Rosa Privacy Policy

Rosa helps health professionals and their patients to exchange information in a confidential, secure and trusted environment. We have no other ambitions, and we do not use personal data for other purposes.

Rosa has the ambition to give its users control over their information. Over time, we will add functionalities to our applications to let you access more information and decide what to do with it, with whom you want to share it, etc.

This document describes everything Rosa does with the personal data it processes as part of its activities

What is it?

Each time an event (e.g. an appointment, a teleconsultation, an attestation,...) at a specific health professional is created for a new patient, Rosa creates a “patient record” in relation to that patient for the benefit of the relevant health professional. 

What personal data does Rosa process?

Patient records may contain the following personal data of a patient:

• First name  
• Last name;
• Date of birth;
• National registry number (SSIN/BIS);
• Phone numbers;
• E-mail addresses;
• Postal addresses;
• Gender;
• Contact details of the person(s) of contact;
• First name and last name of family members;
• History of Rosa events (e.g. booking, teleconsultation, attestation,...);
• History of non-Rosa events (conditional to partner software integrations);
• Account status and restrictions; and
• Any other information about the patient that the health professional might have referred to in a note.

Where the Rosa Services are used on behalf of the patient, by an individual (referred to as a “user”) who is not the patient, patient records may also contain the following personal data of a user: 

• First name  
• Last name;
• Date of birth;
• Phone numbers; and 
• E-mail addresses.

What is it? 

Some health professionals require patients to strongly authenticate and identify themselves for a given event (e.g. booking an appointment, accessing a patient portal, generating an attestation, joining a teleconsultation,...).

What personal data does Rosa process? 

Strong authentication and identification of patients may contain the following personal data of a patient:

• First name and last name
• Date of birth
• National registry number (SSIN/BIS)
• The language preference of the user's interface
• The existence of a mandate assigned to the user

Additional purpose and legal basis 

Law of August 8, 1983, organizing a National Register of Natural Persons ("RN Law"). Healthcare institutions may be granted access to National Register data and the National Registry Number based on Article 5, §1, 2° of the RN Law, Article 8§3 of the RN Law, and Deliberation RN n°21/2009, for the purpose of managing the patient's medical record.

Based on Article 5, §1, 3° of the RN Law, healthcare institutions that have received this authorization (or are exempt from it) may engage a processor to carry out the aforementioned data processing activities.

As a result, Rosa may also receive the National Registry Number as a processor, acting on behalf of and under the instructions of healthcare institutions for the purpose of managing the patient's medical record and the sub-purpose of patient identification and authentication.

Additional information 

National registry numbers (SSIN/BIS) are only stored temporarily on the user’s device and are deleted at the end of the session. Session duration varies by platform. When the data is incorrect, patients can exercise their rights with the relevant State authority. 

What is it?

Each time an appointment is booked or accessed through Rosa, Rosa collects and processes some information about that booking.

What personal data does Rosa process?

Rosa processes personal data related to appointments when a patient books an appointment online or when a health professional creates an appointment in their calendar. For each appointment, Rosa may process the following personal data:

• First name and last name of the patient;
• First name and last name of the health professional;
• Contact details of the patient;
• Contact details of the health professional;
• Specialty and expertises of the health professional;
• Date and place of the appointment;
• Motive and/or visit reason for the appointment (as defined by the relevant health professional or resource);
• The status of the appointment and, when canceled, who canceled and when;
• Answers to medical questions (e.g. through a form);
• A note left by the patient at the time they completed their booking;
• A note added by the health professional.

What is it?

Some health professionals or resources (e.g. imagery exams) require a prescription to schedule an appointment. 

What personal data does Rosa process?

Rosa processes personal data related to prescriptions when a patient books an appointment online where the health professional requires the upload of a valid prescription. 

• First name and last name of the patient;
• First name and last name of the health professional;
• Contact details of the patient;
• Contact details of the health professional;
• Specialty and expertises of the health professional;
• Date and place of the appointment;
• Motive and/or visit reason for the appointment (as defined by the relevant health professional or resource);
• The status of the appointment and, when canceled, who canceled and when;
• Answers to medical questions (e.g. through a form);
• A note left by the patient at the time they completed their booking;
• A note added by the health professional.

What is it?

Each time a patient books, modifies or cancels an appointment through Rosa, Rosa will send a confirmation email to that patient. Based on the health professional’s notification parameters, Rosa might also send to the patient (i) a confirmation email / SMS when a health professional makes, modifies or cancels a booking with that patient; and/or (ii) a reminder email(s) / SMS prior to the appointment. If the patient uses the Rosa mobile app and has consented to receiving push notifications, Rosa may also send push notifications for any appointment confirmation, cancellation, reminder or modification.

What personal data does Rosa process?

When a confirmation or a reminder email / SMS / push notification is sent, Rosa processes the following personal data:

• First name of the patient;
• Email address of the patient;
• Mobile phone number of the patient;
• First name and last name and contact details of the health professional (or the contact details of the medical practice);
• Details of the appointment (which may include motive, date, time, and place of the appointment, as well as specific instructions from the relevant health professional); and 
• Details of the notification (which may include delivery status and details)

Additional information

The content of the confirmation and reminder emails will also be transmitted to, and processed by, Rosa’s email service provider. Data related to push notifications may be processed by our mobile app distribution platforms. You can find more information about Rosa’s service providers on the page Data Processors.  

What is it? 

Health professionals have the option to use Rosa to (i) consult information about the insurability (and derived rights) of a patient in order to carry out an invoice or to deliver products or services; (ii) generate an electronic attestation or an electronic invoice; and (iii) encode payment methods and track payments.

These features are referred to as ‘Rosa eBilling’. 

What personal data does Rosa process?

When a health professional uses Rosa eBilling, they need to log in to their Rosa account and they need to authenticate with their eHealth certificate. Rosa may therefore process the health professional account management data and data from the eHealth certificate. 

The health professional shall process patient data, including  relevant appointment information, patient record information, payment information (whether the payment has been made or not and the payment method), and patient data made available to them by, or on behalf of, the NIHII (INAMI/RIZIV) (such as, for example, the nomenclature of health services performed by the health professional for that patient).

Additional information

Rosa eBilling information is only accessible to the relevant health professional, the patient involved and their Mutuality, the inter-mutuality (CIN-NIC) and social security services.

What is it? 

Some health professionals offer remote consultations via secure video calls. 

What personal data does Rosa process? 

Rosa processes personal data related to teleconsultations: 

• First name and last name of the patient;
• First name and last name of the health professional;
• Contact details of the patient;
• Contact details of the health professional;
• Date of the appointment;
• The status of the teleconsultation (e.g. if the patient is in the virtual waiting room);
• Answers to medical questions (e.g. through a form);
• Any relevant document exchanged on the platform; and
• Chat messages exchanged during the teleconsultation.

Additional information

The secure video call can also be processed by Rosa’s video streaming service provider. You can find more information about Rosa’s service providers on the page Data Processors.

What is it?

What personal data does Rosa process?

When a health professional creates an account or wishes to get Rosa’s support in relation to their account, Rosa may collect, access, use or generate the following personal data in relation to that health professional:

• First name and last name;
• Mobile phone number;
• Email address;
• Password created by the user to set up their account;
• Postal address;
• Spoken language;
• INAMI/RIZIV or VISUM number and associated profession; 
• Health visa validity;
• Enterprise/VAT number;
• Electronic payment details;
• Payment history; and 
• Any other information from, or related to, a health professional’s account or that the health professional may share with, or send to Rosa for support purposes.
  
  

About whom?

Health professionals account management information contains personal data about all health professionals who have created an account with Rosa. 

For which purpose and on what legal  basis?

Who has access to the user and account management information?

Customer account management information is only accessible to the relevant customer and/or Rosa. Rosa uses the services of Mollie B.V. (Mollie), a regulated payment service provider located in The Netherlands, to manage online payments. Payments methods available include Bancontact. You can find more information on how Mollie and its affiliates process your personal data and how to exercise your personal data protection rights here.

How can a health professional exercise their rights in relation to their account management information?

Health professionals can exercise their rights by contacting Rosa’s DPO at gdpr@rosa.be. You can find more information on how Mollie and its affiliates process your personal data and how to exercise your personal data protection rights here.

How long does Rosa keep the account management information?

Rosa keeps that information for 30 days after the end of the agreement between Rosa and the health professional.  To protect against litigation or comply with its legal obligations, Rosa might keep some data for up to 10 years after the end of the agreement. 

What is it?

What personal data does Rosa process?

Strong authentication and identification of health professionals may contain the following personal data of a health professional:

• First name and last name;
• National registry number (NISS/BIS);
• NIHII (INAMI/RIZIV) or VISUM number and associated profession;
• Health visa validity.
  
  

About whom?

Strong authentication and identifications of health professionals contains personal data about all health professionals who have created an account with Rosa. 

For which purpose and on what legal  basis?

Who has access to the strong authentication and identification of health professionals?

Strong authentication and identification data of health professionals is only accessible to Rosa.

How can a health professional exercise their rights in relation to this data processing?

Health professionals can exercise their rights by contacting Rosa’s DPO at gdpr@rosa.be.

How long does Rosa keep that information?

The authentication and identification data is received and stored temporarily on the user’s device and is deleted at the end of the session. Session duration varies by platform. 
Rosa will further store the data strictly necessary for the health professional account management on its servers, see the section “Health professionals account management”:

• First name and last name
• NIHII (INAMI/RIZIV) or VISUM number and associated profession
• Health visa validity
  
  

What is it?

Rosa offers health professionals using its online calendar and/or booking application the possibility to publish some information about themselves and the services they offer.

What personal data does Rosa process?

When a health professional chooses to create, fill in and publish their Rosa Profile, Rosa may process the following personal data about that health professional:
Photo;

• First and last name;
• INAMI/RIZIV number;
• Gender;
• Spoken language;
• Speciality and expertises;
• Professional address(es);
• Contact details;
• Education and background;
• Availabilities for appointments;
• Health costs such as contracted status, accepted payment methods and fees; and
• Any other personal information that the health professional wishes to publicly share on their profile. 

About whom?

Rosa Profile contains personal data about health professionals.

For which purpose and on what legal basis?

Who has access to your Rosa Profile?

Once activated, Rosa Profile is accessible to anyone online and may appear in search engine results. To increase health professionals’ online visibility and facilitate online booking appointments, Rosa may communicate limited information from a Rosa Profile (e.g. the URL of your Rosa Profile page) to its partners (e.g. online medical registries) to allow them to create a referral link from their platform or website to your Rosa Profile page on Rosa. For the sake of clarity, Rosa will always ensure that its partners guarantee that they already have information about you in compliance with applicable laws, including GDPR, and Rosa will only allow them to create a referral link to your existing Rosa Profile (not to create a new profile on their platform without your consent). 

How can a health professional exercise their rights in relation to their Rosa Profile?

Health professionals can exercise their rights by contacting Rosa’s DPO at gdpr@rosa.be. Health professionals working for a hospital that has entered into an agreement with Rosa shall contact their hospital to exercise their right in relation to their hospital-related Rosa Profile. 

How long does Rosa keep the Rosa Profile?

Upon termination of the agreement between you (or the relevant hospital) and Rosa, Rosa will remove your Rosa Profile from its online applications. Rosa will delete your Rosa Profile within 30 days from the end of the agreement between Rosa and the health professional or the relevant hospital.

What is it?

Health professionals have the option to receive a notification email from Rosa when (i) an existing and/or new patient makes a booking; and/or (ii) a patient leaves a note at the time of the booking; and/or (iii) a patient cancels a booking.

What personal data does Rosa process?

When a notification email is sent, Rosa processes the following personal data:

• First name and last name of the patient and whether it is a new patient;
• Contact details of the patient;
• Email address of the health professional; and
• Date, time, motive and place of the appointment.

About whom?

Notification emails contain personal data about the relevant health professional and the patient involved (where the appointment has been taken by a user who is not the patient, no personal data about the user is shared with the health professional in that notification email).

For which purpose and on what legal basis?

Who has access to the notification emails?

The content of notification emails is only accessible to the health professional involved. The content of the notification emails will also be transmitted to, and processed by, Rosa’s email service provider. You can find more information about Rosa’s service providers on the page Data processors.

How can a health professional exercise their rights in relation to this data processing?

Health professionals can exercise their rights by contacting Rosa’s DPO at gdpr@rosa.be.

How long does Rosa keep that information?

After the Agreement between Rosa and the health professional ends, Rosa will retain the information for a maximum of 30 days, solely to allow for proper data deletion procedures.

What is it? 

Rosa may occasionally send personalized marketing emails to health professionals to share updates on relevant product launches, offers and updates from Rosa. 

What personal data does Rosa process?

Rosa use following personal data in relation to that health professional:

• First name and last name;
• Email address; 
• Medical specialty;
• Spoken language;
• Practice information (e.g. location, group type,...); and
• Product activity.

For which purpose and on what legal basis? 

Who has access to the marketing emails?

The content of marketing emails is accessible to the health professional involved and Rosa. The content of the marketing emails will also be transmitted to, and processed by, Rosa’s email service provider. You can find more information about Rosa’s service providers on the page Data Processors.  

How can a health professional exercise their rights in relation to this data processing? 

If you receive marketing emails from us, you can opt out at any time by clicking the “unsubscribe” link at the bottom of the email. Health professionals can exercise their rights by contacting Rosa’s DPO at gdpr@rosa.be.  

How long does Rosa keep that information? 

After the Agreement between Rosa and the health professional ends, Rosa will retain the information for a maximum of 30 days, solely to allow for proper data deletion procedures.

What is it? 

Individuals may create a patient account on Rosa to access certain Services (for instance, to book an appointment with a health professional, access a patient portal, join a teleconsultation or receive an attestation) and update their contact details.

What personal data does Rosa process?

When creating an account for an individual, Rosa may collect or generate the following personal data in relation to that individual:

• First name and last name;
• Mobile phone number;
• Email address;
• Spoken language; 
• Date of birth;
• Account status and restrictions;
• History of Rosa events (e.g. booking, teleconsultation, attestation,...); and
• History of non-Rosa events (conditional to software integrations). 

Where the individual creating the account is not the patient, Rosa may also collect the following personal data in relation to the patient:

• First name and last name; and
• Date of birth.

About whom?

Patient account management information contains personal data about all individuals who have made a booking on Rosa and, where relevant, about patients for whom an appointment is made by a user. 

For which purpose and on what legal  basis?

Who has access to the patient account management information?

Patient account management information is accessible to the individual creating the account, the health professional with whom they have booked an appointment, and/or Rosa. 

More specifically, the data provided to the health professional includes the following: 

• In the case where a patient makes an appointment for themselves: first name, last name and date of birth. This data is minimal and strictly necessary for the correct identification of the person making the appointment, in order to avoid administrative errors. 
• In the case where a patient makes an appointment for a third party: first name and last name. This data is also limited to what is strictly necessary for the correct identification of the person making the appointment, in order to avoid administrative errors.  

How can a patient exercise their rights in relation to their patient account management information? 

Patients can exercise their rights by contacting Rosa’s DPO at gdpr@rosa.be. Where the individual creating the account is not the patient, the patient can exercise their rights by contacting the user who made the appointment on their behalf. 

How long does Rosa keep the patient account management information?

After the Agreement between Rosa and the patient ends, Rosa will retain the information for a maximum of 30 days, solely to allow for proper data deletion procedures. Rosa will delete the patient account 5 years after the patient has last interacted with Rosa.

What is it? 

To increase the platform security and trust, Rosa requires patients to strongly authenticate to verify their identity when creating an account and when authenticating to their account.

What personal data does Rosa process? 

The patient authentication and identification data may contain the following personal data of a patient:

• First name and last name
• Date of birth
• National registry number (SSIN/BIS)
• The language preference of the user's interface
• The existence of a mandate assigned to the user

For which purpose and on what legal basis? 

Who has access to the patient identification data? 

The identification data is received and stored on the patient’s device and cannot be accessed directly by anyone. The patient’s first name, last name and birthdate is transferred to Rosa, stored in the Patient Account and is accessible to Rosa staff and the health professionals with whom the patient interacts through Rosa, and their organizations. 

How can a patient exercise their rights in relation to this data processing? 

Patients can exercise their rights by contacting Rosa’s DPO at gdpr@rosa.be. When the data is incorrect, patients can exercise their rights with the relevant State authority.

How long does Rosa keep that information? 

The authentication and identification data is received and stored temporarily on the user’s device and is deleted at the end of the session. Session duration varies by platform. 

Rosa will further store the data strictly necessary for the Patient Account management on its servers, see the section “Patient Account Management”:

• First name
• Last name
• Date of birth

What is it? 

Rosa offers patients the option to view insurance-related data such as a more accurate prediction of mandatory health insurance coverage. It will also allow patients to link their Patient Account with their health insurance fund account, thereby enhancing their understanding of supplementary coverage and promoting greater financial transparency.

What personal data does Rosa process?

When creating this functionality/feature for patients, Rosa may collect or generate the following personal data in relation to that individual:

• Health insurer;
• Status of compulsory insurance;
• Increased reimbursement status;
• Medical house membership; 
• Global medical file;
• Third-party payment obligation;
• Maximum invoice ceiling reached. 

About whom?

Financial transparency and insurance information contains personal data about all individuals who have chosen to make use of this functionality/feature. 

For which purpose and on what legal basis?

Who has access to the financial transparency and insurance information?

The information is only accessible to the authenticated patient through their own device. Access is locally secured using encryption mechanisms such as device PINs or biometric authentication. No third parties or Rosa staff can access this data unless explicitly shared by the user. 

How can a patient exercise their rights in relation to financial transparency and insurance information? 

Patients can exercise their rights by contacting Rosa’s DPO at gdpr@rosa.be. 

How long does Rosa keep the financial transparency and insurance information? 

Rosa does not store this data on its servers. 

What is it? 

Rosa may occasionally send marketing emails to patients to share updates on relevant product launches, offers and updates from Rosa. 

What personal data does Rosa process?

Rosa use following personal data in relation to that patient:

• First name and last name;
• Email address; and
• Product activity.

For which purpose and on what legal basis? 

Who has access to the notification emails?

The content of marketing emails is accessible to the patient involved and Rosa. The content of the marketing emails will also be transmitted to, and processed by, Rosa’s email service provider. You can find more information about Rosa’s service providers on the page Data Processors.  

How can a patient exercise their rights in relation to this data processing? 

If you receive marketing emails from us, you can opt out at any time by clicking the “unsubscribe” link at the bottom of the email. Patients can exercise their rights by contacting Rosa’s DPO at gdpr@rosa.be.  

How long does Rosa keep that information? 

After the Agreement between Rosa and the patient ends, Rosa will retain the information for a maximum of 30 days, solely to allow for proper data deletion procedures. Rosa will delete the patient account 5 years after the patient has last interacted with Rosa.

What is it? 

Each time someone visits Rosa’s website (without using Rosa’s services), Rosa may process your personal data, including using cookies and/or other tracking technologies. 

Rosa may use social media services such as Facebook, Instagram, LinkedIn and Twitter. If you use these services, you should review their privacy policy for more information on how they deal with your personal data.

Visitors can also contact us spontaneously (for instance via our ‘Contact Us’ online form). 

What personal data does Rosa process?

When you visit our website or a (hospital) registry powered by Rosa, we may process the following usage and connection data relating to your use of our website, including 

• technical data which may include personal data, such as your IP address, OS and browser version;
• your preferences (e.g. language preferences);
• data about your usage of Rosa’s website (as a health professional or as a patient) (including data about the searches made and the appointments booked - with your consent, such data is linked to a UserID which does not allow us to identify you by your name or email address but it allows us to better understand how you use our services, how a feature is used, and to measure the impact of (new) features).

When you get in touch with us via our website (including via email), we may collect the following data:

• First name and last name, 
• Email address,
• Reason why you contact us, 
• Content of your message, as well as 
• Technical data which may include personal data, such as your IP address, OS and browser version, basic user details about usage of Rosa’s website or application(s). 

To find out more about how Rosa collects personal data on its website and applications, and how to manage your cookie preferences, please read the page Data Processors as well as our Cookie Policy. 

About whom?

This information is collected about visitors to our website.

For which purpose and on what legal basis?

Who has access to that information?

That information might be accessed by Rosa and its data processors, as described on the Data Processors page and in our Cookie Policy.

How can a visitor to our website exercise their rights? 

Visitors can exercise their rights by contacting Rosa’s DPO at gdpr@rosa.be.  

How long does Rosa keep the website visitor’s information? 

This depends on the type of information collected. Data received via the ‘Contact Us’ form is kept 12 months from the date the last correspondence was sent or received by Rosa.  For technical data, please read our Cookie Policy and Data Processors page for more information.

What is it? 

Each time someone downloads and uses Rosa’s mobile application, creates an account with Rosa, books an appointment or otherwise uses Rosa’s services, Rosa may process your personal data, including using cookies and/or other tracking technologies. 

What personal data does Rosa process?

When you use our applications, we may process the following data: 

• Usage and connection data relating to your use of our applications or services, including 
  • technical data which may include personal data, such as your IP address, OS and browser version;
  • your preferences (e.g. language preferences);
  • data about your usage of Rosa’s application(s) (as a health professional or as a patient) (including data about the searches made and the appointments booked - with your consent, such data is linked to a UserID which does not allow us to identify you by your name or email address but it allows us to better understand how you use our services, how a feature is used, and to measure the impact of (new) features).
• User (patient or health professional) account data.

When you get in touch with us via our applications (including via email), we may collect the following data:

• First name and last name, 
• Email address,
• Reason why you contact us, 
• Content of your message, as well as 
• Technical data which may include personal data, such as your IP address, OS and browser version, basic user details about usage of Rosa’s website or application(s). 

To find out more about how Rosa collects personal data on its applications, and how to manage your cookie preferences, please read the page Data Processors as well as our Cookie Policy. 

About whom?

This information is collected about users of our application(s).

For which purpose and on what legal basis?

Who has access to that information?

That information might be accessed by Rosa and its data processors, as described on the Data Processors page and in our Cookie Policy.

If you download Rosa’s mobile application from an app store (such as Apple’s App Store or Google Play store), your data might be collected and processed by that online mobile app store for their own purposes. For more information, we encourage you to read their Privacy Policy. 

How can a user of our applications exercise their rights? 

Users can exercise their rights by contacting Rosa’s DPO at gdpr@rosa.be.  

How long does Rosa keep the application users’ information? 

This depends on the type of information collected. Data received via the ‘Contact Us’ form is kept for 10 years following termination of their agreement with Rosa. For technical data (including those collected via cookies or similar technologies), please read our Cookie Policy and Data Processors page for more information.

What is it? 

Rosa conducts research and collects feedback in order to improve its existing product and services and create new ones. For instance,  Rosa might collect feedback from (potential) customers or other individuals. 

What personal data does Rosa process?

Rosa might collect personal data such as your name, email address and/or feedback, or any other personal data, as explained by Rosa at the time of collection. Whenever possible, Rosa will collect pseudonymized or anonymized data. 

About whom?

This information is collected about any research participant. 

For which purpose and on what legal basis?

Who has access to that information?

That information is only accessed by Rosa, or as otherwise explained by Rosa at the time of collection. If you participate in interviews via a video conferencing tool, your name and email address may also be collected by the tool’s provider as part of its service.

How can an individual exercise their rights in relation to this data processing? 

Individuals can exercise their rights by contacting Rosa’s DPO at gdpr@rosa.be.  

How long does Rosa keep the individual’s information in relation to this data processing? 

Rosa keeps the data for 5 years from the time of collection, unless otherwise explained by Rosa at the time of collection.

What is it?

This section refers to all the personal data that Rosa collects and processes as part of considering an individual for a role or position at Rosa.

What information does Rosa process?

Rosa may collect and process the following personal data in relation to a  prospective staff: 

• Personal contact details, including name, postal address, email address, and phone number;
• Date of birth and gender;
• Employment and education history and qualifications;
• Details relating to the right to work in Belgium (where applicable);
• Any other information provided to Rosa (as part of a curriculum vitae, letter of support, reference checks, during an interview or otherwise) or that Rosa receives from a referee.

About whom?

This personal data is about prospective staff (such as prospective employees, contractors, volunteers or students). 

For which purpose and on what legal basis?

With whom does Rosa share that personal data?

Rosa mainly processes such personal data internally but it may also share part of that information with referees, legal representatives, consultants and professional advisers.

How can a prospective staff exercise their rights in relation to this data processing? 

Prospective staff can exercise their rights by contacting Rosa’s DPO at gdpr@rosa.be.  

How long does Rosa keep that information? 

If the applicant is successful, Rosa will keep that information for 5 years after termination of the employment agreement with Rosa. If the applicant is not successful, Rosa will keep that information until completion of the recruitment process and a further 3 years if the applicant gives their consent. 

What is it?

This section refers to the personal data that Rosa collects and processes as part of running its business, including when prospecting for, or communicating with, potential new customers, partners, collaborators, and/or vendors.

What information does Rosa process?

Rosa may collect and process the following personal data: 

• Personal contact details, including first name and last name, postal address, email address, and phone number;
• Occupation or job title;
• Any other information sent or disclosed to Rosa, including Rosa’s records of any communications or interactions with you.

About whom?

This personal data is about any individual Rosa deals with in the course of running its business, including potential new customers, partners, collaborators, and/or vendors. 

For which purpose and on what legal basis?

With whom does Rosa share that personal data?

Rosa mainly processes such personal data internally but it may also share part of that information with referees, legal representatives, consultants and professional advisers.

How can those individuals exercise their rights in relation to this data processing? 

You can exercise your rights by contacting Rosa’s DPO at gdpr@rosa.be.  

How long does Rosa keep that information? 

Correspondence for prospection, sales and support and commercial agreements, including negotiation documents and relevant correspondence, are kept permanently.

What is it?

Rosa conducts research and collects feedback in order to improve its existing product and services and create new ones. For instance,  Rosa might collect feedback from (potential) customers or other individuals. 

What personal data does Rosa process?

Rosa might collect personal data such as your name, email address and/or feedback, or any other personal data, as explained by Rosa at the time of collection. Whenever possible, Rosa will collect pseudonymized or anonymized data. 

About whom?

This information is collected about any research participant.

Who has access to that information?

That information is only accessed by Rosa, or as otherwise explained by Rosa at the time of collection.

How can an individual exercise their rights in relation to this data processing?

Individuals can exercise their rights by contacting Rosa’s DPO at gdpr@rosa.be.

How long does Rosa keep the individual’s information in relation to this data processing?

Rosa keeps the data for 3 months from the time of collection, unless otherwise explained by Rosa at the time of collection.

Purposes

1. To improve Rosa’s products and/or services (including analytics and security purposes); or
2. As otherwise explained by Rosa at the time of collection.

Legal bases

1. Legitimate interest (art. 6.1 (f) GDPR)
2. Where the conditions to rely on legitimate interest are not met, Rosa relies on consent (art. 6.1 (a) GDPR)