Privacy Statement
Last revised 23 May 2018
Scope of this Privacy Statement
This Privacy Statement (the “Statement” or “Privacy Statement”) sets out how TUC RAIL collects, uses, accesses or otherwise processes an individual’s personal data. For the purposes of this Privacy Statement, any mention of “TUC RAIL”, “we” or “us” refers to TUC RAIL S.A., registered with the Crossroads Bank for Enterprises under number 0447.914.029, with registered offices at Avenue Fonsny 39, 1060 Saint-Gilles, telephone number +32 2 432 78 11, e-mail address privacy@tucrail.be. TUC RAIL will process your personal data in its capacity as controller in all the situations described in this Statement. Given that TUC RAIL is a subsidiary of Infrabel, we rely on the services of Infrabel’s Data Protection Officer (DPO). You can contact the Data Protection Officer at dpo@infrabel.be.
We are committed to protecting the privacy of our users and customers. The purpose of this Privacy Statement is therefore to inform you of how we collect, define and use information that could identify you, such as your name, e-mail address or other contact data, online identifiers such as IP address or any other information you provide to us when using our website. Consequently, please take the time to read this Privacy Statement carefully.
THIS PRIVACY STATEMENT CONTAINS A DESCRIPTION OF YOUR DATA PROTECTION RIGHTS, INCLUDING THE RIGHT TO OBJECT TO CERTAIN PROCESSING ACTIVITIES THAT WE PERFORM.
Applicable legislation
For the purposes of the Statement, the term “data protection legislation” refers to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (‘GDPR’), as well as any other legislation and/or regulations introduced on the basis of the GDPR and the ePrivacy Regulation, or which implement, amend, replace or consolidate these or one of them, and all other applicable legislation concerning the processing of personal data and privacy.
Definitions
| Third party | A natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data. |
| Personal data breach | A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed. |
| Recipient | A natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. |
| Personal data | Any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. |
| Privacy Shield | The EU-U.S. and Swiss-U.S. data protection legal framework conceived by the U.S. Department of Commerce, the European Commission, and the Swiss federal authorities to provide a mechanism for companies on both sides of the Atlantic to meet data protection requirements when transmitting personal data from the EU and Switzerland to the United States, in support of transatlantic trade. |
| Standard provisions | A range of standard provisions for transfers as adopted by the European Commission for the international transmission of personal data. |
| Supervisory Authority | The Belgian Data Protection Authority created by the Law of 3 December 2017 establishing the Data Protection Authority or, where appropriate, any other supervisory authority within the meaning of the GDPR, namely “an independent public authority that is provided for by a Member State pursuant to Article 51” (www.privacycommission.be). |
| Processing | Any operation or any series of operations carried out or not via automated processes and applied to data or series of data of a personal nature, such as the collection, recording, organisation, structuring, conservation, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of provision, rapprochement, or interconnection, limitation, deletion or destruction. |
| Processor | The natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. |
| Controller | The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law. |
Website visitors
When you visit the TUC RAIL website, we collect a number of personal data for the management and correct functioning of the website.
The table below shows the categories of data we process for these purposes, where your data comes from, the basis for this processing activity, and with whom we may share the data.
| Categories of data processed | Data source | Legal basis for processing | Data recipient |
| IP address | You, directly, when you visit the website | TUC RAIL, as a company, has a legitimate interest to be able to manage the website it provides. This interest of TUC RAIL weighs more than your legitimate interest. | IT service providers |
TUC RAIL aims to make your experience with the website as informative and relevant as possible. To do this, we use cookies and strive to protect your privacy, while at the same time providing a user-friendly online environment. If you would like to know more about how we use cookies, please read our cookie statement.
Newsletter and/or mailings
When TUC RAIL has received your contact details and you have not used the possibility to object to this type of data processing, we process your personal data in order to contact you from time to time, to provide you with information on TUC RAIL’s services and other information relevant to you. We do this in the context of our external relationship management.
If you no longer wish to receive the newsletter and/or mailing, you can always inform us at privacy@tucrail.be or by using the link provided in each newsletter and/or mailing you receive.
The table below shows the categories of data we process for these purposes, where your data comes from, the basis for this processing activity, and with whom we may share the data.
| Categories of data processed | Data source | Legal basis for processing | Data recipient |
| E-mail address, name, telephone number, occupation |
You, directly Infrabel |
Legitimate interest of TUC RAIL |
IT service providers Communication services |
When you contact us
Contact form
If you have a specific question or request, such as a request for an internship or general information or a question about our projects, activities, a job offer or a commercial contact or if you wish to communicate information to TUC RAIL, you can contact us using the contact form on our website. In this context, we process your personal data in order to manage the various requests for information, and in particular to answer your questions, to accept a given request or not, and to follow your responses.
The table below shows the categories of data we process for these purposes, where your data comes from, the basis for this processing activity, and with whom we may share the data.
| Categories of data processed | Data source | Legal basis for processing | Data recipient |
| Surname/first name, e-mail address, name, telephone number, occupation | You, directly, when you fill in the contact form | Ad hoc consent when you fill in the contact form |
IT service providers Communication services |
Email address
You can also contact us by sending an e-mail with a question, request, information or feedback, such as a question about a specific project or a request to use specific photos from our website for a publication. In this context, we process some of your personal data in order to manage the various requests, and in particular to answer your questions, to accept a given request or not and follow up your responses, and allow you to give feedback.
The table below shows the categories of data we process for these purposes, where your data comes from, the basis for this processing activity, and with whom we may share the data.
| Categories of data processed | Data source | Legal basis for processing | Data recipient |
| Email address, first name, last name and any other personal data you choose to share with us | You, directly, by email | Ad hoc consent when you send the e-mail |
IT service providers Communication services |
Social Media
We may process personal data which we obtain via social media platforms (including Facebook, Instagram, LinkedIn, YouTube, or Twitter) when something is linked or addressed to TUC RAIL to (i) be able to respond to questions or complaints in the first instance, (ii) safeguard our online reputation, and (iii) improve our services and identify any opportunities relevant to TUC RAIL.
Some of our social media web pages allow users to post their own content. Please keep in mind that content posted on our social media is publicly available and may be viewed by anyone. Consequently, it is best to be cautious about sharing certain personal information such as financial information or addresses on these platforms. We cannot be held responsible for any actions taken by others when you post personal information on one of our social media platforms, such as Facebook. We also refer to the respective privacy and cookie statements of any platforms you use.
The table below shows the categories of data we process for these purposes, where your data comes from, the basis for this processing activity, and with whom we may share the data.
| Categories of data processed | Data source | Legal basis for processing | Data recipient |
| Any personal data you choose to share with us or post on social media | You, directly, when you post on publicly accessible pages on social media | TUC RAIL, as a company, has a legitimate interest in processing personal data that you have chosen to send to us or that you have made public on social media platforms, with a view to improving services and identifying business opportunities. These interests of TUC RAIL weigh more than your legitimate interests. |
IT service providers HR Services |
Jobs
Vacancies
When you apply for one of the vacancies for permanent or temporary employment at TUC RAIL on the website, we process your personal data for the purpose of administration and management of (future) staff and intermediaries. In this regard, you always have the possibility to modify your data through your account on our website.
The table below shows the categories of data we process for these purposes, where your data comes from, the basis for this processing activity, and with whom we may share the data.
| Categories of data processed | Data source | Legal basis for processing | Data recipient |
| Surname/ first name, sex, date of birth, street and number, country, post code, municipality, photo, telephone number, e-mail address, professional experience, level of education, CV and cover letter, back-up telephone number, back-up e-mail address, reference (personal data of third parties) | You, directly, when you apply | Ad hoc consent when you apply |
IT service providers HR Services |
E-mail address or phone number for job offers
If you wish to apply for a job at TUC RAIL and you do not immediately find a suitable vacancy or if you have a question regarding a vacancy, you can always contact us directly at the e-mail address or telephone number provided.
The table below shows the categories of data we process for these purposes, where your data comes from, the basis for this processing activity, and with whom we may share the data.
| Categories of data processed | Data source | Legal basis for processing | Data recipient |
| Surname/ first name, sex, date of birth, street and number, country, post code, municipality, photo, telephone number, e-mail address, professional experience, level of education, CV and cover letter, back-up telephone number, back-up e-mail address, reference (personal data of third parties) | You, directly, in your e-mail or during your phone call | Ad hoc consent when you apply |
IT service providers HR Services |
Physical visitors to TUC RAIL premises
We request visitors to TUC RAIL premises to provide certain personal data. We process these personal data in order to control access to the premises and therefore guarantee security.
The table below shows the categories of data we process for these purposes, where your data comes from, the basis for this processing activity, and with whom we may share the data.
| Categories of data processed | Data source | Legal basis for processing | Data recipient |
| E-mail address, surname/first name, identification number (different from the national register number), telephone number, occupation | You, directly, when you enter the premises | TUC RAIL, as a company, has a legitimate interest in ensuring the physical security of its premises. This interest of TUC RAIL weighs more than your legitimate interest. |
IT service providers Reception service providers |
What are your rights?
Once you have provided us with your personal data, you have various rights under the data protection legislation. Except for legal exceptions, you can in principle exercise them without cost. These rights may be limited, for example, when fulfilling a request would disclose another person’s personal data, or when you ask us to delete information that we are required by law to retain or that we retain based on our justified interests.
In order to exercise your rights, you need to send a request to the e-mail address privacy@tucrail.be.
If you still have unresolved concerns, you always have the right to file a complaint with the Supervisory Authority. Of course, we encourage you to contact us in the first instance, but to the extent that this right applies to you, you are entitled to complain directly to the Supervisory Authority.
- Right to withdraw your consent
For all elements for which we rely on your consent, you can decide at any time, and on your own initiative, to withdraw this consent by contacting us here. Withdrawing your consent will not affect the legal basis of the processing based on your consent prior to such withdrawal.
- Right to consult and rectify your data
You have the right to consult, review and rectify your personal data. You may request a copy of your data in order to review and/or rectify it. If you wish to rectify data such as your name, email address, address and/or any other data or preferences, you can easily do this, regarding your application for a job, by logging into your account on our website (if you have an account). Otherwise, you can contact us here. Furthermore, you can request a copy of the personal data we process, as described in this Privacy Statement.
- Right to have your data deleted
In accordance with data protection legislation, you have the right to have your personal data, that we process, as described in this Privacy Statement, deleted if it is no longer necessary for the purposes for which it was originally collected or processed, if you have withdrawn your consent, or if you have objected to a processing operation described in this Privacy Statement, and there is no other basis for the processing. If you wish to have your personal data deleted, you can submit a request here [].
- Right to restrict processing
In certain circumstances set out in the data protection legislation, you can request that we restrict the processing of your personal data. This is the case for example when you dispute the accuracy of your personal data. In such a situation, we will limit the processing until we are able to verify the accuracy of your data.
- Right to object to the processing
In certain circumstances set out in the data protection legislation, you can object to the processing of your personal data, in particular when the data are processed for marketing purposes.
- Right to data portability
Where the processing of your personal data is done via automated processes and is based on your consent, or pursuant to a contract between you and us, you have the right to receive the personal data processed with respect to you in a structured, commonly used and machine-readable format, and to transmit it to another service provider.
Security measures
We have taken appropriate organisational and technical measures to ensure an adequate level of security for your personal data. These measures include (but are not limited to) encryption techniques, physical and IT-related access controls, and privacy obligations.
If personal data is compromised following a personal data breach, and where such a breach is likely to involve a high risk to the rights and freedoms of individuals, we will make the necessary disclosures as required by data protection legislation.
Which rules apply for children?
We specifically do not collect personal data from persons under 16 years of age, nor do we ever request such data.
If we become aware that we have collected personal data from a minor under the age of 16 without verification of parental consent, we will take steps to delete this information as soon as possible. If you believe we have or may have information from/regarding a minor under the age of 16, please contact us at privacy@tucrail.be.
How is your personal data shared with third parties?
We only share and disclose information, including to third parties, as described in this Privacy Statement.
Moreover, your personal data will be shared with public authorities and/or police officers when this is necessary for the purposes described above or for the legal protection of the legitimate interest of the data controller, in accordance with the applicable legislation, and when required by law.
Is your personal data transferred outside the EEA?
For the purposes set out in this Privacy Statement, your personal data will be stored in the European Economic Area (“EEA“) and will only be transferred outside the EEA to a country or countries that have been recognised by the European Commission as offering an adequate level of data protection.
If your data is nevertheless transmitted to or stored in a country outside the EEA that has not been recognised as offering an adequate level of protection, TUC RAIL will take appropriate security measures to ensure that the sending of such data complies with the requirements of the data protection legislation. This is possible either by imposing standard provisions approved by the European Commission or, if data is sent to the United States, by ensuring that such data is sent to a company that meets the requirements of the Data Protection Shield.
You can find additional information on how we always ensure an adequate level of protection when processing your personal data at the following websites:
- When using the standard provisions: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contracts-transfer-personal-data-third-countries_en
- With certification via the Privacy Shield: https://www.privacyshield.gov/welcome
If you would like to receive further information about how Infrabel applies the above protections when processing your personal data, you can contact us at privacy@tucrail.be
For how long do we store your personal data?
We store your personal data for as long as necessary to carry out the processing activities set out in this Privacy Statement, for as long as otherwise communicated to you, or as long as permitted by applicable law.
Does this Privacy Statement apply to third party websites?
When you click on a link from a third party website, you will be directed to a website over which we have no control, and our Privacy Statement will no longer apply. Your browsing activity and interactions on any other website are subject to the terms of use and privacy and other privacy statements of such third-party websites. We recommend that you carefully read the privacy statements of other websites. We are not responsible for the information or content of third party websites.
What happens if we change this Privacy Statement?
TUC RAIL reserves the right to update and/or modify this Privacy Statement from time to time. We will inform you if it results in a fundamental change to the processing, or if the changes are relevant to the nature of the processing or relevant to you and affect your data protection rights.
How to contact us?
Any questions, requests, comments or complaints regarding this Privacy Statement are always welcome and can be addressed to: privacy@tucrail.be.
As a subsidiary of Infrabel, TUC RAIL relies on the services of Infrabel’s Data Protection Officer (DPO). For more information, you can always contact the latter at dpo@infrabel.be.