Carbon Neutral Cities Alliance – Privacy Notice
Introduction
Under European Regulation no.679/2016 (hereinafter, the “Regulation”) and national law on personal data protection Carbon Neutral Cities Alliance invites you to carefully read this Privacy Policy, which contains important information on the protection of your Personal Data.
The processing of your Personal Data will be based on the principles of correctness, lawfulness, transparency, purpose and storage limitation, minimisation and accuracy, integrity and confidentiality, in accordance with the provisions of the Regulation.
****
Data controller
The Data Controller is CNCA with registered office in Rue des Colonies 11, 1000 Bruxelles, Belgium, in the person of General Manager Simone Mangili (simonemangili@carbonneutralcities.org), its legal representative pro tempore.
In the framework of its activities, the Carbon Neutral Cities Alliance collects and processes personal data.
The purpose of this notice is to inform you about the way in which the Non-profit Association (“ASBL”) Carbon Neutral Cities Alliance (with registered office at B-1000 Brussels, Rue des colonies 11 and registered with the Crossroads Bank for Enterprises under No. 1013.399.976, hereinafter: “CNCA” or “We”), as data controller, collects and processes your personal data as part of your use of our Website, our services and participation in events, as well as your rights regarding your personal data.
Categories of personal data processed and for which purposes
We process personal data relating to you when you use the Website and/or our services. Such personal data includes:
- Personal identification and contact data: name, surname, e-mail address, phone number, and philanthropies, organisation or city you work for/with, etc.;
- Personal data related to your use of our Website: IP address, log-in data, consulted pages, etc.;
- Banking details provided for funding.
We obtain the above-mentioned personal data directly from you or from the organisation/city you work for. For example, when your organisation applies for a grant we process your name, surname and email address.
We can also process your personal data:
- to provide you with information on future or ongoing projects and on our services;
- to provide our services, manage the funding of CNCA and the grants allocated by CNCA;
- for direct marketing purposes, i.e. to be able to provide you with targeted communication, and information regarding events organised by CNCA or our partners; and
- to perform statistical analyses to improve our Website and services.
Legal basis and retention period
The processing of your personal data is based on:
- CNCA’s legitimate interests: this includes managing our website, funding, services, grants, partnerships and events;
- Your consent: this applies for direct marketing communications when we cannot rely on our legitimate interest.
Your personal data will only be processed as long as necessary to achieve the purposes stated in this Privacy Notice or, when the processing of your personal data is based on your consent, until the moment at which you withdraw your consent, unless a statutory or regulatory obligation or a judicial or administrative order prevents us from doing so.
In order to ensure compliance with the principles of necessity and proportionality of the processing, we have defined various Personal Data storage periods for the individual purposes pursued;
– The data collected for profiling purposes and for the sending of material, for which consent has been given, will be stored for a period of time of no longer than 36 months.
– The data collected for internal statistical use will be stored for the period necessary to carry out the requests and will subsequently be cancelled if there is no further contact, except for administrative requirements.
Sharing and transfer of personal data.
Your Personal Data may be made accessible, for the purposes stated above, to employees and partners of CNCA.
The Personal Data you provide may be transferred to the companies of the CNCA and/or third-party companies located within, as well as outside, the European Union/ European Economic Area. These companies carry out the aforementioned activities concerning treatments of personal data on behalf of the Data Controller and will operate as Data Processors.
Transfers of personal data to third-party companies located outside the EU/EEA are made in accordance with Chapter V of the Gdpr. In particular, they are based on Standard Contractual Clauses (SCC) approved by the European Commission. To obtain copies of these SCCs please contact the Controller at the addresses listed in Section 12 of this Privacy Policy.
Finally, your Data may be sent to the judicial authorities where necessary and in the cases provided for by law.
CNCA shares its IT infrastructure with the “Urban Sustainability Directors Network” (“USDN”), a Non-profit Organization established in Washington DC, United States of America (“U.S.”). USDN acts as a processor for CNCA and processes your personal data strictly on the basis of our instructions.
To ensure the best protection of your personal data, we have taken the necessary contractual steps to ensure that our processor guarantees the security and confidentiality of your personal data. USDN is located in the U.S., a third country which does not ensure an adequate level of data protection according to the European Commission. The transfer of your personal data to USDN is therefore governed by Standard Contractual Clauses approved by the European Commission. You can obtain a copy of this appropriate safeguards by sending a written request to the e-mail address: contact@carbonneutralcities.org.
Joint-controllership
CNCA is present on social media platforms and receives statistical data on your use of our Website and social media platforms.
Meta Ireland is a Joint Controller with us for the collection of your personal information via the Meta Business Tools and its subsequent transmission to Meta Ireland for the purposes of preparing reports and generating analytics and insights.
More information on Meta’s use of your data can be found in Meta Ireland’s Privacy Policy at https://www.facebook.com/about/privacy. We entered into the following Controller Addendum with Meta to determine our respective responsibilities for compliance with the obligations under the GDPR: https://www.facebook.com/legal/controller_addendum?_rdr. Meta Ireland is responsible for enabling Data Subjects’ rights under Articles 15-20 of the GDPR with regard to the Personal Data stored by Meta Ireland after the Joint Processing.
LinkedIn is a Joint Controller with us for the collection of your personal information and its transmission to LinkedIn for the purpose of generating Page Insights from, and relating to, your interactions with our LinkedIn Page.
More information on our Joint Controller agreement with LinkedIn can be found at https://legal.linkedin.com/pages-joint-controller-addendum and more information on LinkedIn’s use of your data can be found in LinkedIn’s Privacy Policy at https://www.linkedin.com/legal/privacy-policy. LinkedIn will answer Data subjects’ Requests in accordance with our agreement, the GDPR, and other applicable law.
With regards to Google’s use of your personal data, in order for CNCA to receive anonymized statistical data, more information can be found in our cookie policy at https://carbonneutralcities.org/cookie-statement/.
Security measures
CNCA implements the appropriate technical and organizational measures to guarantee a sufficient level of security in relation to the risks presented by the processing and the nature of the data. In any event, CNCA implements appropriate security measures to protect your personal data against loss, theft, misappropriation or alteration of the information received, disclosure or unauthorized use. These measures include: firewalls to protect data from unauthorized access, role-based access controls and secure storage systems to prevent loss or theft.
Your rights
As a data subject, provided the legal requirements are met, you have the right to access your personal data as collected and processed by CNCA and to request rectification in the event of inaccuracy or deletion in certain limited cases or in the event that they are unnecessary.
You also have the right to request the limitation of processing, the portability of personal data and you have the right to object to the processing of your personal data due to your particular situation.
You have the right to lodge a complaint with a supervisory authority, if you consider that the processing of your personal data concerning constitutes a breach of the applicable legislation. To exercise your rights, simply contact CNCA by sending a written and signed request to the e-mail address: contact@carbonneutralcities.org or to the postal address of the Carbon Neutral Cities Alliance: Rue des colonies 11, 1000 Brussels, Belgium, together with a copy of your identity card or any other document proving that you are the person concerned by the personal data.
In Belgium, you can lodge a complaint with the Belgian Data Protection Authority.
Further information can be found on the authority’s website: https://www.autoriteprotectiondonnees.be/citoyen/agir/introduire-une-plainte.