Privacy statement for volunteers

Who are we?

This privacy statement is issued by Flanders Classics NV, Harensesteenweg 228, 1800 Vilvoorde, registered with the Crossroads Bank for Enterprises under number 0818.388.802. It applies to everyone who volunteers at our events: volunteers, members of volunteer groups and their contact persons. We process this data through our volunteer platform Crewdesk.

Your volunteer agreement (your volunteer contract) and expense allowance are issued in the name of the company or non-profit organisation that organises the event; this organisation is stated at the top of your agreement. That organisation is also responsible for these contracts and allowances.

If you visit our websites, purchase tickets or participate in a race, the general privacy statement at www.flandersclassics.be applies.

Contact: privacy@flandersclassics.be. If you have a question about a specific event, you can also contact the volunteer coordinator for that event.

What data do we process?

About you:

• Identity: first name, surname, date of birth, nationality.
• Contact: email address, mobile or telephone number, preferred language.
• Address: street, house number, box/unit number, postal code, municipality, country.
• National Register number: only if you live in Belgium or have Belgian nationality.
• Bank account number (IBAN): for your expense allowance.
• Profile: professional status, T-shirt size, languages, preferences for tasks, disciplines and regions, previous experience, your comments.
• Consent: what consent you gave, when, using which wording and from which IP address.

About your participation, provided by you and the organisation:

• Planning: your availability, shifts, tasks, locations and confirmations.
• At the event: your attendance at check-in, equipment issued to you, kilometres travelled.
• Contract: your volunteer agreement, your signature (signed or typed), the date, IP address and browser used when signing, and a verification code; or a scan of the paper version.
• Allowance: amounts, payment date and the bank account number at the time of payment.
• Requests from authorities: whether you gave consent or objected, together with your comments.
• Internal notes: practical notes from the organisation about your participation.

Automatically:

• Emails: which emails we sent you and whether they were delivered.
• Technical: your IP address and browser when you use Crewdesk, in order to prevent misuse. Crewdesk only uses necessary cookies (to keep you logged in), and no advertising or analytics cookies.

Groups. A group (association, club) provides, through its person in charge, the name, nationality and, where applicable, the telephone number and National Register number of its members. That person is responsible for informing the members about this statement.

Photos, videos and cameras. Photos and videos are taken at our events, and CCTV may sometimes be used (with appropriate signage). You can read more about how we handle this below under “Photos and videos”.

We do not request health data, information about your religion or political views, or a copy of your identity card.

Why do we use your data, and on what basis?

• To manage your registration and volunteer profile and invite you to future events. Data: identity, contact details, address, profile. Basis: the agreement (you register as a volunteer) and our legitimate interest in maintaining a volunteer database for future editions.
• To request availability, plan, confirm, brief, manage check-in and equipment. Data: contact details, profile, participation. Basis: performance of the agreement.
• To prepare and have you sign your volunteer agreement and to insure you. Data: identity, address, National Register number, participation, contract. Basis: legal obligation (Act of 3 July 2005 on the rights of volunteers: information obligation and insurance) and the agreement.
• To pay and account for your expense allowance. Data: identity, bank account number, allowance, contract. Basis: legal obligation (accounting, maximum volunteer allowance amounts) and the agreement.
• To provide a list of race marshals to the authorities. Data: surname, first name, date of birth, nationality, contact details, your post or junction, and your National Register number if required by the municipality as part of the permit. Basis: legal obligation (Royal Decree of 28 June 2019 and Circular OOP 45) and the municipal permit. You will be informed in advance and may object.
• To carry out a security screening by the police at major events. Data: surname, first name, National Register number. Basis: the Act of 11 December 1998 and your explicit consent, for each request.
• Emails about your participation (invitation, planning, contract, briefing). Basis: performance of the agreement.
• Photos and videos at events. Basis: our legitimate interest (see “Photos and videos”).
• Security and monitoring: keeping track of who accessed sensitive data and detecting misuse. Basis: our legitimate interest and our legal obligation to secure data.

About your National Register number. This may only be used where permitted or required by law. We only request it from people who live in Belgium or have Belgian nationality, and use it solely for your volunteer agreement and insurance, for a list of race marshals if required by a municipality as part of the permit, and for a police security screening with your consent. We never disclose it for any other purpose. If a list containing your National Register number is provided to an authority, you will see in advance who is requesting it, why, and how long it will be retained.

Consent is not the legal basis for your contract and allowance: without this data, we cannot enter into a contract with you or reimburse you. We only ask for consent where you genuinely have a free choice, such as for police security screening.

Who receives your data?

Within the organisation, not everyone can see everything:

• Flanders Classics administrators and event managers: your full profile, contract and allowance. Your full National Register number and bank account number only where necessary; every access is logged.
• Team leaders and readers: your name, contact details, planning and attendance; not your address, date of birth, National Register number, bank account number or contract.
• The accounting department of the organising company (colleagues or an external accounting firm): solely for payments made by that company, your name, amount, bank account number and signed contract. Each accountant logs in using their own account.
• The person responsible for your group: the data of the members of their own group, for the planning of that group.

Outside the organisation, only where necessary:

• Authorities (police, municipality): only at their request, per event, and only the data they request. Each request is recorded together with its legal basis.
• Our bank: your name, bank account number and amount, in order to pay your allowance.
• Basecone (accounting software): payment lists and signed contracts, for accounting purposes.
• Our insurer: the data required in the event of an accident or claim.

Companies that enable Crewdesk to operate technically, under a data processing agreement:

• Supabase: database, documents and authentication, within the EU (Frankfurt).
• Vercel: hosting of the application, on servers in the EU (Frankfurt).
• Microsoft: authentication for Flanders Classics employees (not volunteers).

We do not sell your data and do not share volunteer data with sponsors or partners.

How do we protect your data?

• Your National Register number and bank account number are encrypted in the database. By default, employees only see the last four digits; anyone requesting access to the full number is recorded in a log.
• Role-based access: each employee can only see what is necessary for their role. Anyone who no longer works with us immediately loses access.
• Login: employees use their Microsoft account with two-factor authentication; external accountants use a code sent by email and an app. Sessions expire after 4 hours of inactivity and no later than after 7 days.
• Personal links in our emails (profile, signing your contract, planning) remain valid for 30 days and never display your National Register number or bank account number in full. The organisation can revoke these links.
• Your data is stored in the EU (Frankfurt).

Do not forward an email containing a personal link: anyone who has the link can view and modify your data.

How long do we keep your data?

Crewdesk automatically deletes or anonymises data every night.

• Your profile (name, contact details, address, preferences): for as long as you are active. After 24 months without participation, your profile is anonymised.
• Your bank account number in your profile: deleted after 2 years without participation, unless a payment is still outstanding.
• Your National Register number in your profile: deleted 7 years after your last contract.
• Volunteer agreements, signatures, allowances and the bank account number at the time of payment: 7 years (statutory accounting retention requirement).
• Lists of race marshals and other requests from authorities: until the deletion date of the request: 6 months after the race for race marshals, shortly after the result for police security screening. After that, only information about who made the request, why and for how many people is retained, without names.
• Content of emails we sent you: 90 days. Sending data (recipient, date, delivery status): 2 years.
• Log of access to sensitive data: 2 years. Payment log: 7 years.
• Photos and videos: for as long as they are used to promote the event and future editions.

Photos and videos

During our events, photos, videos and other visual material are created, including images of volunteers at work. We have a legitimate interest in using this material to promote and convey the atmosphere of the event and future editions (website, social media, brochures, posters) and to share it with affiliated companies, partners and sponsors. If you are the main subject of a photo or video, you can request its removal up to 6 weeks after the event: email privacy@flandersclassics.be with your name, the event and the relevant photo or video. We may ask you to provide proof of your identity.

Your rights

You can manage many things yourself via the “My data” link in our emails:

• Access: you can see what data we hold about you. Your National Register number and bank account number are only shown with the last four digits; you can request the full number via privacy@flandersclassics.be.
• Correction: update your data yourself via your profile link. If you leave the National Register number or bank account number field blank, the existing number will remain unchanged.
• Data portability: download your data as a file.
• Deletion: request this via “My data” or privacy@flandersclassics.be. We will respond within one month. Data that we are legally required to retain (contracts and allowances, 7 years) will only be deleted after that period.
• Objection: you can object to processing based on our legitimate interest (for example, the volunteer database or photos) and to inclusion on a list for a municipality, via the link in the email or privacy@flandersclassics.be.
• Withdrawal of consent: where we asked for your consent, such as for police security screening, you can withdraw it via privacy@flandersclassics.be. Processing that has already taken place remains lawful.
• Restriction of processing: via privacy@flandersclassics.be.

To protect you, we may ask you to confirm your identity.

Minors

Some tasks have a minimum age requirement; the organisation is alerted if someone is too young. A minor volunteer signs the volunteer agreement together with a parent or guardian.

Changes and complaints

If anything changes in how we use your data, we will update this statement and show you the new version when you next register and via your profile link.

If you are not satisfied with how we handle your data, please contact us at privacy@flandersclassics.be. You can also lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be.