Privacy Policy - Takecarebnb

Article 1: General Information Takecarebnb.com Foundation (“Takecarebnb,” “we,” “us,” and “our”) respects the privacy of the visitors to our website (www.takecarebnb.org) and everyone who uses our services, as well as other parties whose personal data we process. This privacy statement (“Privacy Statement”) is intended to provide insight into how Takecarebnb handles privacy. We also aim to provide full transparency to the users of our website and anyone who uses our services. Therefore, we have formulated and implemented a Privacy Statement regarding the processing activities that take place on the website and in the context of our services. Additionally, we inform data subjects in this Privacy Statement about their rights, so that they can exercise these rights as effectively as possible. Article 2: Which Personal Data Are Used and for What Purposes? Takecarebnb collects and processes various information from website visitors, donors, host families, and guests (refugees). We may process this personal data in different ways. Below, you will find information about our general processing of your personal data. Following that, you will find an overview of various topics that you can click on for more detailed information about the processing of your personal data in those contexts. General Processing Purposes We may process your personal data at all times for the following purposes:

For maintenance, administration, and network and security purposes;
For internal control and business operations;
For analyzing and improving our services;
For handling requests, complaints, and disputes;
For establishing, exercising, and defending our rights;
To comply with legal obligations (including fraud prevention) and requests from competent authorities.

General Processing Grounds In general, we may process your personal data based on a legal obligation. This means we process your personal data to the extent we are legally required to do so, such as to comply with minimum retention periods stipulated by law. Legitimate Interest Sometimes, it is indicated that we process personal data based on the legal ground of “legitimate interest.” This means that a balance has been struck between the interests served by the processing on the one hand and your privacy interests on the other, and that the interest of the processing outweighs the latter. The relevant legitimate interests are listed below for each topic. If you would like more information about this, you can contact us directly using the contact details provided below. i. Offering, Maintaining, and Improving the Website (takecarebnb.org) and Social Media Activities We process personal data to offer, maintain, and improve our website(s) and for our social media activities. More specific information about the cookies and similar technologies used in this context can be found in our Cookie Statement. Data Subjects. Our website visitors: individuals who visit Takecarebnb’s website or use our social media channels. Purposes of Processing. For Takecarebnb’s website, we process personal data for the following purposes:

Operating and maintaining the website (including remembering your settings and consent choices);
Improving the website;
Using social media platforms for recruitment, marketing, and communication purposes.

Personal Data That May Be Processed. In the context of offering, maintaining, and improving the website (takecarebnb.org) and our social media activities, we may process the following personal data, which are collected automatically:

IP address;
Device ID;
Browser type;
Email address;
Phone numbers;
Cookie data (see our Cookie Statement).

Sensitive Data. Generally, we do not process sensitive personal data in the context of the website and social media activities. If we do need to process sensitive data in specific cases, you will be informed separately, and explicit consent will be sought where necessary. Legal Basis for Processing. We base the use of your personal data on the following legal grounds:

Consent. Sometimes, we process personal data based on the (explicit) consent of the individual. This applies, for instance, to certain types of cookies and similar technologies that we only use with your consent, as indicated in our cookie pop-up. For more information, please refer to our Cookie Statement.
Legitimate Interest. Our legitimate interest in offering our website and social media channels and the other purposes mentioned above.

Social Media Platforms. Takecarebnb uses various social media platforms, for example, for communication and marketing purposes. Takecarebnb is responsible for the content on its website but not for the management of these social media platforms. For more information about how your personal data is used by these platforms, please refer to the privacy policies of the respective platforms:

ii. Registering, Screening, and Mediating Host Families We process personal data from individuals who register as host families via the website and during the screening process, which includes a follow-up phone call. Data Subjects. Individuals who register as host families and their family members. Purposes of Processing. For the registration and screening of host families, we process personal data for the following purposes:

Connecting host families with guests (refugees) by identifying suitable accommodations;
Considering (personal) circumstances, such as family situation, hobbies, language skills, and other information, to create the best possible match between guest and host family;
Evaluating the accommodation and home situation of the host family to ensure the safety of both the guest and the host family;
Assessing the legitimacy of the application, tracking the progress of a match, and monitoring compliance with hosting arrangement requirements (such as registration status).

Personal Data That May Be Processed. In the context of registration and screening, we may process the following personal data:

Title, first and last name;
Gender;
Address details, province, and municipality;
Email address;
Phone numbers;
Year of birth;
Language proficiency;
Education level and profession;
Hobbies;
Preferences for hosting guests from specific regions;
Information on the availability, accommodation, and family composition;
Photos of the accommodation (optional);
Photo ID (optional);
Copy of the hosting agreement between guest and host family;
Information regarding case managers, program supervisors, or housing counselors.

This information is optional. After submitting the registration form, all adult family members will receive an email with a link to request a Certificate of Conduct (“VOG”). The email to request the VOG is not sent by Takecarebnb but by Justis. Justis is the government agency responsible for handling VOG applications. Information about a rejected VOG application is neither requested nor stored by Takecarebnb. If a VOG is not provided, the procedure will come to a halt. During the telephone screening interview, additional information will be collected, such as:

More specific questions regarding availability (dates) and accommodation (number of sleeping spaces and any current guests);
Preferences for the type of guests who are welcome (men, women, children, pets); and
Whether the host family agrees to allow information to be shared with our partner organizations.

Sensitive data. As a rule, sensitive personal data about host families is not processed. If this proves necessary in certain cases, Takecarebnb will seek the explicit consent of the individuals concerned. Legal Basis for Processing We process your personal data as part of the registration and screening process for host families based on the following legal grounds: 1. Contract. We process your personal data to facilitate the mediation for establishing a hosting agreement, enabling us to match you with a guest. 2. Legitimate Interest. We may also process your personal data for this purpose based on our legitimate interest in facilitating mediation. 3. Consent. To the extent we process sensitive personal data about you or your family, we will request your explicit consent. Registration, Screening, and Mediation for Guests (Refugees) We process personal data for the registration and screening of guests who sign up via the website and are screened during a follow-up telephone interview. Guests are refugees with a valid residence permit. Involved Individuals. The involved individuals are those who sign up as guests via the website and their family members. Purposes of Processing As part of the registration and screening process for guests, we process personal data for the following purposes:

Evaluating the validity of the application.

A guest must have a valid residence permit in the Netherlands (status holder).

Matching guests (refugees) with host families.

Takecarebnb strives to find as many host families and suitable accommodations as possible.

Ensuring an optimal match between guest and host family.

To facilitate the best possible match, Takecarebnb takes into account (personal) circumstances such as family situation, hobbies, language skills, and other information.

Assessing the safety of accommodations and home situations.

Takecarebnb evaluates the accommodations and home environment of host families to ensure the safety of both the guest and the host family.

Monitoring the progress and compliance of the hosting arrangement.

This includes evaluating the validity of the application, tracking the progress of the match, and monitoring the requirements of the hosting arrangement (such as the status of registrations). Article 3: Cookies Takecarebnb.org uses cookies. For information regarding the use of cookies, please refer to our [Cookie Statement]. Article 4: How Do We Obtain Your Personal Data? Provided by You. We obtain some personal data directly from you. For example, this may include data provided via the contact form or the information you submit on our registration forms. Obtained from Third Parties. We may also obtain personal data about you from third parties. For instance, we may review the public LinkedIn profile of job applicants. Automatically Collected. Some personal data is collected automatically, for example, through the use of cookies and similar technologies. When your computer or mobile device interacts with our web servers (e.g., when you visit our website), our web servers automatically collect usage information. Such usage information includes details about how visitors interact with and navigate through our website. This may include the number of visitors to each web page, the duration of their visits, browser type, and referral data, which helps identify the web page visited before and after accessing our website. More information can be found in our [Cookie Statement]. Inferred. Certain personal data is not obtained directly but can be inferred from the data we already possess. For example, this might include information about your preferences and interests. In principle, you are not obligated to provide us with any personal information. However, failing to provide certain data may negatively impact, for example, the services we can offer you or the functionality of the services you use. If the provision of certain personal data is a legal or contractual requirement or a necessary condition for entering into an agreement with us, we will inform you separately if this is not already clear. We will also inform you of the possible consequences if this data is not provided. Article 5: With Whom Do We Share Your Personal Data? We only share your personal data with third parties if:

It is necessary for service delivery or the involvement of the third party. For example, subcontractors are only granted access to the personal data needed for their part of the service.
Individuals within the third party are obligated to handle the personal data confidentially. Where necessary, this is contractually agreed upon.
The third party is required to comply with applicable data protection regulations. For example, we may have a (data processing) agreement with the third party. This includes ensuring the implementation of appropriate technical and organizational security measures and legitimizing any transfer of personal data to countries outside the EEA.

We may share your personal data on a need-to-know basis with the parties listed below. “Need-to-know” means that a party only gets access to personal data if and to the extent that it is necessary for their tasks.

Authorized individuals working at Takecarebnb (employees or volunteers) involved in the specific processing activity. For example, individuals you have contacted regarding your application or questions.
Authorized individuals working at Takecarebnb’s service providers or subcontractors involved in the specific processing activity. Examples include service providers such as Microsoft OneDrive, Microsoft Outlook, Webex, Zoho Campaigns, Zoho CRM system, Zoho Forms, and Zoho Surveys.
Authorized government authorities. In some situations, Takecarebnb shares your personal data with the Central Agency for the Reception of Asylum Seekers (COA; on behalf of the Ministry of Justice and Security). Additionally, this may include courts, police, and law enforcement agencies. For example, we may disclose information about website visitors, including IP addresses, if legally required, upon request from governmental institutions conducting investigations, or to enforce compliance with our website policies and applicable laws. We may also disclose such user information if we believe it is necessary to protect the rights, property, or safety of Takecarebnb, our business partners, customers, or others.
Aggregated information. We may also share aggregated user statistics with non-identifiable information with third parties for various purposes, including describing our services to potential partners and other third parties. Examples of such non-personal data include the number of users visiting our website over a certain period.

Article 6: How Do We Secure Your Personal Data? We prioritize the protection of your privacy and personal data. Takecarebnb has implemented appropriate technical and organizational measures to safeguard personal data and prevent breaches of the confidentiality, integrity, and availability of the data. All Takecarebnb employees, volunteers, and others engaged by Takecarebnb for processing personal data are required to respect the confidentiality of the personal data. Takecarebnb has internal policies and procedures to ensure an appropriate level of technical and organizational security. Additionally, Takecarebnb has a data breach policy in place outlining how to handle (potential) data breaches. For example, we will notify the relevant supervisory authority and affected individuals if required under applicable law. Article 7: To which countries do we transfer your personal data? Parties involved in the processing of personal data originating from the EU may be based in another country. If these parties are located outside the European Economic Area (EEA), the transfer is legitimized in the manner outlined below. See this link for an overview of the EEA countries. Transfer outside the EEA: The transfer of your personal data to a third party outside the EEA may primarily be legitimized based on an adequacy decision from the European Commission, which concludes that the relevant (part of the) third country ensures an adequate level of data protection. See this link for an overview of the applicable adequacy decisions. If your personal data is transferred to a country outside the EEA for which no adequacy decision applies, we will agree on an appropriate model contract (Standard Contractual Clauses) with the relevant party. This is a standard contract to ensure the protection of your personal data, approved by the European Commission, with the annexes filled in by the parties. See this link for the various model contracts. Where necessary, additional measures will be taken. In certain situations, we may also rely on the exceptions under Article 49 GDPR to legitimize the data transfer. This means that we can transfer your personal data: (i) with your explicit consent, (ii) if necessary for the performance of a contract entered into with you or in your interest, or (iii) if necessary for the establishment, exercise, or defense of a legal claim. Finally, in exceptional cases, we may also transfer personal data if the transfer is necessary for our overriding legitimate interests, which are not overridden by the interests or rights and freedoms of the data subject. You can contact us if you wish to receive additional information on how we legitimize the transfer of your personal data to countries outside the EEA. Our contact details are provided at the bottom of this Privacy Statement. Article 8: How do we determine how long we retain your personal data? In principle, we do not retain your personal data longer than necessary for the purpose for which we process the data, in accordance with the retention periods set out in our retention policy. However, exceptions may apply to our general retention periods. Exception: shorter retention period. If you exercise certain privacy rights, Takecarebnb may delete your personal data earlier or retain it longer than the general rule based on the policy. For more information on this, see the section below titled “Your rights regarding your personal data.” Exception: longer retention period. In certain situations, we may process your personal data longer than necessary for the purpose of the processing. This is the case, for example, when we need to process your personal data for a longer period:

Retention obligation: To comply with a minimum retention period or other legal obligation under EU law or the law of an EU member state;
Procedure: Your personal data is necessary in the context of legal proceedings; or
Freedom of expression: When further processing of your personal data is necessary for the exercise of the right to freedom of expression and information.

Article 9: Your Rights Regarding Your Personal Data Under the General Data Protection Regulation (“GDPR”; (EU) 2016/679), you have various privacy rights. The extent to which you can exercise these rights may depend on the circumstances of the processing, such as how Takecarebnb processes the personal data and the legal basis for such processing. Below, we have provided an overview of your privacy rights under the GDPR. For more information, please refer to this webpage or this webpage from the European Commission. We will respond to all requests without undue delay. If our response takes longer than a month due to the complexity or volume of requests, we will inform you in a timely manner and keep you updated. Additionally, we may ask you for more information to confirm your identity before we can respond to a request. Your Privacy Rights: With regard to our processing of your personal data, you have the following privacy rights: a. Right to Withdraw Consent: To the extent that our processing of personal data is based on your (explicit) consent, you may withdraw that consent at any time using the contact details provided at the bottom of this page. Withdrawing your consent will not affect the lawfulness of the processing prior to the withdrawal. The consequence of withdrawing your consent is that Takecarebnb will no longer process your personal data for the purpose for which you gave consent. However, Takecarebnb may continue processing the data for other purposes, such as for the performance of a contract with you or to comply with a minimum retention period. If this is the case, you will be informed accordingly. b. Right of Access: You have the right to access the way in which we process your personal data. This includes the right to obtain a copy of your personal data (this is not necessarily a copy of the documents in which the personal data is included). We will also provide you with further information on how we process your personal data, including the purposes for which we process it, how we collect it, and with whom we share it. c. Right to Rectification: The right to rectification means that under certain circumstances, you have the right to have your personal data corrected or supplemented. You have this right if we process personal data about you that is: (i) factually inaccurate; (ii) incomplete or irrelevant for the purpose for which it was collected; or (iii) used in a manner that violates applicable law. The right to rectification is not intended to correct professional impressions, opinions, or conclusions with which you disagree. However, in such cases, Takecarebnb may add your opinion about this to the personal data. d. Right to Erasure: Under certain circumstances, you have the right to request the deletion of personal data that we process about you. This allows you to request the deletion or removal of personal data when: (i) the personal data is no longer needed, (ii) you have withdrawn your consent, (iii) you have objected to the processing activities, (iv) the personal data has been unlawfully processed, (v) the personal data must be erased in accordance with a legal obligation, or (vi) the personal data was collected in connection with the provision of information society services. We are not required to comply with your request if the processing is necessary: (i) for the exercise of the right to freedom of expression and information, (ii) for compliance with a legal obligation requiring processing, (iii) for public health reasons, (iv) for archiving purposes, or (v) for the establishment, exercise, or defense of legal claims. e. Right to Object: You have the right to object to the processing of your personal data when we rely on legitimate interests as the legal basis for processing (see above). If the processing of your personal data is for direct marketing purposes, we will always honor your request. For processing for other purposes, we will suspend and cease processing unless we have compelling legitimate grounds for the processing that override your interests, rights, and freedoms or relate to the establishment, exercise, or defense of a legal claim. If this is the case, we will inform you of our legitimate interests and the balancing of interests. f. Right to Restriction of Processing: The right to restrict processing means that Takecarebnb will continue to store personal data at your request, but will not process it further. You have this right when Takecarebnb no longer has a legal basis for processing your personal data or when its legality is in question. This right applies particularly in the following situations:

Unlawful processing: We are no longer permitted to process certain personal data, but you do not want the data erased. For example, if you wish to request the data later.
Personal data no longer needed: Takecarebnb no longer needs your personal data for our processing purposes, but you still need the data for a legal claim. For example, in a dispute.
Pending appeal: You have objected to the processing of your personal data by Takecarebnb (see the right to object above). While awaiting verification of your appeal, we will not process this data further at your request.
Disputing the accuracy of personal data: You dispute the accuracy of certain personal data we process about you (for example, through your right to rectification; see above). During the period in which we assess your dispute, we will not process this data further at your request.

g. Right to Data Portability: You have the right to request the transfer of your personal data to you or a third party of your choice (right to data portability). We will provide you or such a third party with your personal data in a structured, commonly used, and machine-readable format. Please note that this right only applies when the processing is carried out by automated means, and only if our legal basis for the processing is your consent or the performance of a contract you are a party to (see above). h. Right Regarding Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing, including profiling, that significantly affect you (“which has legal consequences or similarly significantly affects you”). We do not use automated decision-making in our processing of your personal data. i. Right to Lodge a Complaint: In addition to the rights mentioned above, you have the right to lodge a complaint with a supervisory authority, particularly in the EU member state of your habitual residence, place of work, or where the alleged violation occurred. For an overview of supervisory authorities and their contact details, please refer to this webpage. However, we would appreciate the opportunity to address your concerns before you approach the supervisory authority, so please contact us first. Exercising Your Privacy Rights: Exercising your privacy rights is free of charge and can be done by phone or email using the contact details provided below. If requests are deemed manifestly unfounded or excessive, particularly due to their repetitive nature, we may charge a reasonable fee or refuse to comply with the request. Confirming Your Identity: We may ask you for additional information to help confirm your identity before we proceed with your privacy request. Follow-up on Your Requests: We will provide you with information about the action taken in response to your request without undue delay and, in principle, within one month of receiving the request. Depending on the complexity of the request and the number of requests, this period may be extended by a further two months. We will notify you of such an extension within one month of receiving your request. Applicable privacy laws may allow or require us to refuse your request. If we cannot comply with your request, we will inform you of the reasons, taking into account any legal or regulatory limitations. Article 10: Contact and Changes Takecarebnb is located at Nieuwe Herengracht 49-4, 1011 RN Amsterdam. Our Chamber of Commerce (KvK) number is 64636917. For questions or information about the Privacy Statement, you can email info@takecarebnb.org. We may update this Privacy Statement from time to time to reflect new technologies, legal requirements, or other purposes. The most recent version can always be accessed through the website. Important changes will also be communicated to you. Our Privacy Statement was last updated on November 23, 2022.