Your privacy rights

When we process your personal data, you have several rights. Would you like to know what these rights are and how you can exercise them? You can find an overview of your privacy rights below, including how to submit a request. 

Depending on the type of processing and the lawful basis, you have various privacy rights. These rights are explained below:

• right of access to the personal data that BNG processes about you;
• right to rectification, if your data is inaccurate or incomplete;
• right to erasure of your data (‘the right to be forgotten’). There are exceptions to this right, such as if your data are still necessary in connection with the purposes for which we process it or because of a statutory retention period;
• right to (temporary) restriction of data processing, for example if you believe that your data is inaccurate;
• right to object to the data processing, if the processing of your data is based on a legitimate interest, for example in regards to direct marketing;
• right to data portability if the processing is based on an agreement with you or on your consent;
• right not to be subjected to automated decision-making without human intervention, if such decisions produce legal effects concerning you or otherwise significantly affect you
• right to withdraw consent if the processing is based on your consent. A withdrawal does not affect the validity of processing of personal data that took place before the withdrawal.

If you wish to make use of your rights, we ask you to be as specific as possible.

How can you exercise your rights?

You can submit your request by email or post:

• By email: privacy-office@bngbank.nl
• By post: BNG, t.a.v. Privacy Office, Postbus 30305, 2500 GH Den Haag

We will respond as soon as possible to your request to exercise your privacy rights, but in any event within one month. In exceptional cases, this period may be extended by up to two months, for example if your request is complex or if you exercise several rights at the same time. If an extension is required, we will inform you within the first month and explain the reason for the delay.

In order to properly assess your request, it must be clear which right you want to exercise and the channel (e.g. by email or post) through which you want to receive the information. In some cases, we may ask you for additional information.

It may not always be possible for us to comply with a request, for example if a legal obligation or a legitimate interest prevents us from doing so. If this is the case, we will inform you and explain our decision.

Verifying identity

When you submit questions or requests in relation to your privacy rights, we will first verify your identity. In this way, we ensure that your personal data does not end up with the wrong party and that no incorrect changes are made. If we cannot verify your identity in a secure digital manner, we may ask you to visit our office for an additional check.

Dutch Data Protection Authority

If you are not satisfied with our response, you can file a complaint with the Dutch Data Protection Authority. However, we would appreciate it if you contact us first so that we can look for a solution together. The contact details of the DPA can be found on the DPA’s website.