Privacy notice

Who is responsible?

Stichting Dutch Aid Foundation, Chamber of Commerce (KVK) number 96823658, is responsible for the personal data DAF itself processes through this website, direct communications, complaints, and its administration.

Our registered office is Dommeldaal 22, 5282 WC Boxtel, the Netherlands. For privacy questions or requests, email info@dutch-aid.nl.

This notice applies to dutch-aid.nl and direct communications with DAF. External websites and platforms also have their own privacy notices.

What personal data do we process?

Depending on what you do, we may process the following types of personal data:

• Contact data: your name, email address, telephone number, and the content of your message when you contact us.
• Complaint and integrity data: information you provide, people involved, documents, our correspondence, assessment, and outcome.
• Donation and administration data: name, contact and payment details, amount, date, payment reference, and information made available to DAF by WhyDonate, a bank, or a payment provider.
• Technical data: IP address, browser and device data, requested page, date and time, referring page, and security or error logs processed by our hosting and security services.
• Preferences: your choice of a light, dark, or automatic colour theme when you save it on your device.

We do not ask for more data than is reasonably necessary. You decide what information to include in a message or complaint. If you give us information about someone else, please consider their privacy.

Purposes and legal bases

DAF processes personal data for these purposes and legal bases:

• Answering questions and staying in contact: our legitimate interest in being reachable and, where applicable, taking steps at your request before a contract.
• Processing, confirming, and recording donations: performance of the donation relationship, our legal accounting and tax duties, and our legitimate interest in accurate fundraising.
• Handling complaints, fraud, and integrity reports: our legitimate interests in accountability, safety, and improvement, legal obligations and, in exceptional emergencies, protection of vital interests.
• Delivering and securing the website and preventing misuse: our legitimate interest in a safe and reliable website and IT environment.
• Processing an optional choice or communication for which we specifically ask permission: your consent. You can withdraw consent for the future at any time.

DAF does not use data from this website for automated decision-making or profiling that produces legal effects.

Service providers and other recipients

We disclose personal data only where needed for a service, our administration, security, or a legal duty. The current website uses:

• Formspree — processes the name, email address, message, and technical data from contact-form submissions and delivers them to DAF.
• WhyDonate — processes online donations and may make donor data available to DAF. WhyDonate and its payment partners also decide for themselves how they process parts of a payment. The donation form is loaded only after you choose to load it.
• GitHub Pages — hosts the static website and may process IP addresses and request logs for delivery and security.
• Cloudflare — provides DNS, proxy, and security services and processes information such as IP addresses and web traffic to deliver and protect the website.
• WhatsApp — If you use WhatsApp, WhatsApp/Meta and your telecom or internet provider process data under their own terms and privacy notices.

DAF may disclose information to banks, payment providers, accountants, IT or legal advisers, insurers, or competent public authorities when necessary or legally required. We do not sell personal data.

Cookies and local storage

DAF does not place analytics or advertising cookies itself. The theme control can store “dark” or “light” under the key “daf-theme” in your browser’s local storage. It remains on your device until you return the setting to automatic or clear browser storage.

Cloudflare may use strictly necessary security mechanisms. The WhyDonate form and any associated cookies or similar technologies are loaded from WhyDonate only after you select the donation-form button. WhyDonate’s cookie and privacy terms then also apply.

Transfers outside the EEA

Some listed providers are based in, or operate from, countries outside the European Economic Area, including the United States. Personal data may therefore be processed outside the EEA. Each provider describes in its privacy notice the transfer basis and safeguards it uses, such as an adequacy decision or European Commission-approved standard contractual clauses. You can ask DAF for more information about safeguards applying to our processing.

Retention periods

We keep data no longer than needed for its purpose and applicable legal duties. This notice uses the following periods:

• Ordinary contact enquiries: up to two years after the last substantive contact, unless earlier deletion is appropriate or longer retention is necessary for an ongoing matter or legal duty.
• Complaints and integrity or safeguarding reports: five years after closure or the last substantive contact, whichever is later, under the approved complaints procedure.
• Donation, payment, and financial administration: generally seven years where required by Dutch tax and record-keeping law.
• Technical security and access logs: as briefly as reasonably necessary for operation, security, and misuse investigations, also subject to GitHub Pages and Cloudflare retention periods.
• Data needed for a legal claim, investigation, or statutory duty may be retained longer for as long as that purpose requires.

Security

DAF takes appropriate technical and organisational measures, including encrypted connections, access restrictions, and carefully selected providers. No method is completely secure. Do not send unnecessary identity documents, medical data, or other highly sensitive information through the general contact form.

Your privacy rights

Where the GDPR applies, you may ask DAF for:

• access to and a copy of your personal data;
• correction of inaccurate or incomplete data;
• erasure or restriction of processing;
• transfer of data you provided, where the right to data portability applies;
• an objection to processing based on a legitimate interest; and
• withdrawal of consent, without affecting earlier lawful processing.

Email your request to the address below. We may ask for more information to establish your identity and normally respond within one month. The GDPR sometimes allows a two-month extension; if so, we will tell you within the first month. A right may be limited where a legal exception applies, for example to protect other people’s rights.

If you are unhappy with how we handle personal data, please contact us first. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Children and sensitive information

This website is not specifically directed at children, and DAF does not knowingly request children’s data directly through the general contact form. If you are under 16, ask a parent or legal guardian for help before sending personal data or donating online. Include sensitive or safety-related information only where necessary; use the route in our complaints procedure for a confidential report.

Changes and contact

We may revise this notice when our activities, services, or legal duties change. The latest version and its revision date will always appear on this page.

Privacy contact