Privacy Statement – ToolBox vzw-asbl
Last updated: 26/10/2026 – version 2.0
ToolBox connects experienced professionals who volunteer their skills ("ToolBoxers") with social-profit organisations. To do this, we need to process personal data. We take this seriously and process your data in line with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Belgian Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data. This statement explains what we do with your data, why, and what your rights are.
1. Who is responsible for your data?
The controller of your personal data is:
ToolBox vzw-asbl, Rue des Douze Apôtres 3, 1000 Brussels. Enterprise number: 0859.563.718 (RPR/RPM Brussels). Privacy contact: privacy@toolbox.be
ToolBox has not appointed a Data Protection Officer, as this is not legally required for our activities. All privacy questions can be sent to the address above.
2. Whose data does this statement cover?
This statement applies to:
🔸ToolBoxers: volunteer experts and candidate volunteers;
🔸Contact persons of organisations that apply for or receive support from ToolBox;
🔸Partners: contact persons at companies, foundations and other partners;
🔸Donors: individuals who make a donation to support ToolBox;
🔸Event participants;
🔸Newsletter subscribers;
🔸Visitors of our website www.toolbox.be.
The controller of your personal data is:
ToolBox vzw-asbl, Rue des Douze Apôtres 3, 1000 Brussels. Enterprise number: 0859.563.718 (RPR/RPM Brussels). Privacy contact: privacy@toolbox.be
ToolBox has not appointed a Data Protection Officer, as this is not legally required for our activities. All privacy questions can be sent to the address above.
2. Whose data does this statement cover?
This statement applies to:
🔸ToolBoxers: volunteer experts and candidate volunteers;
🔸Contact persons of organisations that apply for or receive support from ToolBox;
🔸Partners: contact persons at companies, foundations and other partners;
🔸Donors: individuals who make a donation to support ToolBox;
🔸Event participants;
🔸Newsletter subscribers;
🔸Visitors of our website www.toolbox.be.
3. What data do we process, why, and on what legal basis?
We only collect the data we need for the purposes below:
We do not process special categories of personal data (such as health data or political opinions), and we do not ask for your national register number.
Where we rely on our legitimate interest, we have weighed that interest against your rights and freedoms. You can ask us for more information about this assessment.
4. Where does your data come from?
Most data comes directly from you: when you apply as a volunteer, submit a support request, register for an event, subscribe to our newsletter or contact us. We may also receive data:
🔸 from your organisation, when a colleague names you as its contact person;
🔸from a ToolBoxer or partner who refers you to us;
🔸from the King Baudouin Foundation, when you make a donation to the ToolBox Friends Fund. The Foundation collects and processes donor data, including the data needed for tax certificates, as an independent controller under its own privacy policy. It only shares your name and contact details with us, if you have agreed to this, so that we can thank you and keep you informed;
🔸from public sources, such as your public LinkedIn profile (when you share it with us) or the Crossroads Bank for Enterprises.
🔸from public sources, such as your public LinkedIn profile (when you share it with us) or the Crossroads Bank for Enterprises.
5. Who do we share your data with?
We never sell your data. We only share it in the following cases:
🔸With organisations we match you with (ToolBoxers): when we propose you for an assignment, we share your name, contact details and relevant professional profile with the organisation concerned. In the same way, we share the name and contact details of an organisation's contact person with the ToolBoxers assigned to it.
🔸With other ToolBoxers, through the Member Zone and community activities (see section 3).
🔸With our service providers (processors) that help us run our activities, such as our CRM, website host, mailing, survey and IT providers. They act only on our instructions, under a data processing agreement that obliges them to keep your data confidential and secure (Art. 28 GDPR).
🔸With public authorities, where we are legally required to.
6. Is your data transferred outside the European Union?
Some of our service providers may process data outside the European Economic Area. In that case, we make sure the transfer is protected by an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, for certified companies) or by the European Commission's standard contractual clauses, with additional measures where needed. You can ask us for a copy of the relevant safeguards.
7. How long do we keep your data?
We do not keep your data longer than needed:
🔸ToolBoxers: as long as you are active. We delete your data 5 years after your last activity, except a minimal record (name and assignments carried out) kept to document the history of projects.
🔸Candidate volunteers who are not onboarded: 1 year after the last contact.
🔸Contact persons of organisations: 5 years after the end of the last assignment.
🔸Partners: for the duration of the partnership, and then 5 years.
🔸Donors: 5 years after your last donation.
🔸Accounting and invoicing data: for the statutory retention period, in principle 7 years, unless specific legal obligations require a longer period.
🔸Newsletter: until you unsubscribe.
Event registrations: 2 years after the event.
🔸Contact form messages: 1 year after the question has been handled.
🔸Cookies: see our cookie policy.
8. How do we protect your data?
We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, including access rights limited to the staff who need them, strong passwords and, where possible, two-factor authentication on our systems, and agreements on data protection with our service providers. If a data breach poses a risk to your rights, we will notify the Data Protection Authority and, where required, inform you.
9. What are your rights?
You have the right to:
🔸access your data and receive a copy;
🔸have inaccurate or incomplete data rectified and completed;
🔸have your data erased, unless we must keep it by law;
🔸restrict processing, for example when you contest the accuracy of your data;
🔸data portability: receive the data you provided in a commonly used format, or have it sent to another organisation;
🔸withdraw your consent at any time, without affecting processing carried out before the withdrawal;
🔸object, see below.
Right to object. You can object at any time to processing based on our legitimate interest, for reasons relating to your particular situation. You can also object at any time, without giving a reason, to the use of your data for our newsletter and other communications.
To exercise your rights, email privacy@toolbox.be. We may ask you to confirm your identity. We will respond within one month; this period can be extended by two months for complex requests, in which case we will let you know. Exercising your rights is free of charge. We do not take decisions about you based solely on automated processing, including profiling.
10. Cookies
Our website uses cookies that are strictly necessary for it to work (for example to remember your language choice and to keep forms secure). These cookies do not require your consent.
We only place other cookies, such as analytics cookies or cookies from embedded content (for example videos or social media), if you accept them through our cookie banner. You can change your choice at any time via the "Cookie settings" link at the bottom of each page. Full details of the cookies we use, their purpose and duration are in our Cookie Policy.
11. Photos and video at events
We sometimes take photos or videos at our events to illustrate our activities on our website, social media and annual report. We will always tell you in advance when this happens. Group pictures are taken on the basis of our legitimate interest; you can tell the photographer or us at any time that you do not want to appear. Close-up portraits are only published with your consent.
12. Social media
ToolBox has pages on LinkedIn, Facebook, Instagram and YouTube. When you interact with these pages, the platform also processes your data under its own privacy policy. For page statistics, ToolBox and the platform may be joint controllers; you can exercise your rights with either. We recommend checking your privacy settings on each platform.
13. Questions and complaints
For any question or complaint about how we process your data, contact us first at privacy@toolbox.be. If you are not satisfied with our answer, you have the right to lodge a complaint with the Belgian supervisory authority:
Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels. www.gegevensbeschermingsautoriteit.be / www.autoriteprotectiondonnees.be
You can also lodge a complaint with the supervisory authority of the EU country where you live or work.
14. Changes to this statement
We may update this statement, for example when we change our tools or when the law changes. The latest version is always available on our website, with its date at the top.
This version dates from 26/10/2026
We only collect the data we need for the purposes below:
Purpose | Personal data | Legal basis (GDPR) |
Recruiting, onboarding and managing ToolBoxers. | Surname, first name, contact details (email, phone, address), LinkedIn profile, professional experience, skills, languages in which you can support organisations, availability, gender. | Performance of the volunteer agreement and steps before entering into it (Art. 6(1)(b)). |
Matching ToolBoxers with organisations and following up assignments. | Name, contact details, professional profile, skills, languages; assignment history and feedback. | Performance of the volunteer agreement (Art. 6(1)(b)) and of the agreement with the organisation. |
Handling support requests from organisations and managing assignments. | Name, position and contact details of the contact persons; information about the request. | Performance of the agreement with the organisation (Art. 6(1)(b)); our legitimate interest in communicating with the organisation's representatives (Art. 6(1)(f)). |
Running the ToolBoxer community: Member Zone, directory of members, community events. | Name, contact details, professional profile and skills, visible to other ToolBoxers. | Our legitimate interest in enabling knowledge-sharing between volunteers (Art. 6(1)(f)). You can object at any time (see section 9). |
Publishing your name, photo and LinkedIn profile on our website, in the Member Zone or in our annual report. | Name, photo, LinkedIn profile, short testimony. | Your consent (Art. 6(1)(a)), which you can withdraw at any time. |
Managing partnerships and contributions. | Name, position and contact details of partner contacts; invoicing data. | Performance of the agreement (Art. 6(1)(b)); legal obligation for accounting (Art. 6(1)(c)). |
Organising events and handling registrations. | Name, contact details, organisation, dietary preferences if you choose to share them. | Performance of your registration (Art. 6(1)(b)). |
Sending our newsletter. | Name, email address, language preference. | Your consent (Art. 6(1)(a)); for ToolBoxers and partners, our legitimate interest in informing them about our activities (Art. 6(1)(f)). You can unsubscribe at any time via the link in each email. |
Measuring satisfaction (Net Promoter Score and surveys) | Survey answers | Our legitimate interest in improving our services (Art. 6(1)(f)). Results are only analysed in aggregate, never individually. |
Operating and securing our website. | IP address, browser data, cookies (see section 10). | Our legitimate interest in a secure, working website (Art. 6(1)(f)); your consent for non-essential cookies (Art. 6(1)(a)). |
Answering contact form messages. | Name, email, message content. | Our legitimate interest in replying to your question (Art. 6(1)(f)). |
Complying with legal obligations. | Data required by law (e.g. accounting, tax). | Legal obligation (Art. 6(1)(c)). |
Where we rely on our legitimate interest, we have weighed that interest against your rights and freedoms. You can ask us for more information about this assessment.
4. Where does your data come from?
Most data comes directly from you: when you apply as a volunteer, submit a support request, register for an event, subscribe to our newsletter or contact us. We may also receive data:
🔸 from your organisation, when a colleague names you as its contact person;
🔸from a ToolBoxer or partner who refers you to us;
🔸from the King Baudouin Foundation, when you make a donation to the ToolBox Friends Fund. The Foundation collects and processes donor data, including the data needed for tax certificates, as an independent controller under its own privacy policy. It only shares your name and contact details with us, if you have agreed to this, so that we can thank you and keep you informed;
🔸from public sources, such as your public LinkedIn profile (when you share it with us) or the Crossroads Bank for Enterprises.
🔸from public sources, such as your public LinkedIn profile (when you share it with us) or the Crossroads Bank for Enterprises.
5. Who do we share your data with?
We never sell your data. We only share it in the following cases:
🔸With organisations we match you with (ToolBoxers): when we propose you for an assignment, we share your name, contact details and relevant professional profile with the organisation concerned. In the same way, we share the name and contact details of an organisation's contact person with the ToolBoxers assigned to it.
🔸With other ToolBoxers, through the Member Zone and community activities (see section 3).
🔸With our service providers (processors) that help us run our activities, such as our CRM, website host, mailing, survey and IT providers. They act only on our instructions, under a data processing agreement that obliges them to keep your data confidential and secure (Art. 28 GDPR).
🔸With public authorities, where we are legally required to.
6. Is your data transferred outside the European Union?
Some of our service providers may process data outside the European Economic Area. In that case, we make sure the transfer is protected by an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, for certified companies) or by the European Commission's standard contractual clauses, with additional measures where needed. You can ask us for a copy of the relevant safeguards.
7. How long do we keep your data?
We do not keep your data longer than needed:
🔸ToolBoxers: as long as you are active. We delete your data 5 years after your last activity, except a minimal record (name and assignments carried out) kept to document the history of projects.
🔸Candidate volunteers who are not onboarded: 1 year after the last contact.
🔸Contact persons of organisations: 5 years after the end of the last assignment.
🔸Partners: for the duration of the partnership, and then 5 years.
🔸Donors: 5 years after your last donation.
🔸Accounting and invoicing data: for the statutory retention period, in principle 7 years, unless specific legal obligations require a longer period.
🔸Newsletter: until you unsubscribe.
Event registrations: 2 years after the event.
🔸Contact form messages: 1 year after the question has been handled.
🔸Cookies: see our cookie policy.
8. How do we protect your data?
We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, including access rights limited to the staff who need them, strong passwords and, where possible, two-factor authentication on our systems, and agreements on data protection with our service providers. If a data breach poses a risk to your rights, we will notify the Data Protection Authority and, where required, inform you.
9. What are your rights?
You have the right to:
🔸access your data and receive a copy;
🔸have inaccurate or incomplete data rectified and completed;
🔸have your data erased, unless we must keep it by law;
🔸restrict processing, for example when you contest the accuracy of your data;
🔸data portability: receive the data you provided in a commonly used format, or have it sent to another organisation;
🔸withdraw your consent at any time, without affecting processing carried out before the withdrawal;
🔸object, see below.
Right to object. You can object at any time to processing based on our legitimate interest, for reasons relating to your particular situation. You can also object at any time, without giving a reason, to the use of your data for our newsletter and other communications.
To exercise your rights, email privacy@toolbox.be. We may ask you to confirm your identity. We will respond within one month; this period can be extended by two months for complex requests, in which case we will let you know. Exercising your rights is free of charge. We do not take decisions about you based solely on automated processing, including profiling.
10. Cookies
Our website uses cookies that are strictly necessary for it to work (for example to remember your language choice and to keep forms secure). These cookies do not require your consent.
We only place other cookies, such as analytics cookies or cookies from embedded content (for example videos or social media), if you accept them through our cookie banner. You can change your choice at any time via the "Cookie settings" link at the bottom of each page. Full details of the cookies we use, their purpose and duration are in our Cookie Policy.
11. Photos and video at events
We sometimes take photos or videos at our events to illustrate our activities on our website, social media and annual report. We will always tell you in advance when this happens. Group pictures are taken on the basis of our legitimate interest; you can tell the photographer or us at any time that you do not want to appear. Close-up portraits are only published with your consent.
12. Social media
ToolBox has pages on LinkedIn, Facebook, Instagram and YouTube. When you interact with these pages, the platform also processes your data under its own privacy policy. For page statistics, ToolBox and the platform may be joint controllers; you can exercise your rights with either. We recommend checking your privacy settings on each platform.
13. Questions and complaints
For any question or complaint about how we process your data, contact us first at privacy@toolbox.be. If you are not satisfied with our answer, you have the right to lodge a complaint with the Belgian supervisory authority:
Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels. www.gegevensbeschermingsautoriteit.be / www.autoriteprotectiondonnees.be
You can also lodge a complaint with the supervisory authority of the EU country where you live or work.
14. Changes to this statement
We may update this statement, for example when we change our tools or when the law changes. The latest version is always available on our website, with its date at the top.
This version dates from 26/10/2026
Cookie policy – ToolBox vzw-asbl
Last updated: 26/10/2026 – version 2.0
1. What are cookies?
Cookies are small text files that a website stores on your computer, tablet or phone when you visit it. They allow the site to work properly, remember your choices (such as your language) and, if you agree, help us understand how the site is used. In this policy, "cookies" also covers similar technologies such as local storage and pixels.
Some cookies are placed by ToolBox itself (first-party cookies). Others are placed by third parties whose services we use on our site (third-party cookies).
2. Who is responsible?
ToolBox vzw-asbl, Twaalfapostelenstraat 3 – Rue des Douze Apôtres 3, 1000 Brussels, enterprise number 0859.563.718, is responsible for the cookies placed on www.toolbox.be. For questions, contact privacy@toolbox.be.
3. When do we ask for your consent?
We follow the Belgian rules on cookies (Article 10/2 of the Law of 30 July 2018) and the General Data Protection Regulation (GDPR):
🔸Strictly necessary cookies are placed without consent, because the website cannot work without them.
🔸All other cookies (statistics, embedded content) are only placed after you have given your consent via our cookie banner. Until then, they are blocked.
You can accept or refuse non-essential cookies with a single click. Refusing has no consequences for your use of the site, apart from embedded content (such as videos) that may not be shown.
We keep your choice for 6 months. After that, we ask you again.
4. How can you manage your choices?
🔸Via our cookie banner: you can change or withdraw your consent at any time via the "Cookie settings" link at the bottom of every page. Withdrawing consent is as easy as giving it.
🔸Via your browser: you can also delete cookies or block them in your browser settings. Blocking strictly necessary cookies may prevent parts of the site from working (for example the Member Zone login). Instructions are available on the help pages of your browser (Chrome, Firefox, Safari, Edge).
5. Third parties and transfers outside the EU
When we use third-party services (such as [Google Analytics, YouTube or LinkedIn]), these parties may also process data collected through cookies under their own privacy and cookie policies. Some of them are based outside the European Economic Area. In that case, the transfer is protected by an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, for certified companies) or by standard contractual clauses. We recommend reading their policies:
🔸Google: policies.google.com/privacy
🔸LinkedIn: linkedin.com/legal/privacy-policy
6. Your rights
Where cookies collect personal data, you have the rights described in our [Privacy Statement] (access, rectification, erasure, objection and others). You can also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be.
7. Changes to this policy
We update this policy whenever we change the cookies used on our site. The version number and date at the top show when it was last changed. Earlier versions are available on request at privacy@toolbox.be.
This version dates from 26/10/2026