This template covers the most common data processing situations for nonprofits in the Netherlands. Work through it in order before you publish.
Step 1: List what you collect. Before touching this document, write down every type of personal data your organisation processes: from website visitors and donors to employees and applicants. This list is your reference point for everything that follows.
Step 2: Pick your sections. The green H2 headers mark sections that only apply to specific situations. Go through them and delete any that don't apply to your organisation.
Step 3: Check for gaps. Compare your list against the sections you kept. If you collect or process something this template doesn't cover, add a section for it.
Step 4: Fill in the blanks. Press Cmd/Ctrl+F and search for [ to find every placeholder. Fill each one in before publishing the privacy statement on your website.
If your organisation has very specific needs or risks, consider having reviewed your privacy policy by a lawyer or a privacy professional before publishing it.
[Organization name] believes it's crucial to handle your personal data with care. In processing personal data, we adhere to relevant laws and regulations, such as the General Data Protection Regulation (GDPR).
It's important for us to clearly and comprehensively explain what we do with your data and what control you have over it. Therefore, in this privacy statement, we extensively outline the data we collect from you and how we handle it. We encourage you to read this privacy statement carefully. We may revise this privacy statement at any time. We recommend that you regularly review this privacy statement to stay informed of any changes.
Last updated on: [Date]
Contact details
Stichting [Organization name]
[Address]
Chamber of Commerce number in The Netherlands: [KvK number]
If you have any questions about the processing of your personal data or about this privacy statement, you can contact us at privacy@[email]. We're here to assist you!
Data controller
[Organization name] (Netherlands) is the data controller for all personal data processing described in this privacy statement.
Concerned parties
We process your personal data when you visit our website, contact us, or if you are a funder, supplier, or business relation. We typically receive this data directly from you or your employer.
Funders
Personal Data
If you become a funder and financially support us, we may process the following personal data:
First and last name
Email address
Phone number
Address details
Financial data
Correspondence, including emails
Other personal data you provide to us
Purpose and Legal Basis
We process your personal data for the following purposes:
Administration (legal obligation)
Personal contact (legitimate interest)
Informing about developments at [Organization name] (legitimate interest)
Mention on our website as a funder (consent)
Retention Period
We retain financial data for at least 7 years in accordance with the fiscal retention period. We retain all other data for the duration of the agreement and at least 5 years thereafter.
Consent
If we process your personal data based on your consent, you can always withdraw it by emailing us at [privacy email].
Relationship management
Personal Data
In the context of relationship management, we may process the following personal data:
First and last name
Email address
Phone number
Company name
Chamber of Commerce (KvK) number
Address details
Correspondence, including emails
Other personal data you provide to us
Purpose and Legal Basis
We process your personal data for the following purposes:
Retaining contact details (legitimate interest)
Making personal contact (legitimate interest)
Building and maintaining a business network (legitimate interest)
Retention Period
We do not retain your data longer than necessary for the benefit of our organization or until you request us to delete it.
Website visitors: cookies
Personal Data
A cookie is a small file that can be stored on your computer, tablet, or smartphone when you visit our website. With a cookie, personal data can be processed. When you visit our website, we may process the following personal data through cookies:
IP address
Location data
Other data for which you have given consent via the cookie banner on our website
Purpose and Legal Basis
We process your personal data for the following purposes:
Improving access to and operation of our website
Providing a good user experience of our website
Offering a personalized experience of our website
Analyzing information for marketing purposes
Where we can achieve these purposes without using personal data or by using only functional cookies, the legal basis for processing lies in the legitimate interest we have in a well-functioning website. This includes functionalities such as the operation of spam filters, the use of caching to make the website faster, and cookies for tracking session and login information.
Where we can only achieve these purposes by using personal data differently, we process your personal data only with your consent. More information about this can be found via the tool we use for this purpose on our website.
Website Analytics
We use [Name analytics tool, e.g. Plausible] to understand how visitors use our website. [In case you use Plausible, you can leave this text:] Plausible is a privacy-focused analytics tool that does not use cookies, does not collect personal data, and is hosted entirely within the European Union. Because Plausible does not process personal data, no consent is required for its use.
If we introduce additional analytics or advertising tools in the future (such as Google Ads, Meta Pixel, or LinkedIn Insight Tag), these may use cookies and process personal data. We will only enable such tools with your explicit consent via the cookie banner on our website, and we will update this privacy statement accordingly.
Social Media and Other Plugins
Using services from other parties sometimes involves placing cookies and sharing data with these parties without us having a choice. We will enable the most privacy-friendly option possible. We have placed 'social media buttons' from LinkedIn and Instagram, among others, on our website. We also embed videos from YouTube and Vimeo on our website. Once you click to play, they may collect data from you via a third-party cookie. This is the most privacy-friendly setting possible that we have set. We have no further control over this. We refer you to the privacy policy of these parties. Some of these parties store data in the United States.
Marketing Cookies
If enabled, we may place marketing cookies from advertising platforms (such as Google Ads, LinkedIn, or Meta) for advertising purposes including retargeting. These cookies will only be placed with your explicit consent via the cookie banner on our website.
IP Address and Web Servers
Your IP address may be stored in the log files of our web server when you visit our website. This is necessary to manage and secure the website correctly. We do not use your IP address to track or record your online behavior. In principle, we are unable to link your IP address to your name, address, or other identifying information unless you provide us with such information and continue to use the same IP address.
Retention Period
Depending on the type of cookies and the reason for placing cookies, cookies are stored either for the duration of the (browser) session or for a longer period. You can actively delete cookies yourself at any time. In that case, no new data will be shared with us or other parties until new cookies are placed (with consent). We have no control over how other parties handle the cookies they place and the data collected via these cookies.
Consent
Via the cookie banner on our website, you can give consent for the placement of non-functional cookies. You can also set your browser to no longer store non-functional cookies or delete all information previously stored through your browser's settings, whether automatically or not.
Consequences of Not Accepting Cookies
You are not obligated to accept cookies. If you set your browser not to store cookies or if you delete information previously stored, whether automatically or not, you may have a less optimal user experience on our website and may not be able to use all functionalities.
Questions and requests
Personal Data
When you contact us by phone, email, via the contact form on our website, or in any other way, we may process the following personal data:
First and last name
Phone number
Email address
Correspondence, including emails
Other personal data you provide to us
Purpose and Legal Basis
We process your personal data for the following purposes:
Contacting you or taking action in accordance with the form you filled out (legitimate interest)
Handling your question or request (legitimate interest)
Retention Period
We will only use your data to handle your question or request. We store all data in our archive. We retain our archive for at least five years.
Newsletter
Personal Data
When you subscribe to our newsletter, we process the following personal data:
First and last name
Email address
Email engagement data (opens, clicks)
Purpose and Legal Basis
We process your personal data to send our newsletter based on your consent (Article 6(1)(a) GDPR). Subscribing is entirely voluntary and requires your explicit opt-in.
Retention Period
We retain your data for as long as you wish to receive the newsletter. We use software to send our newsletter. Unsubscribing from a newsletter means you will no longer receive it. However, your data is not automatically deleted by the software. If you want your data completely removed, please contact us.
Unsubscribe
You can unsubscribe from the newsletter at any time by clicking the unsubscribe link in any email, or by contacting us at [privacy email].
Consent
If we process your personal data based on your consent, you can always withdraw it by emailing us at [privacy email].
Webinars and other free services
Personal Data
When you sign up for a webinar or other free service we offer, we may process the following personal data:
First and last name
Email address
Purpose and Legal Basis
We process your personal data to provide you access to the requested free service (legitimate interest).
Retention Period
We will only use your data to provide access to the requested service. We store all data in our archive. We retain our archive for at least five years.
Job applicants
Personal Data
In the context of a job application, we may process the following personal data to assess your suitability for the role:
First and last name
Email address
Phone number
CV and motivation letter
References and reference contact details
Any other personal data you provide to us during the application process
Purpose and Legal Basis
We process your personal data for the following purposes:
Assessing your application and conducting the selection procedure (pre-contractual measures, Article 6(1)(b) GDPR)
Communicating with you about your application (legitimate interest)
Conducting online and social media research as part of the selection procedure, where applicable (legitimate interest)
Retention Period
If your application is unsuccessful, we will retain your personal data for up to six months after the position is filled, after which it will be deleted. With your explicit consent, we may retain your data for up to two years to consider you for future vacancies.
If you are hired, your data will be transferred to your personnel file.
Consent
If we retain your personal data beyond six months based on your consent, you can withdraw that consent at any time by emailing us at [privacy email].
Optional paragraph — include only if the organisation screens applicants online:
As part of the application procedure, we may search for publicly available information about you online, including via Google and public social media profiles. We do this to protect our organisation's reputation and on the basis of our legitimate interest. We will never ask you to grant us access to a private profile or to connect with us on social media. Any findings will be discussed with you during the process. If you object to this, you may let us know at the time of your application.
Website visitors under 16 years of age
We do not intend to process personal data of website visitors under the age of 16 without the consent of parents or guardians. However, we cannot control this. If you suspect that we are processing personal data of a person under the age of 16 without consent, please contact us so that we can delete the information if we are not lawfully processing it.
Automated decision-making
We do not engage in automated individual decision-making and profiling that may have adverse effects on you as an individual.
If in the future we enable advertising tools (such as Google Ads, Meta, or LinkedIn), data may be shared via cookies in connection with those platforms' profiling. We have no control over how they handle data collected via their cookies. We will only enable such tools with your explicit consent.
Your rights
You may always ask us to access your data (right to access), correct your data if it is incorrect or incomplete (right to rectification), and delete your data (right to erasure). You also have the right to object to data processing, the right to restrict data processing, and the right to data portability.
If you wish to exercise any of these rights, you can email your request to [privacy email]. We may need to verify your identity to fulfill your request.
We will respond to your request within one month. If your request is complex, we may extend this period by two additional months, in which case we will inform you of the extension within the first month.
If you have a complaint about how we handle your data, we would like to resolve it with you. Please contact us to do so. If you are not satisfied with the handling of your request or complaint, you can contact the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.
Sharing with others
We use multiple processors to operate our services. We have entered into data processing agreements with all our processors. We will never sell your personal data to third parties.
We share your personal data with the following categories of processors:
Email and newsletter software
Accounting and financial administration software
Online working environment, including email and document storage
Website hosting
Accountant (under confidentiality agreement)
Application and survey management tools (e.g., Typeform), acting as processor
A complete and up-to-date list of our processors and their key sub-processors is available on request. We update the list when our processor relationships change.
International transfer of personal data
We primarily process your data within the European Economic Area (EEA). However, some of our processors are based outside the EEA, including in the United States. For these transfers, we rely on the following safeguards:
EU Standard Contractual Clauses (SCCs)
EU-US Data Privacy Framework, for transfers to processors certified under this framework (where applicable)
Adequacy decisions, for transfers to countries recognized by the European Commission as providing adequate protection
You can request a copy of the relevant transfer safeguards by contacting us at [privacy email].
Data breach notification
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay. We will also notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of becoming aware of a qualifying breach.
Security
We have taken extensive measures to secure your data both organizationally and technically. We have secured our systems and various communication methods to ensure that your data does not fall into the hands of others. Your data is safe with us. We also ensure that your data is only used by people who have received permission from us.
Governing law
This privacy statement is governed by Dutch law. The competent court in [Amsterdam?], the Netherlands, has exclusive jurisdiction over any disputes arising from or in connection with this privacy statement.