Privacy Policy & Cookie Policy
anderlecht.eu platform · Version 1.0 · Effective from 1 July 2026
Commitment to transparency: The anderlecht.eu platform has been designed in accordance with the principle of ‘privacy by design’. We collect only the data strictly necessary for the service to function. We do not sell any data to third parties. We do not display any targeted advertising.
Article 1 — Data Controller
The data controller for personal data collected via the anderlecht.eu platform is:
- Name: anderlecht.eu Citizens’ Platform [To be completed: name or company name of the publisher]
- Postal address: [To be completed], Anderlecht, Belgium
- Contact email address: contact@anderlecht.eu
- Google Cloud reference: Project anderlecht eu
If you have any questions regarding the protection of your personal data, you may contact the data controller at the address above.
Article 2 — Data collected, purposes and legal bases
2.1 Authentication via Google (OAuth2 / Social Login)
The anderlecht.eu platform offers a secure login feature via the Google OAuth2 service (‘Sign in with Google’). When you use this feature, Google transmits only the following basic identification data to the Platform:
- First name and surname;
- Email address associated with the Google account.
This data is used exclusively to:
- Validate and secure access to the account on the platform;
- Link published opinions and reviews to an identified account.
Legal basis: Performance of a contract (Article 6(1)(b) of the GDPR) — logging in via Google is necessary for the provision of the personalised access service.
We do not collect any other Google data (contacts, calendar, Drive files, GPS location, etc.). The management of Google permissions is governed by Google’s Privacy Policy.
2.2 Data voluntarily published by the user
When posting a review or opinion, the user freely enters:
| Data | Nature | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Username | Required | Identification of the author of the review (without revealing their real identity) | Consent (Art. 6(1)(a)) |
| Rating (1 to 5 stars) | Required | Calculation of the average rating for the service or elected representative being reviewed | Consent (Art. 6.1.a) |
| Textual comment | Mandatory (min. 10 characters) | Publication of the citizens’ opinion | Consent (Art. 6.1.a) |
| Neighbourhood of residence | Optional | Geographical targeting of the opinion within the municipality of Anderlecht | Consent (Art. 6.1.a) |
| Date of publication | Automatic | Date of the notice for transparency purposes | Legitimate interest (Art. 6.1.f) |
Published notices are visible to the public on the Platform, without the author’s real identity being disclosed.
2.3 Machine translations (DeepL)
In order to make the Platform accessible in the six officially supported languages (French, Dutch, English, Italian, Portuguese, Romanian), comments submitted by users are sent to the DeepL API for machine translation at the time of publication. The translations are then stored in a database.
DeepL AG (Germany) acts as a data processor within the meaning of Article 28 of the GDPR. The transfer is governed by the Standard Contractual Clauses (SCCs) approved by the European Commission. No personally identifiable data is transmitted to DeepL — only the text of the comment.
2.4 Browsing data and audience statistics
The Platform collects anonymous browsing data solely for internal statistical purposes:
- Page viewed (Home, Services, Elected Representatives, a specific service page, an elected representative’s page, feedback form);
- Language selected by the user;
- Anonymous session ID (see Article 3 below);
- Time stamp of the visit.
This data does not allow a visitor to be personally identified. No IP addresses are recorded. No advertising profiles are created.
Legal basis: Legitimate interest (Article 6(1)(f) of the GDPR) — improving the service and understanding the needs of Anderlecht’s residents.
Article 3 — Use of the browser’s local storage (localStorage)
The anderlecht.eu Platform uses the user’s browser’s local storage (localStorage) mechanism. Unlike traditional cookies, localStorage does not automatically send any data to the server with every request and is not accessible to third parties.
The data stored in your localStorage by the Platform is as follows:
| Stored key | Value | Purpose | Duration |
|---|---|---|---|
ae_sid |
A random, anonymous universal unique identifier (UUID v4), in the format ae_9f3a2b1c-… | Anonymous identification of the browsing session for statistical purposes (counting unique visitors without using personal data). Prevention of multiple review fraud. | Persistent (until the cache is manually cleared) |
ae_lang |
Selected language code (e.g. fr, nl, en…) | Stores the user’s language preference so that the Platform is displayed in their chosen language during subsequent visits. | Persistent (until modified or deleted) |
These trackers are strictly necessary for the service to function. They are not used for any advertising purposes, are never shared with advertisers or targeting networks, and do not allow a personal profile to be reconstructed. They do not require prior consent in accordance with Article 5.3 of Directive 2002/58/EC (ePrivacy) and the guidelines of the Belgian Data Protection Authority (APD).
Users may delete this data at any time by clearing their browser’s localStorage (via their browser settings > Privacy > Clear site data). This action will reset their language preferences and session ID.
Article 4 — No advertising cookies or cross-site tracking
The anderlecht.eu platform does not use any advertising cookies, tracking pixels or cross-platform behavioural analytics tools (such as Google Analytics or Facebook Pixel). No browsing data is shared with advertising platforms. No commercial profile is created based on your visits.
Article 5 — Data retention period
| Type of data | Retention period |
|---|---|
| Published reviews and opinions (username, rating, comment, neighbourhood) | Until deleted by the user or the administrator, or until the Platform is closed |
| Google account data (name, email address) | For the lifetime of the account; may be deleted on request by emailing contact@anderlecht.eu |
| Anonymous browsing data (statistics) | 36 rolling months, then automatically deleted |
| localStorage data (ae_sid, ae_lang) | Stored locally on the user’s device — not retained on our servers beyond the session |
Article 6 — Data recipients and data processors
The data collected is intended exclusively for the anderlecht.eu Platform team. It is never sold, rented or transferred to third parties for commercial purposes.
The technical data processors we use are:
| Service provider | Role | Location |
|---|---|---|
| OVH SAS | Server and database hosting | France (EU) — Roubaix |
| DeepL AG | Automatic translation of comments | Germany (EU) — Cologne |
| Google LLC (via OAuth2) | Social authentication service | United States (transfer governed by a standard contractual clause) |
Each of these service providers is bound to anderlecht.eu by a data processing agreement that complies with the requirements of Article 28 of the GDPR.
Article 7 — Data transfers outside the European Union
The use of Google LLC (OAuth2 authentication) involves a transfer of data to the United States. This transfer is governed by the Standard Contractual Clauses (SCCs) adopted by the European Commission (Implementing Decision 2021/914), which guarantee an adequate level of protection for your personal data.
All other processing activities (hosting, database management, DeepL translations) are carried out within the European Union.
Article 8 — Users’ rights
In accordance with Regulation (EU) 2016/679 (GDPR) and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, you have the following rights:
- Right of access (Art. 15 GDPR): You may obtain confirmation as to whether personal data concerning you is being processed and receive a copy of such data.
- Right to rectification (Art. 16 GDPR): You may request the correction of any inaccurate data concerning you.
- Right to erasure / right to be forgotten (Art. 17 GDPR): You may request the removal of your published reviews and your account, as well as the erasure of all associated data.
- Right to restriction of processing (Art. 18 GDPR): You may request the temporary suspension of the processing of your data in certain circumstances.
- Right to data portability (Article 20 of the GDPR): You may receive your data in a structured, machine-readable format.
- Right to object (Article 21 of the GDPR): You may object to the processing of your data on the grounds of legitimate interests.
To exercise any of these rights, please send a written request to: contact@anderlecht.eu. We undertake to respond within a maximum of one (1) month from receipt of your request (this period may be extended by a further two months in the case of complex or multiple requests, subject to prior notification).
Article 9 — Right to lodge a complaint with the DPA
If you believe that the processing of your personal data by anderlecht.eu does not comply with the applicable regulations, you have the right to lodge a complaint with the Belgian Data Protection Authority (APD):
- Website: www.autoriteprotectiondonnees.be
- Postal address: Rue de la Presse 35, 1000 Brussels
- Telephone: +32 (0)2 274 48 00
- Email: contact@apd-gba.be
This right is exercised without prejudice to any other administrative or judicial remedy.
Article 10 — Data security
The Platform implements appropriate technical and organisational measures to protect your data against unauthorised access, disclosure, alteration or destruction, including:
- Secure connection via the HTTPS/TLS protocol;
- Access to the database restricted by authentication;
- Separation of roles (administrator/user);
- No storage of passwords in plain text;
- Infrastructure hosted on ISO 27001-certified OVH servers.
Article 11 — Amendments to this policy
This privacy policy may be updated to reflect any changes to applicable regulations or the Platform’s practices. The date of the last update is indicated in the header of this document. In the event of a substantial amendment, users will be informed via a notification displayed on the Platform.
Article 12 — Contact and Data Protection Officer
If you have any questions regarding the protection of your personal data or wish to exercise your rights, please contact us at: contact@anderlecht.eu.
Note: Given the size and nature of the Platform, the appointment of a Data Protection Officer (DPO) is not mandatory under Article 37 of the GDPR. The data controller fulfils this role directly.