Privacy statement

At Haagsche Recherche Academie, we attach great importance to protecting your privacy. In this privacy statement, we explain what personal data we collect, how we use, store and protect it.

1. Controller

Haagsche Recherche Academie, with its registered office at Alexanderveld 5, 2585 DB The Hague, registered with the Chamber of Commerce under registration number 74655736, is responsible for processing within the meaning of Article 4 (7) GDPR. We determine the purpose and means of processing your personal data and ensure compliance with the AVG and the GDPR Implementation Act.

Do you have questions about this? Feel free to contact our Data Protection Officer (DPO).

Contact details:
Haagsche Recherche Academie
Alexanderveld 5
2585 DB The Hague

070 20 42 7 44
fg@haagscherechercheacademie.nl

FG number: FG0017215

2. Personal Data

We only process personal data that is necessary for the execution of our legal and contractual obligations (Article 5 (1) (c) GDPR).These include:

• Identification data (name, date of birth, gender, address, telephone number, email address);
• Education and work-related data (courses, diplomas, references);
• Data that is necessary for screening, security or access to our locations (such as camera images, log files);
• Technical data such as IP address, browser data and cookies (see cookie policy).

3. Purposes of processing

We process personal data only for specific, explicit and legitimate purposes (Article 5 (1) (b) GDPR), including:

• Assessing the suitability and reliability of candidates;
• Implementing agreements with students and teachers;
• Complying with legal obligations (such as tax retention, safety);
• Preventing fraud and misuse of our services.

4. Legal basis for processing

The processing of personal data takes place on one or more of the following legal grounds (Article 6 GDPR):

• execution of an agreement or preparation for it (Article 6 (1) (b) GDPR);
• compliance with a legal obligation (Article 6 (1) (c) GDPR);
• the legitimate interest of Haagsche Recherche Academie, for example in preventing fraud or protecting property (Article 6 (1) (f) GDPR, see EDPB Guidelines 1/2024).

5. Retention periods

Personal data is not stored longer than necessary for the purpose for which it was collected, unless a legal obligation requires a longer period of time (Article 5 (1) (e) GDPR).

• Financial administration: 7 years (tax retention obligation);
• Correspondence and files: 1 year after completion of training, unless necessary for legal proceedings;
• Camera footage: maximum 4 weeks, unless an incident requires further investigation.

6. Sharing personal data

We only provide personal data to third parties if this is necessary for the performance of our tasks, or if we are legally obliged to do so (Article 6 (1) (c) GDPR). We conclude processing agreements with parties that process personal data on our behalf in accordance with Article 28 GDPR and the EDPB Opinion 22/2024 on sub-processors.

7. Personal data security

We use appropriate technical and organizational measures (Article 32 GDPR) against loss, unauthorized access, unlawful processing or disclosure. Some of the most important security measures we use include:

• Two-factor authentication (2FA): We use two-factor authentication to access our systems. This means that, in addition to a password, an additional verification step, such as a code on your mobile device, is also required to gain access.
• Single Sign-On (SSO): We use a Single Sign-On system, allowing employees to log in securely and efficiently with a single set of credentials for multiple applications, while their access is monitored and managed.
• Encryption (SSL): Sensitive information exchanged via our website is protected by Secure Sockets Layer (SSL) encryption. This ensures that data is transferred securely between your device and our servers.
• Data breach protocol: We have a strict data breach protocol that provides procedures for reporting, investigating and dealing with data breaches. If necessary, we will inform you and the Data Protection Authority in good time about a data breach, in accordance with legal requirements.
• Password protocol: We use a strict password protocol, where passwords must meet high security requirements, such as minimum length, complexity and regular renewal. Employees only have access to the systems and data that are necessary for their work.
• Access to data limited to authorized employees: Access to personal data is strictly limited to employees who are authorized to process that data. This is regulated through authorization management and the principle of minimal access, where employees only have access to the data they need for their specific tasks.
• Regular data protection checks: We carry out regular checks and audits to ensure that our data protection measures comply with the latest security standards and that there are no vulnerabilities in our systems. This helps us to continuously ensure the confidentiality, integrity and availability of your personal data.

Through these measures, we can guarantee the security of your personal data and ensure that it does not fall into the wrong hands or is processed unlawfully.

8. Rights

You have the following rights with respect to your personal data:

• Right to access, you can request a copy of the personal data we hold about you.
• Right to rectification, you can have incorrect or incomplete data corrected.
• Right to be forgotten, in certain cases, you can ask us to delete your personal data.
• Right to restrict processing, you can ask us to restrict the processing of your data in specific situations.
• Right to object, you can object to the processing of your data based on legitimate interests.
• Right to data portability, you can request that your data be received in a structured, commonly used and machine-readable format.

You can exercise your privacy rights through us AVG request form. To ensure that the request for inspection has been made by you, we ask you to perform an ID check.

If you are not satisfied with how your personal data is or has been processed by the Haagsch Detective Office, you can make use of our legal obligations complaints procedure.

If your complaint has not been dealt with satisfactorily, you can contact the national supervisor, the Personal Data Authority

We reserve the right to amend this privacy statement. You can always find the most current version on our website.