Privacy statement

This privacy policy statement of the Agency for Justice and Enforcement describes how we process your personal data.

Please take a moment to familiarise yourself with our privacy practices, set out hereinafter, and contact us if you have any questions regarding this statement. If you have general questions about how we process your personal data, you can contact the Data Protection Officer (hereinafter: DPO) of the Agency for Justice and Enforcement by emailing dpo.ajh@vlaanderen.be(opens in your email application). You can also contact the DPO with comments and suggestions and to exercise your rights.

The Agency for Justice and Enforcement processes your personal data, and safeguards and respects your privacy in this regard. The Agency for Justice and Enforcement acts as controller within the meaning of the General Data Protection Regulation (hereinafter: GDPR). This means that the Agency is responsible for processing your personal data as described in this privacy policy statement.

When an incident is reported, we process personal data of the following categories of natural persons:

• The persons who report an incident;
• The persons being reported;
• The persons identified in the context of the reported incident;
• The persons handling the report.

The following personal data may be processed in this regard:

• Identity information (e.g., first and last name);
• National registration number;
• Contact details (e.g., e-mail address or telephone number);
• Personal characteristics (Information on occupation, education, age, gender, nationality, marital status and residence status);
• Financial data;
• Data on lifestyle, leisure activities and social context;
• Family data: on family composition and housing situation;
• Data concerning health, data revealing origin or descent, data concerning sexual behaviour or sexual orientation, political data or data revealing religious or philosophical beliefs (this includes special categories of personal data within the meaning of Art. 9 GDPR);
• Police and judicial data, this includes criminal data within the meaning of Art. 10 GDPR;
• Behavioural data, data on risk situations and behaviours;
• Other necessary data required to fulfil the objectives of the reporting centre, such as:
  • Audio, video, images and office files containing personal data that are uploaded as attachments to a report;
  • Personal data ascertained from the factual circumstances related to the report (e.g., name of witnesses).

On the one hand, we receive your personal data directly, in one of the following ways:

• The person reporting an incident makes contact via the fill-in form on this website;
• The person reporting an incident makes contact via email;
• The person reporting an incident makes contact by phone;
• The person reporting an incident makes contacts via chatbox;
• The person reporting an incident has an appointment in person.

In addition, we may also receive your personal data indirectly. This may be the case, for example, when a report contains personal information about persons other than the person reporting an incident.

We process your personal data to process a report and provide an individual service to the person reporting an incident based on that report. Providing an individual service for the person reporting an incident includes the following secondary tasks:

• Reports of transgressive behaviour are received, and demand and supply is clarified based on these reports;
• Interviews are arranged with a view to support and recognition;
• Support is offered and any report of transgressive behaviour and the subsequent procedure within a specific sector or organisation is followed up on;
• A cordial referral is made to an external service;
• A short-term psychological support process is offered;
• A legal consultation on the civil, criminal or disciplinary options is offered;
• Rehabilitation discussions are arranged

We also process personal data to provide policy opinions to organisations involved in reports of transgressive behaviour, and follow up and support them. These policy opinions only contain general information and will not contain direct data that can identify you, for example, your name or personal situation will never be indicated.

The processing of personal data takes place on the basis of your (express) consent if you contact us yourself and communicate your personal data (Art. 6(1)(a) GDPR and Art. 9(2)(a) GDPR).

Within the Agency for Justice and Enforcement, only the employees who handle your report have access to your personal data.

In addition, the Agency may use third parties to perform certain processing activities. We always ensure that any third party provides sufficient guarantees for the protection and confidentiality of your data. When you report an incident, we may forward your personal information to:

• Service providers acting on behalf of the Agency for Justice and Enforcement to carry out certain processing activities, such as the case management system that tracks reports and the chat tool.
• Other organisations: if we believe that we are required to do so by applicable law or regulation or on the basis of another lawful request or order, we may in specific cases disclose your personal data to supervisory authorities or police, judicial, aid organisations, internal reporting centres or other authorities (e.g. disciplinary authorities). If necessary, we will ask for your consent in this regard.

Your personal data will not be kept longer than necessary for the purpose described above. Your personal data will be kept for up to ten years after the Agency for Justice and Enforcement closes your report.

Your personal data will be processed within the European Economic Area (hereinafter: EEA).

However, sometimes we may share your personal data with a third party outside the EEA. Where this is the case, we undertake to ensure an appropriate and adequate level of protection for your personal data.

If you have questions about a possible transfer of your personal data outside the EEA, please contact the DPO at dpo.ajh@vlaanderen.be(opens in your email application).

As a data subject, you have various rights you can exercise. When you request the Agency for Justice and Enforcement to exercise any of the rights listed below, the DPO will always consider whether the request can be granted.

The right to information

You can submit an access request to the Agency for Justice and Enforcement to obtain access to all personal data we process about you, including the grounds for processing and how that data was collected.

Right to rectification, erasure and restriction of inaccurate or unlawfully obtained data​​​​​​​

You have the right to have inaccurate personal data corrected or amended and, under certain circumstances, the right to have your personal data deleted from our filing system. You acknowledge that if you refuse to provide certain information or request the deletion of your personal data, we will no longer be able to provide certain services. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data or to object to processing.

Right to withdraw your consent​​​​​​​

If the processing activity is based on your consent, you have the right to withdraw this consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Right to data portability​​​​​​​

You have the right to receive your personal data processed by us in a structured, commonly used and machine-readable format and/or to transfer that data to another controller.

Right to lodge a complaint​​​​​​​

If at any time you believe that we have violated your privacy and if you disagree with the way we process your data, you have the right to lodge a complaint with the supervisory authority responsible for the protection of personal data in the country where you reside or in a country of your choice.

The contact information for the Flemish Supervisory Commission is:

Flemish Supervisory Commission

Boulevard du Roi Albert II 15, 1210 Brussels

+32 (0)2 553 20 85

contact@toezichtcommissie.be(opens in your email application)

You can email the Belgian Data Protection Authority at contact@apd-gba.be(opens in your email application) or reach them at the address below:

Data Protection Authority

Rue de la Presse 35, B-1000 Brussels

To exercise one or more of your rights, please contact the DPO at dpo.ajh@vlaanderen.be(opens in your email application). We will ask for proof of your identity to ensure your data are not disclosed to anyone who is not entitled to it.