Privacy

Ecorys Global Privacy Notice

This is the privacy statement of Ecorys, representing Ecorys Netherlands, Ecorys UK Ltd, Ecorys B.V. Ecorys Brussels, Ecorys Europe E.E.I.G, Ecorys Spain, Ecorys Poland, Ecorys South East Europe, and Ecorys Croatia. 

Our privacy statement

Ecorys has an esteemed reputation and undertakes all its work with the highest integrity, ensuring respect for the interests of everyone who is affected by these activities. Data protection is given the highest priority and we strive for transparency about our activities and reasons. 

Data Protection Officers

Ecorys has appointed Data Protection Officers (DPOs), who supervise compliance with the GDPR. The Data Protection Officers can be reached via the e-mail addresses below: 

Ecorys is responsible for the processing of personal data as it is collected in several ways, including when:

  1. You are visiting our websites
  2. You are supplier or client of Ecorys
  3. You are a respondent in  research conducted by Ecorys
  4. You are visiting an event, training or meeting organised by Ecorys
  5. You are applying for a job
  6. You are visiting Ecorys premises

1) When you are visiting our website, and filling in the contact form on our website

What data do we process?

When you sign up for our newsletters, we collect your contact details (such as name and email address), any message you left, including any personal data. You can unsubscribe anytime.

The purpose of processing your personal data

This data is collected for service purposes to be able to follow up on your query and to inform you regarding the next steps; for relationship management, marketing; customer administration. And for sending newsletters.

What is the legal ground for processing your personal data?

Consent – when you provide your data in our website forms, this is used only at your request and with your consent. Cookies are used to provide an efficient service on the website. For our cookie policy we refer to our cookie policy. which is also included below.

Legitimate interest – Ecorys has a legitimate interest in processing your personal data on our website for the purposes stated.

How long do we store your personal data?

As the data controller, we store your personal data until we have marked your message as “completed” unless we have to store your data longer because of a legal regulation or if it’s necessary to carry out our activities. We keep contact details of visitors who have signed up for our newsletter until you choose to cancel receipt of our newsletter and then up to 4 weeks after receipt of the cancellation. You can unsubscribe at any time in all newsletters sent.

Our cookie policy

Cookies may contain identifying information and are only used to make the Ecorys website more accessible for you. 

Functional cookies

Ecorys uses functional cookies to make the website operate more efficiently, and to register the behaviour of the visitor on the website and save certain preferences. For this we do not need your consent. 

Other cookies

Ecorys does not collect or use other analytical or marketing cookies

Third party cookies

Via the social media cookies, Ecorys offers the possibility to share the information on this website via social media buttons. These third parties can place cookies that are not in our control should you chose to use these services. For more information, please see the privacy statements of LinkedIn, Twitter or Facebook. This information changes from time to time and Ecorys cannot influence this.

2) When you are a supplier or a client of Ecorys

What personal data do we process?

Your contact details such as name, surname, title, your company address, place of residence, telephone number, banking data for payments to or from Ecorys. 

The purpose of processing your personal data

Delivering services and advice, purchasing services and products, conduct customer administration, and debt and creditors management, conduct reviews on customer service for ISO 9001 or conduct market research. 

The legal ground for processing your personal data

Contract between the parties – We use the data to assist in performing the agreement and / or user conditions with you or to comply with a legal obligation.

How long do we store your personal data? 

As either a data processor or a data controller, we delete the data after the retention period has expired based on our contract or based on local legal retention periods, unless we are required to keep a copy of the data for regulatory reasons. 

3) When you are a respondent in research conducted by Ecorys

What personal data do we process?

The data we collect during research varies from project to project. Besides contact data this can include data such as beliefs and opinions, knowledge, intentions, interests, preferences, attitude, income, class, purchase and spending habits. 

In some research projects, we collect and process special category personal data such as race, ethnic origin, political opinions, religious or philosophical beliefs, trade union memberships, genetic data, data relating to health, a person’s sexual behaviour or sexual orientation.

You will always be given a copy of a relevant privacy statement and an information sheet for that project, that will include the details of who the data controller is, who is processing your information and for what specific purpose. 

The purpose of processing your personal data

The data collected from respondents in research conducted by Ecorys is used to answer research questions that either Ecorys, or Ecorys’ clients have asked us to obtain. 

The legal ground for processing your personal data

Wherever possible personal data will be anonymised before being processed, so that the personal data cannot be identified. Where this is not possible, we or our client:

  • Will seek your consent to process your personal data, or
  • Will have received your consent to the research from our client or from a request for respondents, or
  • May have a contract with you for processing your data, or
  • May have a legitimate interest for processing the data, or
  • May need to process the data to perform a public task, 

For special category data, we or our client will seek your specific consent.

How long do we store your personal data?

As a data processor or data controller, we may delete the data after the retention period has expired based on the duration of our project or contract with our client, unless there is a legal regulation that requires us to keep the data for longer; or we may be required to transfer the data back to the data controller. 

4) When you are visiting an event, training or meeting organised by Ecorys

What data do we process?

Contact details (possibly including title, initials, first name, surname, gender, company, job title, email address and any special requirements you have during the event- this may include details of any disabilities or health issues).

The purpose of processing your personal data

Service purposes, customer administration and relationship management, as far as necessary for your participation in the event, training or meeting; to conduct customer administration and payment management; to manage a Client Management System (CMS) and for Communication with you via e-mail, or other agreed methods.

What is the legal ground for processing your personal data? 

The use of your personal data is necessary for the execution of a contract between us for the event, training or meeting, for the purposes of preparing such a contract in the legitimate interest of Ecorys or third parties to provide our services as efficiently as possible.

How long do we store your personal data? 

We store your personal data for three months after you have attended a course and we have sent you a certificate or when you have visited an event/meeting. Only your contact details will be kept for three years for future invitations for other comparable events.

5) When you are applying for a job

What data do we process?

Your contact and identification data, such as: name, address, place of residence, e-mail address, mobile phone numbers, date of birth, gender, photo, social media profile (such as LinkedIn), passport or other identification document, curriculum vitae and work experience, we may also need to process your disability status and or any health issues for safety and access to interviews.

Why do we process your data?

Processing job applications, arranging interviews, making a job offer and commencing employment.


What is the legal ground for processing your data?

Consent – you have provided us with the data, and we have your consent to process it for your job application and associated processes. We have a legitimate interest to process your personal data to ensure you meet job requirements, for right to work checks and to appropriately identify you. For interviews conducted in an office, we may need to process your disability or health issues to ensure proper access for you. Anonymized personal data such as health data (disability status), gender and/ or race and ethnic origin may be used for equality monitoring.

How long do we keep personal data?

We delete personal data one month after closure of the application process, unless we have your consent to retain it for a longer period to consider for future job roles, then we will keep it for a maximum of 3 years. 

6) When you are visiting Ecorys’ offices or other premises

What data do we process?

When you are visiting Ecorys’ premises, Ecorys could process contact details (such as first name, surname, company name, we may also need details about your disability status or health issues for safety and access purposes) and in some offices such as in Rotterdam and Brussels, camera images (CCTV) may also be processed.

The purpose of processing your personal data

Internal control and security, health and safety and prevention and detection of crime.

What is the legal ground for processing your personal data?

Legitimate Interest – the use of your personal data is necessary in securing our premises and for health and safety reasons.

How long do we store your personal data?

We store your personal data up to 6 months after you have visited the premises. We store CCTV and images data for a maximum of 4 weeks after your visit unless we have to keep your personal data longer because of a legal regulation.

7) General

Who has access to your personal data 

Employees of Ecorys who need the personal data to carry out their work. 

Ecorys also may use various systems for processing your data or subcontractors or suppliers for processing your data as part of our project. For example, Ecorys hosts the website on servers located in the UK through our supplier Bytemark. The servers are backed up daily offsite. The event organizer, venue and training providers may also need access to your personal data to ensure appropriate access to their services. We protect your data through robust contracts with all our subcontractors and suppliers. Where applicable, our client may also have access to your data as part of the project.

There are also links in our website that lead to third-party websites, Ecorys does not manage these third-party websites and has no control over how they use or collect your data, by clicking through to these third-party websites you are leaving Ecorys’ controlled area.

If you are a supplier or a respondent in one of our projects, our end client may be given access to your details to comply with our contract with them.

If you are a client, we may need to share your details with our suppliers, especially for contract exit purposes.    

All CCTV data is saved in a separate hard network location. Access is based on authorisation and vital interests.

Automated decision-making

Ecorys does not take individual decisions based on automated processing.

Technical and organizational security measures

Ecorys takes reasonable steps to ensure that your personal information is properly secured using appropriate technical and organizational measures to protect it from unauthorized or unlawful use, alteration, unauthorized access or disclosure, accidental or unlawful destruction and loss.

Your rights to view, modify, delete data or object to processing

You have the right to view, correct, delete or to object to the processing of your personal data by Ecorys. You also have the right to withdraw your consent to data processing at any time.

You can submit a request to us for access to the personal data we hold or process about you, known as a subject access request. This means we will send you the personal data, which we have hold or process about you. This can be sent in a computer file to you or another organization, as required by you. If you wish to request access to, correction, deletion, data transferability of your personal data or submit a request for cancellation of your consent or objection to the processing, please contact the Data Protection Officers.

You also have the right to file a complaint about the way we have processed your personal data with one of the Local Protection Authorities. 

Changes and our Privacy Statement

We may adjust our privacy statement from time to time. When we make changes, we adjust the date mentioned at the top of this statement. The modified version applies to you and your data as of the date of revision. We advise you to review this statement at regular intervals, so that you are kept informed of how we process and protect your data.

Contact

If you have any further questions about this privacy policy or the way we process data, please contact:

Last updated: 27th October 2023