Privacy Policy

Last updated: 17 July 2026

1. About this Privacy Policy

Stichting Fairspace values your privacy and handles personal data with care. This Privacy Policy explains which personal data we process, why we process it, which legal bases we rely on, how long we retain the data, which organisations may receive it and which rights you have.

This Privacy Policy applies to personal data processed through our website, contact forms, email, newsletters, donations, events, workshops, projects, research, recruitment activities, social media and other interactions with Stichting Fairspace.

This Privacy Policy should be read together with the cookie settings available on our website and any additional privacy information provided for a specific project, event, research activity or recording.

2. Data Controller and Contact Details

Stichting Fairspace is the data controller for the processing described in this Privacy Policy, unless another organisation is explicitly identified as an independent or joint data controller.

Stichting Fairspace
Based in Rotterdam, the Netherlands
Chamber of Commerce number: 70014000
RSIN number: 858103874
Website: fairspace.co
Email: info@fairspace.co

Stichting Fairspace does not currently publish a visiting or postal address. Privacy requests and questions can be submitted by email.

We process personal data in accordance with the General Data Protection Regulation, also known as the GDPR, and other applicable Dutch and European privacy and telecommunications legislation.

3. Personal Data We Process

Personal data is information that directly or indirectly relates to an identifiable person. The information we process depends on how you interact with Stichting Fairspace.

3.1 Information You Provide Directly

You may provide us with information such as:

First name and last name
Email address
Telephone number
Organisation, company, job title or professional role
Address details, where required
Messages, questions and correspondence
Registration and participation information
Newsletter preferences
Donation information and payment references
Application documents and portfolio information
Feedback, survey answers and evaluation responses
Photographs, audio or video recordings, where applicable
Information you voluntarily share in connection with a project or activity

3.2 Information Collected Through the Website

When you use our website, we or our service providers may process:

IP address
Browser type and version
Device type and operating system
Language and display settings
Approximate location based on the IP address
Pages visited and links clicked
Date, time and duration of visits
Referral source
Interactions with forms, buttons and embedded content
Cookie identifiers and similar online identifiers
Technical, diagnostic and security information

3.3 Information Received From Other Sources

In some cases, we receive personal data from another source instead of directly from you. These sources may include:

Clients, project partners and collaborating organisations
Event organisers, venues, trainers or educational institutions
Organisations that register participants for an activity
References provided during recruitment
Public professional websites and professional social media profiles
Geef.nl in connection with a donation, depending on the donor’s choices and the platform settings
Social media platforms when you interact with our accounts or content

When we receive personal data from another source, we provide the information required by the GDPR within the applicable period, normally at the first contact, at the first disclosure or within one month, unless a legal exception applies.

4. Processing Activities, Purposes, Legal Bases and Retention

The sections below connect each main processing activity with its purpose, legal basis, usual retention period and relevant service providers.

4.1 Website Hosting, Operation and Security

Provider: SiteGround

Personal data: IP addresses, browser and device information, website requests, security events, server logs, form data stored through the website, database content and website backups.

Purpose: To host and operate our website, deliver website content, maintain availability, create backups, prevent misuse, identify technical problems and protect our systems.

Legal basis: Our legitimate interests in operating a reliable and secure website. Where website functionality is necessary to provide a requested service, processing may also be necessary to take steps before entering into or to perform an agreement.

Retention: Security and access logs controlled by Stichting Fairspace are generally retained for no longer than 90 days, unless longer retention is necessary to investigate an incident, prevent misuse or comply with a legal obligation. Website content and backups are retained according to our operational backup schedule and are overwritten or deleted when no longer required.

SiteGround processes website and hosting data to provide its hosting and technical support services. SiteGround may use infrastructure and subprocessors as described in its own legal and privacy documentation.

4.2 Contact Forms and Email Communication

Provider: Gmail, provided by Google

Personal data: Name, email address, telephone number, organisation, message content, email headers, attachments and any other information you provide.

Purpose: To answer questions, handle requests, communicate about our activities, prepare collaborations and maintain professional correspondence.

Legal basis: Our legitimate interest in responding to enquiries and maintaining professional communication. When the communication relates to a possible or existing agreement, processing is also necessary to take steps before entering into or to perform that agreement. We rely on consent where we explicitly ask for it.

Retention: General enquiries are normally retained for up to two years after the request has been completed. Correspondence connected to a client, partner, supplier or project relationship may be retained for up to five years after the relationship or project ends. Information that forms part of financial or legal records may be retained for seven years or for another period required by law.

Google may process email content and account data in multiple countries under its applicable privacy, security and data transfer terms.

4.3 Newsletters and Mailchimp

Provider: Mailchimp, part of Intuit

Personal data: Name, email address, subscription date, consent record, mailing preferences, delivery status and unsubscribe status. Where email measurement is enabled, Mailchimp may also process information about email opens and link clicks.

Purpose: To send newsletters, invitations, project updates and other communications requested by subscribers, and to understand whether communications are delivered and useful.

Legal basis: Consent. Any use of open or click measurement is only carried out where this has been clearly disclosed and any consent required by law has been obtained.

Retention: Subscription data is retained until you unsubscribe or the newsletter service ends. After an unsubscribe request, limited information may be retained on a suppression list for as long as necessary to ensure that the address is not accidentally subscribed again.

Every newsletter contains an unsubscribe link. You can also unsubscribe by contacting info@fairspace.co.

4.4 Donations Through Geef.nl

Provider: Geef.nl

Personal data: Depending on the donor’s choices and the information made available to Stichting Fairspace, this may include name, email address, donation amount, date, payment reference, donation message, recurring donation status and communication preferences.

Purpose: To receive and administer donations, communicate about a donation, process changes or cancellations, maintain financial records and comply with accounting and tax obligations.

Legal basis: Processing necessary to carry out the donation, our legitimate interest in donor administration and relationship management, and compliance with legal accounting and tax obligations. Separate consent is used for newsletters or other optional communications.

Retention: Financial and donation administration is retained for at least seven years where required by Dutch tax and accounting law. General donor correspondence is normally retained for up to two years after the donor relationship or request has ended, unless it forms part of financial records or a legal matter.

Donations are processed through the Geef.nl platform. Geef.nl also processes donor information under its own privacy statement and donation terms. Depending on the platform settings, donors may be able to donate anonymously.

4.5 Relationship and Project Management

Provider: monday.com

Personal data: Names, contact details, organisation, professional role, project information, tasks, correspondence summaries, meeting notes, agreements, deadlines and collaboration information.

Purpose: To manage projects, relationships, collaborations, tasks, planning and internal coordination.

Legal basis: Processing necessary to perform an agreement or take requested steps before an agreement, and our legitimate interests in efficient project management, administration and professional relationship management.

Retention: Project and relationship information is normally retained for up to five years after the project or relationship ends. Financial records are retained for at least seven years where required by law. Information that is no longer necessary is deleted or anonymised earlier where reasonably possible.

monday.com processes customer data on behalf of its customers under its service terms and Data Processing Addendum.

4.6 Google Analytics

Provider: Google

Personal data: Online identifiers, browser and device information, pages visited, interactions, referral information, approximate location and technical information. An IP address may be processed during the technical transmission of a website request.

Purpose: To understand how the website is used, measure page visits and interactions, identify technical or usability issues and improve our website and communications.

Legal basis: Consent.

Retention: Google Analytics event data is retained for 14 months. Aggregated reports that no longer identify an individual may be retained for longer.

Google Analytics is activated only after you have consented to analytics cookies through the cookie settings.

4.7 LinkedIn Insight Tag

Provider: LinkedIn

Personal data: IP address, page URL, referral URL, browser and device characteristics, timestamp, page views, interactions and LinkedIn cookie identifiers.

Purpose: To measure the effectiveness of LinkedIn content and campaigns, understand website interactions after a LinkedIn visit and receive aggregated audience and campaign reports.

Legal basis: Consent.

Retention: Stichting Fairspace may retain aggregated campaign reports for up to two years. LinkedIn states that direct identifiers collected through the Insight Tag are removed within seven days and that the remaining pseudonymised data is deleted within 180 days.

The LinkedIn Insight Tag is activated only after you have consented to marketing cookies through the cookie settings.

4.8 Events, Trainings, Workshops and Participation

Personal data: Name, contact details, organisation, registration details, attendance, accessibility requirements, dietary requirements, emergency contact details where necessary, feedback and participation information.

Purpose: To organise activities, communicate with participants, provide the activity, support safety and accessibility, evaluate the activity and maintain appropriate records.

Legal basis: Processing necessary to perform an agreement or organise requested participation, our legitimate interests in organising and evaluating our activities, consent where specifically requested, and legal obligations where applicable.

Retention: Registration and participation information is normally retained for up to two years after the activity. Financial records are retained for at least seven years where required by law. Emergency and accessibility information is deleted sooner when it is no longer necessary.

4.9 Recruitment, Internships and Volunteer Applications

Personal data: Name, contact details, curriculum vitae, cover letter, education, work experience, portfolio, references, interview notes, availability, fee or salary expectations, work permit information and screening information where relevant.

Purpose: To assess an application, communicate with applicants, organise interviews or assessments, contact references where appropriate and prepare a possible agreement.

Legal basis: Steps taken at the applicant’s request before entering into an agreement, our legitimate interests in recruitment and selection, and consent for retaining an application for future opportunities.

Retention: Unsuccessful applications are normally deleted within four weeks after the recruitment process ends. With the applicant’s consent, information may be retained for up to six months for future opportunities.

4.10 Photographs, Video and Audio

Personal data: Photographs, video, voice, statements, location and contextual information that may identify a participant.

Purpose: To document, evaluate, report on or communicate about our projects and activities.

Legal basis: Consent where consent is appropriate or required. In limited situations, we may rely on a legitimate interest after considering the context, reasonable expectations, purpose, impact and right to object. Additional care is taken when minors, vulnerable people or sensitive subjects are involved.

Retention: The retention and publication period is explained for the relevant activity where appropriate. Where consent is the legal basis, consent may be withdrawn for future use. Withdrawal does not automatically make earlier lawful publication or processing unlawful.

4.11 Research, Surveys and Evaluations

Personal data: Survey answers, feedback, demographic information, participation information and, where necessary and explicitly communicated, sensitive personal experiences.

Purpose: To evaluate activities, understand impact, conduct research and improve our work.

Legal basis: Consent, our legitimate interests in evaluation and improvement, or another legal basis communicated for the specific research. Special categories of personal data are processed only where an additional condition under the GDPR applies, such as explicit consent.

Retention: The applicable retention period is communicated for the specific research or evaluation. We anonymise or aggregate information where reasonably possible and delete identifiable data when it is no longer necessary.

4.12 Social Media Communication

Providers: LinkedIn, Instagram, TikTok, YouTube and other platforms used by Stichting Fairspace.

Personal data: Public profile information, username, messages, comments, reactions, engagement information and data made available by the platform.

Purpose: To communicate with followers, respond to messages, moderate comments, share information, organise campaigns and understand engagement with our content.

Legal basis: Our legitimate interests in public communication and community engagement, consent where specifically requested, and performance of an agreement where a message relates to a requested service or collaboration.

Retention: Direct messages and relevant correspondence are normally retained for up to two years after the matter is completed, unless a longer period is necessary for a project, agreement, complaint or legal matter. Content published on a platform remains subject to the platform’s own retention rules and the user’s settings.

5. Cookies and Similar Technologies

Our website uses cookies and similar technologies, including scripts, tags, pixels, local storage and embedded third-party content.

5.1 Strictly Necessary Technologies

Strictly necessary technologies are used to provide requested website functions, remember privacy choices, maintain security, protect forms, prevent misuse and keep the website operational. These technologies may be used without consent where permitted by law.

5.2 Analytics Technologies

Google Analytics is used only after you have consented to analytics cookies. You can refuse or withdraw this consent without losing access to the essential parts of the website.

5.3 Marketing Technologies

The LinkedIn Insight Tag is used only after you have consented to marketing cookies. Stichting Fairspace does not currently use Google Ads for active advertising campaigns, personalised advertising or remarketing.

5.4 Embedded Content

Our website may contain embedded videos, posts, feeds or other content from platforms such as YouTube, LinkedIn, Instagram or TikTok. Where required, this content is blocked until you consent to the relevant category.

5.5 Managing Your Preferences

You can accept, refuse or manage non-essential technologies through the cookie settings on our website. You can change or withdraw your preferences at any time. Withdrawing consent does not affect processing that took place lawfully before the withdrawal.

The cookie settings should provide the current cookie names, providers, purposes, categories and retention periods used on the website.

6. Special Categories of Personal Data

Stichting Fairspace works with subjects such as harassment, discrimination, safety, inclusion and sexual misconduct. Participants or contacts may therefore sometimes choose to share sensitive personal experiences.

This information may include health information, information about sexual behaviour or sexual orientation, racial or ethnic origin, religious beliefs or other special categories of personal data.

We do not request more sensitive information than necessary. When we intentionally process special categories of personal data, we identify both a legal basis under Article 6 GDPR and an additional condition under Article 9 GDPR. Where appropriate, we provide project-specific privacy information and request explicit consent.

Please do not submit sensitive personal information through a general contact form unless it is necessary for your request.

7. Sharing Personal Data

We do not sell personal data.

We may share limited personal data with service providers and other organisations where this is necessary for the purposes described in this Privacy Policy. These recipients may include:

SiteGround for website hosting, backups and technical services
Google for Gmail and Google Analytics
Mailchimp and Intuit for newsletters
Geef.nl for donations
monday.com for relationship and project management
LinkedIn for the Insight Tag and social media services
Other social media and embedded content providers
Banks, payment providers and financial service providers
Accountants, auditors, legal advisers and professional advisers
Trainers, venues, project partners and collaborating organisations
Recruitment, screening or assessment providers where necessary
Public authorities where disclosure is required by law

Depending on the service and processing activity, a recipient may act as a processor on our instructions, an independent data controller or a joint controller. Where required, we enter into a data processing agreement with providers that process personal data on our behalf.

8. International Data Transfers

Some service providers may process personal data outside the Netherlands or outside the European Economic Area. This may apply to Google, Mailchimp and Intuit, LinkedIn, monday.com and certain subprocessors used by our hosting, cloud and communication providers.

Where personal data is transferred outside the European Economic Area, we use an appropriate transfer mechanism where required. Depending on the provider and destination, this may include:

An adequacy decision issued by the European Commission
The EU-US Data Privacy Framework
Standard Contractual Clauses approved by the European Commission
A provider’s Data Processing Addendum
Additional contractual, technical or organisational safeguards

You may contact info@fairspace.co for more information about the safeguards used for a specific service.

9. General Retention Principles

We do not retain personal data longer than necessary for the purpose for which it was collected.

The retention periods in Section 4 are our standard periods. A different period may apply where:

A longer period is required by law
The information is required for an ongoing agreement, complaint, dispute or investigation
Retention is necessary to establish, exercise or defend legal claims
You have given consent for a specified longer period
The information has been irreversibly anonymised

When a retention period ends, personal data is deleted, anonymised or securely archived where continued storage is legally required.

10. Security

Stichting Fairspace takes appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, unlawful disclosure, alteration, destruction and misuse.

Measures may include:

Secure HTTPS connections
Access restrictions and role-based access
Strong passwords and multi-factor authentication where available
Software and security updates
Secure backups
Confidentiality obligations
Limiting access to authorised persons
Security monitoring and incident procedures
Data processing agreements with relevant providers

No electronic transmission or storage method is completely secure. We therefore cannot guarantee absolute security.

Security vulnerabilities relating to fairspace.co can be reported to info@fairspace.co.

Additional security contact information is available through our security.txt file.

11. Use of AI

Stichting Fairspace uses artificial intelligence (AI) in some of its work, for example to support research, content development, administration and other internal processes. We use AI responsibly and follow our AI Ethical Framework, which sets out the principles and safeguards we apply when using AI. You can read our AI Ethical Framework here.

We take care to protect personal and sensitive information when using AI tools and do not use AI to make decisions that produce legal or similarly significant effects for individuals.

12. Personal Data Breaches

When a personal data breach occurs, Stichting Fairspace assesses the information involved, the possible consequences, the number of people affected, whether the incident is ongoing and which measures can reduce the risk.

Where required, we notify the Dutch Data Protection Authority. Where a breach is likely to result in a high risk to individuals, we also inform the affected individuals unless a legal exception applies.

13. Your Privacy Rights

Under the GDPR, you may have the following rights:

The right to receive information about processing
The right to access your personal data
The right to correct inaccurate or incomplete data
The right to request deletion
The right to restrict processing
The right to object to processing
The right to data portability
The right to withdraw consent
The right not to be subject to certain solely automated decisions
The right to file a complaint with a supervisory authority

These rights are not absolute. In some cases, we may be legally permitted or required to refuse all or part of a request.

To exercise your rights, contact info@fairspace.co and use the subject line Privacy Request.

We may request limited additional information to verify your identity. We aim to respond within one month. Where permitted by the GDPR, this period may be extended for complex or multiple requests. We will inform you if an extension is necessary.

13.1 Objection to Legitimate Interest Processing

Where we process personal data on the basis of a legitimate interest, you may object to that processing. We will stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for legal claims.

You may object to direct marketing at any time. We will stop using your personal data for that purpose.

14. Children and Young People

Stichting Fairspace activities may involve children and young people. We take additional care when processing their personal data and limit collection to what is necessary.

Depending on the activity, age and legal basis, we may:

Request permission from a parent or legal guardian
Provide information in age-appropriate language
Request the young person’s own agreement
Apply additional access and security restrictions
Avoid publishing identifiable information
Use anonymised information where possible

Our website is not intended to knowingly collect personal data from children under the age of 16 without appropriate permission where that permission is legally required.

Parents or guardians who believe that a child has provided personal data without appropriate permission may contact info@fairspace.co.

15. Automated Decision-Making

Stichting Fairspace does not make decisions that produce legal or similarly significant effects for you solely through automated processing.

16. Links to Other Websites and Platforms

Our website may contain links to websites and platforms that are not operated by Stichting Fairspace. When you follow an external link, the privacy policy and terms of the external service apply.

Stichting Fairspace does not control and is not responsible for the independent privacy practices, security or content of external websites and platforms.

17. Changes to This Privacy Policy

We may update this Privacy Policy when our services, providers, technology, legal requirements or processing activities change.

The current version is published at fairspace.co/privacy-policy/. The date at the top shows when the policy was last updated.

Where changes have a significant effect on how we process personal data, we provide additional notice where appropriate.

18. Complaints

If you have a concern about how Stichting Fairspace processes personal data, please contact us first through info@fairspace.co.

You also have the right to file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

19. Contact

Questions, requests and complaints about this Privacy Policy or the processing of personal data can be sent to:

Stichting Fairspace
Based in Rotterdam, the Netherlands
Chamber of Commerce number: 70014000
RSIN number: 858103874
Email: info@fairspace.co
Website: fairspace.co

For privacy requests, use the subject line: Privacy Request.