The Personal Data Controller is asbl Brussels Major Events, located at Petite rue du Musée, 6–8 in 1000 Brussels.

You can contact the Data Protection Officer via privacy@bmeo.be. You will find more information on how to exercise your rights in section 5.

The data BME collects about you, if any, are:

• Personal details: such as your surname, name, date of birth, sex, entrant number, etc.
• Contact details: postal address, email address, phone number, etc.
• Details of your online behaviour: such as the links you click on, the pages you visit, etc.
• Photographs or videos taken at events
• Details of your performances (e.g. your time)
• Details of the products and services you provide (for artists, artisans, suppliers, etc.)
• Details of complaints, questions, comments, etc.
• Details of your professional skills (for job applicants).

BME collects and uses your data for specific, explicit and legitimate purposes, but never for subsequent incompatible purposes.

*the legal bases
We process your data on the following bases:

• Contract BME processes your personal data for executing your contract with us or for taking your requested precontractual measures. into with it, or for the execution of pre-contractual measures taken at your request.
• Consent BME will ask for your consent to use your personal data for stated purposes. When we process your data with your consent, you have the right to withdraw that consent at any time.
• Legal obligation BME sometimes has a legal obligation to process your data.
• Legitimate interest In certain situations, we need to process your data for the legitimate interests pursued by BME. In that case, we verify that your interests, rights and freedoms do not override BME’s interests. When we process your data in our legitimate interest, you can tell us that your interests override ours at any time.

• Data subject Applicants for a BME position
• Data processed Personal details, contact details, CVs, cover letters, interviews, skills, publicly available information on the applicant
• Storage Time needed to manage the application. Applicants’ names are archived
• Transfer to third parties No
• Legal basis* Precontractual measures

• Data subjects Applicants for a BME position who were not selected but may be suitable for BME in the future
• data processed CVs, interview summaries, skills
• storage CVs are stored for a further six months on a recruitment waiting list
• Transfer to third parties No
• Legal basis* BME’s legitimate interest

• Data subjects Artists and artisans registering for events, suppliers
• Processed data Personal details, contact details, details of products, services or creations
• Storage Until the removal request — after five years if the artist or artisan stops registering for events or if the supplier no longer participates in a market
• Transfer to third parties If the artisan/artist consents, transfer to third parties that want to initiate professional contact
• Legal basis* BME’s legitimate interest and consent (for the transfer to third parties)

• Data subjects Artists
• data processed Personal details, contact details, creations, skills
• Storage See ‘Managing the database of artists’
• Transfer to third parties See ‘Managing the database of artists’
• Legal basis* BME’s legitimate interest and consent (for the transfer to third parties)

• Data subjects Traders
• data processed Personal details, contact details, product details
• storage Until the removal request — after five years if the trader stops registering for events
• Transfer to third parties Subcontracting (event registration app and site); with consent, transfer to third parties that want to initiate professional contact
• Legal basis* Precontractual or contract measures and consent (for the transfer to third parties)

• Data subjects Artists and artisans participating in events, suppliers, traders
• data processed Personal details, contact details, details of products, services or creations, safety information for the fire/police service (use of gas, fire, etc.)
• storage Information stored on the participation (archiving for historic reasons)
• Transfer to third parties To the fire and police services for safety management (legal obligation)
• Legal basis* Precontractual or contract measures; legal obligation for transfer to the fire and police services

• Data subjects Participants in the BXL Tour event
• data processed Personal details, contact details, emergency tel., category, registration time, time, photo finish
• storage Five years or until the removal request
• transfer to third parties ChronoRace, our technical subcontractors for sending emails and managing our computer systems and databases
• Legal basis* Contract execution
• Intervention of third parties BME may ask media partners to take photographs at the event. These partners are the data processors (for the photographs). They will make the photographs available to buy via the website that publishes the results. Full details of their data processing can be found on their website. Media partner: Sportograf – More information at https://www.sportograf.com/fr/privacy. In the interests of full disclosure, please note that Sportograf does not use facial recognition to find photographs of you at BXL Tour. At your request, photographs will be identified using your entry number (bib number).

This statement aims to tell you how ASBL Brussels Major Events (hereinafter "BME") collects, processes and uses your personal data for organizing Brussels City Hall tours.

To manage the ticket office, the Data Processor is the service provider Brussels Expo, which operates under the trade name "Ticket Live". Please refer to its Privacy Policy for more information on how it processes the data (see the footer on the reservation site).

BME processes personal data as stipulated by the General Data Protection Regulation (GDPR), all applicable privacy protection and personal data regulations and privacy@bmeo.be.

• Purposes of the processing Managing guided tours of Brussels City Hall, including verifying that the conditions for obtaining particular categories of tickets have been met, resolving problems or addressing special requests.
• Data collected BME verifies but does not store the following data collected by the online ticket service provider:
  • Personal details
  • Date/time when the ticket was issued
  • If the payment has been made
    
    BME verifies but does not store the following data when tickets are subject to special conditions:
    
  • Contact details
  • Evidence or supporting documents if necessary to justify a particular category of tickets
    
    BME may use the following data to contact individuals in the event of problems or special requests:
    
  • Contact details (email address, postcode, city and country, phone number)

• Data subjects The person buying the tickets
• Source Provider of the Brussels Expo online tickets reservation service
• Legal basis Contract execution
• Storage period BME does not store information. BME accesses data on the online ticket platform to verify that tickets have been issued and payments made. Please refer to the ticket office’s data protection statement for more information on how long it stores data.
• Your rights You have the right to access your data, receive information on how it is processed, as well as the right of rectification, objection, limitation, erasure and portability. You can contact privacy@bmeo.be to exercise your rights. If we are unsure, BME reserves the right to verify the requester’s identity before fulfilling the request. BME undertakes to answer you immediately and at the latest within one month of receiving your request on said rights. We consider the time of receipt to be the time when your request is complete, which includes receiving proof of your identity or being certain thereof. When your request is complex or you make numerous requests, this one-month period may be extended by two months. We will inform you of any extension as quickly as possible. You have the right to complain to the competent regulatory authority if you feel that your rights have been violated. This will likely be the Belgian Data Protection Authority. You will find its contact details on the website www.autoriteprotectiondonnees.be.

• Data subjects Event participants
• data processed Personal, contact, reservation or registration details
• Retention Identifiers stored until the account removal request — registrations stored for ten years
• Transfer to third parties Website management partners
• Legal basis* Contract execution

• Data subjects Event participants (sporting or others) who agreed when registering to receive communications on future events (sporting or others) organized by BME
• data processed Personal details, contact details, possibly the registration category, interests (if provided)
• storage Five years or until the removal request
• Transfer to third parties Our technical subcontractors for sending emails and managing our computer systems and databases
• Legal basis* Consent

• Data subjects Event participants who agreed when registering to receive communications
• data processed Personal details, contact details, possibly the registration category, interests (if provided)
• storage Five years or until the removal request
• Transfer to third parties Our technical subcontractors for sending emails and managing our computer systems and databases
• Legal basis* Consent

• Data subjects Event participants, Internet users
• data processed Participation rates, registration rates, use of the websites
• storage Unlimited (anonymized data statistics)
• Transfer to third parties Google Analytics, USA
• Legal basis* Legitimate interest or consent (if cookies used)

• Data subjects Volunteers, temps and trainees working on events
• data processed Personal details, contact details, position or role
• storage Duration of the event
• Transfer to third parties To event co-organizers in the case of joint events; public authorities as appropriate
• Legal basis* Precontractual measures, contracts, legal obligation for transfers to public authorities

• Data subjects Volunteers, temps and trainees working on events
• data processed Personal details, contact details, position or role played during BME events
• storage Until the removal request
• Transfer to third parties No
• Legal basis* BME’s legitimate interest

• data subjects Media contacts
• data processed Personal details, sector, contact details, past contacts
• storage Until the removal request
• Transfer to third parties No
• Legal basis* BME’s legitimate interest

• Data subjects Internet users
• data processed Questions, requests, images and other shared data
• storage Pursuant to social media terms and conditions (FB, Twitter, others)
• Transfer to third parties No
• Legal basis* Internet users’ requests

• Data subjects Internet users, event participants
• data processed Images and videos of crowds, images and videos of people attending events
• storage Images of crowds: five years then archiving, images of people who have consented: see the storage length on the document provided
• Transfer to third parties Posts on social media, the website
• Legal basis* Individual photographs: consent; crowds: BME’s legitimate interest

• data subjects Employees, volunteers, suppliers, visitors, participants, sponsors, partners
• data processed Personal details (if necessary), contact details, images
• storage Images: max. one month
• Transfer to third parties Public authorities, police, fire service, security companies
• Legal basis* Surveillance: legitimate interest — images transferred to the police: legal obligation

• Data subjects Citizens of Brussels
• data processed Personal details, contact details, participation in local meetings
• storage Until the deletion request or if BME is informed that the person no longer lives in the area
• Transfer to third parties No
• Legal basis* Consent

• Data subjects Complainants
• data processed Personal details, contact details, complaint, context, follow-up
• storage One year after comprehensive management of the complaint, then archiving
• Transfer to third parties No
• Legal basis* BME’s legitimate interest

1. We use the technical services of external providers:

• Database managers (that manage, update and quality control the data)
• Computer system and application providers
• External consultants
• Data hosting and security services

We guarantee that these providers only have access to your data to the extent necessary to perform their tasks. We also guarantee that they are bound by a duty of confidentiality and may only process the data in accordance with the instructions we provide.

2. We are sometimes required to share your personal data with public authorities. This can be imposed by laws, regulations or legal proceedings: at the request of authorities, fire services or police forces in the context of law enforcement actions. We may also believe that it is necessary or advisable to disclose your data to prevent physical or financial harm, or in the event of an investigation into suspected or actual fraud or illegal activities.

3. Where your data is transferred to a country outside the European Economic Area and the level of data protection in that country is not considered adequate by the European Commission, we will provide the necessary safeguards to protect your data (we usually use the European Commission’s standard contractual clauses). In this way, we ensure that the data we transfer to third countries is adequately protected.

You have the right to access your data, receive information on how it is processed, as well as the right of rectification, objection, limitation, erasure and portability.

You can contact privacy@bmeo.be to exercise your rights. If we are unsure, BME reserves the right to verify the requester’s identity before fulfilling the request.

BME undertakes to answer you immediately and at the latest within one month of receiving your request on said rights. We consider the time of receipt to be the time when your request is complete, which includes receiving proof of your identity or being certain thereof. When your request is complex or you make numerous requests, this one-month period may be extended by two months. We will inform you of any extension as quickly as possible.

You have the right to complain to the competent regulatory authority if you feel that your rights have been violated. This will likely be the Belgian Data Protection Authority. You will find its contact details on the website www.autoriteprotectiondonnees.be.

We ensure that your personal data is protected by appropriate technical and organizational security measures against accidental or unlawful loss, destruction, alteration, unauthorized use, disclosure or access.

BME uses social media (Facebook, Twitter, Instagram, etc.) to send you information. You can also contact BME through these channels. BME will then use your data to respond to your question, comment or complaint.

These social media platforms’ general terms and conditions apply. By using the services, you have accepted the T&Cs. You will find more information on the platforms about their use of your data. BME is not responsible for how these service providers process your data. We are, however, responsible for giving you information on our use of your data on social media.

BME uses social media services to promote our events. We may also send communications to people who make requests or ask questions.

BME keeps track of all information published about us on social media. We retain that data. Data you have published about BME may therefore be retained in this context.

BME may post photographs of our events, including of attendees.

Finally, social media may also be used during recruitment campaigns to access the information you post or to contact you (when your profile is open to BME).

Video surveillance data is processed in accordance with the applicable legislation (Belgian Act of 21 March 2007 and all other applicable laws and regulations on surveillance and data protection).

The images are kept for a maximum period of one month, except where they are necessary for evidence in the context of investigations or for the establishment, exercise or defence of legal rights.

As several people may appear on the images, communicating them to one person may infringe the privacy of others. Therefore, BME only discloses the images via a police request.

The BME website may contain links to websites operated by other companies. These websites should have their own privacy statements. We stress the need to read the statements carefully when surfing on the sites. BME cannot in any way be responsible for the websites’ content or for how personal data is processed by these third parties.

This statement may be amended from time to time to better reflect BME’s data protection policy. You will find the date when it was last updated at the top of this page.

You can contact us at privacy@bmeo.be if you have any questions, complaints or requests about the processing of your personal data.