Personal data protection policy

1. Who is the data controller and who is the data protection officer?

The office NOTILIUS, Associated Notaries processes personal data as part of its activities.

NOTILIUS, Associated Notaries located on the Boulevard du Souverain 288, 1160 Auderghemwith the company number  1021.161.659 acts as data controller for the processing of personal data carried out within the study (hereinafter referred to as "the study"). The data controller is the natural or legal person who determines the purposes and means of the processing of personal data.

The firm is committed to protecting your privacy. It undertakes to protect and process your personal data with particular care and transparency, in strict compliance with privacy protection legislation, in particular the General Data Protection Regulation (EU) 2016/679 (hereinafter "GDPR") and the Code of Conduct of the National Chamber of Notaries of 28 January 2021 specifying certain procedures for the application of the General Data Protection Regulation (EU) 2016/679 (GDPR) for notaries (hereinafter "Code of Conduct").

In accordance with the RGPD and the Code of Conduct, the firm has appointed a Data Protection Officer, namely Privanot ASBL. The Data Protection Officer can be contacted at the following e-mail address: info@privanot.beor by letter to the following address Privanot asbl, Rue de la Montagne 30, 1000 Brussels.

By means of this personal data protection policy, we would like to explain to you more about how we handle the personal data we hold. This policy provides answers to the following questions:

• Who is the data controller and who is the data protection officer?
• Why is your personal data processed?
• What is the legal basis for processing your personal data?
• What personal data is processed by the study?
• What are the sources of information?
• To whom may your personal data be communicated?
• Who are the study's subcontractors?
• Will your personal data be transferred outside the European Economic Area (EEA)?
• How long will your personal data be kept?
• How are the security and confidentiality of your personal data ensured?
• What are your rights?

Please note that information relating to the processing of personal data of internal employees in the context of human resources is contained in the firm's employment regulations. Information on the processing of personal data of external employees in the context of human resources is contained in specific documents, such as service contracts or general policy documents.

2. Why is your personal data processed?

Goals - The firm collects and processes personal data for the main purpose of ensuring the legal security of transactions whose authenticity the notary guarantees, and for the management of files entrusted to the notary.

In addition, processing operations are necessary to achieve other important tasks and objectives, namely :

• management of the firm's files, including processing carried out before and after the execution of an authentic instrument, such as the necessary searches and verifications, as well as any other processing required to fulfil the notary's duties as a public official and the missions entrusted to him by the public;
• administrative management and monitoring of citizens' files, including invoicing and accounting ;
• carry out the necessary checks and controls in accordance with legislation on the fight against money laundering;
• optimise navigation on the website through the use of cookies;

3. What is the legal basis for processing your personal data?

Legality - The processing of personal data by a notary is considered lawful where it is, in most cases, necessary to comply with a legal obligation to which the notary is subject or necessary for the performance of a task in the public interest entrusted to the notary in charge of the case within the firm.

The processing of personal data is carried out by the study on the basis of, but not limited to, the following legislation:

• The law of 25 Ventôse An XI containing the organisation of the notarial profession ;
• The Act of 18 September 2017 on the prevention of money laundering and terrorist financing and limiting the use of cash.

Finally, the lawfulness of the processing may be based on the consent of the data subject, for example when non-functional cookies are used on the study website.

4. What personal data is processed by the study?

Depending on the services you use, the study may process the following personal data:

• identification data (surname, first name, civil status, national register number, place and date of birth, etc.);
• contact details (postal address, e-mail address, telephone number, etc.);
• economic and financial data (bank account number, etc.) ;
• data relating to legal capacity ;
• data relating to professional activity ;
• data relating to acts carried out within the firm ;
• data relating to your family, social, tax or other circumstances that the notary must collect from official sources and administrations concerning you;
• data resulting from AML due diligence obligations, such as national and international financial sanctions lists, PEP status, and adverse information from public sources concerning offences underlying money laundering, countries presenting a high AML risk or considered to be tax havens, and judicial data).

5. What are the sources of information?

As a public official, the notary is required to collect and use personal data about you in order to carry out his activities.

Your personal data will come from :

• yourself or your legal representative ;
• authentic data sources strictly regulated by specific legislation, such as the National Register, the Crossroads Bank of Social Security, the Central Inheritance Register, the Central Register of Cohabitation and Marriage Contracts, etc. ;
• official bodies authorised to supply data to notaries in the course of their public duties;
• the tool
  the National Chamber of Notaries’ AML screening programme.

6. To whom may your personal data be communicated?

The personal data processed by the study may be communicated to third parties ("recipients"), depending on the context of the processing, and in particular :

• legally authorised partners, such as public services and notarial institutionsfor storing transcripts of deeds and their metadata as part of electronic registration and for entering your data in the central registers of the notarial profession (e.g. the Central Register of Marriage Contracts, the Central Register of Power of Attorney Contracts, the Central Register of Declarations concerning the appointment of a trustee or a person of trust, etc.);
• to the Royal Federation of Belgian Notaries asblThe purpose of this database is to generate statistics and to enable notaries to estimate the value of real estate in the exercise of their functions;
• to the Provincial Chamber of Notaries concerned by your case and/or the National Chamber of Notaries (e.g. as part of their accounting control duties or as part of the prevention of and fight against money laundering) ;
• at other notaries involved in your case (e.g. as part of a property sale deed);
• at State archives for the conservation of files, minutes and wills;
• at banks involved in your case ;
• to thechartered accountant/tax specialist who manages the firm's accounts;
• at subcontractors for the management and continuity of the study, such as the software suppliers for the preparation of documents;
• to the Financial Intelligence Unit (CTIF), for example in the context of preventing and combating money laundering; ;
  to the judicial authorities, for example in the context of preventing and combating money laundering; ;
  to the authorities involved in national and international cooperation in the prevention and combating of money-laundering practices.

7. Who are the study's subcontractors?

A processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the study.

The study uses the following categories of subcontractors in particular:

• hardware supplier ;
• software suppliers, for example for records management and accounting;
• server/back-up provider ;
• Consultant or external collaborator ;

8. Will your personal data be transferred outside the European Economic Area (EEA)? 

In principle, your personal data will not be transferred outside the European Economic Area (hereinafter "EEA").

However, in the event that your personal data is nevertheless transferred to countries outside the EEA and the European Commission has considered that the country to which the data is transferred does not offer an adequate level of protection, the study will endeavour to protect your personal data by providing additional guarantees (for example, by entering into standard contractual clauses approved by the European Commission, adopting binding corporate rules, etc.).

9. How long will your personal data be kept?

In accordance with the principle of limiting the storage of personal data, the above-mentioned data may only be stored for as long as is necessary to achieve the intended purpose, in accordance with the laws specifically applicable and the limitation periods for commercial and personal claims. The retention periods below correspond to the retention periods indicated in the study's register of processing activities.

Retention periods vary according to the nature of the documents concerned:

• citizens' client files will be kept for as long as the citizen has not chosen to change notary, and will be kept for a maximum of the citizen's entire lifetime to enable the provision of advisory services (in accordance with article 9 of the Ventôse An XI law containing the organisation of the notarial profession);
• files are kept for 50 years following their closure for evidential purposes (in accordance with article 3.27 of the new Civil Code);
• the minutes are kept for 75 years after the signing of the deed and will then be transferred to the State archives (in accordance with article 62 of the Ventôse An XI law on the organisation of the notarial profession);
• the books (accounts) are kept for 10 years after the end of the financial year (in accordance with article 33 of the Ventôse An XI law on the organisation of the notarial profession);
• account statements are kept for 10 years after the end of the financial year concerned (in accordance with article 33 of the Ventôse An XI law on the organisation of the notarial profession);
• personal data covered by the Money Laundering Act shall be deleted after a retention period of 10 years (in accordance with Articles 60 and 62(1) of the Act of 18 September 2017 on the prevention of money laundering and terrorist financing and the restriction of the use of cash) ;
• Personal data processed for the management of the website is kept for as long as is necessary to achieve the intended purpose;

10. How are the security and confidentiality of your personal data guaranteed?

The firm shall take appropriate technical and organisational measures to ensure a level of security appropriate to the risk. In addition, the firm shall ensure that it adopts the security measures for the processing of personal data set out in the Code of Conduct of the Chambre nationale des notaires of 28 January 2021.

Security measures are taken to prevent the loss, destruction, alteration, unauthorised disclosure of or access to personal data transmitted, stored or otherwise processed.

The notary's office ensures in particular that :

• access to premises containing data media is restricted to authorised persons;
• the server environment is properly secured;
• personal data is stored and destroyed securely;
• employees and subcontractors are provided with secure access to the data required to achieve the intended purpose;
• a personal data breach notification procedure applicable to all members of the study is put in place;
• a procedure for managing the rights of data subjects applicable to all members of the study is put in place;
• an information security policy accessible to all members of the study is put in place;
• there is an awareness of the RGPD for the members of the study;
• technical security measures, such as firewalls, anti-virus software and regular security updates, are applied.

These measures are regularly monitored and revised by the aforementioned DPO following an audit.

In accordance with Article 28 of the RGPD and Article 2 of the Code of Ethics of the National Chamber of Notaries of 28 January 2021, the firm has signed a subcontracting agreement with the various subcontractors it uses.

11. What are your rights?

Under the RGPD, you have a number of rights as a person affected by the processing of your personal data by the study.

Thus, depending on the circumstances and subject to compliance with its legal obligations and the fulfilment of its public interest missions by the data controller, you have the following rights:

• Right to information You have the right to know, among other things, what personal data the study processes about you, for what purposes, how long it is kept, etc. ;
• Right of access You have the right to consult and obtain communication of your personal data held and processed by the firm;
• Right of rectification You have the right to obtain rectification of inaccurate or incomplete personal data concerning you;
• Right to erasure You have the right to request the destruction of your personal data processed by the firm;
• Right to restrict processing You have the right to restrict the processing of your personal data, for example if you dispute the accuracy of the data;
• Right to data portability You have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit them to a third party;
• Right to object You have the right to object to the processing of your personal data by the notary's office.

You can exercise your rights directly with the firm by e-mail info@notilius.be or by letter Boulevard du Souverain 288, 1160 Auderghem or contact the Data Protection Officer by e-mail info@privanot.be.

Finally, if you feel that your rights are not being respected in accordance with the RGPD, you are entitled to lodge a complaint with the Data Protection Authority (rue de la Presse 35, 1000 Brussels or via their website https://www.autoriteprotectiondonnees.be/).