Privacy statement: application form QR-code for people with no citizen service number or DigiD who have been tested/vaccinated by the GGD

Who are we and what do we do?
You can use the coronavirus pass application form for people with no citizen service number or DigiD who have been tested/vaccinated by the GGD to apply for a coronavirus pass. The application that you submit using this form goes to GGD GHOR Nederland (specifically: the National Coordination Foundation for COVID-19 Control (LCCB)). GGD GHOR Nederland is the umbrella organisation for the 25 regional GGD organisations and as such coordinates national processes. GGD GHOR Nederland also manages the GKVI system on behalf of the GGDs. The regional GGDs are the organisations that implement testing, source and contact tracing, and vaccinations. More specifically, as the controller, the regional GGDs perform their statutory task* in order to provide citizens with the data needed for coronavirus passes. That is why GGD GHOR sends your application on to the regional GGD responsible for your application. This regional GGD will then process your application.

Bases and purposes
We do not process your personal data without having a specific purpose for doing so and having a legal basis for this processing. A legal basis means that there is a reason provided for by law for processing personal data. We process your personal data in respect of the application form on the basis of the legal obligation to collect, share and retain certain personal data. As the processor, we base processing on the legal obligation of the GGDs to provide citizens with the data needed for coronavirus passes.

In addition, the purpose of the processing of personal data must be defined clearly and for the processing. The personal data collected must be necessary for the purpose for which this data was collected.

What personal data do we process?
In the context of GKVI requests, GGD GHOR Nederland processes the following categories of personal data:

• Name and address details including your first and last name, street, house number, postcode, town, country, telephone number and email address;
• Optional: V-number, citizen service number and patient number;
• Health data, including the answer to the question of whether you have been tested positive by the GGD in the last six months, whether you received your most recent vaccination or booster shot from the GGD, the date, place and GGD region of the most recent vaccination/booster or positive test; and
• Your application (recovery certificate or vaccination certificate).

Who processes your personal data?
GGD GHOR Nederland processes your personal data now that you have submitted these personal data yourself by means of the form that has been filled in and linked to GGD GHOR Nederland’s systems. We also share your personal data with the regional GGD so that it can, if applicable, provide you with a coronavirus pass. We also use a sub-processor (Bizway B.V.), which makes the relevant web form and makes it available online. We have concluded a data processing agreement in which agreements are made about what may be done with your personal data and how it will be properly secured. The personal data are not processed outside of the European Economic Area.

How long do we keep your personal data?
We do not keep your personal data longer than necessary. We do so based on a legal basis and based on a data retention policy. At the end of the retention period your personal data is destroyed. The regional GGDs have their own data retention periods. For more information about these data retention periods, please go to your municipality’s GGD. You can find this on www.ggd.nl (in Dutch).

What are your rights?
These are your rights according to the law:

• You have the right to receive correct information about what happens to your personal data.
• You have the right to view your personal data. You can get a copy of your personal data.
• You have the right to obtain your personal data in a structured, commonly used and machine-readable format and to transfer this personal data to another controller.
• Is your personal data incorrect? Then you can ask us to correct it.
• In some cases, you can ask us to delete your personal data.
• In some cases, you can object to the use of your personal data.

You should submit your request to the Data Protection Officer of the GGD that should, if applicable, provide you with a coronavirus pass.

How do we secure your personal data?
Keeping your personal data secure is very important to us. We ensure that we keep your personal data well protected. We apply security measures in accordance with the applicable legal requirements and regulations (including physical, technological, electronic and administrative measures) that are suitable for protecting personal data against loss, destruction, misuse and/or unauthorised access. We have an information security policy for this.

Do you have any questions or complaints?
Your own GGD
Do you have questions or complaints about the use of your personal data? Then contact the Data Protection Officer of the GGD that should, if applicable, provide you with a coronavirus pass. Every GGD has a privacy statement that names their Data Protection Officer.

GGD GHOR Nederland
You can also contact GGD GHOR Nederland if you have questions or want to exercise your rights. Contact us via privacy@ggdghor.nl. If you want to make a confidential report, have a question or are not satisfied with the way your question or request was handled, or if you have a complaint relating to personal data or personal data processing, you can submit this to the Data Protection Officer of GGD GHOR Nederland via fg@ggdghor.nl. The Data Protection Officer will handle your notifications and treat them as confidential.

If you do not agree with the outcome or the way we handled your complaint you can submit a complaint to the Dutch Data Protection Authority via this website (in Dutch).

Changes to the privacy statement
In connection with changes to legal requirements and/or changes in our services, we reserve the right to change the privacy statement. In so far as the changes to the privacy statement are considered material and significant, you will be informed about them on our website.

* Article 58re (6) of the Dutch Public Health Act (Wet publieke gezondheid); articles 5 to 8 of the Temporary Decision regarding Digital COVID Certificates (Tijdelijk besluit DCC)