Privacy statement

Kiwa Register aims to create trust, which is why your privacy is important to us. We respect your privacy and your right to transparent information regarding the personal information we process. In this privacy statement, we disclose the necessary information defined in the General Data Protection Regulation (GDPR) to keep applicants informed regarding the processing of their personal information taking place.

Kiwa Register offers a wide range of products and services, to all of which this statement applies. This statement is regularly reviewed and updated as our products and services may evolve.

Kiwa Register’s objective is to provide the requested service while respecting every individual’s privacy. This is achieved by adhering to industry specific and international standards, combined with high professionalism and ethics among its employees and contractors. The combination of the above-mentioned activities results in adequate protection of your personal data.

Who are we?

Kiwa Register is part of Kiwa N.V., the organization was founded in 2010 and mandated by the Minister of Infrastructure and Water Management to issue aviation, maritime and road transport licenses and permits on the Minister’s behalf. We issue approximately 100.000 permits and licenses yearly to individuals and businesses in aviation, maritime and road transport for the transport of good and/or passengers purposes.

As part of the agreements between Kiwa Register and the Inspectie Leefomgeving en Transport (ILT), relevant permit and license information is shared with ILT to facilitate their official enforcement and supervisory activities in the transport sector.

What do we use personal data for?

Kiwa Register issues licenses and permits, therefore processing of personal information is a fundamental process that must take place. Depending on the application we regularly perform automated information checks with government agencies. The requested personal information will be processed in order to primarily:

• Identify and/or authenticate the applicant and documentation, in order to ensure the license and/or permit is issued to the correct legal and/or natural person.
• Assess the necessary documentation in order to establish the level of competency and whether the permit and/or license requirements have been met.

Below you will find a list of the legal bases that Kiwa Register utilizes to process personal data and the associated activities. You can find further information about the legal basis on the website of the Data Protection Authority.

Legal obligations

• Assessment and registration of a license applicant's dossier;
• Compliance with National and European law;
• Adherence to sanctions laws.

Legitimate interests

• Development and improvement of products and/or services;
• Providing information regarding changes to our services and/or products;
• Performance of secondary business tasks and responsibilities;
• Informing relevant third parties on the status of a request.

If and when personal data is processed on the basis of consent the purpose of the processing will be communicated and your consent will be requested. This consent can, at any moment in time be retracted by you.

What personal data do we collect?

Kiwa Register collects personal data to enable us to provide you with our products and services. In order to properly assess if the necessary requirements are met, often several type of personal data must be collected. The information is most often submitted by the license holder, however it is not uncommon for an employer or third parties to submit information on behalf of the data subject.

The type and amount of personal data collected fully depends on the requested permit or license that is requested. Taking into account the different services and products, the list below provides a non-exhaustive summary of personal data that may be necessary in order to fully assess and process the requested service:

• First- and last name
• Gender
• Date of birth
• Birthplace
• Address information
• Phone number
• E-mail address
• Driver’s license information
• Copy-ID (driver’s license and/or passport)
• Certificates and/or diplomas corresponding their corresponding unique number.

Depending on the requested license or permit special categories of information and/or information relating to criminal convictions and offenses (VOG) may also need to be processed to properly assess an applicant's worthiness. These type of information will be processed strictly when explicitly required and within the constraints of the law. Kiwa Register processes the following sensitive and/or special categories of personal data:

• Social security number (BSN)
• VOG (verklaring omtrent het gedrag)
• Medical certificate, with the purpose of checking whether an applicant is declared fit or not fit.
• Credit score (Kiwa Register may need to do a credit check with business-related certificates. The credit information could be reduced to personal data).

Occasionally, personal data may be collected as you visit and navigate our website. This data includes information about: locations, IP-addresses, activity on our website, or activity on other websites (for example if these includes an ad network). For further information about the data that is collected during a visit to the Kiwa Register website can be found in the cookie policy.

How do we protect your information

Kiwa Register uses two main methods to process and store personal information:

• The Kiwa Register datacenter(s).
• (Cloud) Applications from a select few suppliers.

Kiwa Register is a (qualified) trusted service provider and operates under strict security protocols as required by the National Cyber Security Centrum (NCSC). Aside from sector specific legislation we also adhere to the following frameworks, standards and legislation:

• GDPR (General Data protection regulation)
• ISO 27001 Information security management
• ISO 9001 quality management
• NIS 2
• ETSI 319-401, 319-411-1, 319-411-2
• PKI-Overheid framework

The combination of the above mentioned standards and legislation ensure that Kiwa Register meets the necessary security and privacy requirements that is subject to both national and European level legislation. These requirements are internally translated into organizational and technical measures that guarantee that the standards are not only met but also kept updated. Kiwa Register also regularly performs internal and external audits to ensure compliance with the relevant frameworks and legislation.

How long is your personal data stored?

Kiwa Register does not store your personal data longer than necessary to achieve the purposes for which they are collected. As a legal entity with a statutory task, personal data are stored in accordance with the Archiefwet and the applicable agreements made with the ILT.

With whom do we share personal data?

It may be necessary for Kiwa Register to share your personal data with some of our partners and/or other institutions. This is done to provide the requested service. Special categories of personal data will not be shared with any organization, unless Kiwa Register is legally obligated to do so or consent has been obtained from the relevant data subjects. Furthermore, personal data will not be shared with countries outside the EU/EER, unless there are specific legal exemptions or appropriate information security level can be guaranteed.

Kiwa Register will share personal information with national, EU/EER and/or international organizations and/or governmental agencies in the following situations:

• Checking the validity, identification and/or authentication of natural persons, competence and/or authorities.
• Anti-fraud assessment.

Appropriate safeguards, including data minimization, will be taken when these processes are performed. Personal data may also be shared with organizations outside of the Netherlands upon request of the person involved. Such as in instances where individuals need their file to work abroad.

Further information about shared personal data and the specific domains can be found through the following links:

• domain Land;
• domain Air;
• domain Water.

Who can access your data?

Taking into account both privacy and security of the information, we strictly limit access to personal data to only the staff members that require access to perform their license issuing tasks. This principle is commonly known as the “least privileged” principle. Furthermore only information that is strictly necessary will be shared with processors and/or the necessary parties . Both organizational and technical measures are in place to guarantee that this principle is respected.

Your rights as an individual

The General Data Protection Regulation (GDPR) provides individuals with a set of rights. These individual rights are stated in the GDPR and are respected by Kiwa Register. These rights include:

• The right to information:
  • The right to be informed where personal data are collected. As an individual you have the right to be informed on the circumstances regarding the processing of your personal information. These are outlined and described in this privacy statement.
• The right to access:
  • You may at any given moment request a summary of your personal data being processed and stored by Kiwa Register. Also the purpose, means and method of the processing. Kiwa Register reserves the right to request a payment when several copies are requested.
• The right to rectification:
  • If any doubt arises regarding the accuracy of your data, you may request rectification of your personal data before any further processing is conducted.
• The right to data portability:
  • Depending on the basis on which your personal data is processed, you can have your personal data transferred to another party. Note that the right to data portability does not trigger any right to erasure.
• The right to erasure:
  • Under specific circumstances, you may request erasure of your personal data. You may request that all of your personal information stored and/or processed by Kiwa Register be permanently deleted.
• Restriction of processing:
  • When presented with a legitimate case such as those described in the GDPR (Article 18) Kiwa Register is obligated to either fully or partially restrict the processing of your information.
• Right to object:
  • The right to object to the processing of your personal data or to the application of automated processing and profiling. If you disagree with the actual decision, you can request a human review of the decision taken.

Further information on your rights as an individual can be found on the website of the Data Protection Authority.

The above mentioned privacy rights can be submitted through e-mail, post or the complaint form. Kiwa Register’s e-mail address and post address can be found at the contact page. In such a request you should clearly mention which GDPR right you wish to submit and which personal data is involved. Kiwa Register also offers the opportunity to object every official decision. After such a decision, we will send you a document in which this opportunity is explained. Finally, you can lodge a complaint with Kiwa Register. Information about filing a complaint can be found in the complaint regulation.

In addition to these rights, you have the right to lodge a complaint with the Data Protection Authority.

About this privacy statement

The version of this Kiwa Register Privacy Statement was created in September 2024. This privacy statement will be periodically reviewed to ensure transparency towards individuals. If there are any material changes to the statement or in how Kiwa Register will use your personal data, we will either notify you by prominently posting such changes on our website or by directly sending you a notification. In the event of a conflict between this Kiwa Register privacy statement and the terms of any agreement(s) between a customer and Kiwa Register, the terms of those agreement(s) will control.

Questions about your privacy at Kiwa Register

If you still have any questions regarding our privacy policy, you can contact our Privacy Officer, via e-mail: register.security@kiwa.nl.