This statement relates to the use of your personal data by the Rijksvastgoedbedrijf (RVB). This statement applies to all situations in which your personal data is used by or on behalf of the RVB. In addition to this general statement, specific privacy statements or notices may be applicable. These specific statements will contain additional information: for example the reasons for use of your personal data, how long we retain your personal data, and with whom we share it.
The RVB respects your privacy and treats your personal data with the utmost care. The RVB complies in this respect fully with the relevant privacy legislation. The most important privacy legislation is the European General Data Protection Regulation (GPDR). In addition to the GPDR, other laws and regulations govern the use of your personal data, such as the Burgerlijk Wetboek (Dutch Civil Code), the Wet Bibob (Dutch Act on the Promotion of Integrity Assessments by the Public Aministration) and the Kadasterwet (Dutch Land Register Act).
What comprises personal data?
Personal data is information that relates to a particular individual or information that can be traced back to an individual. Examples of personal data are addresses, telephone numbers, vehicle registration numbers, IP addresses and e-mail addresses.
Why does the RVB process personal data?
The RVB processes personal data for a variety of reasons and in the performance of her legal responsibilities, such as dealing with real estate transactions, managing unattended legacies, and carrying out investigation in compliance with the Bibob legislation. This general statement applies to all the personal data that the RVB collects for these purposes.
Who is responsible for the use of your data?
As the RVB falls under the remit of the Ministry of the Interior and Kingdom Relations (BZK), the Minister and Secretary of State of the Ministry of BZK are responsible for the processing of your data. They are responsible for the correct use of your data in compliance with the law. You can hold them accountable.
What is the legal basis for the use of my personal data by the RVB?
The RVB may use your personal data only in the following situations:
- You have consented to their use;
- Use is necessary for the preparation or execution of a contract that will or has been made with you, e.g. if you provide a service to the RVB;
- Use is necessary to comply with a legal obligation. This may be the case if your are hired /employed by the RVB;
- Use is necessary for the protection of a vital interest;
- Use is necessary for the performance of a public duty, e.g. dealing with unattended legacies; or
- Use is necessary for a legitimate purpose, e.g. camera supervision performed for the protection of buildings;
- In the more specific privacy statements or notices used by the RVB can be indicated on which of the above grounds your personal data is being used specifically.
What are my rights when my personal data is processed on the basis of my consent?
When the RVB processes your persona data on the basis of your permission you are at all times free, with a simple notification, to withdraw your permission. The withdrawal of consent does not have the consequence that the use of your data by the RVB, in the period prior to withdrawal, is illegal.
Am I obliged to provide the RVB with my personal data?
Should the RVB request personal data from you, it is possible that your are legally obliged (1) or contractually committed (2) to providing the requested data; or that the provision of your data is a necessary prerequisite for execution of an agreement/contract with you (3). Should you fail to provide the necessary data in the first situation you may possibly be in breach of the law. In the second situation you may possibly be in breach of contract. In the third situation failure to provide the necessary data can possibly result in failure to execute the agreement/contract with you.
With whom does the RVB share my personal data?
If the RVB is contractually or legally obliged, it may share your data with among others the following entities: suppliers, building contractors, subcontractors, clients, notaries public, real estate chain partners, participants in a partnership, facility service providers, the Ministry of Finance (in connection with audits) and/or justice or other government parties (including EU entities).
How does the RVB protect my data?
The RVB complies with the GDPR by taking appropriate measures (both technical as organisational) to protect your personal data. Government wide agreements have been made about this. More information on these agreements you can find on the website Earonline.nl.
How long does the RVB retain my data?
Under the GDPR, the RVB is not entitled to retain your personal data any longer than is necessary to achieve the purpose for which your data was collected. After the retention period has expired, your data will be destroyed or anonymised. In some cases the retention periods result from the law, in other cases the RVB determines this.
A retention period that is often used by the RVB and results from the law is the minimum retention period of 9 years for data on commercial real estate. This period is stated in article 34a of Wet op de omzetbelasting (the Dutch Turnover Tax Act) and commences in the year following the year in which the property is used for the first time.
In certain cases, the data are eligible for archiving in the public interest under the Public Records Act. In that case, the data will be transferred over time to the National Archives.
In the more specific privacy statements or notices retention periods can be further elaborated.
What rights do I have?
On the basis of the GDPR you can request for:
- Access to your data;
- Correction and deletion of your data;
- Limited use of your data.
There may be reasons why your request cannot be granted. If that is the case, the RVB will explain this to you carefully.
In certain cases you are also entitled to:
- Receive a copy of your data in digital form;
- Object to the processing of your data.
Contact about your rights?
You can submit your request on the basis of the GDPR (see above) by sending a letter to PO Box 16169, 2500 BD The Hague or through mailbox RVB privacy contact point.
In principle you will receive a decision on your request within one month. If you do not agree with the decision, you can lodge an objection and appeal against this. See here more about objection and appeal.