Privacy statement city of Leuven

The city of Leuven respects your privacy. We treat your personal information confidentially and according to the European General Data Protection Regulation (GDPR).

This privacy statement applies to the city of Leuven, OCMW Leuven and autonomous agencies.

What is personal data?

Personal data is data that allows us to identify someone.

To perform our tasks, we process personal data. What data we use, depends on the task or activity.

There are 2 types of personal data:

  • Regular personal data
  • Sensitive data

Regular personal data

  • Identification and contact data
    Name, address, e-mail address, telephone number, national register number ...
  • Personal characteristics
    Age, gender, marital status, nationality, date of marriage, number of children ...
  • Personal interests and preferences
    Membership of an organisation, hobbies ...
  • Financial and social data
    Bank account numbers, assets, income, benefits, subsidies, employment, unemployment, pension ...
  • Visual and sound recordings
    Photographs and video recordings on which you can be seen ...

Sensitive data

In very specific situations we process sensitive personal data. But only if we are legally allowed to do so. We handle this data with extra care.

Sensitive data includes:

  • Ethnic origin
    Genetic data, descent, language preference, physical characteristics ...
  • Political, religious or philosophical beliefs or memberships
    Political affiliation, political functions, funeral rites ...
  • Biometric data
    Fingerprints, facial recognition ...
  • Health data
    Medical records, information on disability, pregnancy, diet, allergies ...
  • Data on gender and sexuality
    Marriage between persons of the same sex, pronouns ...
  • Judicial data
    Convictions and punishments ...

How we collect and use data

How do we get your personal data?

We get your data in 2 ways:

  • You provide data yourself, e.g. via our website or during an interview.
  • We obtain them from other authorities or organisations, e.g. through the National Register, the Crossroads Bank for Social Security, Fluvius, schools in Leuven ...

We follow the principle of minimum data processing: we only ask for the data we really need to help you.

What do we use your personal data for?

We only use your personal data for the purpose we need it for.

Some examples:

  • Did you give us your name and address to receive a brochure? Then we'll only use your data to send you the brochure, not to send you other material.
  • Did you give us permission to use your data from the national register? Then we'll only use this permission for that purpose. We never pass on or use your data for anything else.

We always need one of these reasons from the GDPR to use your personal data:

  • Agreement
    Sometimes we need your data to fulfill an agreement with you, for example if you use our services.
    Examples:
    • You register your child for a sports camp.
    • You rent a property through AG Stadsontwikkeling Leuven.
  • Legal obligation
    Sometimes the law requires us to keep track of personal data.
    Examples:
    • The city is obliged to keep details of every resident in the population register.
    • If you request support from OCMW, we have to create a case to justify your need for support.
  • Task of general interest or a task of public authority
    As a city, we carry out tasks of general interest or public authority without the law describing how to do so.
    Example:
    • Leuven can choose to automatically grant you some benefits. To remove the threshold for applying for the benefit, we obtain the necessary personal data from other authorities.
  • Justified interest
    We only use this reason when providing services that a government is not required to provide, but that we want to.
    Example:
    • We use necessary cookies to ensure you can use parts of our website.
    • We use cameras for better security in our city.
  • Vital interest
    In exceptional, life-threatening emergencies, we may use your personal data.
    Example:
    • Sending an ambulance to an address when we know there is a emergency.
  • Consent
    We usually ask for your consent to process your data. We'll inform you why we ask for data and what we'll use it for.

    • At any time, you can withdraw your consent (form only in Dutch). Keep in mind that your withdrawal doesn't work retroactively: anything we processed before remains valid if there was a good reason for the consent at the time.

      Examples:

      • If you subscribe to a newsletter, we ask for your e-mail address.
      • If we take your photo, we ask whether we can use the photo for specific purposes.

Sharing data with others

General rule

We do not share your data with others.

Exceptions

We only share your data if:

  • You give us permission
  • It is necessary for our services
  • It is required by law

Sharing personal data with other organisations

If an organisation processes your data on our behalf, we have an agreement with them. This ensures that they handle your data securely and confidentially. We remain responsible for processing your data.

Sharing personal data with other authorities

If we exchange personal data digitally with other authorities, we draw up a protocol. This documents describes a number of things to make clear that the principles of the GDPR are being followed.

View protocols (only in Dutch)

How long we store data

We will not store your personal data for longer than necessary. The duration may be related to our services or may be required by law.

Afterwards, your personal data is deleted. If you want to know how long we keep your data in a specific case, you can ask us.

Ask how long your personal data are kept (form only in Dutch)

What are your rights?

You have the right to:

  • Access your personal data
  • Edit your personal data if it is incorrect or incomplete
  • Delete your personal data (under certain conditions)
  • Request a copy of your personal data
  • Restrict or object the processing of your personal data (subject to certain conditions)
  • Transfer your personal data to someone else

Make your request online. It's free. You'll receive a response as soon as possible, and no later than 30 days after we received your request. If we are not convinced of your identity, we may ask you to provide us with a copy of your ID. While this service is free, we may charge you for some requests if we can prove you're overusing your rights.

I want to access, modify, delete, restrict, object or transfer my personal data (form only in Dutch)

Cookies

Most of our websites use cookies. We use them to make everything work smoothly, to analyse and improve our online services.

More information about the cookies we use can be found on each website.

Read more about cookies on leuven.be

Photos

  • Did we take a portrait photo of you? Then we will ask your permission to use it. You can withdraw your permission at any time.
  • We are allowed to use photos of public figures (e.g. politicians), a crowd or in public places for neutral messages without permission.

Newsletters and social media

Newsletters

We only use your e-mail address to send the newsletter you subscribed to. You can unsubscribe online (form only in Dutch) at any time. You can do so for every newsletter. We'll delete your data immediately.

We send our digital newsletters via Mailchimp, an external platform.

Read the terms and conditions of Mailchimp

Social media

We use social media, such as X, Facebook and Instagram. If you contact us through these platforms, we will only use your personal data to help you.

We have no influence on how social media handle your personal data. Your data may end up outside the EU. You can read more about this in their privacy statement.

Camera footage

Some places in Leuven have security cameras. We only review the footage after an incident. We don't save the footage for more than 4 weeks, unless the police ask to keep it longer.

Reporting a data breach

What is a data breach?

There is a data breach if:

  • Personal data is stolen or lost
    Example: A city employee lost a USB stick with work documents on the train.
  • Personal data has not been processed correctly
    Example: The city kept your data without a valid reason.
  • Personal data has been viewed or edited by people that should not
    Example: Your data was accidentally shared with another organisation.
  • Personal data kept longer than necessary or agreed upon, without that person's consent
    Example: You asked for your data to be deleted, but it was not.

Think there's a data breach at the city?

Report a data breach (form only in Dutch)

Filing a complaint

About this privacy policy

Who does this privacy policy apply to?

This privacy policy applies to:

City of Leuven
Professor Van Overstraetenplein 1, 3000 Leuven
BE 0207.521.503

OCMW Leuven
Andreas Vesaliusstraat 47, 3000 Leuven
BE 0208.236.927

M Leuven
Professor Van Overstraetenplein 1, 3000 Leuven
BE 0896.728.376

AG Stadsontwikkeling Leuven
Professor Van Overstraetenplein 1, 3000 Leuven
BE 0870.310.526

Academie SLAC & Conservatorium SLAC
Dirk Boutslaan 60 - 62, 3000 Leuven

Erfgoedsite Abdij van Park
Professor Van Overstraetenplein 1, 3000 Leuven
BE 0686.647.360

Vzw Stedelijk Jeugdwerk Leuven
Professor Van Overstraetenplein 1, 3000 Leuven
BE 0445.445.279

Vzw Leuvenement
Professor Van Overstraetenplein 1, 3000 Leuven
BE 0410.888.337

Vzw Centrummanagement Leuven
Professor Van Overstraetenplein 1, 3000 Leuven
BE 0472.859.459

Vzw 30CC
Professor Van Overstraetenplein 1, 3000 Leuven
BE 0450.701.689

Vzw Kinderopvang Leuven
Professor Van Overstraetenplein 1, 3000 Leuven
BE 0478.167.834

Tofsport vzw
Professor Van Overstraetenplein 1, 3000 Leuven
BE 0450.965.569

Diversleuven vzw
Professor Van Overstraetenplein 1, 3000 Leuven
BE 0459.239.471

Updates

We regularly review our policy on personal data and compare it to legislation and our services. Therefore, we may occasionally modify our privacy statement. Changes are valid from the time they are published on this page.

Date of last update: 22 October 2024

Do you have a question?

Do you have questions, comments or complaints about the protection of your personal data? Please let us know. You can do so by mail or letter.

Mail

Mail the data protection officer (DPO).

Functionaris voor Gegevensbescherming (Data Protection Officer)

Brief

Send a letter to one of our addresses.

Something wrong or unclear on this page? Let us know.