Privacy & GDPR policy

European Diisocyanates and Polyols Producers Association  (ISOPA)

Association internationale sans but lucratif

Siège social situé Rue Belliard 65, B-1040 Etterbeek

Numéro d’entreprise TVA BE0649.434.695, RPM Bruxelles

 

European Aliphatic Isocyanates Producers Association (ALIPA) 

Association internationale sans but lucratif

Siège social situé Avenue Van Nieuwenhuyse 6, B-1160 Bruxelles

Numéro d’entreprise TVA BE 0673 850 981, RPM Bruxelles

 

(The « Associations »)

——

       What is the purpose of this document?

The associations are committed to protecting the privacy and security of your personal information.

This privacy notice describes how we collect and use personal information about you. The Company will only process personal information in a manner that is compatible with applicable data protection legislation.

We will respect your privacy and will only process your personal information as necessary to support our engagement with you. We endeavour to ensure that the information that we process is accurate, relevant, adequate and not excessive.

1. Data protection principles

We will comply with data protection law. This says that the personal information we hold about you must be:

1. Used lawfully, fairly and in a transparent way.
2. Collected only for specified, explicit and legitimate purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
3. Relevant to the purposes we have told you about and limited only to those purposes.
4. Accurate and kept up to date.
5. Kept only as long as necessary for the purposes we have told you about.
6. Kept securely.

 

2. We may collect, store, and use the following categories of personal and company information about you:

• Your First name
• Last name
• E-mail address and confirmation email address
• Company name and address in case of invoicing
• platform ID and password
• Date and time of platform access
• Other data you shared with us

 

1. How is your personal information collected?

We typically collect personal information from:

• Associations Members Companies;
• Associations Member Company representatives;
• Other representatives, experts, service providers and persons interacting with the associations;
• Subscriptions to associations communication / newsletter / news services;
• Registration for events or initiatives organised, promoted or supported by the associates;
• Via your request to participate as an authorised user of the platform having access to certain content available from the associations intranet
• Your submission of data necessary for continued authorised access to and the proper performance of the controlled private network service and the platform; or
• Other sources.

Furthermore, we collect information you have provided spontaneously to us by sending correspondence via email, post or other means, the visit and use of our website and intranet and news services, leaving your business cards, or by otherwise providing information to us.

 

1. Who has access to your personal information?

The associations employees, directors and those of its processors (including IDloom, the associations processor responsible for managing access to and the operation of the platform and the controlled private network service) have access to your personal information. They will only use this access if necessary and only for the specified purposes.

Under exceptional circumstances, other persons can access your personal information (see below under “data sharing”).

 

1. How we will use information about you

We will only use your personal information when we have a lawful basis to do. Most commonly, we will use your personal information in the following circumstances:

1. Where we need to comply with a legal obligation;
2. Where it is necessary for our legitimate interests;
3. To fulfil a contractual obligation;
4. Where you have given consent to the data processing;
5. We may also process your personal information in the following situations, which are likely to be rare:
   • Where we need to protect your interests (or someone else’s interests), for example, when someone has wrongly duplicated or used your platform ID and password (issued within the framework of the ISOPA controlled private network service);
   • Where it is needed in the public interest or for official purposes, for example, in the case of fraud or use of fake identity.

1. Situations in which we will use your personal information

The situations in which we will process your personal information are listed below:

• Organisation of events or initiatives hosted, promoted or supported by the associations
• Communication about the associations activities, initiatives, the associations policies and viewpoints
• Correspondence, news and newsletters
• Compliance with health and safety obligations
• For the associations controlled private network service and the operation of the platform specifically,
  • Processing of information to determine whether an authorised user has accessed or sought to access the platform;
  • Issuing, amending or cancelling ID and passwords to users of the platform whilst authorised to do so or on any cancellation of that authorisation;
  • Management, administration, verification and review of associations authorised platform usage
  • Follow-up on fraud cases.

1. If you fail to provide personal information

If you fail to provide certain information when requested, we may not be able to provide our services and carry out our activities. We will not ask any information that is not strictly necessary for the specified purposes.

1. Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

1. Data sharing

We may have to share your data with third parties, including third-party service providers. We require third parties to respect the security of your data and to treat it in accordance with the law.

 

      9.1. Why might we share your personal information with third parties?

We may share your personal information with third parties where required by law, where it is necessary to administer the relationship with you or where we have another legitimate interest in doing so.

     9.2. Which third-party service providers process your personal information?

“Third parties” includes third-party service providers (including contractors and designated agents).

The following processing activities are carried out by third-party service providers on behalf of the associations:

• IT services provided by IT services providers;
• Invoicing and accounting services provided by external services providers
• Administrative services and services to protect the legal status of the associations by legal, accounting and administrative service providers;
• Specifically within the framework of the associations secure platform, the processing of personal data of authorised users, with the processing of such data being necessary for the proper performance of the controlled private network service.

We may share your personal information with other third parties, for example for the development and maintenance of our database. We may also need to share your personal information with a regulator or to otherwise comply with legal requirements.

 

1. Data security

We have put in place measures to protect the security of your information. Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

1. Information regarding the transfers of personal data outside the European Economic Area (EEA)

The associations main administrative offices and those of our processor are based in the EEA and that is where personal information collected through its website or interactions with its members is processed.  The personal data collected by the associations, particularly that of representatives of the associations Member Companies, other representatives, experts, service providers and persons interacting with the associations and our delegates may be transferred to the associations Member Companies, their representatives, other representatives, experts, service providers and persons interacting with the associations and their delegates located in non-EEA countries, for the purposes of fulfilling ISOPA’s contractual obligations to its members.  We may also enter into contracts with our data processors that require them to transfer personal data outside the EEA, subject to appropriate safeguards under the GDPR and in a manner and for a purpose that is consistent with this Policy.

 

1. How long will we store your information? 

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

 

1. Your rights and duties

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes.

You have the right to:

• Request access to your personal information.
• Request correction of the personal information that we hold about you.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. The erasure of data could result in us not being able to provide our services.
• Object to processing of your personal information where we are relying on a legitimate interest.
• Request the restriction of processing of your personal information.
• Request the transfer of your personal information to another party when the processing is based on consent or on the fulfilment of a contractual obligation or is carried out by automated means.

If you want to exercise these rights, please contact the data protection officer in writing (details below).

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessively onerous for us. Alternatively, we may refuse to comply with the request in such circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

 

1. Data protection officer

We have appointed a data protection officer (DPO) to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact the Secretary-General of ISOPA via the following contact details:

ISOPA AISBL – ALIPA AISBL

For the attention of the Secretary-General,

Rue Belliard 65,

B-1040 Etterbeek,

main@isopa.org

Tel: + 32 2 786 35 53

 

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the country of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes your rights under the applicable data protection legislation.

 

1. Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates if you provide us with your contact details.

 

—