As a website visitor (hereinafter "you" or "your"), your personal data is collected and processed by Mediwe vzw, with its head office at 2610 Wilrijk, Sneeuwbeslaan 20 bus 04 and registered under enterprise number BE 0415.945.205, in its capacity as controller and/or processor (hereinafter "we", "us", "our").

Scope of the Privacy Statement

This privacy statement (hereinafter "Privacy Statement") applies to you regarding your personal data that we collect and process via our website or that you provide to us in another way. It contains important information about how and for what purposes we collect and process personal data, and clarifies which rights you can exercise as a data subject. Please therefore read this Privacy Statement carefully.

We are committed to protecting your (personal) data with the utmost care and to processing it only in a fair and lawful manner in accordance with the provisions of the GDPR^[1], including all current national or international laws or regulations implementing or future laws or regulations replacing the GDPR (hereinafter collectively referred to as "Applicable Data Protection Legislation").

When and how do we collect and process your personal data?

We collect and process your personal data when you request one of our services or contact us regarding the services we provide. We may also process your personal data if you ask us a general question via our email, web form, telephone, or fax.

As the Data Controller, we only process personal data that you provide to us yourself. We process the personal data of our clients' employees as a Data Processor. Further on in this privacy statement, you can find which personal data we process as a Data Processor. If you would like more information about this, we refer you to your employer's internal privacy statement.

What are the legal bases for the processing of your personal data?

As the Data Controller, we process your personal data based on our legitimate interest or on the basis of the performance of a contract.

During application procedures, we process your data based on our legitimate interest.

We process the personal data of our clients' employees in different capacities depending on the context:

• We process the personal data of our clients' contact persons as the Data Controller, with the legal basis being the performance of the contract.
• We process the personal data of employees for whom an examination is requested as the Data Processor. We have concluded a data processing agreement with the employer for this purpose.
• We process sick leave certificates as both Joint Data Controller and Data Processor.

We process the personal data of medical examiners in the performance of the agreements with our clients.

We process the data we receive via the online contact form based on your consent.

For what purposes do we process which of your data?

As Data Controller

As Data Processor

Your rights as a data subject

Subject to the conditions and limitations of the Applicable Data Protection Legislation, you may exercise the following rights as a data subject at Mediwe for the processing operations for which we act as Controller.

As Processor, we have the duty to assist our clients (the employers) if data subjects wish to exercise a right.

If you wish to view your file with the examining physician, you may contact the examining physician themselves.

Right of access to your personal data

The right to request access to your personal data, to request a copy of the personal data we collect about you, and additional information about how we process your data.

Right to rectification

The right to have inaccurate personal data corrected or to complete incomplete personal data that we hold about you.

Right to erasure ("right to be forgotten")

The right to have your personal data removed from our systems. The request to erase your personal data cannot always be granted due to, for example, contractual or legal obligations. We will observe these obligations when responding to your request.

Right to object

The right to object to the processing of your personal data if the processing is based on our legitimate interest or on grounds of public interest. We will cease processing unless we can demonstrate compelling legitimate reasons for further processing or for the exercise of legal claims. You may also object if we process your data for direct marketing purposes, so that the personal data are no longer processed for these purposes.

Right to withdraw your consent

For the processing of your personal data collected by us with your consent, you may withdraw your consent at any time. For example, you can unsubscribe from newsletters at any time. However, withdrawing your consent does not affect the lawfulness of processing based on consent before it was withdrawn.

Right to restriction of processing

In certain cases, you have the right to have the processing of your personal data restricted. If you successfully exercise this right, we will continue to store your data, but we will limit its use. You can make this request, for example, if you believe that your personal data is inaccurate or if the processing by us is not justified. We are only required to comply with these requests in specific cases, as determined by law.

Right to data portability

The right to obtain your personal data processed by us in a structured, commonly used, and machine-readable format and/or to have this data transferred or copied to another controller. The above rights can be exercised free of charge by sending an email to privacy@mediwe.be. Subject to legitimate exceptions under the Applicable Data Protection Legislation, we undertake to respond to your request within one month of receipt. We may first ask for additional information to confirm your identity and to ensure that the request originates from you.

Right to lodge a complaint

If you believe that we are violating your data protection rights, you have the right to lodge a complaint with the Belgian Data Protection Authority: Data Protection, Drukpersstraat 35, 1000 Brussels, Tel +32 (0) 2 274 48 00, e-mail: contact@apd-gba.be.

Recipients

We refrain from disclosing or selling your personal data to third parties and from making your personal data public, except in the following specific cases:

• Personal data may be shared with external service providers to whom we have outsourced certain processing activities. In any case, they are limited to processing your personal data in accordance with our instructions and, if necessary, a processing agreement will be concluded so that they are obliged to comply with all obligations required by the Applicable Data Protection Legislation;
• If required by applicable law or regulation.

International transfer

We will comply with the Applicable Data Protection Legislation regarding the provision of adequate protection for the transfer of personal data to recipients in countries outside the European Economic Area ("EEA").

In the event that we transfer your personal data to a third country or international organisation outside the EEA, we will ensure that your personal data are transferred to third countries deemed by the European Commission to offer an "adequate" level of protection (a list of adequate third countries is available on the European Commission's website), or, alternatively, when your personal data are not transferred to a country that offers an adequate level of protection, we will ensure that appropriate safeguards are in place at the entity receiving your personal data (e.g. EU Standard Contractual Clauses or Binding Corporate Rules, taking into account additional requirements regarding international transfers such as additional measures) to ensure that your personal data remain protected in accordance with Applicable Data Protection Legislation.

If you would like to receive more information or a copy of these safeguards, you can contact us via the following email address: privacy@mediwe.be.

Retention of your personal data

We do not retain your personal data for longer than is strictly necessary to achieve the purposes for which we received the data. Retention periods vary depending on the type of processing activity and the purpose for which the personal data were collected.

Personal data that we collect based on your consent will be retained by us for as long as your consent remains valid.

In all cases, personal data may be retained for a longer period if there is a legal or regulatory reason for doing so, or for a shorter period if you object to the processing of your personal data and there is no longer a legitimate reason to retain them. We guarantee that your personal data will be deleted or anonymized as soon as the retention period has expired.

Personal data of our customers (contact details and employee data) will be retained for up to 5 years after the end of the contract with the customer. If the customer does not have a contract with us, the personal data will be deleted 5 years after the customer's last request.

If you would like more information about the retention periods we apply, please contact us via the following email address: privacy@mediwe.be.

Contact Details

If you have comments or questions about the information in this Privacy Statement, or about other matters regarding our processing of your personal data, you can contact us via privacy@mediwe.be.

If you prefer to contact us by post, you can do so at the following address:

Sneeuwbeslaan 20 bus 04, 2610 Wilrijk.

Changes to our Privacy Statement

We may amend or update this Privacy Statement from time to time to reflect changes in our practices regarding the processing of your personal data or changes in the Applicable Data Protection Legislation. We will do this by posting the updated version on our website. When we publish changes to our Privacy Statement, we will change the date and version number of the "last update" of our Privacy Statement. Important changes are listed on our homepage. Nevertheless, we recommend that you read our Privacy Statement regularly.

1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). ↑