Privacy statement
This statement explains which personal data VTK processes on the public website, in the member portal, for tickets and reservations, in logistics tools and for optional face recognition.
Last updated on 18 July 2026.
Who is responsible?
VTK, Vlaamse Technische Kring, Studentenwijk Arenberg 6/1, 3001 Heverlee, Belgium, is the controller. For questions, rights requests or withdrawal of consent, contact it@vtk.be.
Which data do we process?
Depending on the features you use, we process: • account and membership data: name, KU Leuven email, language, r-number, roles and session data • optional profile data: address, date of birth, personal email, email preferences, study profile and profile picture • orders and activities: ticket buyer and attendees, answers, payments and refunds, sandwiches, shifts, equipment and van reservations and related notes • access and security data: card number/name, door events, IP address, browser and technical logs • photo albums: a selfie and biometric face template, but only when you explicitly consent
Purposes and legal bases
We process necessary account, ticket and reservation data to provide the requested service or perform an agreement. Roles, fraud prevention, access control and limited security logs rely on VTK's legitimate interest in operating the association and its systems securely. We retain accounting data where a legal obligation requires it. Mailing categories, optional browser diagnostics and face recognition are used only with consent. You may withdraw consent without affecting earlier lawful processing. VTK does not sell personal data or use it for advertising profiles.
Signing in with your KU Leuven account
When you sign in with your KU Leuven account, the login service of the Associatie KU Leuven shares your name and your verified email address with VTK. We use that email address to link you to your existing VTK account. VTK does not receive your password.
Face recognition in photo albums
This optional feature is disabled by default. If VTK enables it after a data protection impact assessment, you must explicitly consent before every search. The uploaded selfie and its temporary template are deleted after the search, and a cleanup job removes leftovers within one hour. The album index may contain face templates of people shown in photos; questions, objections or deletion requests can be sent to it@vtk.be. No decision with legal or similarly significant effect is made solely by automation.
Who do we share your data with?
We use only parties needed to provide the service: KU Leuven/Associatie KU Leuven for sign-in and card data; our hosting, database, object-storage and email suppliers; Mollie for payments; VTK's managed Immich service for albums; and, only with browser consent, Sentry for diagnostics. YouTube or Vimeo is contacted only when you start external media. The actual suppliers, locations and retention settings are maintained in the processing register. Where data leaves the EEA, VTK must use an adequacy decision or appropriate safeguards such as standard contractual clauses.
How long do we keep your data?
Sign-in sessions expire within 30 days. Technical door and access logs are deleted after 12 months by default; raw diagnostic payloads and delivery details are cleaned after 90 days and fraud fingerprints after 30 days. Account and membership details remain while needed for membership and administration. Ticket, reservation and payment data is then deleted or anonymised, except where accounting or other law requires longer retention. Retention periods are periodically enforced by the privacy maintenance task.
Your rights and choices
In your account you can correct your profile, download a copy of your data and request deletion. Deletion removes the account and anonymises personal details in transactions VTK must retain for legal, financial or integrity reasons. You may also request access, rectification, erasure, restriction, portability or object by emailing it@vtk.be. VTK may verify your identity and normally responds within one month. You may complain to the Belgian Data Protection Authority.
Children and changes
The services are intended for (prospective) students and members. Where a minor's consent is insufficient under applicable rules, a parent or guardian must act. We update this statement when the service or suppliers change; the date above shows the latest material update.