Belgian Acupunctors Federation (BAF)

Website: https://acupunctuur-baf.be
Last updated: 23 October 2026
This policy replaces the previous privacy statement dated 22 May 2018.

1. Introduction

The Belgian Acupunctors Federation (BAF) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how BAF collects, uses, stores, shares and protects personal data when you visit our website, contact us, apply for membership, use our member services, register for activities, subscribe to communications or purchase products or services.

BAF processes personal data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and applicable Belgian data protection legislation.

This Privacy Policy applies to website visitors, BAF members, membership applicants, event participants, customers, newsletter recipients and other individuals who interact with BAF.

2. Who is responsible for your personal data?

The controller responsible for the processing of personal data described in this Privacy Policy is:

Belgian Acupunctors Federation (BAF)
Zamenhoflaan 5
2900 Schoten
Belgium

Company number: BE 0847.292.525
Email: info@acupunctuur-baf.be
Website: https://acupunctuur-baf.be

For questions about the processing of your personal data or to exercise your rights under the GDPR, please contact us using the email address above.

3. What personal data do we collect?

The categories of personal data processed by BAF depend on your relationship with the federation and the services you use.

3.1 Website visitors

When you visit our website, certain technical information may be processed, including:

IP address;
Browser type and device information;
Operating system;
Date and time of website access;
Pages requested and technical server logs;
Cookie preferences and consent records.

This information is used where necessary to operate, secure and maintain the website and to manage cookie preferences.

3.2 Members and membership applicants

When you apply for or maintain membership with BAF, we may process:

First name and last name;
Email address and telephone number;
Postal address and practice address;
Professional qualifications and information relevant to membership eligibility;
Professional specialisations and practice information;
Membership status, category and relevant membership dates;
Membership applications and supporting documentation;
Membership fees, payment records and related correspondence;
Website account information and access permissions.

We only request information that is relevant and necessary for membership administration, verification or the provision of member services.

3.3 Public practitioner directory

BAF maintains an online directory to help visitors find affiliated acupuncture practitioners.

Depending on the information provided and approved for publication, a member’s public profile may contain:

First name and last name;
Practice name and practice address;
Professional telephone number;
Professional email address;
Website address;
Professional profile information and specialisations.

Information published in the directory is publicly accessible and may be indexed by search engines.

BAF does not intentionally publish private membership administration records, account credentials, payment information or confidential documents in the directory.

Members may contact BAF to request corrections or changes to their public profile.

3.4 Contact forms and correspondence

When you contact us through a website form or by email, we may process:

Your name;
Email address;
Telephone number, if provided;
The content of your message;
Any additional information or attachments you voluntarily submit.

We use this information to respond to your enquiry and manage any necessary follow-up.

Please do not submit medical records, patient files or other sensitive personal information through general website contact forms.

3.5 Orders, payments and invoicing

When you purchase products, pay membership fees or register for paid activities, BAF may process:

Customer or member name;
Billing address;
Email address;
Details of the products or services purchased;
Order number, payment reference and payment status;
Invoice and accounting information.

Payments made through the website are currently handled by direct bank transfer.

BAF does not currently process online card payments through Stripe or a comparable card payment gateway.

Payment information is used to administer orders, reconcile payments, issue invoices and meet accounting obligations.

3.6 Newsletters and federation communications

When you subscribe to or receive BAF communications, we may process:

Your name;
Email address;
Membership status, where relevant;
Communication preferences;
Subscription and unsubscription information.

These communications may include newsletters, BAF Flash updates, professional information, invitations, educational activities and announcements relating to the federation.

3.7 Events, training and educational activities

When you register for an event, course or educational activity, we may process:

Your name;
Email address and contact details;
Membership status;
Registration details;
Attendance information;
Information needed to organise the activity;
Payment and invoicing information, where applicable.

Some event registrations may be collected using external online forms, including Google Forms.

Where an external form is used, the relevant provider may also process technical information in accordance with its applicable privacy terms.

4. Why do we process your personal data?

BAF processes personal data only where there is an appropriate legal basis under Article 6 GDPR.

Purpose	Legal basis
Processing membership applications and administering membership	Performance of a contract or steps requested before entering into a contract
Managing member accounts and access to member services	Performance of a contract
Publishing and maintaining the practitioner directory	Performance of membership arrangements and/or legitimate interests, subject to the applicable publication arrangements
Responding to enquiries and correspondence	Legitimate interests or steps requested before entering into a contract
Processing orders, registrations and payments	Performance of a contract
Maintaining invoices and legally required accounting records	Compliance with a legal obligation
Organising training sessions and events	Performance of a contract or legitimate interests, depending on the activity
Sending essential membership and administrative communications	Performance of a contract or legitimate interests
Sending optional promotional communications	Consent, or another applicable legal basis where permitted by law
Maintaining website security and preventing misuse	Legitimate interests
Using non-essential cookies and similar technologies	Consent, where required by law
Establishing, exercising or defending legal claims	Legitimate interests, where applicable

Where processing is based on legitimate interests, BAF considers the necessity of the processing and the interests, rights and freedoms of the individuals concerned.

Where consent is the legal basis, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Providing certain personal data is necessary to apply for membership, complete an order or access a requested service. If you do not provide the required information, BAF may be unable to provide that service.

5. Membership administration and professional verification

BAF uses personal data to manage membership applications, verify relevant professional information, maintain accurate membership records and provide access to membership-related services.

Membership information may be stored and managed through the federation’s website administration systems.

Access to internal membership information is intended to be restricted to authorised individuals who require that information to perform their responsibilities.

Membership applicants may be asked to submit supporting documentation. Such documents are used for the relevant application or verification process and are not intended for public disclosure.

Where professional insurance forms part of membership arrangements, BAF may need to process or disclose certain member information for insurance administration. Any such disclosure must be limited to the information necessary for that purpose and supported by an appropriate legal basis.

6. Public availability of member profiles

The practitioner directory is intended to help members of the public identify and contact affiliated acupuncture practitioners.

Because directory profiles are publicly accessible, information displayed in a profile may be viewed, copied or indexed by third parties, including search engines.

BAF takes reasonable steps to maintain the accuracy of published information. Members are encouraged to keep their professional details up to date.

Requests to correct, restrict or remove published personal data may be sent to info@acupunctuur-baf.be.

Where information is removed from the BAF website, it may remain temporarily visible in external search engine caches or independent third-party records outside BAF’s direct control.

7. Newsletters and electronic communications

BAF uses email to communicate with members and other individuals who have requested information from the federation.

We distinguish between:

Administrative and membership communications: messages necessary to manage membership, payments, accounts, activities or other services requested from BAF.

Optional newsletters and promotional communications: messages for which consent or another legally permitted basis is required.

Where consent is required, BAF will request it through an appropriate subscription mechanism.

Recipients may withdraw consent or object to direct marketing at any time.

Where an unsubscribe link is available, it may be used to stop the relevant communications. You may also request to unsubscribe by emailing info@acupunctuur-baf.be.

Unsubscribing from optional communications does not prevent BAF from sending messages that are necessary to administer an ongoing membership, order or legal obligation.

8. Cookies and similar technologies

The BAF website uses cookies and similar technologies to support its operation, remember preferences and manage access to website functionality.

Depending on the features used, these may include:

Strictly necessary cookies required for essential website functionality;
Authentication and session cookies for member accounts;
Cookies used by shopping cart and checkout functionality;
Cookies recording your privacy and cookie preferences;
Other cookies or technologies used by integrated third-party services.

BAF uses a cookie consent management solution to provide information about cookies and manage consent where required.

Non-essential cookies requiring consent should not be placed before the relevant consent has been obtained.

You can review or change your cookie preferences through the cookie settings available on the website.

Further information about individual cookies, their providers, purposes and retention periods should be available in the website’s Cookie Policy or cookie declaration.

9. Third-party service providers

BAF uses external service providers to operate its website, manage information and deliver federation services.

Depending on the activity, these providers may include:

Website hosting and email services

Hostinger provides website hosting and email infrastructure.

Website administration and membership systems

The website uses WordPress and integrated tools, including WooCommerce for order administration and directory and membership functionality.

Website forms

Fluent Forms and Elementor may be used to collect and process information submitted through website forms.

Document storage and collaboration

Google Drive may be used for the storage and sharing of federation documents with authorised individuals. Documents previously stored using Dropbox may remain subject to retention or migration arrangements.

Event registration

Google Forms may be used for registrations and information collection relating to events or training activities.

Email distribution

BAF may use email distribution services, including YMLP where still in use, to manage newsletters and invitations.

Maps and location functionality

The website may use OpenStreetMap-based mapping services to display practitioner locations. Depending on the technical configuration, the map service provider may receive information such as an IP address and technical request data.

Accounting and professional services

Relevant personal data may be shared with BAF’s accountant, professional advisers or other authorised service providers where necessary.

BAF assesses the role of each recipient and applies appropriate contractual, organisational and technical safeguards where required by law.

Not every third-party recipient acts as a data processor on behalf of BAF. Some service providers may process data as independent controllers for specific activities.

BAF does not sell personal data to third parties.

10. International data transfers

Certain service providers used by BAF may process personal data outside the European Economic Area (EEA), or may provide access to personal data from outside the EEA.

Where personal data is transferred to a country outside the EEA, BAF will ensure that the transfer is subject to a lawful transfer mechanism where required by Chapter V of the GDPR.

Depending on the circumstances, this may include:

An adequacy decision adopted by the European Commission;
Standard Contractual Clauses approved by the European Commission;
Additional contractual, technical or organisational safeguards where necessary;
Another transfer mechanism permitted by the GDPR.

You may contact BAF for further information about the safeguards applicable to relevant international transfers.

11. How long do we retain personal data?

BAF retains personal data only for as long as necessary for the purpose for which it was collected, unless a longer retention period is required or permitted by law.

The applicable retention period depends on the category of information.

Membership records: retained for the duration of membership and, where necessary, for a limited period afterwards to manage outstanding obligations, enquiries, disputes or legal claims.

Public practitioner profiles: normally maintained while the relevant publication arrangements apply and removed or updated when the publication is no longer justified.

Contact enquiries: retained for as long as reasonably necessary to respond and complete any relevant follow-up.

Newsletter subscriptions: retained while the subscription remains active. Limited information may be retained after unsubscription to ensure that an opt-out request continues to be respected.

Orders, invoices and accounting records: retained for the periods required by applicable Belgian tax, accounting and other legislation.

Event registrations: retained for the time necessary to organise the activity, administer payments and meet applicable recordkeeping requirements.

Technical and security records: retained for a limited period appropriate to operational and security needs.

BAF’s previous general policy referred to a maximum retention period of five years after the last use. This is not an absolute limit for every category of personal data: statutory retention requirements or other lawful grounds may require a different period.

At the end of the applicable retention period, personal data is deleted, anonymised or otherwise handled in accordance with legal requirements.

12. How do we protect your personal data?

BAF takes appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction.

Depending on the relevant system and processing activity, these measures may include:

Restricting access to authorised users;
Using account authentication and access permissions;
Applying software and security updates;
Maintaining appropriate backups and recovery arrangements;
Using secure connections for website communications;
Applying confidentiality obligations to individuals with access to personal data;
Limiting access to internal membership records and documents;
Reviewing security incidents and taking corrective action where necessary.

No online service or information system can be guaranteed to be completely secure.

Where a personal data breach occurs, BAF will assess its impact and comply with applicable notification obligations under the GDPR.

13. Your rights under the GDPR

Subject to the conditions and limitations set out in applicable law, you have the following rights:

Right of access: to obtain information about the personal data we process concerning you and to request a copy.

Right to rectification: to request correction of inaccurate personal data and completion of incomplete data.

Right to erasure: to request deletion of personal data in circumstances provided for by law.

Right to restriction: to request that processing be restricted in certain circumstances.

Right to data portability: to receive certain personal data in a structured, commonly used and machine-readable format and, where applicable, transmit it to another controller.

Right to object: to object to processing based on legitimate interests, subject to the conditions of the GDPR.

Right to object to direct marketing: to object at any time to the processing of your personal data for direct marketing purposes.

Right to withdraw consent: to withdraw consent at any time where processing is based on consent.

Rights concerning automated decision-making: to benefit from the protections provided by the GDPR where applicable to decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise any of these rights, contact:

info@acupunctuur-baf.be

BAF may request additional information where reasonably necessary to verify your identity before responding to a request.

We will respond without undue delay and, in principle, within one month of receiving your request. Where permitted by the GDPR, this period may be extended by up to two additional months due to the complexity or number of requests. You will be informed of such an extension within the initial one-month period.

Requests are generally handled free of charge, subject to the exceptions provided by the GDPR.

Some rights are not absolute. For example, BAF may be legally required to retain certain accounting records even after receiving a deletion request.

14. Complaints

If you have concerns about how BAF processes your personal data, we encourage you to contact us first at info@acupunctuur-baf.be.

You also have the right to lodge a complaint with the Belgian supervisory authority:

Belgian Data Protection Authority
Gegevensbeschermingsautoriteit / Autorité de protection des données

Website: https://www.gegevensbeschermingsautoriteit.be

You may also lodge a complaint with another competent supervisory authority where permitted by the GDPR.

Your right to seek a judicial remedy remains unaffected.

15. External websites and links

Our website may contain links to external websites or services operated by third parties.

BAF is not responsible for the privacy practices or content of websites that it does not control.

We recommend reviewing the privacy policies of external websites before submitting personal data to them.

16. Changes to this Privacy Policy

BAF may update this Privacy Policy to reflect changes in its services, website functionality, processing activities or applicable legislation.

The latest version will be published on https://acupunctuur-baf.be with an updated revision date.

Where required by law, we will provide additional notice or request renewed consent for relevant changes.

17. Contact

For questions about this Privacy Policy, requests concerning your personal data or concerns about data protection, please contact:

Belgian Acupunctors Federation (BAF)
Zamenhoflaan 5
2900 Schoten
Belgium

Company number: BE 0847.292.525
Email: info@acupunctuur-baf.be
Website: https://acupunctuur-baf.be

Last updated: 23 October 2026