Privacy policy | Vlaams Instituut voor de Zee
 

Vlaams Instituut voor de Zee

Platform voor marien onderzoek

Privacy policy

This document describes the privacy policy of the Flanders Marine Institute (VLIZ). It affects all data gathered and processed by VLIZ. This policy is a derivative of the GDPR, and is to be applied to VLIZ activities, and VLIZ data processing and data and information systems.

General Data Protection Regulation (GDPR)

The GDPR is EU Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. It repeals Directive 95/46/EC. The GDPR comes in force on 25 May, 2018. More information can be found on the EC GDPR site.

VLIZ as data owner and processor

The Flanders Marine Institute (VLIZ) gathers personal data via several data and information systems and for a range of VLIZ activities, such as the organisation of events. VLIZ is the owner and processor of this data and does not pass this data on to third parties. All data gathered and processed by VLIZ is subject to the EU General Data Protection Regulation (GDPR), which aims to protect the privacy of all EU inhabitants.

You can contact VLIZ through e-mail at info@vliz.be; at the address Wandelaarkaai 7, 8400 Oostende, Belgium; or by phone: +32 (0)59 34 21 30. For questions concerning private data and how VLIZ makes use of it, please contact privacy@vliz.be.

Complaints concerning the privacy policy of VLIZ, or concerning unlawful data processing by VLIZ, can be addressed to the Belgian Privacy Commission (www.privacycommission.be), the National Data Protection Authority (DPA) for Belgium. If there is a data breach, VLIZ is bound to inform the Privacy Commission within 72 hours, and affected users - if identifiable - will also be notified.

Your rights as a data subject

A data subject is the natural person for whom personal data is processed. Each person has the right to be informed on what personal data is being processed and to have access to their personal data. 

You have the right: to have your personal data corrected; to request a restriction or an end to processing of your data; and to be forgotten, which means the erasure of your personal data. Note that not all rights are absolute: VLIZ can have compelling legitimate grounds that outweigh the interests and rights of the objector (accountancy, juridical reasons,...). When a request is made, VLIZ may demand extra information to confirm identity. Note that the GDPR stipulates that each request made must be logged.

Legal grounds for data processing

There are several legal grounds for data processing. The most common is prior consent, which can be withdrawn at any time. A processing of data can be within agreement. Some of the services offered by VLIZ require a personal account, and the processing of this data is limited to the linked services and is within agreement. VLIZ has the legal obligation to process personal data for accountancy purposes, and has to keep this data for as long as is mandatory. VLIZ also processes personal data for common interest: VLIZ has the mandate to describe the marine scientific landscape in Flanders, and gathers professional data on scientists and institutes for this purpose.

Data processing by VLIZ

The VLIZ privacy policy lists all data and information systems which process personal data. For some of the systems a more specific disclaimer is made, and direct contact details are given in the disclaimer.  Questions can also be directed to privacy@vliz.be.

The basic principles of the GDPR is to keep the processing of personal data to a minimum - data privacy by design and by default - and to think about how to protect data from the beginning - data protection by design. To this end VLIZ places its systems and data processing under scrutiny, and deletes data or renders it anonymous where possible.

VLIZ services requiring personal data

For some of the services and activities of VLIZ, an account and / or processing of personal data is necessary. By entering your personal data and / or creating an account you agree to the data processing. The following is a list of VLIZ activities and systems which make use of personal data. This data is kept for as long as the agreement lasts, and at least as long as is required for legal purposes (e.g. accountancy). For purposes concerning proof in juridical disputes, VLIZ may store personal data up to 10 years after the fact, which is the maximum legal term for placing personal claims.

VLIZ memberships, donations to VLIZ, purchases

A VLIZ membership requires contact information (name, e-mail, address) to inform VLIZ members on VLIZ activities and for membership administration. The name of the member's partner is also kept if they opted to make the partner an accompanying member. The institutional affiliation is saved for institutional members. More information on VLIZ membership, including the disclaimer, can be found on http://www.vliz.be/en/membership.

For each donation over €40, VLIZ will keep contact and bank information for accounting and tax purposes for at least seven years. This does not apply to donations under this limit or if made as an anonymous gift. 

Volunteer work at VLIZ

Volunteers working for VLIZ are insured by VLIZ. In case of an accident, contact information will be offered to the insurance company as per Belgian law.

Questions sent to VLIZ via mail, web form or other media

VLIZ keeps a record of each data, library or information request it receives. This record includes the work-flow needed to answer the questions in a timely manner. These records, and other similar requests, are kept for statistical purposes. In the yearly overview, VLIZ reports on the number of requests received and answered. The data are rendered anonymous/pseudonymous as soon as possible.

Visitor tracking on websites and cookies

VLIZ keeps logs of website visits - which contain: an IP address, time information, and the url visited - for bug tracking and to monitor for malicious visits. Along with the web-server logging, an anonymous visitor-tracking system is in place, to track which pages on the websites hosted by VLIZ are accessed. We also use cookies to enhance the surfing experience (e.g. so visitors only have to log in or choose the language setting once). On each of our sites, we indicate that cookies are used and refer to our privacy policy.

Conference and other event participation

Registration is essential to participate in a VLIZ event. This is for organisation purposes (to know the venue size, chose catering services, event payment,...) and to keep attendees informed on the programme. Each registration form has a GDPR section which allows attendees to subscribe to further communications by VLIZ or to remove their data once the event has taken place (this is the default option). For each event, several e-mails may be sent as part of the communication agreement: save-the-date, posting of the tentative programme, abstract submission calls, closing of the early bird or final programme, and the closing e-mail with links to pictures taken and download links for presentations.

During our events, pictures are taken and on some occasions there is filming. It is extremely difficult to organise an opt-in system for photography and filming, therefore requests for the removal of photographs or films should be sent to the e-mail address used for event administration or to privacy@vliz.be. Photos in which the requester are shown will be removed from our web sites and servers; for films, the film segment will be cut out or the film deleted out if the requester is clearly visible. 

Mailing lists organised or serviced by VLIZ

VLIZ manages mailing lists which were created to facilitate events, to allow for working-group communication, for partners in a project, etc. Each e-mail sent to these mailing lists contains an unsubscribe link and, for more information or the unsubscribe fails, a contact address. Unsubscribing is possible by sending an e-mail to a mailing list's specific e-mail address, which is the e-mail address of the list with the '-unsubscribe' handle in front of the @ (e.g. vlizine-unsubscribe@vliz.be). Unsubscribing will fail if not requested from the registered e-mail address; in addition, some people have formal and informal e-mail addresses or forwarded e-mails automatically. If the unsubscribe fails, or simply for more information on the list, an e-mail can be sent to the list's e-mail address or to privacy@vliz.be.

VLIZ newsletter, Grote Rede digital and acquisition notifications

VLIZ has an electronic magazine, or e-zine, the VLIZine, which is written in Dutch and sent out on a daily, weekly or monthly basis, as chosen by the recipient. Each recipient can review and change their subscription via the VLIZ site, and can unsubscribe by mailing to the unsubscribe address (<name of list>-unsubscribe@vliz.be).

Accompanying the paper version of 'De Grote Rede', VLIZ offers a digital version for which a notification for each new edition can be received by mail. The Grote Rede web page allows for (un)subscribing to the mailing list, and (un)subscribing is also possible via e-mail.

The VLIZ Library offers a mailing list to keep recipients up to date on library acquisitions. Each week, an e-mail is sent out to registered e-mail addresses. Subscribing is possible by mailing to libacq-subscribe@vliz.be, and unsubscribing by mailing to libacq-unsubscribe@vliz.be or by sending an e-mail to library@vliz.be. The ScheldeMonitor, a project in which VLIZ participates, offers a similar service on its site.

Publication requests to the VLIZ library

When you request a publication at the VLIZ library, your data will be processed to ensure delivery of the publication. This request will be kept for as long as is necessary to fulfill the obligation entered into. The data may also be kept for a term of 10 years for evidence purposes in case a claim is made against VLIZ.
Requests for publications are also kept for a year for statistical purposes to determine the response time of the delivery. VLIZ is obliged by a Convenant with the Flemish government to register this. Your data is rendered anonymous/pseudonymous for this purpose as soon as possible.

Personal data offered for job applications

Personal data offered in the context of job applications will be used solely for processing the application, unless consent was given for alerts on future job offers. The data will only be available to VLIZ personnel handling the job offer and to the members the jury (VLIZ and/or external experts).

The emails and personal data received at jobs@vliz.be will be stored for 10 years for evidence purposes in case of juridical claims by the applicant.

In case of hiring, the personal data will be shared with SDworx, the social secretariat for VLIZ.

VLIZ systems making use of personal data

VLIZ Single Sign-On (SSO)

Many VLIZ services accessed via the VLIZ web account or VLIZ SSO. Users create an account based on their e-mail address and with a password. All passwords are stored encrypted and thus VLIZ does not have access to it. All login sessions are logged by the system. This allows for VLIZ to report on the use of its services in its annual report.

Integrated Marine Information System (IMIS) (www.vliz.be/imis)

The IMIS database is an extensive collection of data about scientists that contribute to marine scientific research. The database aims to centralise all data regarding the names, education, professional background, affiliation, publications, projects and datasets of these scientists. In this way VLIZ creates a hub that can contribute to and facilitate scientific research. To improve the data-flow within the scientific community, this database also contains professional e-mail addresses and phone numbers. VLIZ gathers the information via direct contact, from third party sources or from open sources. This data is stored indefinitely or until a request is made to VLIZ to remove a record.

Next to the public part of IMIS, this system is also used for internal VLIZ activities such as VLIZ memberships, subscriptions to paper publications, etc. This information is limited to address and membership type, and is only accessible within the internal VLIZ network.

All IMIS visits and searches are registered and tracked for statistical and bug-fixing purposes, and for IMIS users (i.e. those with a login) their edits are additionally registered and tracked. Search data are stored to provide a better experience for the user and are rendered anonymous as soon as possible.

The dataset submit form facilitates the sharing of your scientific data. You can describe or share your dataset on this webpage, and after a manual check this metadata may be added to IMIS. VLIZ is not responsible for the processing of this data but simply provides the service to those who wish to make use of it. Please ensure that you respect the GDPR when making use of this application.

Marine Data Archive (MDA) (mda.vliz.be)

VLIZ offers a service to marine scientists to allow them to archive their data in a secure environment. Several copies of the data are retained. Using the MDA requires having a VLIZ web account so VLIZ can track the source of the data. Each action within the MDA is subject to logging for legal purposes. For MDA users, who performed what action on each of the files and file groups is clearly visible, as long as they have access to those files or directories.

The number of submits and downloads is also tracked to report on the use of the MDA in the VLIZ annual report.

VLIZ Photo Gallery

All pictures gathered by VLIZ are archived in the VLIZ photo gallery. This system allows for anyone to post pictures via the web site. During upload, personal data is requested to allow tracking of the source of the pictures. Note that the pictures in the VLIZ photo gallery are made public unless specified otherwise. Everyone has access to the public pictures. It is the responsibility of the person posting the picture to be compliant with the GDPR, and to obtain the consent of the people portrayed.

A request for removal can be made on any page of the VLIZ photo gallery, if you are logged in or by sending an email to the general VLIZ information mailing address. Note that VLIZ will check whether you are the person depicted, or if you have the legitimate right to demand removal.

Marine Regions (www.marineregions.org)

This VLIZ system offers a database with geographic data, mainly marine names such as seas, sandbanks, bays, etc., which are hierarchically interlinked. Next to these geographic objects, the maritime boundaries for each country, which also defines its Exclusive Economic Zone (EEZ), is available.

This data is available for download, but requires a valid e-mail address to track downloads and to report on the use of Marine Regions in the VLIZ annual report. Whenever is new version is made available, each user of Marine Regions will receive a notice via e-mail. This is required to ensure users only make use of the latest version and to minimise the spread of outdated versions.

VLIZ Data portals (www.emodnet-biology.euwww.scheldemonitor.org)

The data portals developed by VLIZ allow for visualising and downloading data. To download data it is not required to create an account or fill in personal data. For EMODnet Biology it is requested to fill in organization and country for statistical, anonymous reporting on the use of the data portal. On ScheldeMonitor it is possible to share downloads with others, only such features require for an account. Actions performed on our data portals are logged via ip address or account, and this data is used for statistical purposes and bug tracking.

Marine Information and Data Acquisition System (MIDAS) (www.vliz.be/vmdcdata/midas/)

MIDAS is used for tracking all research activities on board our research vessel the Simon Stevin. It is also used to plan scientific trips and cruises with our vessel. Trip information includes the scientists present and their actions on board, and the stations or locations that will/were be visited. This data allows for the of tracking the source of scientific data and samples, and will not be deleted.

Drupal, our content management system (CMS)

Nearly all sites hosted by VLIZ are created in Drupal. For content management several editors are appointed, and these need an account to be able to log in to and change a site. All session information and changes made by the editors are stored in Drupal. Each editor can list their actions for each of the sites via a Drupal module.