Forward Fest, an initiative of KOEPEL VAN INTERNATIONALE SOLIDARITEIT – 11.11.11, the NGO federation, and VLIR-UOS, respects your privacy. We make it a point to handle your personal data appropriately. The processing of personal data is done in a manner that complies with the requirements of the General Data Protection Regulation (Regulation EU 2016/679, commonly known as GDPR) and any other laws and regulations regarding the protection of personal privacy.

This Privacy Statement outlines how Forward Fest handles personal data. The organization provides measures regarding information security and a Privacy Protection Policy developed in accordance with applicable legislation. This policy is supported by a specially appointed information security consultant and a Data Protection Officer (DPO).

This privacy statement is divided into a general part, a part specific to information processing systems (software, databases, etc.), a part concerning websites, and finally, a part about newsletters managed by or created on behalf of Forward Fest or services of Forward Fest.

1. General

About Forward Fest

With the help of Forward Fest’s information systems and information management, inventories are made, actions are prepared, services are delivered, and information is provided to policymakers, internal services, governments (e.g., subsidizing authorities, social security, finance), inspection services, volunteers, and citizens. This is all done with the general objective of ensuring the best possible service and information for the individuals with whom Forward Fest has contact in various capacities.

Identification of the Controller for the Processing of Personal Data

11.11.11 – Koepel van Internationale Solidariteit
Vlasfabriekstraat 11
1060 Brussels
Belgium
Tel. 02 536 11 11
Fax 02 536 19 82
Email: info@11.be
Main website: www.11.be
Company number: 0421.210.424
VAT number: BE 0421 210 424
Account number: IBAN BE30 0000 0000 1111

NGO Federation
Vlasfabriekstraat 11
1060 Brussels
Belgium
Tel. 02/536.19.31
Email: webmaster@ngo-federatie.be
Main website: ngo-federatie.be
Company number: 0449.400.604
VAT number: BE 0449.400.604

VLIR-UOS
Julien Dillensplein 1, P.O. Box 1A
1060 Brussels
Belgium
Tel. 02 289 05 50
Email: info@vliruos.be
Registered office: Flemish Interuniversity Council (VLIR), Ravensteingalerij 27, 1000 Brussels, Belgium
Main website: vliruos.be
Company number: 0418.766.123

2. Information Processing Systems

This part of the Privacy Statement describes the data processing in a structured manner, mainly by IT systems and solutions (software, databases) of BE 0449.400.604.

2.1 Processing of Personal Data

Forward Fest processes personal data of you as a citizen or as an employee of a government/administration, organization, or company. In this capacity, your data is processed as a “data subject” and/or you gain access to one or more information processing systems.

The GDPR defines the term ‘processing’ as follows (GDPR Art. 4): “any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data”.

Forward Fest collects, records, and processes personal data to ensure better service to its relations. We always strive to collect only the data necessary to achieve the intended purpose.

Forward Fest needs certain data from you:

• To comply with legal obligations;
• To provide you with a tax certificate as a donor;
• To perform certain administrative actions (financial administration and invoicing, rights management, user agreement management, etc.);
• To fulfill contractual obligations (e.g., you ordered a publication);
• To keep you informed about new developments concerning one or more topics that Forward Fest is committed to and publicly expresses if desired.

In this context, Forward Fest processes – depending on the nature of the relationship with you as an information seeker, donor, volunteer, or employee of a government/administration, organization, or company and the necessary processing of (personal) data – possibly the following data of yourself or, in certain cases, of children under your care:

• First name
• Last name
• Email address(es)
• Organization

Forward Fest collects no more data than necessary for the service they are supposed to provide and does not wish to retain this data longer than legally required, necessary, or acceptable.

In principle, there is no systematic processing of personal data of children under the age limits determined by the GDPR and the Belgian legislator. If this happens (e.g., for insurance, or for employees in the context of social security), it is with the knowledge and consent of parents or guardians.

For recording and using (publishing) visual material such as photos or films, consent is requested if the portrayed persons are clearly individually recognizable. For group shots or from a certain distance where there is less recognizability, fewer restrictions generally apply. In any case, applicable laws and regulations in this area are taken into account.

2.1.1 Data You Provide to Forward Fest

Customers

When you make a purchase through our ticket link or directly from Forward Fest, we collect the necessary contact details (name and address details, possibly telephone accessibility) for invoicing and delivery.

Volunteers

If you sign up online as a volunteer for an action or a more extended engagement, we ask for your name, place of residence, phone number, and year of birth so that we can contact you with a concrete engagement tailored to you. We do this also if you express your engagement via email, letter, or direct contact. In the context of insurance for a specific activity, a date of birth may also be necessary.

Newsletters, Event Registrations, or Activities

Forward Fest offers various newsletters to inform interested parties about different aspects of our work. For electronic newsletters, we ask for your email address and optionally your name, municipality, or in certain cases, your age or year of birth (e.g., for activities aimed at young adults). For the delivery of newsletters in printed form, we need your address.
We add your details to the mailing list of newsletter subscribers only with your explicit consent. Each newsletter contains a link that allows you to unsubscribe.

(See further in this Privacy Statement)

Event or Activity Registration

If you register for an event organized by Forward Fest (debate, workshop, etc.), we collect your name and email details and sometimes (optionally) your place of residence, year of birth, gender, and/or organization. Some of this information is requested due to obligations imposed by subsidizing authorities to check which target groups are reached with certain activities (e.g., gender, to check gender balance; or age, for activities aimed at youth).
You can indicate if you want to be kept informed of similar events in the future.

Communication

When you send us emails or other messages, we may retain those messages to further assist you. Sometimes we ask for certain personal data relevant to the particular situation. This makes it possible to process your questions and respond to your requests.

2.2.2 Data Automatically Collected

During the use of the information processing systems by employees or yourself (e.g., when entering or consulting an application made available via web access), Forward Fest and/or processors designated by Forward Fest also collect certain data. This data is required for service delivery and monitoring the quality of the data collected by Forward Fest. This data can be used by Forward Fest or a processor/service provider designated by Forward Fest under strict conditions if there are complaints about the connection or the software/web application not functioning correctly. Depending on the activity you carry out as a data subject, the information systems of Forward Fest may process the following data:

• IP address
• Username (login) or identification number
• eID identification and authentication data
• Timestamp of actions in the software

Visitors of a Forward Fest Website

We register traffic on our websites and media channels using cookies and similar technologies, for example, to remember that you are logged in and to analyze the use of the website. Only non-personal data is retained in this process. We will not combine this data with other personal data we may have.

Read more about how Forward Fest handles cookies, and see also in our Cookie Policy.

2.2 The Role of Forward Fest in the Processing of Your (Personal) Data

Forward Fest processes data of its target groups and contacts (citizens, employees of other governments/organizations/companies, clients, advisory firms, experts, etc.) and acts as a Controller for these data processing operations within the meaning of the GDPR.

Measures in the Context of the General Data Protection Regulation

In some cases, processors designated by Forward Fest, with whom a sufficiently appropriate contract and/or processing agreement has been concluded in the context of the GDPR and other legal and regulatory obligations, will process personal data of data subjects with the information systems or data processed by these information systems.

Forward Fest can also act as a co-controller or processor of personal data in certain cases within the meaning of the GDPR. This means that Forward Fest processes personal data on behalf and under the instruction of governments, authorized bodies, or other organizations. These other parties act as Controllers for these data processing operations within the meaning of the GDPR. They apply their own privacy policy for which Forward Fest is not responsible but which must be openly communicated.

For example, some organizations (MO*, the NGO federation, etc.) use

information processing platforms of Forward Fest, which provides technical support and/or facilitation, but these organizations are responsible for the content of the provided environments.

In each of these cases, a register of data processing activities is prepared and updated if changes occur, in accordance with the GDPR requirements. The register (inventory) for processing personal data can be viewed by the competent Data Protection Authority (DPA); in Belgium, this is the “Data Protection Authority” from 25 May 2018, as the successor to the Commission for the Protection of Privacy (known as the Privacy Commission). Any organization that processes personal data and is covered by the GDPR is required to give access to the Data Protection Authority if requested.

Forward Fest strives to map the processing activities of the processes within the organization and optimize and update this inventory/register if necessary.

The risk of a privacy breach or the inability to guarantee your rights as a data subject is also mapped, and a data protection impact assessment (DPIA) is conducted for activities with an increased risk profile regarding privacy protection. Other principles of the GDPR such as data protection by design and by default, incident management for information security and privacy incidents with a procedure for notification and handling of data breaches and data loss are included in the approach Forward Fest adopts regarding privacy protection.

Information Security (Personal Data)

Forward Fest strives to protect personal data and privacy in physical form, in information systems, and online. Forward Fest ensures appropriate organizational and technical measures to secure personal data and prevent unauthorized access to and use of information, such as a robust password policy, use of SSL certificates on websites (https secured file transfer), quality firewalls, antivirus/antimalware, and intrusion and anomaly detection.

Forward Fest employees are granted access to personal information only as needed to perform their duties. The number of employees with access to personal information is limited. The involved employees received training to handle confidential data correctly.

Data is stored on the CRM platform BREVO.

2.3 Authorizations for Processing Certain Data

Forward Fest or the organizations it acts for have obtained authorization for the processing of certain personal data. The relevant authorizations can be consulted at Forward Fest or the authorizing government (e.g., Finance for issuing tax certificates).

3. Exercise of Your Right to Access, Rectification, or Deletion

The GDPR provides for several privacy rights that you as a ‘data subject’ (natural person) can invoke. This is, of course, taking into account the privacy rights of other individuals and legal provisions and limitations.

As a data subject within the meaning of the GDPR, you have the following rights, summarized as “the right to correct, legitimate processing of your personal data”:

• Right of access to data processed about you (GDPR Art. 15);
• Right to rectification or correction of errors (GDPR Art. 16);
• Right to data erasure (officially “right to be forgotten”); this right applies in certain cases, particularly if we process data based on informed consent and no legal or other legal basis exists for further processing, including retention (GDPR Art. 17);
• Right to restriction of processing (GDPR Art. 18);
• Notification of rectification, erasure, or restriction of processing (GDPR Art. 19);
• Right to data portability (GDPR Art. 20);
• Right to object to processing (GDPR Art. 21);
• Rights regarding automated decision-making, including profiling (GDPR Art. 22).

You also have the right to file a complaint with the Belgian Data Protection Authority (DPA) if you believe your rights have been violated and you are not sufficiently recognized in your rights after contacting Forward Fest or the Data Protection Officer (DPO) appointed by Forward Fest.

For the processing of personal data where Forward Fest acts as the Controller for the data processing within the meaning of the GDPR, a “data subject” (i.e., any citizen, donor, volunteer, etc.) can submit a request for access, correction, or deletion. Forward Fest will handle this according to the provisions and timelines prescribed by the GDPR.

For processing of personal data where Forward Fest does not act as the Controller for the data processing within the meaning of the GDPR, requests for access, correction, or deletion cannot be independently handled by Forward Fest. In that case, requests for access, correction, or deletion must be submitted to the Controller for the data processing that uses the services and processing with/by Forward Fest’s information systems, as Forward Fest is not responsible for the information.

If you have a relationship with Forward Fest (as a donor, volunteer, customer, subscriber, participant in an event, etc.) and we process personal data from you for that reason, you can, after a written request and proof of your identity, view your personal data.

If the overview provided by us contains inaccuracies, you can request us to correct the incorrect data or ask to delete certain data.
You can also notify us in writing if you do not wish to be contacted with information about our products and services.

You can address your request to exercise your rights of access, rectification, or deletion to Forward Fest via email at privacy@11.be or by post to Forward Fest – DPO, Vlasfabriekstraat 11, 1060 Brussels.

For more information on how personal data is processed by Forward Fest or to exercise a right under the GDPR, you can contact the Data Protection Officer (DPO) of 11.11.11:

11.11.11 – DPO
Vlasfabriekstraat 11 – 1060 Brussels
Email: privacy@11.be

4. Websites and Social Media of Forward Fest

This part describes the data processing within the websites and related communication channels (social media) of Forward Fest:

Our websites:

• forwardfest.be

Our social media channels:

• Facebook
• X
• Instagram
• LinkedIn
• TikTok

5. Newsletters of Forward Fest

From Forward Fest and the services within Forward Fest, various newsletters and similar communications are sent by email or post to target groups, usually at their own request or, for example, to provide you with information about the event. New newsletter sign-ups use an active and informed consent (OPT-IN) for the use of your provided contact details. For data already previously provided by you to us, this data will be further processed and used for a limited period. The same applies to newly provided information, which is valid for a limited period. We ask for and use no more personal data than necessary in the context of a particular newsletter, usually limited to pure contact details.

The services of Forward Fest only add your contact details for newsletter management and similar information resources to a newsletter file if you have given consent or when you are part of specific target groups in the professional sphere (e.g., professional email addresses of employees of specialized organizations or companies). Each newsletter contains a link to unsubscribe (OPT-OUT). The databases or lists with email addresses used for a newsletter from Forward Fest are never shared with third parties.

Your data is only added to the subscriber list with your explicit interested consent. You can withdraw this consent at any time: each newsletter contains a link to unsubscribe.

We send our newsletters with BREVO

BREVO is a CRM system that allows creating and sending newsletters with mailing lists.
Only a limited number of Forward Fest employees have access to the personal data processed in the context of newsletter management and only when necessary for sending the newsletters.

6. Application of this Privacy Statement

This version of Forward Fest’s Privacy Statement is effective from 15 January 2024.

If the objectives change for which personal data is processed, Forward Fest will publicly announce this and transparently communicate it on the websites and other media channels used by Forward Fest.

Forward Fest reserves the right to adjust the privacy statement to new needs or insights.

For questions about the Privacy Statement or its amendments, you can contact the Data Protection Officer (DPO):

11.11.11 – DPO
Vlasfabriekstraat 11 – 1060 Brussels
Email: privacy@11.be

Last updated 24/01/2024