ASBL Nouveaux Horizons
Data protection
This notice explains how personal data may be used in Attendance Log to organize training and track attendance.
Data controller
The data controller is ASBL Nouveaux Horizons. To ask a question about your personal data or exercise your rights, contact us at the address below.
Data concerned
Depending on the activities and features used, Attendance Log may process the following categories of data:
- first and last name;
- email address;
- registrations for activities or courses;
- attendance status;
- arrival time when a session start time is configured;
- punctuality information calculated from the arrival time;
- participant code;
- individual QR identifier used for attendance.
Participant and registration administration
Identity and contact data are used to manage registrations and organize the training or services for which the participant registered.
The legal basis is Article 6(1)(b) GDPR: processing is necessary for the relationship connected with registration and delivery of the training.
Attendance and attendance/punctuality statistics
Attendance and, when used, arrival times help track participation, support the proper organization of training, produce attendance and punctuality statistics, and improve the organization of activities.
The legal basis is Article 6(1)(f) GDPR: Nouveaux Horizons’ legitimate interests in organizing its training and understanding attendance.
Punctuality information is not used to make an automated decision about a participant, create a behavioral profile, or automatically impose a sanction.
Access and minimization
Access to personal data is limited according to each user’s responsibilities. People taking attendance receive only the necessary operational information, such as the participant’s name and code.
When real identity is not necessary for analysis, reports may show participants in pseudonymized form. Authorized operational workflows remain identified when they require the participant’s identity.
Retention period
Personal identity is retained while it is necessary for participation and active registrations.
When a participant is inactive and no active registration remains, their identity is retained for no more than 12 months after their last meaningful activity. Once that period is reached, it may be irreversibly anonymized.
Anonymization is not automatic: it is currently triggered manually by an authorized administrator, and only when every eligibility condition is met.
Historical attendance facts and statistics may then be retained in anonymous form, without the participant’s former identity.
Backups
Older backups may temporarily contain personal data that has since been anonymized in the live database. These archives are not rewritten retroactively: they are subject to bounded retention and rotation, then expire under the applicable backup policy.
Recipients and technical service providers
Data is available to authorized Nouveaux Horizons users according to their responsibilities. When configured, it may also be processed by technical providers needed to operate Attendance Log, including the outbound email provider and secure backup-storage provider.
The providers actually used and their processing locations depend on the configuration selected by Nouveaux Horizons.
Your rights
Subject to the conditions of the GDPR, you may request access to, rectification or erasure of your data, restriction of processing, or object to certain processing.
Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. Each request is assessed under the applicable conditions and therefore does not automatically lead to erasure of all information.
Attendance Log provides Nouveaux Horizons with technical tools to export data concerning a participant, rectify their identity, and irreversibly anonymize the identity of an eligible participant.
Contact and complaints
For any question or request, contact Nouveaux Horizons at the address below. You may also lodge a complaint with the competent supervisory authority, including the Belgian Data Protection Authority.