Data Protection Policy

ISOPA is committed to protecting the privacy and security of your personal information.

This privacy notice describes how we collect and use personal information about you. The Company will only process personal information in a manner that is compatible with applicable data protection legislation.
We will respect your privacy and will only process your personal information as necessary to support our engagement with you. We endeavour to ensure that the information that we process is accurate, relevant, adequate and not excessive.

1. Data protection principles

We will comply with data protection law. This says that the personal information we hold about you must be:

1. Used lawfully, fairly and in a transparent way.
2. Collected only for specified, explicit and legitimate purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
3. Relevant to the purposes we have told you about and limited only to those purposes.
4. Accurate and kept up to date.
5. Kept only as long as necessary for the purposes we have told you about.
6. Kept securely.

2. The kind of information we hold about you

We may collect, store, and use the following categories of personal information about you:

• Your name
• Initials
• Occupation, function
• Employer
• E-mail address
• Address
• Date of birth
• Signature
• ISOPA driver training programme card number and validity period
• Test score of driver training programme
• Attendance of driver training, date and location
• Other data you shared with us

3. How is your personal information collected?

We typically collect personal information from:

• ISOPA Members Companies;
• ISOPA Member Company representatives;
• Other representatives, experts, service providers and persons interacting with ISOPA;
• Subscriptions to ISOPA communication / newsletter / news services;
• Registration for events or initiatives organised, promoted or supported by ISOPA;
• Via the attendance list of the ISOPA driver training programme;
• Via driver trainers; or
• Other sources.

Furthermore, we collect information you have provided spontaneously to us by sending correspondence via email, post or other means, the visit and use of our website and intranet and news services, leaving your business cards, or by otherwise providing information to us.

4. Who has access to your personal information?

ISOPA employees, directors and those of its processors have access to your personal information. They will only use this access if necessary and only for the specified purposes.
Under exceptional circumstances, other persons can access your personal information (see below under “data sharing”).

5. How we will use information about you

We will only use your personal information when we have a lawful basis to do. Most commonly, we will use your personal information in the following circumstances:

1. Where we need to comply with a legal obligation;
2. Where it is necessary for our legitimate interests;
3. To fulfil a contractual obligation;
4. Where you have given consent to the data processing;
5. We may also process your personal information in the following situations, which are likely to be rare:
   • Where we need to protect your interests (or someone else’s interests), for example, when someone has wrongly copied a driver card issued within the framework of the ISOPA driver training programme;
   • Where it is needed in the public interest or for official purposes, for example, in the case of fraud or use of fake identity.

6. Situations in which we will use your personal information

The situations in which we will process your personal information are listed below:

• Organisation of events or initiatives hosted, promoted or supported by ISOPA
• Communication about ISOPA activities, initiatives, ISOPA policies and viewpoints
• Correspondence, news and newsletters
• Compliance with health and safety obligations
• For the ISOPA driver training programme specifically,
  • Processing of information to determine whether a driver has attended the driver training;
  • Issuing of ISOPA driver cards to those drivers who have successfully passed the ISOPA driver training programme;
  • Management, administration, verification and review of ISOPA driver cards
  • Follow-up on fraud cases.

7. If you fail to provide personal information

If you fail to provide certain information when requested, we may not be able to provide our services and carry out our activities. We will not ask any information that is not strictly necessary for the specified purposes.

8. Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

9. Data sharing

We may have to share your data with third parties, including third-party service providers. We require third parties to respect the security of your data and to treat it in accordance with the law.

9.1. Why might we share your personal information with third parties?

We may share your personal information with third parties where required by law, where it is necessary to administer the relationship with you or where we have another legitimate interest in doing so.

9.2. Which third-party service providers process your personal information?

“Third parties” includes third-party service providers (including contractors and designated agents).
The following processing activities are carried out by third-party service providers on behalf of ISOPA:

• IT services provided by IT services providers;
• Administrative services and services to protect the legal status of ISOPA by legal, accounting and administrative service providers;
• Specifically within the framework of the ISOPA driver training programme: collection of personal data during and after training sessions by the driver trainer.

We may share your personal information with other third parties, for example for the development and maintenance of our database. We may also need to share your personal information with a regulator or to otherwise comply with legal requirements.

10. Data security

We have put in place measures to protect the security of your information. Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

11. How long will we store your information?

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

12. Your rights and duties

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during the use of your driver license. You have the right to:

• Request access to your personal information.
• Request correction of the personal information that we hold about you.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. The erasure of data could result in us not being able to provide our services.
• Object to processing of your personal information where we are relying on a legitimate interest.
• Request the restriction of processing of your personal information.
• Request the transfer of your personal information to another party when the processing is based on consent or on the fulfilment of a contractual obligation or is carried out by automated means.

If you want to exercise these rights, please contact the data protection officer in writing (details below). You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessively onerous for us. Alternatively, we may refuse to comply with the request in such circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

13. Data protection officer

We have appointed a data protection officer (DPO) to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact the Secretary-General of ISOPA via the following contact details:

ISOPA AISBL,
For the attention of the Secretary-General,
Rue Belliard 65,
1040 Brussels,
main@isopa.org
Tel: +32 2 786 35 53

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the country of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes your rights under the applicable data protection legislation.

14. Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates if you provide us with your contact details.