with whom a corporate transaction or cooperation is envisaged;
• professional advisers to the parties concerned (lawyers, consultants, etc.);
• judicial, police or administrative authorities if required by law or circumstances.

Retention period: up to 10 years after the termination of the corporate transaction or cooperation.