Personal Data Protection Charter

Table of Contents

1. Why a Privacy Policy?
2. Glossary of Key Legal Terms
3. Who is responsible for the use of your data?
4. Why do we collect your data and on what legal basis?
5. What personal data do we collect?
6. With whom do we share your personal data?
7. How long do we keep your data?
8. What are your rights and how can you exercise them?

- 8.1 Right of access
- 8.2 Right to rectification
- 8.3 Right to erasure (right to be forgotten)
- 8.4 Right to object
- 8.5 Right to data portability
- 8.6 Right to restriction of processing

9. Is your data transferred abroad?
10. Data security
11. Contacting us and/or lodging a complaint with a data protection authority
12. How will you be informed of changes to this policy?

1. Why a Privacy Policy?

Eurheca AISBL prioritizes your privacy. We handle the personal data of users of the website https://www.eurheca.eu (hereinafter "you") with care and implement appropriate measures to ensure its protection, in accordance with Regulation (EU) 2016/679 (GDPR) and the Belgian law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

This policy explains:

• what data we collect and why;
• how we use it and on what legal basis;
• your rights and how to exercise them.

Note: You can manage certain preferences (e.g., newsletter, cookies) at any time via the mechanisms provided on the website (unsubscribe link, cookie management module, etc.).

2. Glossary of Key Legal Terms Used

Personal data (or “personal information”): any information relating to an identified or identifiable natural person (e.g., name, email address, telephone number, IP address, browsing data, etc.).

Processing: any operation performed on personal data (collection, recording, organization, storage, adaptation, consultation, use, disclosure, restriction, erasure, etc.).

Data controller: the entity that determines the purposes and means of the processing (here, Eurheca AISBL).

Data processor: the entity that processes data on behalf of the data controller (hosting provider, email service provider, maintenance provider, etc.).

3. Who is responsible for the use of your data?

Data controller: Eurheca AISBL – European Health Professionals’ Competent Authorities

Registered office: Avenue Henri Jaspar 94, 1060 Brussels (Belgium)

Company number (BCE): BE0534.958.463 – Brussels Trade Register

General contact: This email address is being protected from spambots. You need JavaScript enabled to view it.

Privacy contact (if applicable): This email address is being protected from spambots. You need JavaScript enabled to view it.

Any questions relating to this policy or your data can be addressed to the contacts above.

4. Why do we collect your data and on what legal basis?

We collect and use your data for specific, explicit, and legitimate purposes; each purpose is based on a legal basis provided for by the GDPR.

5. Quelles données personnelles collectons-nous ?

We do not identify specific service providers here. If/when they are used, we will document them (name, role, legal basis, transfers) in the Cookie Policy and/or in additional information.

6. Who do we share your personal data with?

• Internally: authorized Eurheca personnel (communication, website, request management), bound by confidentiality agreements.
• Technical subcontractors: hosting, maintenance, email/newsletter, anti-spam/anti-bot tools, statistics. They act on Eurheca's instructions, under a contract compliant with Article 28 of the GDPR, and may not reuse your data for any other purpose.
• Third parties and authorities: only if required/permitted by law (legal obligation, defense of rights).
• No data is sold.

A detailed list of recipient categories can be provided upon request and/or specified in the Cookie Policy (for third-party cookies/trackers, which are activated only after consent when they are not strictly necessary).

7. How long do we keep your data?

8. What are your rights and how can you exercise them?

You have the following rights; we will respond within one month (extendable by two months in case of complexity/number of requests – you will be informed).

8.1 Right of access

You can obtain confirmation that we process data concerning you and receive a copy of it, with information on the purposes, categories, recipients, retention periods, rights, etc.

How to do this: send us an email to This email address is being protected from spambots. You need JavaScript enabled to view it. (subject: “Right of access”) or a letter to Eurheca AISBL, Avenue Henri Jaspar 94, 1060 Brussels, Belgium. Proof of identity may be requested to prevent disclosure to an unauthorized third party.

8.2 Right to rectification

You can have inaccurate data corrected or incomplete data completed.

How to do this: This email address is being protected from spambots. You need JavaScript enabled to view it. (subject: "Rectification") or by mail (see above).

8.3 Right to erasure (right to be forgotten)

In cases provided for by the GDPR (non-essential data, withdrawal of consent, unlawful processing, legal obligation to erase, etc.), you can request the deletion of your data. This right is not absolute (e.g., legal obligations to retain data, defense of rights).

How to do this: This email address is being protected from spambots. You need JavaScript enabled to view it. (subject: "Erasure") or by mail.

8.4 Right to object

You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (unless there are compelling legitimate grounds for the processing). You can also object to receiving newsletters at any time (unsubscribe).

How to opt out: This email address is being protected from spambots. You need JavaScript enabled to view it. (subject: "Opposition") or via the unsubscribe links.

8.5 Right to Data Portability

For the data you have provided to us, processed by automated means based on your consent or the performance of a contract, you have the right to:

• obtain a copy in a structured, commonly used, and machine-readable format;
• request its transmission to another controller, where technically feasible.

Contact: This email address is being protected from spambots. You need JavaScript enabled to view it. (subject: “Data Portability”).

8.6 Right to Restriction of Processing

You may request the restriction (temporary suspension) of processing, in particular if: you contest the accuracy of the data, the processing is unlawful but you prefer restriction to erasure, the data is no longer necessary for us but is still required for the establishment, exercise, or defense of legal claims, or pending the outcome of an objection.

Contact: This email address is being protected from spambots. You need JavaScript enabled to view it. (subject: “Restriction”).

9. Is your data transferred abroad?

9.1 Transfers within the EEA

When processing involves entities located in Belgium or other EEA countries (EU + Iceland, Liechtenstein, Norway), your data benefits from the same GDPR framework.

9.2 Transfers outside the EEA

If certain subcontractors or tools are located outside the EEA (or host data there), we will only carry out these transfers if one of the safeguards in Chapter V of the GDPR is in place:

• Adequacy decision of the European Commission, or
• Standard contractual clauses (SCCs) / other appropriate safeguards, and, where necessary, additional technical and organizational measures, or
• Your explicit consent where required.

Further information (and a copy of the essential safeguards) can be obtained upon request: This email address is being protected from spambots. You need JavaScript enabled to view it..

10. Data Security

We implement appropriate technical and organizational measures (e.g., HTTPS/TLS, access control, backups, segmentation, monitoring, internal policies, and training) to ensure a level of security appropriate to the risks.

Since no technology offers absolute security, we apply incident management procedures. In the event of a data breach, we will comply with legal obligations (notification to the DPA and, if necessary, to the persons concerned).

11. Contacting us and/or lodging a complaint with an authority

Contact us (data/privacy)

• Email: This email address is being protected from spambots. You need JavaScript enabled to view it. (or This email address is being protected from spambots. You need JavaScript enabled to view it.)
• Post: Eurheca AISBL, Avenue Henri Jaspar 94, 1060 Brussels, Belgium

Data Protection Authority (Belgium)

• Website: https://www.autoriteprotectiondonnees.be
• Address: Rue de la Presse 35, 1000 Brussels
• : +32 2 274 48 00 – Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

You can also lodge a complaint with the authority in your Member State of residence or work, or where the alleged violation occurred.

12. How will you be informed of changes to this policy?

We may update this policy to reflect changes in our practices or legislation.

• The date of the last update is shown at the top of the document. 
• In the event of a substantial change, we will post a notice on the website and/or notify you by email.
• A change history is available upon request.