Privacy statement PGGM
This Privacy Statement PGGM relates to the processing of personal data by PGGM N.V. (“PGGM”). PGGM considers it important that personal data is processed carefully, confidentially, transparently, and in accordance with the General Data Protection Regulation (hereinafter: GDPR) and related laws and regulations.
Tailored Privacy Statement
In this Privacy Statement PGGM, we explain which personal data we process, how we handle personal data, and which rights you have in relation to this processing. In addition to the general Privacy Statement of PGGM N.V., the following specific privacy statements are available:
Privacy Statement PGGM&CO
The Privacy Statement of PGGM&CO can be found on the PGGM&CO website.
Privacy Statement PGGM Employees
Employees of PGGM can find the Privacy Statement PGGM Employees on our intranet. This statement concerns the processing of personal data of PGGM employees.
Privacy Statement PGGM Applicants
PGGM also has a Privacy Statement PGGM Applicants, which applies to the processing of applicants’ personal data.
In specific situations, PGGM may choose to inform data subjects about the processing of personal data by means other than a privacy statement.
As a pension administration organization, PGGM also processes personal data on behalf of pension funds within its Group. The pension funds concerned are listed on our website, www.pggm.nl. For further information, please contact the relevant pension fund directly.
1. Our Processing Activities
We process your personal data in the following situations:
a. Visitors to PGGM
Your host registers your name and visit time in our reception visitor management system in advance so that we can welcome you appropriately upon arrival. In addition, for security reasons, it is important that we maintain an overview of all persons present in our building at all times. These data are deleted after 100 days.
b. CCTV Surveillance at PGGM (Building and Premises)
PGGM uses security cameras in public areas within its buildings and on its premises. Visitors are informed of this through signage. The camera footage is recorded to ensure the safety of our employees and visitors and to protect our property. We have a legitimate interest in doing so.
The footage is retained for a maximum of 14 days and will not be viewed or used unless there is a reason to do so. The footage is not shared with third parties. In the event of an incident, however, the footage may be retained for as long as necessary to handle the incident and may, within the limits of applicable law, be provided to law enforcement authorities in support of the reporting of a criminal offence.
c. Contact via Our Website www.pggm.nl
Our website, pggm.nl, offers various ways to contact us. If you make use of these options, we process the following personal data:
Website News Updates - You may subscribe via a button on our website to receive notifications when we publish new articles. We consider it important to inform anyone who is interested in this way. For this purpose, we process the email address you provide when subscribing. You may unsubscribe at any time, after which we will delete your email address from this service.
woordvoering@pggm.nl - If you are a journalist with a question, you may contact our Media Relations department via woordvoering@pggm.nl. To receive and respond to your email, we process at least your email address, name, and any other personal data you include in your correspondence. The contents of this mailbox are regularly archived for historical purposes, and personal data that are no longer necessary are deleted.
Cookies - When you visit our website(s), we use cookies to improve usability and make the website as relevant and engaging as possible for each visitor. For more information, including the retention periods we apply, please refer to our Cookie Statement on our website.
d. Telephone Conversations
As part of our business operations, telephone conversations may be recorded and/or the content of conversations may be documented in writing. We may also record telephone conversations for evidential purposes. In some cases, we are legally required to record conversations. In addition, we may have a legitimate interest in retaining recordings as evidence. Recordings are retained for a maximum of 30 days and, in the event of a report or legal proceeding, until the conclusion thereof.
PGGM handles these data with care and does not retain recordings longer than necessary or required by law. Naturally, the recordings are not accessible to unauthorized persons within or outside PGGM. We only provide your personal data in connection with this activity to supervisory authorities and/or law enforcement agencies where we are legally obliged to do so.
e. Events
PGGM periodically organizes events to which business relations are invited. Upon registration, invitees provide their name and email address. These data are required to organize the event, including planning and catering purposes.
Personal data are deleted no later than one month after the event has taken place.
f. Suppliers
As part of its business operations, PGGM works with suppliers. In this context, necessary personal data of supplier employees may be processed, such as names, signatures, and contact details. We have a legitimate interest in processing these data because they are required in connection with the agreement with the supplier. The data are retained for up to seven years after the end of the agreement. In exceptional cases, retention may be longer, for example due to warranty periods or legal proceedings.
2. Security of Personal Data
PGGM has implemented appropriate technical and organizational measures to protect your personal data against loss or any form of unlawful processing. PGGM employees only have access to your personal data where necessary for the performance of their duties and are always bound by confidentiality obligations.
3. Disclosure of Personal Data to Third Parties
We may disclose your personal data to third parties where we are legally required to do so, where necessary for the provision of our services, or where you have given your explicit consent. Such third parties may include our external clients (pension funds) and supervisory authorities.
These third parties act as independent controllers, and their own privacy statements apply to their processing of personal data.
In addition, we may engage other companies to support the delivery of our services. These companies act as processors on behalf of PGGM. They receive only the personal data necessary for the performance of their services and may not use such data for any other purpose. PGGM engages third parties only where this is consistent with the requirements of the GDPR and its own privacy policy.
We do not transfer your personal data to parties outside the European Economic Area (EEA) unless this is strictly necessary. In such cases, PGGM will ensure that appropriate safeguards are in place to adequately protect your privacy rights outside the EEA.
4. Your Rights
Under the GDPR, you may request PGGM to:
- provide access to your personal data;
- supplement, correct, or delete your personal data
- restrict the processing of your personal data;
- transfer your personal data to you or to a third party.
You also have the right to object to the processing of your personal data.
These rights are not absolute. We will assess your request in accordance with the GDPR. We may ask you to verify your identity as part of this process. PGGM will inform you of the actions taken in response to your request no later than one month after receiving it. This period may be extended by up to two additional months if necessary due to the complexity of your request or the number of requests received. In that case, we will inform you accordingly.
5. Data Protection Officer and Contact Details
PGGM has appointed a Data Protection Officer (DPO) who oversees the processing of personal data. If you have any questions, comments, or complaints about how PGGM handles your personal data, or if you wish to exercise your rights as a data subject, you may contact the Data Protection Officer at:
PGGM N.V.
Attn. Data Protection Officer
P.O. Box 117
3700 AC Zeist
The Netherlands
Email: Functionaris.Gegevensbescherming@pggm.nl
6. Dutch Data Protection Authority
You always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) regarding the processing of your personal data by PGGM. Further information is available on the website of the Dutch Data Protection Authority.
7. Publication and Amendments
This Privacy Statement is published on the PGGM website. PGGM may amend this Privacy Statement from time to time. The most recent update was made on 23 September 2022. Whenever changes are made, the Privacy Statement will be updated with a new publication date.