De Museumstichting SON attaches great importance to your privacy. We make every effort to protect your data.
The purpose of this privacy statement is to provide you with clear, understandable and readable information about how we collect, process and store your data. De Museumstichting SON attaches great importance to the protection of your personal data, and the fact that your privacy is respected. De Museumstichting SON complies with the applicable laws and regulations, including the General Data Protection Regulation (GDPR, EU Regulation 2016/679).
In all cases, we ensure that:
- We will only process your personal data for the purpose for which they are provided to us;
- We will only process the minimum personal data that we need to ensure smooth functioning;
- We will always ask for your explicit consent when we request your personal data;
- We do not pass on your personal data to third parties, unless this is necessary for the purposes for which they were provided;
- We are aware of your rights regarding your personal data, we wish to reassure you of this, and we respect these rights.
If, after reading through our privacy statement, you have any questions about the processing of your data, or you wish to contact us, please use the contact details here below:
De Museumstichting SON
Francis Wellesplein 1
+32 3 432 41 40
This privacy statement may be modified at any time. Older versions are stored in our archive. You can submit a request via email to consult these. The last modification was made on 16 July 2018.
For whom is this privacy statement intended?
This privacy statement is intended for visitors to our museums and websites, candidates and visitors to the careers site, participants in activities, persons who show or have shown an interest in our activities, members, journalists, customers, prospects and suppliers.
This privacy statement is applicable to all services of De Museumstichting SON. "All services" refers to the services with which you come into contact through a visit to one of our museums, media campaigns, public events organised by De Museumstichting or one of its museums and administrative services, such as invoicing. In addition, all online services of De Museumstichting are covered by this statement, including the websites, apps, and internet services proposed by De Museumstichting and access to content (e.g. press site for journalists, digital platforms, etc.).
Why does De Museumstichting SON process personal data?
De Museumstichting SON and its museums process your personal data for various purposes and legal grounds, including:
- To be able to participate in activities such as workshops, events and guided tours at De Museumstichting SON and its museums (implementation of the agreement)
- When purchasing tickets for the delivery of tickets, access control, service emailing before/after your visit and for making contact, if the programme is changed or cancelled.
- When consulting the online collection catalogue (consent of the data subject)
- For the operation of the library (consent of the data subject)
- To maintain press relations (consent of the data subject)
- For sending updates, newsletters, marketing emails and invitations based on your location, age, language and additional interests (consent of the data subject)
- For the financial administration, including the generating, sending and receipt of order forms, invoices and claims (implementation of the agreement)
- To obtain a subsidy from the government (legal requirement)
- For the security of the museums, our infrastructure, staff and visitors (justified interest)
- To analyse trends and statistics (anonymous)
- To receive applications or questions about vacancies, follow-up of and communication with candidates, notifications of new vacancies (consent of the data subject)
You have the right to withdraw your consent at any time, if your personal data are processed on the basis of your consent. We use the data provided only for the purposes for which we obtained it.
Which personal data does De Museumstichting SON process?
For the above-mentioned objectives, De Museumstichting SON processes the following data, according to the objective:
- Personal identification data: surname, first name, domicile
- Private contact details: telephone number, email address
- Education and training (diplomas, certificates, etc.)
- Identity details issued by the government: identity card number, national register number
- Personal characteristics: date of birth, place of birth, sex/gender, nationality
- Financial details: bank account number, payments
- Image material (in the event of a physical visit to the museum)
On the careers site, when you apply for a job, we may ask you about your origin, the origin of your parents and whether you have a disability or chronic illness. This question is never compulsory, and whether you answer it or not will in no way affect your application. Nor does the answer to this question affect how we handle your application. The question is only asked to evaluate and, if necessary, adjust our diversity policy.
We collect this information when you provide it to us (such as when you sign up or make a booking) or when you use our online services. Some of the ways in which we collect information are: cookies, registration forms, contracts, debt claim forms or personal/telephone/electronic contact. We do not collect personal data through third parties, with the exception of the data we receive from the City of Antwerp.
In order to provide you with the best possible service, it is possible that we combine your data with data that is publicly available or with data that you pass on to De Museumstichting SON via other platforms (for example, by buying a ticket or booking a guided tour).
Which personal data does De Museumstichting SON collect when I visit the website?
When you visit the website of De Museumstichting or one of the three museums, some data is collected automatically. For example, we can see the IP address, the pages which were opened, the number of mouse clicks, the date and time of the visit and which browser you use. Using these data, the website can recognise you next time you visit, and we can further optimise our websites and our processes to what the visitor is looking for.
As we wish to know who visits our websites and how we can improve them in the future, we use Google Analytics.
Which data does De Museumstichting SON collect from people under 16?
People under 16 can only register for workshops, guided tours and the newsletter if they have obtained parental consent. Furthermore, people under 16 have the same rights as anyone else within this privacy statement.
What if I do not provide certain data?
If you do not wish to provide us with certain information, you might not be able to purchase a ticket, make a reservation, or collaborate with De Museumstichting SON and its museums, as certain information is necessary for implementation.
Are personal data passed on to third parties?
We only provide your data to third parties if this is necessary for the purposes which we described above. In such cases, we always ask for your consent. You can withdraw this consent at any time.
We use third parties in the following situations:
- Selling admission tickets, booking workshops and guided tours (including Typeform, ESB-TSB, Syx Automations, Eventbrite)
- Sending press releases (including Prezly)
- Saving and processing data in the cloud (including SharePoint and Google)
- Maintaining the internet environment for web hosting and mail hosting (including Digipolis Antwerp)
- Maintaining IT infrastructure (including Digipolis)
- Maintaining (financial) administration (including EASI)
- Maintaining and distributing newsletters and invitations (including Mailchimp)
- Registering library visitors
- Access and consultation to/of the collection by visitors
- Following up applications (including HR Organizer)
In the event that we use a third party, we always conclude a processing agreement or ensure that the same provisions are included in the contract conditions. We ensure in this contract or agreement that your personal data are protected at all times.
De Museumstichting SON regularly collaborates with other companies or government bodies, meaning that these parties come into contact with your personal data in certain cases. We share personal data with the following external parties:
- Government bodies (including subsidy-granting authorities, tax administrations and social security bodies)
- Partners with whom we organise activities together and for which lists of participants are exchanged (including Prospekta/Info Cultuur and the City of Antwerp)
We also ensure with these parties that the necessary arrangements to protect your personal data are made, followed up and respected. Under no circumstances will we pass on your data to other third parties, unless required and permitted by law (such as by court order or police order). Your personal data will never be sold, rented or used for commercial purposes.
In the event that your personal data are transferred to countries outside the European Economic Area (EEA), they are protected by specific contractual obligations in accordance with the obligations of the European privacy regulation.
For how long does De Museumstichting SON store my personal data?
We never store your personal data longer than is necessary for the purpose for which they were provided, taking into account the terms specified by law (such as for accounting purposes). Storage terms may vary depending on the objective.
We undertake not to store personal data for more than ten years after the last use or termination of the collaboration.
How are my data secured?
Your personal data are protected against unauthorised access, use, loss or disclosure. We have taken the following measures, among others:
- Persons who may become aware of your data on our behalf have a duty of confidentiality
- We pseudonymise and encrypt personal data where necessary
- We make back-ups of personal data in order to be able to restore it in the event of physical or technical incidents
- We regularly test and evaluate our measures and adjust them if necessary
- Our employees are informed about the importance of protecting personal data
- Access is only granted to your data if these employees need such information to perform their taskFor new projects that may have an impact on your privacy, a comprehensive analysis is carried out to guarantee your rights, the security and protection of your personal data.
Should an incident nevertheless occur in which your personal data are involved, you will be notified personally in the circumstances provided for by law.
What are my rights?
You have various rights regarding the processing of your personal data, including:
- Right of access and copy
- Right to improve and supplement data
- Right to delete data if they are no longer strictly necessary for the purposes for which they were processed. We reserve the right to determine whether your request is justified.
- Right to restriction of processing
- Right to object to the way your personal data are processed, including the right to object to the use of your personal data for direct marketing purposes.
- Right to have your data transferred to yourself or, on your behalf, to another party
You can exercise these rights by contacting us at the address at the top of this privacy statement, accompanied by a justification of your request and identification to verify your identity. In this regard, we recommend that you cover up your passport photo and clearly state that it is a copy.
To only withdraw your consent for receiving newsletters, click on 'unsubscribe' in the footer of any email you receive from De Museumstichting SON or one of its museums.
No category of persons shall be subjected to any form of automated decision-making or profiling.
What is the procedure if I have a complaint?
If you have a complaint about how we process your personal data, or regarding the exercise of your rights, we recommend that you first contact us directly via the contact details given at the top of this privacy statement.
In addition, you can always lodge a complaint with the Data Protection Authority:
Data Protection Authority (DPA)
Rue de la Presse 35