Privacy policy

PRIVACY POLICY OF MEDIAHUIS

Version 4.3 changed on May 8th, 2024

INTRODUCTION

Below you will find the privacy policy of Mediahuis (hereafter “Mediahuis” or “we”). This policy concerns the processing of personal data relating to natural persons, i.e. personal data on all websites, via all (mobile) apps and via all services of the different entities within Mediahuis. A list of the different Mediahuis entities and domains can be found here.

This policy does not apply to the processing of personal data relating to legal persons.

This privacy policy does not affect, and should be read together with, the other applicable policies and agreements of the Mediahuis Entities:

Cookies Policy
General Subscription Conditions
Terms of use
Regulation for telephone competitions
Ad hoc competition rules
Charter for online publications

1. DEFINITIONS

Within this policy, it is necessary to use a number of technical terms. That is why we provide a brief overview of the definitions and frequently used terms in this section.

Recommended Content: suggestions about our Services (e.g. articles, offers, etc.) that a Mediahuis Entity aligns with the interests of a User (on the basis of Click Behaviour with his/her consent) or of a Registered User (on the basis of Click Behaviour with his/her consent, and of Registered Data, if so consented to).

Cookies: Text or other files and similar technologies that store or access information on your computer, tablet, smartphone or other devices with which you visit a Mediahuis Domain. More information about this subject can be found in our Cookie Policy.

Service(s): Access to news, promotions, functionalities for a better User experience, (mobile) apps, Recommended Content or products that a Mediahuis Entity sells, provides or makes available on or through a Mediahuis Domain. You can enjoy our Services as soon as you visit a Mediahuis Domain or after installing one of our apps (as a User). If you choose to create an account with a Mediahuis Domain and vist logged in, then you become a Registered User and our Services are more comprehensive than those for Users. If you are a Subscriber, then you can also read the “plus” articles marked with (+) on the newspaper websites.

Click here for an overview of the Services for each Mediahuis Domain.

User: you who visit a Mediahuis Domain to enjoy a Service without creating an account. This can be done directly via a Mediahuis Domain or after installing one of our apps.

Registered User: you who register by creating an account on a Mediahuis Domain to enjoy a Service.

Targeted Advertisements: commercial information that is addressed to a User’s interests (if consented to, then based on Click Behaviour) or a Registered User’s interests (if consented to, then based on Click Behaviour and Registered Data).

Registered Data: personal data that a Registered User him/herself provides to a Mediahuis Entity when he/she subscribes to a Service. This information may vary by Mediahuis Domain, but usually includes: first name, surname, e-mail address, street, house number, postal/zip code, city, gender, date of birth and/or desired newsletters. If you want to, you can also enter your phone and/or mobile number. You can always consult and change these details on your account page.

Click Behaviour: The interests of a User or Registered User, after having obtained his/her consent, are derived from the use of a Service. Click Behaviour mainly includes:

(i) session data, i.e. operating system, device type, browser type, etc.;
(ii) pages visited from which we classify you according to area(s) of interest (e.g. sports, lifestyle, car enthusiast).

Mediahuis Domain: a website or (mobile) application offered or operated by a Mediahuis Entity.

Mediahuis: all the Mediahuis Entities set out here.

Mediahuis Entity: the legal person within Mediahuis who offers/supplies a Service. An overview of all Mediahuis entities can be found here.

2. THE DIFFERENT CONTROLLERS WITHIN MEDIAHUIS

Each Mediahuis Entity acts as a controller of your personal data if it sells, provides or makes available its respective Service to you, registers you for a competition with it, if you visit this Mediahuis Entity, etc.

Click here for an overview of the different Mediahuis Entities and Domains.

3. GENERAL INFORMATION REGARDING THE PROCESSING OF PERSONAL DATA BY ALL MEDIAHUIS ENTITIES

3.1 What are the purposes and legal basis for the processing of your personal data?

Each Mediahuis Entity processes personal data for specific purposes.

The Mediahuis Entity always acts based on a legal basis set out by law. This is a legal ground that allows the use of personal data. Examples of such legal bases include: consent, execution of an agreement, legal obligation and legitimate interest.

The purposes and legal bases for the processing of your personal data differ depending upon your capacity and relationship with us. More information about the applicable purposes and legal grounds can be found in Part 4 – Specific information about the processing of personal data by each Mediahuis Entity.

3.2 How does a Mediahuis Entity receive your personal data?

Each Mediahuis Entity processes your personal data in the first place because you yourself pass on your personal data in the context of the provision of a Service.

A Mediahuis Entity further receives personal data from public sources, such as official government publications (e.g. the Belgian Official Gazette, CBE, NIS (social class)).

3.3 Who receives your personal data?

For each of the specific processing operations listed in Section 4, a Mediahuis Entity will transfer your personal data to:

subcontractors who work on its behalf and its account (processors);
its employees in the context of the exercise of their function.

Mediahuis ensures that these recipients only have access to personal data that is relevant, adequate and necessary for the processing.

For certain processing, there are specific recipients of your personal data, those are each time listed below in Part 4 – Specific information about the processing of personal data by each Mediahuis Entity.

The Mediahuis Entity Mediahuis NV may communicate a limited set of your personal data to Black Tiger Belgium NV, Researchdreef 65, 1070 Brussels. Mediahuis does this based on the legitimate interests of Mediahuis, Black Tiger Belgium and its clients so that Black Tiger Belgium can comply with (or assist its clients in complying with) article 5.1d) GDPR which requires their data to be accurate and updated as necessary, in order to generally improve the quality of data held by companies.

For the avoidance of doubt: data that Mediahuis provides to Black Tiger Belgium is not passed on to its clients by Black Tiger Belgium. Black Tiger can only use this data to complement its own databases, to validate, uniquely identify and/or link its data or the data provided by its clients.

On its special GDPR webpage avg.blacktigerbelgium.tech. Black Tiger Belgium informs you about how they process personal details that they collect via Mediahuis NV and other channels, about your GDPR rights and how you can exercise them.

3.4 Does a Mediahuis Entity transfer your personal data to countries outside the European Economic Area?

The European Economic Area (EEA) includes all countries of the European Union together with Norway, Liechtenstein and Iceland. EU legislation requires additional safeguards if a Mediahuis Entity transfers personal data to other countries situated outside the EEA. In such a case, the Mediahuis Entity will warrant that the transfer is covered by the appropriate safeguards, including a European Commission adequacy decision, or the European Commission’s standard contractual clauses, to ensure the same level of protection for your personal data.

You may always consult the data protection officer (DPO) to have access to the appropriate safeguards provided by the Mediahuis Entity. See section 3.5 below.

3.5 Which rights do you have as a data subject?

Subject to the terms, limitations and conditions provided for by applicable law, you may always contact a Mediahuis Entity to exercise the following rights:

You have a right of access to your personal data. This allows you to verify which personal data a Mediahuis Entity processes about you.
You always have the right to have your personal data corrected. This allows you to rectify or correct, inaccurate or incorrect personal data a Mediahuis Entity processes about you.
You have the right to have your personal data erased. This allows you to permanently delete personal data that a Mediahuis Entity processes about you.
You have the right to limit the processing of personal data related to you. This allows you to ‘freeze’ the use of your personal data by a Mediahuis Entity, without deleting it.
You have the right to object to a processing of your personal data. This allows you to object to the further processing operations by a Mediahuis Entity of your personal data.
You always have the right to withdraw your consent whenever the processing of your personal data takes place on the basis of your consent.
You always have the right to object to the processing of your personal data for direct marketing purposes. Registered Users can amend their newsletter preferences in their account.
You have the right to data portability. This allows you to easily move, copy or transfer your personal data from one controller to another.

For all processing operations set out in this privacy policy, you may exercise your rights via this specific web form.

Please note – This web form does not apply to amendments, corrections or deletion of data in online publications of journalistic content. For this, we refer you to the charter for online publications. There you will find the options available to you in case you are mentioned in an online publication, be it an article, an audio or video clip.

3.6 How can you contact the Data Protection Officer (DPO)?

A data protection officer (DPO) has been appointed for all processing operations carried out by each Mediahuis Entity.

You can always contact him/her with questions or complaints in connection with any processing of personal data by each Mediahuis Entity. To contact the DPO, click here.

3.7 Do you wish to file a complaint with the supervising authority?

You are entitled to file a complaint with the supervising authority. For Belgium this is:
Data Protection Authority, Drukpersstraat 35, 1000 Brussels, Belgium, contact@apd-gba.be, www.gegevensbeschermingsautoriteit.be, tel: +32 2 427 48 00.

3.8 Interaction through social media

If you use any one of the Services of a Mediahuis Entity or visit any of them through your account on social media (e.g. login through your Facebook account) or interact on our social media channels or through buttons or other techniques, then the Mediahuis Entity can receive from the social media entity data (e.g. page statistics). These can be used by Mediahuis to evaluate its marketing actions or to display Targeted Advertisements on the social media channels.

The use of or interaction with social media is subject to the social media channel’s own rules – no Mediahuis Entity has any influence over such rules. Consult the user terms and the privacy policy of the social media network concerned to understand how such networks deal with your personal data. Information about data on page insights data for Facebook can be found here.

4. SPECIFIC INFORMATION REGARDING THE PROCESSING OF PERSONAL DATA BY EACH MEDIAHUIS ENTITY

Below you can verify the different processing operations within each Mediahuis Entity. Each of the following processing operations takes place at each Mediahuis Entity, unless otherwise indicated.

Of course, not every processing will apply to everyone.

For more general information about the processing (who is the controller, what are the contact details of the data protection officer and the supervisory authority, what are your rights, does Mediahuis share your personal data with countries outside the EEA, etc.), see Part 3 – General information about the processing of personal data by the various Mediahuis Entities and Domains.

4.1 You are a User or Registered User of one of the Services

4.1.1 Processing operations for a User or Registered User

If you are a User or Registered User, then a Mediahuis Entity processes your personal data:

For providing the Service(s) to you based on the need to execute the agreement with you. Here you will find an overview of the different Services for each Mediahuis Domain and Mediahuis Entity.
When providing the Services we may also use cookies.
This applies in particular when we offer you the opportunity to view VRT content on Mediahuis Domains. In such case, we place certain cookies for VRT so that VRT can carry out measurements within the framework of its legal reporting obligations under the management agreement with the Flemish Government and under the Flemish Media Decree.
You can find more information about this use in our cookie policy.

Additional recipients:

Entities to whom you disclose your data when using the Services (e.g. future employers within Jobat, buyers and sellers within Zimmo, etc.);
BlackTiger Belgium NV, if Mediahuis NV is the relevant Mediahuis Entity (see also section 3.3 above).
VRT nv of public law (Auguste Reyerslaan 52, 1043 Brussels, KBO 0244.142.664), when VRT content is displayed on a Mediahuis Domain. In such case, VRT and Mediahuis act as joint data controllers. VRT’s DPO acts as the central contact. Click here for VRT’s privacy policy.

Retention period: up to 10 years after the end of the customer relationship.

For its client administration based on the need to take pre-contractual measures (recording of orders, follow-up of abandoned shopping cart, etc.) and/or the need to execute the agreement (creation and management of an account, invoicing, collection, etc.).

Additional recipients:

BlackTiger Belgium NV, if Mediahuis NV is the relevant Mediahuis Entity (see also section 3.3 above).

Retention period: up to 10 years after the end of the customer relationship.

To invite you to participate in surveys or market research based on its legitimate interest. You are, of course, free to decide whether or not to do so: see section 4.3.

For sending commercial information (direct marketing): see section 4.5.
To participate in a competition, promotion or event: see section 4.2.
To contact us with a question, request or complaint: see section 4.4.

If you are a Registered User, then a Mediahuis Entity will also process your personal data:

For showing Recommended Content: if you give your consent through your privacy preferences in your account, then we use Registered Data (i.e. your gender, age and address postal/zip code) to personalise your digital experience and content. These settings are completely optional and separate from settings related to cookies. You can change your choice at any time within your account.

Additional recipients: /

Retention period: up until the moment you withdraw your consent. Click Behaviour will then be kept for a maximum of 13 months.

Finally, if you are a Registered User of Jobat, the Mediahuis Entity, HORS, will also process your personal data in accordance with its legal obligations under the Flemish decree of 10 December 2010 on private employment services, e.g. to inform candidates in writing of the decision taken about them.

Additional recipients: /

Retention period: up to 10 years after inactivity or closure of your Jobat account.

4.1.2 Processing operations for Registered Users

If you are a Registered User, then a Mediahuis Entity will also process your personal data:

For showing Recommended Content: if you give your consent through your privacy preferences in your account, then we use Registered Data (i.e. your gender, age and address postal/zip code) to personalise your digital experience and content. These settings are completely optional and separate from settings related to cookies. You can change your choice at any time within your account.

Additional recipients: /

Retention period: up until the moment you withdraw your consent. Click Behaviour will then be kept for a maximum of 13 months.

To enable single sign on across Mediahuis Domains: This is a functionality we are introducing so that a Registered User can access all Mediahuis Domains (which offer this functionality – see here) with one unique user account and password. This is regardless of the Mediahuis Entity to which the Mediahuis Domain belongs. This ensures that if, as a Registered User, you read an article on e.g. De Standaard, you can then surf to e.g. Gazet van Antwerpen and log in there with the same account and password.

This processing takes place on the basis of the legitimate interest of the Mediahuis Entities to increase the convenience of Registered Users and to better secure personal data.

The involved Mediahuis Entities collect and use your e-mail address for this purpose.

Additional recipients: the other Mediahuis Entity(ies) involved in its/their capacity as joint controllers.

Retention period: up to a maximum of 10 years after the end of the customer relationship.

4.1.3 Processing operations for Registered Users of Jobat

4.2 You participate in a competition, promotional action or event

If you participate in a competition, promotional action or event of a Mediahuis Entity, then such an entity processes your personal data for the management of the competition/action/event and, where appropriate, the designation of the winner on the basis of the contract with you. The processing of your personal data is necessary to manage the competition or action, to organise the event and to contact the winners to hand over the prize.

Participation in a competition, promotional action or event may be subject to competition rules or action or subscribing terms.

Additional recipients: companies or organisations with which the Mediahuis Entity would cooperate for the organisations of the competition, promotional action or event.

Retention period: up to 10 years after the end of the competition, promotional action or event.

4.3 You take part in a survey or market research

When you participate in a survey or market research, the Mediahuis Entity concerned processes your personal data on the basis of your consent. You are always entitled to withdraw your consent.

Additional recipients:

Companies or organisations with which the Mediahuis Entity would collaborate to conduct the survey or market research;
BlackTiger Belgium NV, if Mediahuis NV is the relevant Mediahuis Entity (see also section 3.3 above).

Retention period: up to a maximum of 3 years after the end of the market research or survey.

4.4 You contact us regarding a question, a request for information or a complaint

If you contact a Mediahuis Entity regarding a question, a request for information or a complaint, then that Mediahuis Entity processes your personal data to take pre-contractual measures at your request so as to answer or help you.

Additional recipients: /

Retention period: up to 10 years after your question, request for information or the answer to your complaint has been made.

4.5 You receive commercial information (other than Targeted Advertisements)

A Mediahuis Entity may process your data for direct marketing purposes, in particular:

To send you the newsletter of the webshop of a Mediahuis Domain. This happens on the basis of your consent.
To provide you with commercial information about the Mediahuis Entity with which you have a relationship (e.g. you are a Registered User, you are participating in a competition or promotional action of that Mediahuis Entity, etc.) based on our legitimate interest in keeping you informed of our activities. If you give us consent through your privacy preferences in your account, then we may use Registered Data (e.g. your gender, age and zip code, current subscriptions, etc.) to more accurately deliver our information to you. We combine this Registered Data with Click Behaviour, where available, to best understand your interests. You can change your selection at any time within your account.
To send you other commercial information (from other Mediahuis Entities or partners). This action will only happen on the basis of your consent. To be clear: Mediahuis receives the commercial information from the partner and then decides who to send it to. The partners are not informed of this and, in the case of partner emails, these partners do not receive any information about you.

You always have the right to withdraw your consent. You can do this via your account page or by contacting the Mediahuis Entity from which you received this information.

Additional recipients: /

Retention period: up to 10 years after the end of the relationship with the Mediahuis Entity that sends you commercial information.

4.6 You choose for Targeted Advertisements on Mediahuis Domains

4.6.1 Targeted Advertisements that we show in partnership with Ads&Data

In the context of a cooperation between several partners, the Mediahuis Entities, Mediahuis NV and De Buren NV, each process your personal data separately with Ads&Data (Harensesteenweg 226, 1800 Vilvoorde, Belgium, ECB: 0809.309.701) as joint controllers.

Ads&Data? This is an organisation that ensures cooperation between Belgian providers of advertising space that jointly build target groups for advertisements and show personalised advertisements on digital media and television.

The categories of personal data that these Mediahuis Entities and Ads&Data collect and use for the purposes are: Registered Data and Click Behaviour.

The collaboration includes, among other things, that, subject to your consent, these Mediahuis Entities will collect and communicate such personal data to Ads&Data in an encrypted form. Due to this encryption, Ads&Data will not be able to identify you directly. Ads&Data will then use this data to build a personalised advertising profile (e.g. sports fans). Ads&Data uses this to automatically display, with the help of service providers, targeted advertisements on the Mediahuis Domains of these Mediahuis Entities.

More specifically, this means that these Mediahuis Entities each separately process your personal data with Ads&Data for the following purposes and on the basis of the following legal grounds:

To create personalised online advertising profiles, based on your consent.
For selecting personalised advertisements, based on your consent.
To measure advertising performance, based on your consent.

You can withdraw your consent for the above-mentioned purposes at any time in the footer of the page or in the settings of your account.

For these purposes, these Mediahuis Entities will communicate your personal data to Ads&Data in its capacity as the joint controller who will process your personal data to create an advertising profile.

Ads&Data shares your advertising profile with:

Processors who process data on our behalf (e.g. IT companies);
advertisers who wish to use Ads&Data’s services to display advertising on our websites and applications.

Ads&Data also shares an identification number from your browser with platforms that offer support services for selecting and displaying targeted advertisements. An overview of these platforms can be found here.

Some recipients may be located in countries outside the Economic European Area (EEA). If your encrypted data is transferred to them, then this transfer is covered by appropriate safeguards, including European Commission model clauses, to continue to guarantee an adequate level of protection. You can always ask the DPO for access to the appropriate safeguards.

Ads&Data continuously updates and stores your personal data for a maximum of 13 months.

As a data subject, you have various rights. These are explained later in this privacy policy. You can exercise all these rights regarding both the Mediahuis Entity and Ads&Data, but the Mediahuis DPO acts as a central point of contact.

4.6.2 Job-related Targeted Advertisements that we show in partnership with HORS

The Mediahuis Entities, HORS BV and Mediahuis NV, work together as joint controllers to show you job-related Targeted Advertisements on Mediahuis Domains.

HORS? That is the abbreviation for House of Recruitment Solutions. This is the Mediahuis Entity that provides Jobat’s services.

The categories of personal data that Mediahuis NV and HORS collect and use for the purposes are: Registered Data (age, postcode, gender, email address and certain information from your CV) and Click Behaviour.

This cooperation implies that, with your consent, Mediahuis NV and HORS will collect personal data on their Mediahuis Domains. Mediahuis NV will transmit the data it collects to HORS in an encrypted form. Due to the encryption, HORS will not be able to identify you directly. HORS then uses this data to build a personalised advertising profile and segments (e.g. whether there is an interest in IT jobs). HORS uses this to show targeted advertisements in an automated way on the Mediahuis Domains of these Mediahuis Entities, with the help of service providers.

Specifically, this means that Mediahuis NV and HORS process your personal data for the following purposes and on the basis of the following legal grounds:

To create personalised online advertising profiles, based on your consent.
For selecting personalised advertisements, based on your consent.
To measure advertising performance, based on your consent.

You can withdraw your consent for the above-mentioned purposes at any time in the footer of the page or in the settings of your account.

For these purposes, the Mediahuis Entities will communicate your personal data to HORS as the joint data controller who will then process them to create an advertising profile.

HORS will share your advertising profile with

Processors.

HORS also shares an identification number from your browser with platforms that provide support services for selecting and displaying targeted advertisements. You can find a list of these platforms here.

Some recipients may be located in countries outside the Economic European Area (EEA). If your encrypted data is transferred to them, then this transfer is covered by appropriate safeguards, including the European Commission model provisions, to continue to guarantee an adequate level of protection. You can always ask the DPO for access to the appropriate safeguards.

HORS constantly updates your personal data. Click Behaviour will be kept for a maximum of 13 months. Registered Data will be retained in accordance with the retention period set out in section 4.3.

As a data subject, you have various rights. We will explain these rights later in this privacy policy. You can exercise these rights regarding both the Mediahuis Entity and HORS.

4.7 You are visiting a Mediahuis Entity

If you are a visitor to a Mediahuis Entity, then each Mediahuis Entity processes your personal data, in the context of visitor management based on its legitimate interests (e.g. guided tours for schools, a meeting with a Mediahuis business contact, inspection of the archive, etc.).

Additional recipients: /

Retention period: up to 1 year after your last visit.

4.8 You are a supplier of a Mediahuis Entity

If you supply products or services to a Mediahuis Entity, then this Mediahuis Entity processes your personal data in the context of supplier management based on the need to perform the agreement with you.

Additional recipients: /

Retention period: up to 10 years after the last delivery.

4.9 You apply for a job at a Mediahuis Entity

If you apply for a job at one of the Mediahuis Entities, then this Mediahuis Entity processes your personal data for:

The management and evaluation of the application in the context of the pre-contractual relationship;
Maintaining a recruitment reserve list based on its legitimate interest. Our justified interest consists of contacting you later for a job opportunity if there is no vacancy immediately available. If you do not wish to be included in the recruitment reserve list, then you can always object to this.

For these processing purposes, we may receive personal data from: the recruitment agency. This concerns the following categories of personal data: contact details, CV, work history, diplomas, training, references and other relevant information for the application.

Additional recipients:

Contracting agencies;
Previous employers (to verify references provided).

Retention period: each Mediahuis Entity will retain your personal data for up to 5 years after the application process has ended.

4.10 In any case

If a Mediahuis Entity processes your personal data for one of the purposes set out above, then that entity processes your personal data as well for the following purposes:

The detection of, prevention of and fight against fraud and abuse based on its legitimate interest. Less fraud and abuse benefits the Mediahuis Entity, its customers and its suppliers.

Additional recipients:
- judicial, police or administrative authorities if the law or the circumstances require it;
- professional advisers (lawyers, consultants, etc.).
Retention period: up to 10 years after the establishment of the facts of fraud or abuse, unless the detection or fight would take longer.
Dispute management based on the law of 30 July 2018 (art. 10§1,1°) and our legitimate interest, as each Mediahuis Entity must be able to safeguard and defend its rights.

Additional recipients:
- judicial, police or administrative authorities if the law or the circumstances require it;
- professional advisers (lawyers, consultants, etc.).
Retention period: up to 10 years after the end of the dispute, unless the management of a specific dispute requires personal data to be kept for a longer period.
Company law transactions and co-operations: personal data may always be processed in the context of discussions, investigations, evaluations, negotiations and implementing measures in connection with a cooperation or corporate transaction (acquisition, merger, sale of shares or assets, joint venture, etc.) by a Mediahuis Entity. This is done based on our legitimate interest to i) enable the legal entities contemplating such an operation to become acquainted with each other’s personal data and ii) for the merger or acquisition to actually take place.

Additional recipients:
- third parties with whom a corporate transaction or cooperation is envisaged;
- professional advisers to the parties concerned (lawyers, consultants, etc.);
- judicial, police or administrative authorities if required by law or circumstances.
Retention period: up to 10 years after the termination of the corporate transaction or cooperation.