{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"Privacy notice (GDPR art. 13 and 14) - Belgium","description":"The information a controller gives to the persons whose data it processes: collected from them (art. 13) or obtained elsewhere (art. 14). audience chooses who the notice addresses (customers, website visitors, staff or job candidates); each element of processing is one purpose.","type":"object","required":["audience","collection_mode","controller","processing","automated_decisions","rights_contact"],"additionalProperties":false,"properties":{"audience":{"type":"string","enum":["customers","website_visitors","staff","candidates"],"description":"Who the notice addresses: customers, visitors of the website, members of staff or job candidates."},"collection_mode":{"type":"string","enum":["direct","indirect"],"description":"direct: the data are collected from the person (art. 13). indirect: the data were not obtained from the person (art. 14)."},"notice":{"type":"object","additionalProperties":false,"properties":{"reference":{"type":"string","description":"Internal reference or version of the notice."},"updated_on":{"type":"string","format":"date","description":"Date of this version of the notice."}}},"controller":{"type":"object","required":["name","enterprise_number","address","contact"],"additionalProperties":false,"properties":{"name":{"type":"string","minLength":1},"enterprise_number":{"type":"string","pattern":"^[01][0-9]{3}\\.[0-9]{3}\\.[0-9]{3}$"},"address":{"type":"string"},"contact":{"type":"string","description":"Contact details as they should be printed (e-mail address, telephone or postal address)."},"seat_region":{"type":"string","enum":["nl_region","fr_region","brussels","de_region"],"description":"Linguistic region of the operating seat of the employer (Flemish decree of 19 July 1973, decree of the French Community of 30 June 1982, coordinated laws of 18 July 1966, art. 52). Compared with the language of the document: a warning when they do not match."}}},"representative":{"type":"string","description":"Identity and contact details of the controller's representative, where there is one."},"dpo_contact":{"type":"string","description":"Contact details of the data protection officer, where one is designated."},"processing":{"type":"array","minItems":1,"items":{"type":"object","required":["purpose","legal_basis","data_categories","retention"],"additionalProperties":false,"properties":{"purpose":{"type":"string","minLength":1},"legal_basis":{"type":"string","enum":["consent","contract","legal_obligation","vital_interests","public_task","legitimate_interests"],"description":"The condition of art. 6, paragraph 1, points a) to f), relied on for this purpose."},"legitimate_interests":{"type":"string","description":"The legitimate interests pursued, when the legal basis is legitimate_interests."},"data_categories":{"type":"array","minItems":1,"items":{"type":"string"}},"recipients":{"type":"array","items":{"type":"string"},"description":"Recipients or categories of recipients. An empty list states that there is none."},"retention":{"type":"string","minLength":1,"description":"The retention period or, when that is not possible, the criteria used to determine it."},"transfers":{"type":"string","description":"Where data are transferred to a third country or an international organisation: the destination, the adequacy decision or the safeguards and how to obtain a copy of them."},"provision_requirement":{"type":"string","enum":["statutory","contractual","contract_condition","not_required"],"description":"Direct collection: whether providing the data is a statutory or contractual requirement, a requirement to enter into a contract, or not required."},"non_provision_consequences":{"type":"string","description":"Direct collection: the possible consequences of failure to provide the data."},"direct_marketing":{"type":"boolean","description":"Whether this purpose is direct marketing (art. 21 (2))"}},"allOf":[{"if":{"properties":{"legal_basis":{"const":"legitimate_interests"}},"required":["legal_basis"]},"then":{"required":["legitimate_interests"]}}]}},"recruitment":{"type":"object","additionalProperties":false,"description":"Candidate audience: the vacancy, whether unsuccessful applications are kept, and the tests used.","properties":{"vacancy_reference":{"type":"string","description":"Reference of the vacancy the application concerns."},"talent_pool":{"type":"boolean","description":"Whether unsuccessful applications are kept for other vacancies."},"talent_pool_retention":{"type":"string","description":"How long and on what basis the talent-pool applications are kept, in the user's words."},"assessment_methods":{"type":"array","items":{"type":"string"},"description":"Tests, assessments or reference checks used in the selection."}},"allOf":[{"if":{"properties":{"talent_pool":{"const":true}},"required":["talent_pool"]},"then":{"required":["talent_pool_retention"]}}]},"source_of_data":{"type":"string","description":"Indirect collection: the source from which the data originate."},"publicly_accessible_source":{"type":"boolean","description":"Indirect collection: whether the data came from publicly accessible sources."},"automated_decisions":{"type":"object","required":["exists"],"additionalProperties":false,"properties":{"exists":{"type":"boolean","description":"Whether there is automated decision-making, including profiling, referred to in art. 22 (1) and (4)."},"logic":{"type":"string","description":"Meaningful information about the logic involved."},"significance":{"type":"string","description":"The significance and the envisaged consequences of the processing for the person."}},"allOf":[{"if":{"properties":{"exists":{"const":true}},"required":["exists"]},"then":{"required":["logic","significance"]}}]},"rights_contact":{"type":"string","minLength":1,"description":"Where the person exercises the rights (e-mail address, form or postal address)."},"supervisory_authority":{"type":"object","additionalProperties":false,"properties":{"address":{"type":"string","description":"Postal address of the Data Protection Authority as it should be printed."},"website":{"type":"string","description":"Website of the Data Protection Authority as it should be printed."}}}},"allOf":[{"if":{"properties":{"collection_mode":{"const":"indirect"}},"required":["collection_mode"]},"then":{"required":["source_of_data"]}}]}