EU Belgian–Albanian Chamber of Commerce and Industry (EUBACCI)
The EU Belgian–Albanian Chamber of Commerce and Industry (“EUBACCI”, “we”, “our”, “us”) is committed to protecting your personal data and respecting your privacy.
This Privacy Notice (“Notice”), together with our Terms of Use and Cookies Policy, explains:
what personal data we collect about you,
how and why we use it,
on what legal bases,
with whom we share it,
how long we keep it, and
what rights you have under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Belgian law.
By “personal data”, we mean any information relating to an identified or identifiable natural person.
1. Who is responsible for your personal data?
The data controller is:
EU–Belgian–Albanian Chamber of Commerce and Industry (EUBACCI)
Form: Association sans but lucratif (ASBL)
Registered office: Rue des Colonies 11, 1000 Brussels, Belgium
Company number: (to be inserted once you have it)
EUBACCI determines the purposes and means of processing your personal data, in accordance with the Code des sociétés et des associations and its Statutes.
In some cases (for example, joint events with partner chambers or institutions), we may act as joint controllers with those partners. Where required, we will make this clear in the specific event notice or registration form.
2. Contact for privacy matters (no DPO)
EUBACCI is not required to appoint a Data Protection Officer under Article 37 GDPR (we are not a public authority, we do not carry out large-scale regular monitoring, and we do not process special categories of data on a large scale).
However, for any question, request or concern regarding this Notice or our processing of your personal data, you can contact:
📧 privacy@eubacci.com
📨 EU–Belgian–Albanian Chamber of Commerce and Industry (EUBACCI)
Rue des Colonies 11, 1000 Brussels, Belgium
Supervisory authority in Belgium:
Autorité de Protection des Données / Gegevensbeschermingsautoriteit
3. Categories of personal data we collect
Depending on your relationship with us (member, contact, partner, supplier, speaker, visitor, etc.), we may collect and process the following categories of data:
3.1 Identity & Contact Data
Name, title, gender
Professional or personal address
Email address, telephone number(s)
Organisation, position, department
Nationality, country of residence (when relevant to our activities)
3.2 Membership & Governance Data
Membership category (adherent, effective, honorary, etc.)
Membership applications, references, committee participation
Roles within EUBACCI (board member, committee member, speaker, mentor)
Records of attendance at General Assemblies or internal meetings
3.3 Financial & Payment Data
Stripe account details (for membership fees, reimbursements, payments)
Payment history, invoices, receipts
Information necessary for accounting and legal archiving obligations
3.4 Business & Professional Data
Information about your company or organisation
Professional background and sector of activity
Areas of interest (e.g. trade, innovation, EU programmes, specific industries)
Information related to cooperation projects, events, delegations, working groups
3.5 Event & Communication Data
Registrations for events, missions, trainings, webinars
Dietary / accessibility needs (e.g. vegetarian, allergies, mobility assistance)
Communication preferences (newsletter, invitations, language)
Feedback and surveys related to our events and services
3.6 Website, Technical & Usage Data
Collected when you visit our website or use our online tools:
IP address, browser type and version, device type
Time zone setting, operating system, platform
Pages visited, clickstream, forms submitted
Cookies and similar technologies (see our Cookies Policy)
3.7 Limited Special Categories of Data
We do not seek to collect sensitive data about you (e.g. health, political opinions, religious beliefs), except where you choose to provide it or where it is strictly necessary for a specific purpose, for example:
dietary or health-related information for event catering and accessibility;
information required for due diligence or sanctions screening in limited cases.
In such situations, we will rely on the relevant GDPR legal bases (e.g. explicit consent, or the necessity to establish, exercise or defend legal claims, or substantial public interest where applicable).
4. How we obtain your personal data
We may collect your personal data:
Directly from you, for example:
when you become a member of EUBACCI,
when you register for an event, mission, delegation or training,
when you subscribe to our mailing lists or newsletters,
when you contact us by email, phone, or via forms on our website,
when you apply for a role, traineeship or collaboration.
From your organisation or a third party, for example:
your employer or organisation registers you as a contact or delegate,
partner chambers, institutions or event organisers share participant lists,
public sources (company registers, LinkedIn, official websites),
funding or cooperation partners (e.g. EU projects where we are a partner).
Automatically, when you browse our website:
via cookies and similar technologies (analytics, preferences, etc.),
via our IT systems’ security and access logs.
We do not use systematic CCTV or body-worn cameras as part of normal operations. If this ever changes (e.g. security arrangements for a high-level event), we will provide clear and specific information at that time.
5. Purposes and legal bases for processing
We always process your personal data on one or more lawful bases under Article 6 GDPR (and Article 9 for any special categories).
5.1 To manage membership and the association (contract & legal obligation)
Purposes:
Processing membership applications and renewals
Maintaining the statutory register of members
Inviting you to and organising General Assemblies
Managing membership fees and accounting
Complying with obligations under Belgian non-profit and accounting law
Legal bases:
Performance of a contract or pre-contractual measures – Art. 6(1)(b) GDPR
Compliance with legal obligations (CSA, tax, accounting) – Art. 6(1)(c) GDPR
5.2 To organise and manage events, missions and activities (contract & legitimate interests)
Purposes:
Registration and participation in events, delegations, seminars, webinars
Preparing participant lists, badges, attendance lists
Coordinating speakers, sponsors, and partners
Collecting feedback to improve future activities
Legal bases:
Performance of a contract (your event registration) – Art. 6(1)(b)
Our legitimate interest in organising and promoting our activities – Art. 6(1)(f)
Where we process health-related information (e.g. allergies, accessibility), we rely on:
your explicit consent – Art. 9(2)(a), or
vital interests in exceptional cases – Art. 9(2)(c).
5.3 Communication, newsletters and marketing (consent & legitimate interests)
Purposes:
Sending newsletters, updates, invitations, and information about EUBACCI,
Informing you about opportunities, programmes, calls, and initiatives related to our mission,
Managing mailing lists and communication preferences.
Legal bases:
Your consent for electronic direct marketing where required – Art. 6(1)(a)
Our legitimate interests in promoting our activities and maintaining a network – Art. 6(1)(f)
You can withdraw your consent or unsubscribe at any time (see section 10).
5.4 Website operation, security and analytics (legitimate interests & consent)
Purposes:
Ensuring the technical functioning and security of our website and IT systems
Detecting and preventing misuse, fraud or cyber-attacks
Using analytics to understand how the site is used and improve content
Legal bases:
Our legitimate interests in running a secure and user-friendly website – Art. 6(1)(f)
Your consent for non-essential/analytics cookies – Art. 6(1)(a)
See our Cookies Policy for details.
5.5 Compliance, risk management and disputes (legal obligation & legitimate interests)
Purposes:
Compliance with Belgian and EU laws (e.g. accounting, sanctions-related checks in specific cases, grant or project audit requirements)
Responding to requests from authorities or courts
Establishing, exercising or defending legal claims
Legal bases:
Legal obligation – Art. 6(1)(c)
Legitimate interests in protecting our rights and ensuring good governance – Art. 6(1)(f)
For any sensitive data: Art. 9(2)(f) (legal claims) where applicable.
5.6 Recruitment and traineeships
Purposes:
Processing applications for jobs, internships, or volunteer roles
Assessing qualifications and suitability
Managing recruitment communications
Legal bases:
Pre-contractual measures – Art. 6(1)(b)
Legitimate interests in selecting appropriate candidates – Art. 6(1)(f)
6. What happens if you do not provide certain data?
In some cases, the provision of your personal data is:
necessary to enter into or perform a contract with you (e.g. membership, event registration), or
required by law (e.g. accounting records).
If you do not provide the data we request, we may be unable to:
accept you as a member or contact,
allow you to participate in an event,
process your payment or provide a requested service.
We will always indicate clearly when data is mandatory.
7. Who we share your personal data with
We may share your personal data, on a “need to know” basis, with:
Service providers (processors):
IT and hosting providers
Emailing and event management tools
Payment and accounting service providers
External consultants supporting our activities
Partner organisations and institutions:
other chambers of commerce, business associations, EU institutions, embassies or trade agencies involved in a given event or project, where necessary and proportionate.
Professional advisors:
lawyers, accountants, auditors, insurance providers, where required.
Public authorities and regulators:
when required by law, court order, or at the request of a competent authority.
In all cases where third parties act as processors, they are bound by contracts that meet GDPR requirements and must process your data only on our documented instructions.
We do not sell your personal data.
8. International transfers
Some of our providers or partners may be located outside the European Economic Area (EEA) or may store data on servers outside the EEA.
Where such transfers occur, we ensure that:
the country has an adequacy decision from the European Commission, or
appropriate safeguards are in place (e.g. Standard Contractual Clauses, additional security measures) in accordance with Articles 44–49 GDPR.
You may request more information on these safeguards by contacting us at privacy@eubacci.eu.
9. How long we keep your data (retention)
We keep your personal data only for as long as necessary for the purposes described above, and to comply with legal, accounting, or reporting obligations.
Indicative retention periods (which may be adapted over time):
Membership data: for the duration of membership and typically up to 10 years after the end of the financial year of termination, to comply with legal and accounting obligations.
Event data: typically up to 3 years after the event (longer if needed for project or grant reporting).
Newsletters / communications: until you unsubscribe or we consider you inactive for a reasonable period.
Accounting records (invoices, payments): as required by Belgian law (generally 7–10 years).
Recruitment data (unsuccessful applicants): normally up to 6–12 months, unless you agree to a longer period or law requires otherwise.
After expiry of the applicable period, we will either delete your data or irreversibly anonymise it.
10. Security of your personal data
We take appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.
These measures include, as appropriate:
access controls and authentication,
secure communication channels,
regular backups and logging,
contractual confidentiality obligations.
No system can be guaranteed 100% secure, but we continuously work to maintain a level of security appropriate to the risks.
11. Your rights under GDPR
You have the following rights in relation to your personal data, subject to the conditions and limitations of GDPR and national law:
Right of access – to obtain confirmation whether we process your data and a copy of that data.
Right to rectification – to correct inaccurate or incomplete data.
Right to erasure (“right to be forgotten”) – in certain cases, to have your data deleted.
Right to restriction of processing – in certain circumstances, to limit our use of your data.
Right to data portability – to receive the data you provided in a structured, commonly used, machine-readable format and transmit it to another controller where the processing is based on consent or contract and carried out by automated means.
Right to object –
to processing based on our legitimate interests, on grounds relating to your particular situation;
at any time, to processing for direct marketing (including profiling related to such marketing).
Right to withdraw consent – where processing is based on your consent, you may withdraw it at any time; this will not affect previous lawful processing.
Right to lodge a complaint – with the Belgian Data Protection Authority or another competent supervisory authority in the EU where you live or work.
12. How to exercise your rights
You may exercise your rights by contacting us at:
📧 privacy@eubacci.com
We may ask you for additional information to confirm your identity where necessary and will respond within the time limits set by GDPR (generally one month, extendable in complex cases).
You also have the right to lodge a complaint with:
Autorité de Protection des Données / Gegevensbeschermingsautoriteit
(Belgian Data Protection Authority)
13. Changes to this Privacy Notice
We may update this Notice from time to time, for example to reflect:
changes in our activities,
new legal or regulatory requirements,
guidance from supervisory authorities.
The most recent version will always be available on our website. Significant changes may be notified to you by email or via our usual communication channels.