Privacy Statement
SECTION 1 - INTRODUCTION
Your personal data is processed by the Towards Sustainability Labelling Agency (CLA) vzw, with its registered office at Koning Albert II-laan, 1210 Brussels, named CLA hereafter.
If you have any questions about the processing of your personal data by the CLA, please contact us at info@towardssustainability.be.
How does the CLA handle your personal data?
The CLA aims to process your personal data in a legally correct and secure manner. Through this statement, we want to inform you in clear terms about what personal data we (may) process (request, collect, store, use, etc.) and for what purposes we do so. We also explain how you can exercise your rights with regard to the CLA, if desired.
When we refer to personal data below, we mainly mean identification and contact details such as your surname, first name, address, telephone number, email address, position within your organisation, language, gender, etc.
SECTION 2 - THE DIFFERENT CAPACITIES IN WHICH YOU COME INTO CONTACT WITH THE CLA
This statement concerns the processing of personal data of natural persons who come into contact with the CLA. It is not intended for the CLA employees themselves, who are informed in more detail about the processing of their data in a specific statement drawn up for this purpose.
In practice, a natural person may come into contact with the CLA in several capacities or roles. That capacity is of great importance. It determines for what purpose which data is processed, what the basis for this is, how long it is stored, with whom it is shared and what rights you have.
A natural person may have the following capacities in relation to the CLA. Below, we explain what data processing entails in concrete terms for each of these capacities or roles. These capacities determine the way in which you, as a data subject, can exercise the rights granted to you by the regulations. This aspect is explained in more detail at the end of this statement.
Your personal data will be processed by the CLA if you are an employee of a legal entity submitting an application for the Towards Sustainability label to the CLA
Purposes
As a representative of a legal entity submitting an application to the CLA, we process your data for the purpose of handling and managing that application.
Basis.
The basis for this processing is the CLA's legitimate interest in handling applications for the Towards Sustainability label.
Categories of personal data
In this context, the following categories of personal data are processed:
- Personal identification data (surname and first name, address, contact details)
- Professional contact details (title, professional telephone number, email address and postal address, etc.)
- Job details of the applicant
How do we obtain your data?
In principle, we obtain your personal data from you when you use the software proposed by the CLA. It is possible that your employer, the legal entity on whose behalf you are submitting the application, may provide us with your data.
Recipients
Your personal data is accessible to the processors used by the CLA for the purpose of processing and managing the application, in particular the consortium responsible for the verification, the ad hoc Advisory Committee, the Eligibility Commission and the CLA Board of Directors. All these entities play a role in processing the application for the Towards Sustainability label.
Retention periods
This data will be retained for as long as the label is awarded. It will be deleted as soon as the legal entity on whose behalf you are submitting the application informs us that you no longer represent them.
Rights of the data subject
You may exercise your right of access, rectification and/or deletion at any time, as well as object to the processing of your personal data. Please note that in the latter case, the CLA will not be able to process the application for the label. The manner in which you can exercise your rights is described further in this statement.
If you are not an employee of a label holder, but a person with whom the CLA comes into contact in the context of its mission and activities (such as politicians, cabinet staff, journalists, academics, regulators, etc.), we process your personal data in order to communicate with you, share information with you and, where appropriate, involve you in the CLA’s activities.
Purpose
Your personal data will then be processed for the purpose of representing and promoting the interests of the CLA as a label awarding organisation.
Basis
The processing of this personal data is based on the CLA's legitimate interests in promoting and pursuing its interests as a labelling organisation (freedom of organisation).
Categories of personal data
The categories of personal data that are processed are:
• Personal identification data (surname and first name, title, position, address, contact details, etc.)
• Personal details (age, gender, etc.)
• Professional activities (position within a company or organisation, job title, nature of the company or organisation's activities, etc.)
• Membership of a professional organisation, political party or trade union
• Public mandates
• Personal data revealing political opinions, philosophical beliefs or trade union membership
How do we obtain your data?
In principle, the data is not obtained directly, but through consultation of public sources.
Recipients
This data is processed solely internally, within the CLA. It is not shared with third parties, except in cases where there is a legal obligation to do so.
Retention periods
This data is retained for as long as you are relevant to the CLA's mission and activities. Each year, you will be sent a message to verify your data, which will also give you the opportunity to delete your data.
Rights of the data subject
You can always exercise your right to access, correct and/or delete your data, as well as object to the processing of your personal data. Please note that in the latter case, it will not be possible to communicate with you, share information with you and, where applicable, involve you in the CLA’s activities. The manner in which you can exercise your rights is described further in this statement.
Like any natural person, you have the option of indicating that you wish to be kept informed of the CLA's activities in a manner other than via the website.
Purpose
In that case, your personal data will be processed to inform you about the CLA's activities, in particular information about the Towards Sustainability label, sustainable saving and investing, and labelled products.
Basis
The basis for this processing is the CLA's legitimate interest in informing interested persons about its mission, services, and activities.
Categories of personal data
The categories of personal data that are processed are:
• Personal identification data (surname and first name, title, contact details such as address and email address)
• Your request to be kept informed of activities
• Any topics in which you are interested
How do we obtain your data?
In principle, the data is obtained directly from you, through your request or expression of interest.
Recipients
Your data is processed internally by the departments that need it to keep you informed, in particular the communications department.
Retention periods
The data is retained for as long as you wish. This means that you can indicate at any time that you no longer wish to be kept informed of the CLA's activities.
Rights of the data subject
You can always exercise your right of access, rectification and/or deletion, as well as object to the processing of your personal data. Please note that in the latter case, it will not be possible to keep you informed of the CLA's activities. The manner in which you can exercise your rights is described further in this statement.
The data you provide us with when registering for the event will be processed for the purposes of following up your registration (invitation, confirmation of receipt, additional information about the event, invoicing (if applicable), etc.). We may also store your feedback for the purposes of satisfaction surveys or any complaints.
For certain events, participants will receive a simplified list of participants with their surnames, first names, job titles and organisations.
During certain events, atmospheric images and photos of participants may be taken to illustrate and support the CLA's activities and mission.
Purpose
The purpose of this processing is the organisation and management of events by the CLA (including invitations and registration), including direct mailing related to these events.
Basis
The basis for this processing is the legitimate interest that the CLA has as an organisation to promote its services, as well as sustainable saving and investing in general.
Insofar as the image of the data subjects is concerned, the consent of the data subject is required in principle, both for taking and publishing the image.
Categories of personal data
The data we process are as follows:
• Personal identification data (surname and first name)
• Other identification data (car license plate for parking, etc.)
• Professional data (job title, etc.)
• Images (photo)
• Personal data relating to health – this concerns certain data (regarding allergies or preferences) that is requested in the context of a meal during the event.
How do we obtain your data?
In principle, the data is obtained directly from you. If and insofar as the data is obtained via your company, you will be informed by means of a confirmation email.
Recipients
Your data is processed internally by the departments that need it for the organisation of the event.
A processor may be called upon for the organisation of events, but always under the control and responsibility of the CLA.
In the case of an event organised with another party, your data will be shared with that party, but only for the purpose of registering for the event and following up on it.
Retention periods
Data relating to event management and follow-up will not be retained for longer than one month after the end of the event.
Rights of the data subject
You may exercise your right to access, rectify and/or delete your data at any time, as well as object to the processing of your personal data. Please note that in the latter case, the CLA will not be able to register you for the event. The manner in which you can exercise your rights is described further in this statement.
If you contact the CLA, for example with a request for information, we will only use your data for the purpose of handling your request.
Purpose
The purpose of this processing is to communicate with individuals who contact the CLA with a question, request or other form of contact.
Basis
The basis for this processing is the CLA's legitimate interest in responding to the question or request or following up on any other form of contact.
Categories of personal data
The data we process are as follows:
• Personal identification data (surname and first name, title, contact details such as address and email address)
• Subject of the question, request or contact
How do we obtain your data?
We obtain your data from you when you ask us a question or make a request via the contact page provided for this purpose, or via email or telephone.
Recipients
Your personal data will be communicated internally to the departments that need it in order to respond to your question or request.
Retention periods
Your data will be retained for as long as necessary to respond to your question, request or contact. Partly to enable follow-up, it will be retained for up to 1 year after contacting the CLA.
Rights of the data subject
You may exercise your right to access, rectify and/or delete your data at any time, as well as object to the processing of your personal data. Please note that in the latter case, the CLA will not be able to contact you in connection with your question, request or contact. The manner in which you can exercise your rights is described further in this statement.
The CLA requires products and services in order to carry out its activities. These are supplied by various individuals and/or companies. You may be a service provider yourself or an employee of a company that supplies a product or service to the CLA. In that case, your personal data will also be processed, as a representative of the supplier.
Purpose
The CLA processes your personal data for the purpose of following up on the services provided and any comments or complaints in this regard. As such, your data is processed in particular for general supplier management, including accounting processing, management of disputes and legal proceedings, the collection or transfer of receivables and the protection of the CLA's rights in general.
Basis
The basis for the processing of your data depends on your capacity as a supplier:
• If the supplier is a natural person, the processing is based on the execution of the agreement concluded between the CLA and the supplier.
• If the supplier is a legal entity, the processing is based on the CLA's legitimate interests in carrying out its activities and, in that context, processing the data of natural persons acting as representatives and/or contact persons of the suppliers with whom the CLA enters into an agreement.
Categories of personal data
The data we process are as follows:
• Supplier identification data (including identification data of representatives)
• Financial data
• Data relating to the services or products provided
How do we obtain your data?
In principle, we obtain your data from you when providing the services or products, or via the company where you work.
Recipients
The data is processed internally (within the CLA) by the departments that need it for the operation or requirements of their service. This data is made available to the accounting department responsible for payment. In principle, your data is not shared with others, unless this is necessary for legal reasons, such as compliance with VAT regulations.
Retention periods
Your personal data will be retained for up to 10 years following the last contact we had with you or the company or organisation you work for.
Rights of the data subject
You may always exercise your right to access, rectify and/or erase your data, as well as object to the processing of your personal data. Please note that in the latter case, you will not be able to supply products or services to CLA. The manner in which you can exercise your rights is described further in this statement.
Any natural person may visit the CLA offices. In this context, your personal data will be processed by an external company responsible for receiving visitors, without the CLA's involvement. In addition, the CLA will also take images of you as a visitor when you enter the floors where the CLA is located.
Purpose
When you visit CLA, we process your personal data for the purpose of securing the building where we are located.
Basis
The basis for this processing is the CLA's legitimate interests in securing the buildings in which it is located.
Categories of personal data
The categories of data that are processed are:
• Identification data
• Images
How do we obtain your data?
In principle, we obtain your personal data from you, following your visit to our buildings.
Recipients
Your data is processed by the CLA for purely internal purposes of monitoring the buildings.
Retention periods
The CLA does not retain your personal data for longer than is necessary for the intended purposes of the processing. In principle, your data will not be retained for longer than one month.
Rights of the data subject
You may always exercise your right of access, rectification and/or deletion, as well as object to the processing of your personal data. Please note that in the latter case, the CLA will not be able to grant you access to our buildings. The manner in which you can exercise your rights is described further in this statement.
If you are applying for an open position or submitting a spontaneous application, the CLA will process the personal data you provide for the purpose of following up on your application.
Purpose
Your personal data will be processed by the CLA for the purpose of assessing and following up on your application.
Basis
Insofar as an application is intended to determine whether an (employment) contract can be concluded, the processing of this personal data is necessary for taking pre-contractual measures.
Categories of personal data
The categories of personal data that are processed are:
• Identification data (surname, first name(s), address, etc.);
• Personal data (place and date of birth, nationality, gender, telephone number, email address, hobbies and interests, etc.);
• Photograph, if provided voluntarily;
• Data relating to professional experience (profile, details of former employers, termination of previous employment and work performed, special projects, etc.). If references are included in the CV, this may lead to an investigation of those references.
• Information relating to education (diplomas, certificates, internships, special training, etc.);
• Language skills;
• If applicable, a work and/or residence permit for the European Economic Area (EEA);
• Any other information provided in the application, CV or cover letter in connection with the performance of the job;
• Digital assessment via the internet (presence on social media), to the extent that this presence is public;
• All other personal data (other than those mentioned above) that must be processed by law.
How do we obtain your data?
In principle, the data is obtained from you, either in response to an application for a vacant position or in response to a spontaneous application.
Recipients
Your personal data will only be processed internally by the CLA's human resources department and the managers responsible for the position for which you are applying.
Rights of the data subject
You may always exercise your right to access, rectify and/or delete your data, as well as object to the processing of your personal data. Please note that in the latter case, the CLA will not be able to process your application. The manner in which you can exercise your rights is described further in this statement.
Retention periods
In principle, your personal data will only be retained for the time necessary to assess your application. This means that if your application is not successful, your data will in principle be deleted. Nevertheless, in order to take into account unforeseen circumstances in the context of recruitment, it will be retained for up to 6 months after the conclusion of the application procedure. If the CLA wishes to include your data in a recruitment reserve and retain it for longer than 6 months, it will ask for your consent.
You can visit the CLA website(s) at any time. In that case, CLA may store certain data by means of cookies. A ‘cookie’ is a small file that is sent by an internet server and stored on your computer's hard drive. This file contains information about your visit to our website. Cookies are intended to improve your browsing experience on your next visit to our site and to compile general statistics on the quality and use of the website. Cookies are never used for commercial or direct marketing purposes.
Due to the specific importance of this, we refer you to the CLA's cookie policy.
SECTION 3 - PLACE OF PROCESSING AND STORAGE
Where are your data processed and stored?
In principle, your data are processed on Belgian territory. It is possible that, in the context of the management and storage of your data, third parties based in a third country may be involved. To the extent that it is necessary for them to have access to your data, we take all necessary measures to comply with the regulations prescribed by the GDPR in this area, so that your rights are protected as much as possible.
SECTION 4 - COMMUNICATION TO THIRD PARTIES
The CLA never shares your personal data with or sells your data to third parties who process this data for their own commercial purposes.
For certain aspects of the processing of your personal data, such as ICT and logistics, the CLA may call on external parties referred to as “processors”. These are companies that process your data within a clearly defined framework and in accordance with a task defined by the CLA. In principle, these companies are located in Belgium or in the European Union. If this is exceptionally not the case, the CLA (non-profit organisation) will take the necessary measures to ensure that your transfer is surrounded by the necessary safeguards.
Additional information about possible recipients can be found in the sections about or concerning the various roles you may have as a natural person in relation to the CLA.
SECTION 5 - YOUR RIGHTS WITH REGARD TO THE PROCESSING OF YOUR PERSONAL DATA
What rights do you have with regard to the CLA? The regulations grant you several rights. We will limit ourselves to those rights that apply to your relationship with the CLA.
Right to object
If the CLA processes your personal data on the basis of its legitimate interest as described above, you have the right to object to that processing. Please note that this objection may result in the CLA being unable to respond to your question or request or provide any other service due to a lack of personal data.
Right of access
If you wish to access the personal data we process about you, please let it know. If you exercise this right of access, the CLA will provide you with an overview of the data it processes about you.
Right to rectification
If you notice that the data received from you is no longer correct, you can let it know. The CLA will make the necessary changes or additions to the data as soon as possible.
Right to erasure/deletion
If you no longer want the CLA to process your data, you can always contact the CLA and ask them to delete your data.
How can you exercise your rights or lodge a complaint? If you wish to exercise any of the above rights or lodge a complaint about the way the CLA processes your data, you can contact the CLA by:
• Email: info@towardssustainability.be
• Letter to the CLA vzw, Koning Albert II-laan 19, 1210 Brussels
Always be as specific as possible when exercising your rights. This will enable the CLA to deal with your request in a concrete and correct manner.
The CLA will verify your identity to prevent someone else from exercising your rights and obtaining data to which they are not entitled. To this end, you will be asked to provide a proof of identity showing that you are who you claim to be.
Possibility to contact and lodge a complaint with the supervisory authority
If you would like more information about the processing of personal data in general or if you disagree with the CLA's position, you can contact the Data Protection Authority located Drukpersstraat 35, 1000 Brussels – email address contact@apd-gba.be and telephone number +32 (0)2 274 48 00 and +32 (0)2 274 48 35) – where you can lodge a complaint if you wish.
Last updated on 8/09/2026