Privacy Statement
Visit Zuid-Limburg

Foundation VVV Zuid Limburg (hereinafter Visit Zuid-Limburg) respects your personal data and ensures that the personal information supplied to us or otherwise obtained by us is treated in confidence. By ‘personal data’ we mean all information about a person – including information that indirectly tells us something about someone. This privacy statement implements the requirements of the EU General Data Protection Regulation (the ‘GDPR’) concerning the duty to inform data subjects whose personal data is processed by Visit Zuid-Limburg.

The Controller
Visit Zuid-Limburg is a foundation established under civil law registered in the trade register under number 14063449. Its principal business address is at Walramplein 6, 6301 DD Valkenburg aan de Geul. We are designated the controller by virtue of the fact that we receive and process personal data as defined by the GDPR. If you have any questions about the way we process personal data, we invite data subjects to contact us at Visit Zuid-Limburg.

What personal data does Visit Zuid-Limburg process?
Visit Zuid-Limburg processes various sorts of personal data for various purposes. By ‘personal data’ we mean information by which a person can be identified, such as name, address, date of birth, or bank account number. In some circumstances an IP address or user name may also be regarded as personal data.

Services
When we supply services, consisting primarily of providing information for tourism and recreation purposes, Visit Zuid-Limburg processes various kinds of personal data. For example, we use the name and contact details of our business relations so that we can put them in contact with customers. We process a range of personal data of visitors (consumers) to Zuid-Limburg, to act as agent in making agreements with the organisers of activities in Zuid-Limburg or to inform them about such activities. In some cases we also have to share this personal data with third parties. We must always register this so that we can inform data subjects about this matter if subsequently requested.

Acquisition and direct marketing
To be able to expand our services and offer new products we sometimes use direct marketing, for which purposes we will process personal data. This personal data may only be processed by a select group of employees within our organisation who are involved in the search for potential new business relations, clients, etc. This form of data processing is based on the statutory principle of justified commercial interests.

Employees
Obviously, Visit Zuid-Limburg also processes personal data concerning our own employees. This form of processing is based on the underlying contractual relationship and the statutory obligations placed on employers.

Potential new employees
In the context of recruitment procedures Visit Zuid Limburg is also required to process the personal data of job applicants. This involves the processing of personal data such as name, address, telephone number, education and work experience, and so forth. We need this personal data so that we can carefully assess each job applicant. The data will not be stored for longer than six months following a decision regarding appointment for the vacancy. Should the need arise, Visit Zuid-Limburg will only store personal data for any future vacancies and/or job solicitations with the consent of the relevant data subject.

Social media
Visit Zuid-Limburg uses social media (LinkedIn, Facebook, twitter, Instagram). It is therefore possible that we process the personal data of third parties via these channels.

Third parties
In providing our service we may have access to the personal data of third parties with whom we have no direct relationship. The staff of Visit Zuid-Limburg will always handle this personal data with care and only process it in accordance with the rights and obligations arising from the relevant privacy regulations. This processing will then be carried out in the performance either of a legal obligation or in promoting the justified interests of a third party.

Recipients of personal data
Visit Zuid-Limburg will send its processed personal data to other parties only in limited cases, for example where it acts as agent in bringing about a contract between a consumer and the organizers of activities. In such a case, the personal data of the consumer has to be forwarded so that the organizer knows with whom they have entered into a contract.

On the basis of consent
One can think of situations in which we forward personal data to third parties with the consent of the data subject. This consent is only valid if the data subject has freely given their consent having first been clearly informed of the purposes for which the consent is given.

Necessary external processing
Visit Zuid-Limburg cannot provide its services without the assistance of third parties, such as ICT providers. In some cases these external parties will also have to process personal data for the benefit of Visit Zuid-Limburg. This processing will only be performed in accordance with data processor agreements which set out the parties’ mutual rights and obligations with regard to careful processing. In other cases we may be compelled by laws and regulations, or the statutory procedures or requests of government bodies, to forward personal data to third parties. In such cases, Visit Zuid-Limburg will seek guarantees from such third parties as far as possible that they will treat the personal data as confidential and ensure it is sufficiently secured.

Storage terms
Visit Zuid-Limburg stores personal data in compliance with the current statutory storage terms. Personal data may not be stored for longer than to achieve the purpose for which it was processed. This period will differ from case to case. As soon as there is no ground for continued storage of the data it will be deleted or anonymised.

Forwarding to countries outside the EU
It is not impossible that in order to provide our service we need to forward your personal data to a country outside the European Union. Other such countries do not always provide the same guarantees as apply within the EU. We will only forward personal data to parties that we expect to implement a privacy policy similar to that we have adopted at Visit Zuid-Limburg.

The rights of data subjects
Data subjects whose personal data is processed by Visit Zuid-Limburg can exercise the following statutory rights:

1. access
2. rectification
3. erasure of data
4. restriction of processing
5. data portability
6. objection

To ensure that the data subject is able to exercise the above rights, we explain each of them below.

Right of access
In principle, if a data subject so requests, Visit Zuid-Limburg will supply an overview of the personal data that it has processed. The request for access by the data subject must be accompanied by a valid proof of identity.
In responding to the request, Visit Zuid-Limburg will in principle provide access to the processed personal data, and disclose the purposes for which the data is processed, to whom it has been provided, the period during which it will be stored, and what other rights the data subject has.

Rectification
If Visit Zuid-Limburg has incorrectly processed personal data, the data subject has the right to have any incorrect personal data concerning them rectified. If any personal data is incomplete, the data subject may require this to be made complete.

Erasure of data
Under strict circumstances the data subject may require Visit Zuid-Limburg to erase personal data that it has processed. In the following situations Visit Zuid-Limburg must comply with this request:

• if the personal data is no longer required for the purpose for which it was obtained;
• if the data subject withdraws their consent to the processing of personal data for which they initially gave their consent, and there is no other basis on which we are permitted to process that data;
• if the data subject objects to the processing of the personal data and there are no compelling justified grounds for processing that outweigh this objection;
• the personal data was unlawfully processed;
• the personal data must be erased by virtue of a statutory obligation.

Restriction of processing
If a data subject has requested the rectification of personal data processed by Visit Zuid-Limburg, the same data subject may also request that the processing be restricted for the period during which Visit Zuid-Limburg investigates the request. Furthermore, if a data subject believes that we are unlawfully processing personal data or no longer need it, or if the data subject objects to the processing of the data, the data subject may request the processing of data to be temporarily restricted. If Visit Zuid-Limburg considers the request for restriction of the data processing to be justified, we will only continue to process the data with the consent of the data subject or if there is a justified interest in doing so (including, but not limited to, the drawing up or exercise of, or evidential support for, a legal claim).

Data portability
A data subject is entitled to require Visit Zuid-Limburg to provide their personal data in a systematic, generally accepted, and machine-readable form if this data has been processed on the basis of the consent of the data subject, or in the performance of a contract. The data subject is also entitled to require such personal data to be transferred to another controller.

Objection
The data subject always has the right to object to the processing of personal data by Visit Zuid-Limburg, including where this data processing has occurred on the basis of profiles drawn up by Visit Zuid-Limburg in connection, for example, with direct marketing. In such a case, Visit Zuid-Limburg will cease data processing, unless we can provide such justified grounds for the processing that these outweigh the interests, rights and freedoms of the data subject. The data subject always has the right to object to the processing of personal data for the purposes of direct marketing. In every such a case, Visit Zuid-Limburg will immediately cease the processing of data for this purpose.

Exercise of rights
A data subject wishing to exercise any of the above rights should contact Visit Zuid-Limburg. Visit Zuid-Limburg will respond to the request within the statutory period of four weeks. It is not impossible that Visit Zuid-Limburg will not be able to respond in substance to the request within the said period. In that case, we will indicate why more time is needed to respond to the request and within what further period we will respond.

Withdrawal of consent
If Visit Zuid-Limburg processed the personal data of a data subject on the basis of their consent, then this data subject may withdraw that consent at any time. If in that case Visit Zuid-Limburg has no additional ground for processing this personal data, the processing of the data will cease from the moment that the consent is withdrawn.

Complaints
If a data subject complains about the processing of data by Visit Zuid-Limburg and this data subject believes that Visit Zuid-Limburg has not taken the complaint seriously, the complaint may be referred to the Dutch Data Protection Agency (the ‘DPA’). The DPA may then possibly institute an investigation. Furthermore, the data subject can file a relatively simple claim with the court. Further information about this procedure can be found on the DPA website.

Questions or comments
If you have any questions or comments concerning the processing of personal data please contact Visit Zuid-Limburg. This privacy statement has been drawn up in accordance with the GDPR. Visit Zuid-Limburg reserves the right to update this privacy statement from time to time.

Version: June 2018