Privacy Statement
At the MDRA, we are aware of how important the protection of your personal data is. We make every effort to process your personal data responsibly, in accordance with the General Data Protection Regulation that came into force in May 2018. This statement is the first step in making it clear how we do this and what happens to your data.
This privacy statement is structured as follows:
1. Data processing complaint discrimination;
2. Data processing visit website;
3. Data processing by phone or mail;
4. Provision of personal data to third parties;
5. Security;
6. Rights of data subjects;
7. Contact information;
8. Changes to our Privacy Statement.
1. Data processing complaint discrimination
The MDRA is an anti-discrimination facility as defined in the Municipal Anti-Discrimination Facilities Act. Article 1 sub a of this law mentions that an antidiscrimination facility has the task of providing citizens with independent assistance in the settlement of their complaints aimed at discrimination. Subsection b mentions as a core task that complaints under subsection a should be registered. By this provision, the registration and data processing follows from a legal obligation. This legal provision shows that it is necessary for them to process personal data in order to comply with a legal obligation incumbent on the controller.
The MDRA processes special personal data (religion or belief, race, political affiliation, health, sexual life, as well as personal data regarding trade union membership) from the organization's legal mission. Discrimination is prohibited by national law. The MDRA's mission is to prevent and combat discrimination. Because the task implements something regulated by national law, the MDRA is performing a task of substantial public interest. For this reason, the MDRA may also record special personal data.
To handle complaints, it is necessary to have at least the reporting party's zip code.
It remains possible to make an anonymous report, but if a complaint is made, having some personal data is crucial. If the person concerned chooses to go to mediation, data may be exchanged with this particular person or body. If the person concerned does not wish mediation, then no data will be provided to third parties.
2. Data processing visit website
What information the MDRA collects from depends on what data subject does when data subject visits a our website www.mdra.nl. As the data controller, the MDRA has a processing agreement with the controller (Surver) from the website closed.
3. Data processing by phone or mail
If personal data is provided to MDRA by email, web form or telephone, it is collected and used for the purpose for which you leave it (answering your question or being able to send you the requested information) and possibly for internal quality surveys to measure service delivery. Anonymized, the data will be used for analysis, reporting and research.
If you ask us a question or request information, the MDRA has a legitimate interest in processing personal data mentioned above. The processing of this data is necessary for the proper handling of your request.
4. Provision of personal data to third parties
If the MDRA provides personal data to third parties, the MDRA will obtain the prior consent of the parties involved, unless not required by law.
5. Security
MDRA protects the data entrusted to it using technical and organizational security measures to minimize the risk of loss, misuse, unauthorized access, disclosure and alteration. These include physical and administrative access controls to data and servers.
If, despite the security measures in place, a security incident does occur, we will take measures to minimize the impact on your privacy.
If such an incident qualifies as a data breach, we will report it to the Personal Data Authority and, if necessary, to the data subject(s) to whom the personal data relate.
6. Rights of data subjects
To protect the data subject, the law has granted a number of rights to the data subject. These rights concern the data subject's control over service personal data. The General Data Protection Regulation grants several rights to individuals whose personal data are processed. These rights provide more means to control and influence the processing of their personal data. The rights of data subject are listed below.
Right to information:
The MDRA must keep the data subject informed that their personal data is being processed. In addition, during the collection of personal data and before processing, it must be clear to the data subject what the purposes of the processing are. Should the purpose of the processing change, the data subject must be informed.
Right of inspection:
The MDRA must give the data subject the opportunity to inspect their data. When granting the right of inspection, the MDRA will have to inform the data subject of the information requirements.
Right to rectification:
If incorrect personal data are processed, the data subject has the right to rectification. Rectification means that an additional statement based on incomplete data can be submitted.
Right to data erasure/ oblivion:
The MDRA is obliged to delete personal data of the data subject without unreasonable delay. This must be done if the personal data are no longer necessary for the purposes for which they were collected or otherwise processed. The MDRA must also erase the data if the data subject unexpectedly withdraws consent and there is no other legal basis for processing. The data must also be erased if the data subject objects to the processing or if the personal data has been processed unlawfully.
Right to restriction of processing:
The right to restriction of processing means that no processing or modification may be done (temporarily). Should there be a restriction, the MDRA must have clearly indicated this in a file. Also, the data subject must be notified of the restriction and also when it is lifted again.
Right to portability/data portability:
Data subject has the right to request his personal data provided to the MDRA. This gives data subject even more control over their own personal data. A data subject has the right to obtain data from the MDRA in structured, common and machine-readable form.
Right of opposition/objection:
Data subjects have the right to ask the MDRA to stop using their personal data. If the data subject objects, the the MDRA must stop processing.
7. Contact information
Contact information for the MDRA can be found here.
You can direct your questions and requests around the processing of personal data to: the Data Protection Officer Ms. D. Koekkoek at discriminatie@mdra.nl or 020 638 55 51.
8. Changes to our Privacy Statement.
We may update this Privacy Statement from time to time. If so, we will add a new date at the top of this Privacy Statement.