eBox Privacy statement via the FPS BOSA, DG Simplification and Digitalisation
The Federal Public Service Policy and Support, Directorate-General for Simplification and Digitalisation, (hereinafter: “DG Simplification and Digitalisation”) takes care to protect your privacy and in this regard operates at all times in accordance with the stipulations of the General Data Protection Regulation (EU) 2016/679 (GDPR). Read this Privacy Statement to find out more about the way in which personal data are collected and processed in connection with this service.
The DG Simplification and Digitalisation unlocks the eBox itself via various channels, namely by means of the My eBox portal and via the mobile application myGov.be
The DG Simplification and Digitalisation also relies upon accredited service providers and other authorities to unlock the messages in the eBox. Please also read the privacy statements of these organisations before choosing the services offered by them.
1. Security
The DG Simplification and Digitalisation and the accredited service providers and other authorities unlocking eBox messages are committed to taking all suitable technical and organisational measures in order to protect your personal data from destruction, loss, unintended changes, damage or publication.
To guarantee this security, methods used include encryption of the communication between the server and your computer, encryption of the stored data and periodic backups.
2. Personal data and purposes
To be able to use eBox, you must first register for the purpose of correct identification and authentication. It is not possible to use eBox without being correctly identified and authenticated, as only the correct recipient may obtain access to the correct documents. The data are processed in order to make the messages that are addressed to you available to you on behalf of the senders.
Your details will also be processed for the purpose of sending you service notifications, such as a message concerning service maintenance or in order to let you know that a message is available to you in your eBox. To be notified about the presence of a message in your eBox, you will need to give your permission in most cases. If you do not consult the message, you will automatically receive a reminder within the month. If you do not consult your eBox for one year, the DG Simplification and Digitalisation may deactivate it once it has notified you by sending you a message.
During the registration process, the following data are recorded: your name, your email address, your choice of language, your choice whether you wish to be notified when a new message is available, your digital key and your National Register number. Also, contact details such as those you have entered into the National Register and/or your contact details as collected within the Federal Authentication Service (FAS) may also be used, with your permission, to contact you for the purposes described above. Your email address will be verified by sending a code to your email address at the time when you register and later on at times when we contact you at that address. If you do not provide an email address or if the address turns out to be incorrect, your registration for eBox will end and you will receive your messages on paper once again.
During the registration process, we will display your postcode. If you approve, we will use this in an anonymised way to produce statistics concerning the use of eBox. This means that we will not store or process the data in any way that would allow them to be linked back to you.
In order to receive notifications in your eBox from private providers of qualified trust services informing you that a company or other person has sent you an electronic registered letter, you will be able to give your consent separately.
In order to receive electronic registered messages from a company or another person directly in your eBox via the private-sector providers of qualified trust services, you will be able to give your consent separately as soon as this service is available. If you choose to do so, you can optionally provide the following information: address, middle name, phone number(s), additional email address and year of birth. These details will only be used to identify you for the purpose of delivering electronic registered messages and will never be shared with third parties.
A private provider of qualified trust services may, with your explicit approval, provide the DG Simplification and Digitalisation with some items of data about you. The DG Simplification and Digitalisation will use those items of data only in order to identify you for the purpose of delivering the notifications or the electronic registered messages themselves. The data concerned consist of the following: name, last name, email address and optional address, middle name, phone number(s), additional email address, year of birth, National Register number if the sender has authorisation to pass the number to the DG Simplification and Digitalisation and the DG Simplification and Digitalisation has authorisation to use the National Register number for purposes of identification and authentication.
3. Processing of personal data
The processing of your data during your registration and during your use of the eBox is justified on the basis of Article 9 in the Act of 27 February 2019 on the electronic exchange of messages via the eBox (the "eBox Act") in which the DG Simplification and Digitalisation is designated as the data controller for the processing of personal data necessary for the management and for ensuring the proper functioning of the eBox it provides. Article 8 of the eBox Act provides the statutory/legal basis for the use, by the DG Simplification and Digitalisation, of the National Register number and for the use of your contact details.
These data are processed in order to identify and authenticate you correctly so that you can use eBox and so that messages can be provided to you in your eBox. They are also used for service announcements, possibly to notify you if a new message is present in your eBox, if the message is not consulted or before deactivation if your eBox is not consulted for an extended period of time. These processing operations will also be carried out by the DG Simplification and Digitalisation if you consult eBox messages via My eBox or via any other channel operated by DG Simplification and Digitalisation. These processing operations will stop when you explicitly stop using the eBox, upon deactivation of your eBox or upon your death.
As for the processing required for each individual provision of messages, Article 10 of the eBox Act designates the senders as data controllers. In that capacity, they determine to whom a message is sent as well as the content and retention period of the messages made available.
The DG Simplification and Digitalisation relies upon accredited service providers who act as data controllers for the data needed to unlock the messages in the eBox in accordance with Article 11 of the eBox Act. Accredited service providers must comply with the obligations in the Royal Decree establishing the conditions, procedure and consequences of accrediting service providers for the electronic exchanging of messages via eBox. Other authorities can also unlock messages in the eBox once they have fulfilled similar requirements. They too will act as data controllers for the data needed to access the messages in the eBox. These accredited service providers or other authorities can only unlock the messages for you and notify you about them after you explicitly opt for that. They cannot access your messages unless you explicitly agree to that. After they are accredited, they can use your National Register number in accordance with Article 11 of the eBox Act to identify you when offering the service. The other authorities can use your National Register number to identify you when providing the service if they have the necessary legal basis with which to do so.
They receive information from the DG Simplification and Digitalisation about the presence of a message in the eBox and about the read status of a message, so they can notify you, if possible, when a new message is present in your eBox, if the message is not consulted or before deactivation if your eBox is not consulted for a long time.
After receiving your data from the private provider of qualified services and after establishing your identity on the basis of that data (by comparing them with the data available to the DG Simplification and Digitalisation), the DG Simplification and Digitalisation will provide a meaningless identification number to the private provider of qualified trust services. The private provider of qualified trust services will use the temporary meaningless identification number to send the notification or electronic registered message to your eBox. The DG Simplification and Digitalisation will retain the link between your National Register number and the meaningless identification number until the message has been delivered to the addressee and, no later than six months thereafter, will delete the data which the private provider of qualified trust services provided about you as well as your temporary identification number.
You can manage or withdraw your consents for the use of the eBox, to choose an accredited service provider or other authority to receive your messages, to receive notifications from private providers of qualified trust services, or to receive electronic registered messages from companies or other individuals in your eBox at any time via ‘CSAM my permissions’.
As provided for by the GDPR, you may obtain further information on the processing procedures by contacting the DG Simplification and Digitalisation via the contact details shown below.
4. Cookies
eBox makes use of ‘cookies’ – small amounts of data that are placed on your computer by the browser.
The cookies are used to remember your preferred language, to identify you while you are using the eBox service and to collect non-personalised statistics concerning the use of this service.
You can disable the use of cookies in your browser, but this will mean that certain parts of the service will not be usable.
The session cookie is only active during your visit.
The cookie that stores your preferred language will continue to be valid until you log out or for as long as you have not deleted it via the cookie control settings.
5. Log files
Besides the data mentioned above and while you are using the eBox service, the DG Simplification and Digitalisation will record your IP address, your browser and operating system, the external service which referred you to this service and the date and time of each page you visited. This information is collected for statistical purposes only and for the further improvement of the service. The details collected in this way will never be linked to the personal data about you that are collected during the registration procedure.
In accordance with Article 4 of the eBox Act, the DG Simplification and Digitalisation will record this information in a secure manner so that for a period of 10 years, the following legal obligations can be met:
- to unambiguously establish the time of transmission and receipt;
- to record proof of transmission and receipt of the message in the system and make that available;
- to record the identity of the user and addressee, the time of transmission and receipt, the notification and the unique number assigned to the message;
- to identify system errors and record the times when system errors prevent transmission or receipt and to make that information available to stakeholders.
6. Right of access, amendment and rectification − erasure of data and restriction of processing
As provided for by the GDPR, you can consult your personal data processed by the DG Simplification and Digitalisation or obtain information about the processing procedures at any time. You may correct your personal data free of charge by contacting the DG Simplification and Digitalisation via the contact details below or by correcting them yourself via your eBox. You also have the right to delete your personal data or have them deleted, or to have specific types of processing stopped. In some cases, you will then no longer be able to use eBox.
Everyone has the right to file a complaint with the Data Protection Authority. The DPA can be reached at:
Telephone: +32 (0)2 274 48 00
Fax: +32 (0)2 274 48 35
email: contact@apd-gba.be
7. Changes
The DG Simplification and Digitalisation reserves the right to amend the Privacy Statement at any time. Changes to the Privacy Statement will be announced via the eBox. This Privacy Statement was last amended and reviewed on 17 June 2025.
8. Contact details
The DG Simplification and Digitalisation is responsible for the processing of these personal data and employs a data protection officer who ensures the confidentiality and security of the data, as well as compliance with the requirements of the GDPR. Should you have any queries relating to data protection and privacy, you can contact the data protection officer by sending an email to dpo@bosa.fgov.be . You can send details of incidents and complaints to dpo@bosa.fgov.be.
You can contact the DG Simplification and Digitalisation at the following address: FPS BOSA, DG Simplification and Digitalisation, Boulevard Simon Bolivar 30, 1000 Brussels, at info@bosa.fgov.be or by calling +32 (0)2 740 74 74.