Privacy policy
This notice explains how Rock- en Metal Jeugdhuis Asgaard VZW processes personal data when you visit this website or use its member and crew services. It should be read together with the cookie policy.
Who is responsible for your data?
The data controller is Rock- en Metal Jeugdhuis Asgaard VZW, Driebeekstraat 3, 9050 Gentbrugge, Belgium (enterprise number BE0457.357.374).
For privacy questions or requests, contact us at info@jh-asgaard.be. No separate data protection officer contact has been identified.
If you visit the public website
This section applies to everyone who visits the public pages, whether or not they have an account. We process only the technical data needed to deliver, secure and remember preferences for the website:
- Technical and security data: session and cookie preferences, and information processed by the hosting platform or security logs when you access the site. The precise fields and retention periods depend on the hosting and logging configuration.
If you use the contact form
When you send us a message through the contact form, we process the name, email address, message and any images you submit, together with the chosen category, to answer your request. The message is saved on this website and emailed to the person or team responsible for that category; images are re-encoded, stripped of metadata and attached to that email. Submissions, including images, are automatically deleted after 90 days. The form is protected by Cloudflare Turnstile, which checks that the visitor is a person and processes technical connection data (such as your IP address) for that purpose; the form also applies rate limiting. We rely on our legitimate interest in handling enquiries and keeping the form free from abuse.
If you have a member or volunteer account
The following data is processed only for people who have an account or use member, crew or volunteer features. It is not collected from ordinary public visitors just for browsing the site.
- Account and sign-in data: email address, name, account status, roles and authentication data. Local accounts may also use a password hash and, where enabled, a TOTP two-factor authentication secret. If you opt in, your email address is also used to send shift reminder emails (7 and/or 2 days before a shift you signed up for); you can change this at any time in your profile.
- Profile data: preferred language, job title, profile photograph, T-shirt size and any emergency contact information you choose to provide. Emergency contact details may identify another person; please make sure you are entitled to provide them.
- Participation records: event and shift sign-ups, crew assignments, points, rewards and related administrative notes.
Why and on what basis we use data
For public visitors, we use technical data to deliver and secure the website and remember cookie preferences. For account holders and volunteers, we also use account and profile data to manage access and profiles, and participation data to organise events and shifts, administer crew assignments, points and rewards, and keep related administrative records. We also process data where needed to meet legal obligations. Depending on the activity, the legal basis may be the steps needed to provide the service or manage participation, our legitimate interests in operating a secure membership and volunteering platform, compliance with a legal obligation, or your consent. We rely on consent for optional third-party embedded media and non-essential cookies. You can withdraw consent at any time; this does not affect processing that took place before withdrawal.
Where data comes from
Account identity details are obtained from you and, for Entra sign-in, Microsoft Entra ID. With an authorised administrator's delegated access, the site can retrieve work-profile information such as job title and profile photograph from Microsoft Graph. Profile and participation details are provided by you or recorded through your use of member and crew features.
Who may receive data
We do not sell personal data. Access is limited to people who need it to administer the organisation and website. Data may also be processed by:
- Microsoft: Entra ID is used for sign-in; Microsoft Graph may provide profile information when an authorised administrator requests it. Microsoft processes data under its own service terms and privacy information.
- Cloudflare (Turnstile): the security check on the contact form is provided by Cloudflare. When you open the contact page, Cloudflare receives technical connection data from your browser (such as your IP address) to verify that you are a person. This is necessary to protect the form from abuse and therefore happens without consent; Cloudflare processes this data under its own privacy information.
- Google (YouTube) and Spotify: event and post pages may contain optional embedded players. They are blocked until you enable the corresponding service in the cookie preference tool. If enabled, those providers receive connection data from your browser and may use their own cookies or similar technologies.
- Website hosting, infrastructure, email and technical support providers, to the extent needed to operate and secure the service.
International transfers
Some service providers may process data outside the European Economic Area. Where this occurs, the organisation must ensure that an applicable GDPR transfer mechanism and safeguards are in place. The specific locations and safeguards depend on the providers actually used.
How long we keep data
We keep personal data only for as long as needed for the purposes described above and to meet applicable legal requirements. Account, participation, points and audit records may have different retention periods. The organisation should document and apply clear retention periods or criteria for each record type.
Your rights
Subject to the conditions in data protection law, you may ask to access, correct, erase or restrict the processing of your personal data, object to processing based on legitimate interests, request data portability where applicable, and withdraw consent. To exercise these rights, contact us at info@jh-asgaard.be. You may also lodge a complaint with the Belgian Data Protection Authority.
Belgian Data Protection Authority — how to lodge a complaint
Security
We use access controls and technical safeguards intended to protect personal data. No internet transmission or storage system can be guaranteed completely secure.
Automated decisions
The website does not intend to make decisions about you solely by automated means that produce legal or similarly significant effects. Account roles may be synchronised with authorised organisation group membership to manage access.
Cookies and embedded media
The cookie policy describes the cookies and optional embedded media used on this site and explains how to change your preferences.