Data Protection Notice Infrabel
Last revised on May 16th, 2025
Main changes with respect to the previous version: We changed the name of privacy policy to data protection notice, clarified the structure and format of this data protection notice, added drones to the title of the section on cameras, updated the procedure on how individuals can communicate with Infrabel to exercise their rights and the right of access;
This date protection notice (the "Notice" or the "Data Protection Notice") describes how Infrabel collects, uses, consults or otherwise processes a natural person's Personal Data. For the purposes of this Notice, any reference to "Infrabel", "we" or "us" refers to Infrabel SA, registered at the Crossroads Bank for Enterprises under number 0869.763.267, having its registered office at Place Marcel Broodthaers 2, B-1060 Brussels, telephone number +32 (0)2 525.22.11, email address internet@infrabel.be. In all situations described in this Notice, Infrabel will process your Personal Data as a dpo@infrabel.be.
TUC RAIL is a subsidiary of Infrabel. TUC Rail's privacy notice is similar to Infrabel's Data Protection Notice. The latest version of TUC Rail's privacy notice can be found here.
We are committed to protecting the privacy of our users and customers. The purpose of this Data Protection Notice serves to inform you about how we collect, define and use information that would allow us to identify you, such as your name, email address or other contact information, online identifiers such as IP address or any other information you provide to us when using our website or our services.
We therefore ask you to take a moment to read this Data Protection Notice carefully. It describes various data processing operations (including those related to your use of our website, your use of our contact forms and the use of our chatbot).
Our "website" means our main website www.infrabel.be and the sub-websites for which no specific data protection notice exists (such as www.info.infrabel.be or www.press.infrabel.be) or the external websites owned by us that link to this Data Protection Notice (such as www.destrafsteploeg.be). If the website in question does contain a data protection notice, this Data Protection Notice takes precedence over our "website" (e.g. www.jobs.infrabel.be and https://opendata.infrabel.be).
It will be updated periodically to reflect any changes in statutory requirements, processing or new features or services we may add. These changes will be announced through our information channels (including our website) and will take effect upon their announcement.
"Data Protection Legislation" shall refer to Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR"), as well as any other legislation and/or regulation introduced pursuant to the GDPR and the e-Privacy legislation, or which implements, amends, replaces or consolidates them or any one of them, and any other applicable legislation relating to the processing of Personal Data and privacy.
Below are the details of the various types of processing of Personal Data.
1. WEBSITES, APPS AND SOCIAL MEDIA
2. LOCAL RESIDENTS
3. CAMERASAND DRONES
4. RAIL SAFETY
5. COMMUNICATION
6. HUMAN RESOURCES
EXERCISING YOUR RIGHTS
If, as a local resident or any other affected third party, you wish to exercise your rights under the GDPR, first of all, you can contact:
- Infrabel's Media team, who will follow up on all of your requests. To do so, please use send an e-mail to contact@infrabel.be.
- Infrabel's account management team for requests related to the Partners Portal. To do so, please send an e-mail to accountmanagement@infrabel.be.
As an organisation, Infrabel is obliged to respond to your request within 1 month. If your request is complex, or if you have sent multiple requests, Infrabel may extend this deadline by 2 months. Infrabel will inform you of this extension and give its reasons within the first month of your request.
If you have not received a response within 1 month of your request, or you are not satisfied with the response you received, please contact the Data Protection Officer (DPO) with questions and concerns about the protection of your data, requests to exercise your rights, or any complaints you may have. To do so, please send an e-mail to dpo@infrabel.be. You can also send a letter to: Infrabel, C/O Data Protection Officer, Marcel Broodthaersplein 2, 1060 Brussels.
You also have the right as a data subject to lodge complaints with the supervisory authority. For Belgium, that is the Belgian Data Protection Authority. Should you have any concern, we of course encourage you to contact us in the first place but, to the extent that this right applies to you, you are entitled to lodge your complaint directly with the Data Protection Authority. You can find more information at: Klacht indienen | Gegevensbeschermingsautoriteit.
RIGHT TO WITHDRAW YOUR CONSENT
Wherever we rely on your consent, you will be able to choose to withdraw that consent at any time and on your own initiative by contacting us here. Withdrawing your consent does not affect the lawfulness of the processing based on your consent until the time of your withdrawal.
RIGHT TO ACCESS AND RECTIFY YOUR DATA
You have the right to access and rectify your Personal Data. You are entitled to ask us for a copy of your information and, if necessary, to have it corrected. If you wish to correct such information as your name, address, email address and/or any other data or preferences, you can easily do so by contacting us.
RIGHT TO ERASURE
In accordance with Data Protection Legislation, you have the right to have your Personal Data processed by us erased as described in this Data Protection Notice, in case it is no longer necessary for the purposes for which it was initially collected or processed, or if you have withdrawn your consent or objected to any processing described in this Data Protection Notice and no other basis for processing exists. If you wish your Personal Data to be erased, a request can be made by contacting us.
RIGHT TO RESTRICTION OF PROCESSING
Under certain circumstances, described in the Data Protection Legislation, you may ask us to restrict the processing of your Personal Data. This is the case, for example, if you dispute the accuracy of your Personal Data. In this case, we will restrict processing until we are able to verify the accuracy of your data.
RIGHT TO OBJECT TO PROCESSING
Under certain circumstances, described in the Data Protection Legislation, you may object to the processing of your Personal Data, including but not limited to when your Personal Data is processed for direct marketing purposes.
RIGHT TO DATA PORTABILITY
Where the processing of your Personal Data is carried out through automated processes and is based on your consent or the execution of a contract between you and us, you have the right to receive your Personal Data processed by us in a structured, common and machine-readable form and to transfer your Personal Data to another service provider.
We have put in place appropriate technical and organisational measures to ensure an appropriate level of security for your Personal Data. These measures include (but are not limited to) encryption techniques, physical and IT system access controls, confidentiality obligations, and so forth.
In the event that Personal Data is compromised as a result of a Personal Data Breach, and where such a breach is likely to pose a risk or high risk to the rights and freedoms of individuals, we will make the necessary notifications as provided for in the Data Protection Legislation.
We do not knowingly collect or solicit Personal Data from persons under the age of 16, except with the consent of a child's statutory representative, and in specific cases.
Should we become aware that we have collected Personal Data from a child under the age of 16, without verification of parental consent, we will take steps to ensure deletion of this data as soon as possible. If you believe we (may) have collected data from/about a child under the age of 16, please contact us.
We only share or disclose information, including to Third Parties, as described in this Data Protection Notice.
In addition, your Personal Data will also be shared with government authorities and/or police officers when necessary for the purposes described above, if mandated by law or if required for the legal protection of the Data Controller's legitimate interests in accordance with applicable law.
For the purposes described in this Data Protection Notice, your data will generally be held within the European Economic Area ("EEA") and will only be transferred to a country or countries outside the EEA that is or are recognised by the European Commission as providing an adequate level of data protection. In the event that your data were to be nevertheless be transferred to or held in a country outside the EEA that is not recognised as providing an adequate level of protection, Infrabel will take appropriate security measures to ensure that the transfer complies with the requirements of the Data Protection Legislation.
If you would like more information on how Infrabel applies the above in relation to your Personal Data, please contact us.
We will retain your Personal Data for as long as necessary to fulfil the processing activities set out in this Data Protection Notice, as long as you have otherwise been notified or as long as permitted by applicable law.
Infrabel reserves the right to occasionally update and/or make changes to this Data Protection Notice. We will draw your attention to these changes where they involve a fundamental change to the processing or where the changes are relevant to the nature of the processing or are relevant to you and affect your data protection rights.
If you have questions, requests, comments or complaints regarding this Data Protection Notice, please do not hesitate to contact us via:
dpo@infrabel.be
or
Infrabel SA Data Protection Officer
Place Marcel Broodthaers 2
B-1060 Brussels