BIG Privacy Notice

This Privacy Notice applies to the processing of data related to the use of the website https://bigagainstbreastcancer.org/ (hereinafter “the Website”).

Breast International Group (BIG)-aisbl (hereinafter “BIG”) as the Controller of the personal data, has committed to comply with the General Data Protection Regulation, the Belgian law of 30 July 2018 on the protection of individuals with regard to the processing of personal data and all applicable laws and regulations regarding data protection. By this Privacy Notice, BIG wants to make sure that you understand what personal information is collected about you, how your personal information is used and how it is kept safe.

 

  1. General warning and use of social media

Access to the Website implies the User’s full and unreserved acceptance of this Privacy Notice (hereinafter the “Notice”), as well as its general terms of use and the Cookies Notice.

The User acknowledges having read the information below and authorizes BIG to process, in accordance with the provisions of the Notice, the personal data that he/she communicates on the Website.

The Notice is valid for all pages hosted on the Website. It is not valid for the pages hosted by third parties to which BIG may refer and whose privacy policies may differ. BIG cannot therefore be held responsible for any data processed on these websites or by them. This Notice also applies to any other website that BIG may operate, including our Company pages on Twitter, Facebook, Instagram, LinkedIn, YouTube and Flickr.

Please, note that for the use of social media, BIG will be Joint-Controller with Twitter, Facebook, Instagram, LinkedIn, YouTube and Flickr only for the following activities: accessing and processing statistical aggregate data provided by Twitter, Facebook, Instagram, LinkedIn, YouTube and Flickr. For any other processing on the platform, social media platform shall be considered as the sole Data Controller.

Facebook, including Instagram, and LinkedIn have created an “addendum” to their user agreements for company pages for the processing for which they are Joint-controllers with us. Such agreement is not currently provided by Twitter, YouTube and Flickr.

 

  1. What personal data do we collect, on which basis and why?

Depending on the purpose for which we process your personal data, we need to process one or other personal data, which will in general be, depending on each case, as follows:

Purposes

Types of personal data

Legal basis

To answer to your queries

Title, Name, email address as required information.

Other personal data may be processed by BIG depending on your request and the information you provide, for example health data when you ask us treatment advice. Please provide us with only the data necessary for your request.

This processing is based on our legitimate interest. We consider that we have lawful interest in answering the requests or queries raised by you through the existing different contact channels. We understand that the processing of these data is also beneficial to you to the extent that it enables us to assist you adequately and answer to the queries raised.

To send you newsletters, other publications and communicate about BIG’s activities

Title, Name, email address

This processing is based on your consent.

For fundraising purposes, such as to process your gifts and donations

Title, Name, email address, postal address, financial details

This processing is based on our contractual obligations and to be able to send tax receipts.

To organize your participation in one of our events

Title, Name, email address, financial details and if applicable number plate number, nationality, clothing size,  emergency contact details

This processing is based on our contractual obligations.

For statistical purposes

Aggregate statistical data (e.g. Company page on Twitter, Facebook, Instagram, LinkedIn, YouTube and Flickr).

We consider that we have lawful interest to understand the way our page is consulted (e.g. how many times our page is consulted,…).

Use of cookies for the functioning and managing of our website

Cookies may store in certain circumstances personal data which may include: IP addresses, browser type, location, operating system,…

Please, see our Cookies Notice for more information.

  1. How long will we keep your personal information?

BIG will keep your personal data for no longer than necessary to fulfill the purposes for which we collected it, including any legal requirements.

The retention period of your personal data will then depend on the purposes for which we process such data, as explained below:

  • To answer to your queries: We will process your data for the time necessary to meet your request.
  • To send you newsletters, other publications and communicate about BIG’s activities: We will process your data until you unsubscribe or cancel your subscription to the Newsletter after 20 years from the date of your subscription.
  • For fundraising purposes, such as to process your gifts and donations: We will keep and process your data for 10 years from the date of your registration in our database, in order to keep you informed about BIG’s activities and progress against breast cancer.
  • To organize your participation in one of our events: We will process your data related to your inscription and payment for the time necessary for the organization of your participation to one of our events. Within three months following the event, we delete all personal data that is related specifically to your participation in the event, for example clothing size, age, car number plate, etc.
  • For statistical purposes: Statistical information are stored by Hootsuite, Twitter, Facebook, Instagram, LinkedIn, YouTube and Flickr and consequently subject to their retention policy. We may export statistical reports, but we guarantee that this is only in an anonymous form.
  • Use of cookies for the functioning and managing of our website: please, see our Cookies Notice.

 

  1. Data sharing

We do not sell, trade, or otherwise transfer to outside parties your personal data.

BIG has contracted with the following Services Providers to manage the Website:

  • Siteground for hosting
  • Koalect for fundraising, crowdfunding & crowdsourcing activities.
  • Stripe for online payment processing
  • org for content management (CMS). Matomo for statistical analytics to evaluate performance of the website
  • Constant Contact for emailing and contact management (CRM)
  • euDonet for contact management (CRM)

Your personal data may also be shared with:

  • BIG Headquarters’ staff,:
    • Philanthropy department should your query concern fundraising activities,
    • Communications department should your query concern communication activities (subscriptions to e-newsletter for example),
    • Research and Development department, should your query concern a BIG study
  • Subcontractors and/or third parties that work under contract to carry out specific activities for BIG, for example to provide shipping or publishing services because you have purchased BIG products or you have asked to receive BIG’s publications;
  • Public and other authorities if needed to fulfill BIG legal’s obligations, for example tax authorities regarding donations;
  • Third parties because you have accepted to participate in events organized with a third party. For example, if you choose to participate in the 20km of Brussels with the BIG team, BIG must share your data with the organizers of the race for your registration.

Sharing your personal data as explained above may involve a transfer of personal data to a country outside the European Economic Area (EEA). BIG is therefore committed to complying with the transfer rules under applicable data protection laws and therefore ensure to:

  • transfer your data to countries where the data recipient is located that has been recognized as adequate by the European Commission
  • or, where a country has not received an adequacy decision from the European Commission, to implement appropriate safeguards, such as the EU Standard Contractual Clauses

You can contact our DPO (see contact details below) if you want to have more details about the mechanism supporting data transfer outside the EEA.

 

  1. How do we protect your information?

BIG treats your personal data in a confidential manner and provides for a sufficient and adequate level of protection of your personal data.

Your personal data are contained behind secured networks and are only accessible by a limited number of persons who have special access rights to such systems and are required to keep the information confidential.

 

  1. Your rights

According to the GDPR, you have the following rights:

  • Right to Access. You have the right to obtain confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, information related to the processing of data and a copy of the data being processed.
  • Right to Rectification. You have the right to require rectification of inaccurate or incomplete data about you.
  • Right to Erasure (“right to be forgotten”): you have the right to request the deletion of your personal data in the situations set forth by applicable data protection law.
  • Right to object to processing. You have the right to object, on grounds relating to your particular situation, at any time to the processing of your data.
  • Right to Restrict the processing. You have the right to restrict processing of data under certain specified circumstances.
  • Right to Data portability. You have the right to request for the receipt or the transfer to another organization, in a machine-readable form, of your personal data.
  • Right to withdraw consent. When you have given your consent for the processing of your data, you can withdraw it at any time without justification.

Please note that all of these rights are not absolute and will be assessed on a case-by-case basis by our Data Protection Officer.  

If you would like to exercise your rights, please let us know by contacting our DPO, dpo@bigagainstbc.org.

You also have the right to lodge a complaint with the Data Protection Authority in the Member State of the European Union of your habitual residence, place of work or place of the alleged infringement if you consider that your personal data is not processed in accordance with the GDPR. Please find their information in section 8 “Contacts”.

 

  1. Contacts

Breast International Group (BIG)-aisbl

Boulevard de Waterloo, 76

B-1000, Brussels

Belgium

 

Data Protection Officer

Email: dpo@bigagainstbc.org.

Phone number: +32 2 896 55 53

 

Belgian Data Protection Authority

 

Autorité de la protection des données – Gegevensbeschermingsautoriteit (APD-GBA)

Rue de la Presse 35 – Drukpersstraat 35 1000 Bruxelles – Brussel

Tel. +32 2 274 48 00

Fax +32 2 274 48 35

email: contact@apd-gba.be

Click here to visit the website

 

Click here for other Data Protection Authorities