Samen fietsen naar je werk in de Brainportregio

Privacy statement Brainport Bereikbaar

Last updated: 18 September 2026

Brainport Bereikbaar handles personal data with care. In this privacy and cookie statement, we explain which personal data we process, why we do so, with whom we share data, how long we retain data, and what rights you have.

This statement applies to the website www.brainportreachbaar.nl and on the services, newsletters, promotions, events, and projects of Brainport Bereikbaar.

1. Who is responsible?

Eindhoven Metropolitan Area is the data controller for the personal data processed within the framework of Brainport Bereikbaar. This means that Eindhoven Metropolitan Area determines for which purposes and in what manner personal data are used.

Contact details:
Eindhoven Metropolitan Area
Raiffeisenstraat 18
5611 CH Eindhoven

Mailing address:
P.O. Box 985
5600 AZ Eindhoven

Telephone: (040) 259 45 94
E-mail: info@metropoolregioeindhoven.nl
Website: www.metropoolregioeindhoven.nl

For questions about Brainport Bereikbaar or about this privacy statement, you can also contact us via info@brainportbereikbaar.nl.

2. Which personal data do we process?

The personal data we process depends on how you use our website, services, promotions, events, or projects.

We may process the following personal data:

your name;
your position and the organization you work for;
your email address;
your phone number;
data that you enter in a contact, registration, or application form;
the content of correspondence and other information that you provide to us yourself;
details about your subscription to our newsletter;
data about your participation in campaigns, events, and projects;
your communication and interest preferences;
technical data, such as your IP address, browser type, device type, and operating system, insofar as our website or service providers process this data;
data about the use of our website, such as visited pages, referring pages, click behavior, and conversions;
cookie identifiers and similar online identifiers;
data regarding the opening of newsletters and the clicking of links, when you have given permission for this;
any photo or video images taken during events or projects, when there is a valid legal basis for doing so.

We ask you not to provide us with special personal data, such as medical data, religious beliefs, or data regarding origin, via the website. Therefore, do not provide such data unless it is necessary and we have explicitly asked you to do so.

3. For what purposes and on what basis do we use personal data?

Contact and services

When you contact us or request information, support, or a service, we use your data to:

to handle your question or request;
to contact you;
to provide the requested information or services;
to make agreements and execute them;
to administer our communication and services.

Depending on the situation, we process this data because it is necessary for the performance of an agreement or for taking steps prior to an agreement, for the performance of our public duty, to comply with a legal obligation, or due to a legitimate interest in good communication and service provision.

Newsletter and project information

When you subscribe to our newsletter or other periodic communications, we use your email address and any name to send these messages.

The basis for this is your consent. You can unsubscribe at any time via the unsubscribe link in every newsletter. Withdrawing your consent has no effect on the lawfulness of the processing prior to the moment you withdraw your consent.

With your separate consent, we use our newsletter software to measure whether you open our newsletters and which links you click. This data may be linked to your email address and newsletter profile. We use this information to assess the reach and relevance of our newsletters and to improve the content.

We use ActiveCampaign to send and analyze newsletters. ActiveCampaign processes personal data on our behalf.

Events, campaigns, actions and projects

When you register for or participate in an event, campaign, action, or project, we may use your data to:

to process your registration or participation;
to send you information about the activity;
to contact you about the execution;
to record participation, attendance or results;
to handle questions or requests regarding the activity;
to evaluate and justify the activity.

The legal basis is, depending on the activity, your consent, the performance of a contract, the performance of a public task, or a legitimate interest in organizing and evaluating our activities.

If additional personal data is required for a specific action or project, we will inform you about this during registration.

Security and technical management

We may process technical data to:

to ensure the website functions properly and safely;
to prevent and investigate abuse, fraud, and security incidents;
to solve technical problems;
to manage our systems and services.

The basis for this is our legitimate interest in a secure and properly functioning website and, where applicable, compliance with statutory security obligations.

Website analysis and Google Analytics

With your permission, we use Google Analytics to gain insight into the use of our website. This may involve the processing of data regarding visited pages, the device used, the browser, your general location, and how you use the website.

We use this information to improve the functionality, usability, and content of the website. Google Analytics is only activated after you have given consent for analytical cookies, unless the configuration used is permitted without consent according to applicable rules.

Google Ads and conversion tracking

With your permission, we use Google Ads and conversion tracking to assess whether our advertisements and campaigns are effective. This may record that a visitor performs a specific action on our website after viewing or clicking on an advertisement.

Depending on the services configured, Google and we may use data for ad measurement, audience targeting, and personalized ads. Marketing tags and marketing cookies are only activated when you have given your consent.

Google Tag Manager

We use Google Tag Manager to technically manage tags and tracking codes on the website. Google Tag Manager does not independently determine for which purposes data is used. Depending on your cookie choice, services such as Google Analytics and Google Ads can be activated via Tag Manager.

The consent required for an underlying service also applies when that service is loaded via Google Tag Manager.

4. Cookies and similar technologies

Our website uses cookies and similar technologies. Cookies are small files that can be stored on your device when you visit a website, or that allow information to be read from your device.

We can use the following categories:

Necessary cookies

These cookies are necessary for the website to function properly and securely. No permission is required for this. You can block these cookies via your browser, but this may cause parts of the website to not work properly.

Preference cookies

These cookies remember choices, such as language or cookie preferences. We ask for permission when legally required.

Analytical cookies

These cookies help us understand how visitors use the website. When analytical cookies could affect your privacy, we only place them after you have given your consent.

Marketing cookies

These cookies and similar technologies are used for ad measurement, conversion measurement, target audiences, and potentially personalized advertisements. We only place these after you have given your consent.

On your first visit, we ask for your choice via the cookie notice. Non-essential cookies are not pre-selected. You can accept, reject, or set cookies by category.

You can change or withdraw your choice at any time via the 'Change cookie settings' link at the bottom of the website. Withdrawing your consent does not affect the lawfulness of the processing prior to the moment of withdrawal.

5. Embedded content and external websites

Our website may contain embedded content, such as videos, maps, forms, or messages from other websites.

Embedded content may behave as if you are visiting the external provider's website directly. In doing so, the provider may process personal data, use cookies, and measure your interaction with the content.

When consent is required for embedded content, this content is blocked until you accept the relevant cookie category.

Our website also contains links to external websites. When you click on such a link, the privacy statement of the external website applies. We are not responsible for the way in which external organizations handle personal data.

6. With whom do we share personal data?

We do not sell your personal data.

We may share personal data with:

employees and contractors who need the data for their work;
Eindhoven Metropolitan Region and involved cooperation partners, to the extent necessary for the relevant service provision, action or project;
suppliers of hosting, website management, security and ICT;
ActiveCampaign for sending and analyzing newsletters;
Google for website analysis, ad measurement, and Google Ads, to the extent that you have given consent for this;
suppliers of forms, event or project administration;
communication, research, and consultancy agencies working on our behalf;
government agencies or regulators when we are legally required to provide data;
other parties when you have given permission for this.

Where necessary, we enter into a data processing agreement with parties that process personal data on our behalf. In this agreement, we make arrangements regarding the purpose of the processing, confidentiality, security, retention periods, and the use of sub-processors.

When a party independently determines why and how personal data is used, that party is itself the data controller. If necessary, we will inform you about this separately.

7. Social media

Brainport Bereikbaar is active on social media platforms and the website may contain links or buttons to, for example, LinkedIn, Instagram, and YouTube.

When you click on a link to a social media platform, you leave our website. The platform may then process personal data about you. The privacy terms of the relevant platform then apply.

When social media content is embedded directly on our website and requires permission, we will only load this content after you have given permission.

We do not have full control over how social media platforms process personal data. Therefore, please also consult the privacy statement and settings of the relevant platform.

8. Transfer outside the European Economic Area

Some vendors, including Google and ActiveCampaign, may process personal data in countries outside the European Economic Area (EEA), including the United States.

For Google services, Google Ireland Limited is generally our contracting party within the EEA. Google may use other Google entities, data centers, and sub-processors outside the EEA, including in the United States, to provide the services. For such transfers, Google uses the applicable statutory transfer mechanisms and safeguards.

We use ActiveCampaign to send and analyze our newsletters. Depending on the agreement, a European or American entity of ActiveCampaign may be involved in the service provision. ActiveCampaign is part of an international organization and may use group companies and sub-processors outside the EEA, including in the United States.

According to ActiveCampaign's documentation, transfers to the United States may make use of the EU-US Data Privacy Framework and, where necessary, standard contractual clauses approved by the European Commission.

9. How long do we retain personal data?

We do not retain personal data longer than necessary for the purpose for which it was collected, unless a legal obligation or a legitimate necessity requires a longer retention period.

In principle, we apply the following timeframes:

contact requests and ordinary correspondence: a maximum of two years after the last substantive contact, unless the data is part of an ongoing case or agreement;
data for the execution of services, actions and projects: during the execution and for a maximum of two years thereafter, unless a longer period is necessary for accountability, subsidies, disputes or legal obligations;
administrative and financial data: for the applicable statutory retention period, generally eight years;
newsletter data: until you unsubscribe or withdraw your consent;
individual opening and clicking behavior: until you withdraw consent or unsubscribe, after which this data will be deleted or anonymized within a reasonable period;
minimal data on an exclusion list: as long as this is necessary to respect your opt-out or objection;
consent records: for as long as this is necessary to demonstrate that valid consent has been obtained;
Google Analytics data: twenty-four months;
cookie preferences: up to twelve months, after which we may ask for your choice again;
cookies: according to the periods stated in the cookie settings for the relevant cookie or service.

After the retention period has expired, we delete or anonymize the data, unless we still need it for ongoing proceedings or a legal obligation.

10. Automated decision-making

We do not make decisions based solely on automated processing that have legal effects or otherwise significantly affect you.

We may use automated statistics, analyses, and segments to evaluate our website, communications, and campaigns. However, no decision is made that has significant consequences for you without human intervention.

11. Your privacy rights

Depending on the situation, you have the right to:

to know which personal data we process about you;
to gain access to your personal data;
to have incorrect or incomplete data corrected;
to have personal data deleted;
to temporarily restrict processing;
to object to processing;
to receive personal data in a transferable format, when the right to data portability applies;
to withdraw previously given consent;
not to be subjected to certain exclusively automated decisions;
to file a complaint with the Dutch Data Protection Authority.

You can submit a request via info@brainportbereikbaar.nl. Clearly state which right you are invoking and to which processing your request relates.

We may request additional information to verify your identity when reasonably necessary. We do not routinely request a full copy of an identity document and never ask for more information than necessary.

In principle, we will respond to your request within one month. In the case of a complex request or a large number of requests, this period may be extended by a maximum of two months. In that case, we will inform you within the first month.

Are you not satisfied with the way we handle your personal data or your request? Then you can file a complaint with the Dutch Data Protection Authority via www.autoriteitpersoonsgegevens.nl.

12. Security

We take appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, unwanted disclosure, and unauthorized modification.

This includes access security, secure connections, authorizations, up-to-date software, agreements with suppliers, limited retention periods, and procedures for handling security incidents.

Despite these measures, no digital system can guarantee complete security. Do you think personal data is not properly secured, or do you suspect misuse or a data breach? Then please contact us as soon as possible via info@brainportbereikbaar.nl.

Do not send sensitive personal data unsecured via email.

13. Children

Our website and services are not specifically aimed at children under the age of sixteen. We do not knowingly collect personal data from children without the consent of a parent or legal guardian when such consent is legally required.

Do you think that we are processing a child's personal data without valid consent? Then please contact us via info@brainportbereikbaar.nl. We investigate the request and delete the data if there is reason to do so.

14. Changes

We may amend this privacy and cookie statement when our services, the website, suppliers used, or applicable laws and regulations change.

The most recent version is always set to www.brainportreachbaar.nl. The date of the last update is stated at the top of this statement. In the event of significant changes, we may provide visitors or stakeholders with additional information.