Privacy Statement of Stichting (foundation) Takecarebnb (TCBNB) for Ukraine Project

Article 1.             General information

Stichting (foundation) Takecarebnb.com (“Takecarebnb”, “we”, “us” and “our”) respects the privacy of the visitors of our website (www.oekraine.takecarebnb.org; hereafter “Website”) and everyone who uses our services and other data subjects whose personal data we process. This privacy statement (“Privacy Statement”) is meant to provide insight into the way in which Takecarebnb handles privacy. Moreover, we want to offer full transparency to the users of our Website and everyone who uses our services. Therefore, we have formulated and implemented a Privacy Statement with regard to the processing that takes place on the Website and in the context of our services. In addition, we inform data subjects about their rights in this Privacy Statement so they can exercise these rights as well as possible.

Article 2.             What personal data is used and for which purposes?

Takecarebnb collects and processes information of website visitors, donors, host families and guests (refugees). We can process this personal data in different ways. Below, you will find information about the way we process your personal data in general. Below that, you will find an overview of various subject which you can click for more detailed information about the processing of your personal data in that context.

General purposes of processing

We can always process your personal data for the following purposes:

  • For maintenance, administration and network and security purposes;
  • For internal control and business operations;
  • For analysing and improving our services;
  • For handling any requests, complaints and disputes;
  • For determining, exercising and defending our rights;
  • To comply with legal obligations (incl. fraud prevention) and requests of competent government agencies.

General grounds of processing

In general, we can process your personal data based on a legal obligation. This means that we can process your personal data insofar as we are obliged to do so by law, for example to comply with statutory minimum retention periods.

Legitimate interest

Sometimes we indicate that we process your data based on the legal ground “legitimate interest”. This means that a balance of interests is performed between the interests that are served by the processing on the one hand and your privacy interests on the other hand, and that the interests in favour of the processing prevail. The related legitimate interests are included below per topic. If you want more information about this, you can contact us directly via our contact details stated below.

i. Offering, maintaining and improving our Website (takecarebnb.org) and social media activities

We process your data for providing, maintaining and improving the Takecarebnb Website specifically aimed at housing Ukrainian refugees (oekraine.takecarebnb.org) and for our social media activities. For more specific information on the cookies and similar technologies used in this respect, please refer to our Cookie Statement.

The persons involved. Our website visitors: people who visit the Takecarebnb Website and people who make use of our social media channels.

The purposes of the processing. When you visit the Takecarebnb Website, we will process your data for the following purposes:

  • The functioning and maintenance of the Website (incl. remembering your settings and consent choices);
  • The improvement of the Website; and
  • The use of social media platforms for recruitment and selection purposes, marketing purposes and communication purposes.

The personal data that can be processed. In the context of offering, maintaining and improving our Website and our social media activities, we can process the following personal data that is collected automatically:

  • IP address;
  • Device ID;
  • Browser type;
  • Email address;
  • Telephone number(s);
  • Cookie information (see our Cookie Statement).

Sensitive information. In the context of (offering, maintaining and improving our Website and our social media activities on) the Website, we do not, in principle, process sensitive information. If we in certain cases will decide to process sensitive information, you will be informed about this separately and, if necessary, we will request your explicit consent.

Legal grounds for the processing. We base the use of your data in the context of the Website on one of the following legal grounds:

  • Consent. Sometimes we base the processing of your data on the (explicit) consent of the relevant person. This is for example applicable for the cookies and similar technologies we only use if you have provided consent for this via a cookie pop-up. For further information on this, please refer to our Cookie Statement.
  • Legitimate interest. Our legitimate interest in offering and using the Website and social media channels; and pursuing the other processing purposes listed above.

Social media platforms. Takecarebnb uses different social media platforms, for example in the context of communication and marketing purposes. Takecarebnb is responsible for the content of the Websites, but not for the management of the social media platforms. For more information about how your data will be used by such social media platforms, we refer to the information already available on the websites of the suppliers of these platforms. Below we have included links to the privacy policies of various suppliers of social media platforms, which we could use:

ii. The registering, screening and mediating of host families

We process personal data of persons that register themselves as a host family when they sign up through the Website and during the screening of the host families though a subsequent telephone interview.

The persons involved. The persons that register themselves as host family through the Website and their family members.

The purposes of the processing. In the context of the registering and screening procedure of host families we process personal data for the following purposes:

  • Connecting host families with guests (refugees). Takecarebnb searches as many host families with suitable guest rooms as possible for this.
  • When connecting a guest with a host family, Takecarebnb takes into account (personal) circumstances, such as the family situation, hobbies, knowledge of languages and other information in order to establish the best possible connection between guest and host family; and
  • Assessing a guest room and the family situation of the host family in the context of the safety of the guest and the host family.
  • Assessing the lawfulness of the request, following the progress of a connection and monitoring the requirements of the lodging arrangement (such as the status of the applications);

The personal data that can be processed. In the context of the registration and screening procedure, we can process the following personal data:

  • Title, first and last name;
  • Email address;
  • Address and province;
  • Municipality*;
  • Telephone number(s);
  • Year of birth;
  • Knowledge of languages;
  • Level of education and profession;
  • Hobbies;
  • I register as host family for: guests from Ukraine, guests from Afghanistan, Yemen, etc. or both*;
  • Information with regard to the availability, guest room and family composition of the host family (for example, if there is room for more than one guest, the composition of the host family);
  • Information about family members aged 18 years or older (such as name, gender, year of birth and email address);
  • Photograph of the guest room*;
  • Information about the acquaintance with Takecarebnb;
  • Passport photograph*;
  • Whether the statement of approval has been accepted; and
  • If the host would like to sign up for the Takecarebnb newsletter*.

* This information is optional

After sending the registration form the lead applicant of the host family will receive an email with a hyperlink to apply for a statement of conduct (Verklaring Omtrent het Gedrag, “VOG”). The email for applying for a VOG is not sent by Takecarebnb, but by Justis. Justis is the governmental organization that handles applications for a VOG. Information about a rejected VOG application is not requested or stored by Takecarebnb. If a VOG is not shared, the procedure will come to a halt.

During the interview by telephone, additional information is requested, such as:

  • More specific questions with regard to the availability (dates) and guest room (number of sleeping places and guests already present);
  • Which types of guests are welcome (men, women, children, pets); and
  • Whether the applicant accepts that information is possibly shared with our partner organizations.

Sensitive information. In principle, we do not process sensitive information about host families. If the processing of sensitive information proves necessary in certain cases, Takecarebnb will ask the explicit consent of the person(s) involved.

Legal grounds for the processing. We base the use of your data in the context of the registration and screening procedure of host families on one of the following legal grounds:

  • Legitimate interest. We can process your personal data for this purpose on the basis of our legitimate interest to perform the mediation.
  • Consent. Insofar as we process sensitive information of you or your family, we will request your unambiguous consent.Th

iii. The registration and mediation of guests (refugees) [click to fold out]

We process the personal data for the registration and screening of guests who signed up through the website of RefugeeHomeNL and who we screen during a subsequent telephone interview.

The persons involved. The persons involved are the persons that register as guest through the website of RefugeeHomeNL and their family members.

The purposes of the processing. In the context of the registering and screening procedure of guests we process personal data for the following purposes:

  • Assessing the lawfulness of the request;
  • Connecting host families with guests (refugees). Takecarebnb searches as many host families with suitable guest rooms as possible for this;
  • When connecting a guest with a host family, Takecarebnb takes into account (personal) circumstances, such as the family situation, hobbies, knowledge of languages and other information in order to establish the best possible connection between guest and host family;
  • Assessing a guest room and the family situation of the host family in the context of the safety of the guest and the host family; and
  • Assessing the lawfulness of the request and following the progress of a connection.

The personal data that can be processed. In the context of the registration and screening procedure, we can process the following personal data:

  • Title, first name and last name;
  • Year of birth;
  • Email address;
  • Telephone number(s);
  • Address details of the current place of residence;
  • Current municipality (if applicable)*;
  • If the guest is already registered in the Personal Records Database (Basis Registratie Personen (BRP))*;
  • Document type (passport, ID-card, etc.);
  • Information about the composition of the guest’s family (how many persons, ages, if there are children present, pets, etc.);
  • Hobbies, interests and professions of family members;
  • Knowledge of languages;
  • Preferences with regard to the location of the host families*;
  • Information with regard to the preferences to the guest room (how many rooms and beds are necessary)*; and
  • Any other relevant information.*

* This information is optional

Sensitive information. In principle, we do not process sensitive information about guests. If the processing of sensitive information proves necessary in certain cases, Takecarebnb will ask the explicit consent of the person(s) involved.

Legal grounds for the processing. We base the use of your data in the context of the registration and screening procedure of host families on one of the following legal grounds:

  • Legitimate interest. We can process your personal data for this purpose on the basis of our legitimate interest in the context of the processing purposes mentioned above, for example to assess the situation of a guest and find suitable lodging;
  • Consent. Insofar as we process sensitive information of you or your family, we will request your unambiguous consent.

iv. Contact with Takecarebnb

The persons involved. Someone who has contacted us through our contact form, through info@takecarebnb.org or calls us on 085 773 11 21.

The purposes of the processing. If you contact Takecarebnb through the contact form or in another manner, we will process your personal data for the following purposes:

  • To offer you support;
  • To answer any questions you have for us.

The personal data that can be processed. If you contact customer services or contact Takecarebnb in another manner, we can process the following personal data:

  • Name;
  • Email address;
  • Subject;
  • The message you send us and any corresponding metadata;
  • Telephone number(s).*

* This information is optional

Legal grounds for the processing. We base the use of your data in the context of the Takecarebnb contact form on our legitimate interest. It concerns our interest to offer you our support and answer any questions you have for us.

Article 3.             Cookies

Takecarebnb.org uses cookies. For the use of cookies, we refer to our Cookie Statement

Article 4.             How do we obtain your data?

  • Provided by you.  Some data about you, we receive straight from you. Examples include information in your messages to us and information you enter in our application form.
  • Obtained from third parties. We could also obtain data about you from other persons or external parties. For example, we can consult the public LinkedIn profile of an applicant. We also obtain personal data from our partners in the RefugeeHomeNL partnership, for example in the context of the Ukrainian refugee application forms.
  • Automatically obtained. Some data we obtain automatically, for example by using cookies and similar techniques. When your computer or mobile device contacts our web servers (e.g. when you visit our Website), our web servers automatically collect usage information. Such usage information includes information about how our website visitors use and navigate the Website. It can include the number and frequency of website visitors to each web page and the length of their stays, browser type, and referrer data that identifies the web page visited prior and subsequent to visiting our Website. Further information on this is included in our Cookie Statement.
  • Derived. Certain data we do not receive directly but can be derived from the information already in our possession. For example, information about your preferences and interests.

In principle, you are under no obligation to provide any information about yourself to us. However, refusal to supply certain information could have a negative influence on, for example, the provision of our services to you or the functionality of our services that you use. If the provision of certain personal data is a legal or contractual obligation or an essential requirement for concluding an agreement with us, we will separately provide additional information about this for as far as this is not clear in advance. In this case we will also inform you about the possible consequences if this information is not provided.

Article 5.             Who do we share your data with?

We only share your data with third parties if:

  • This is necessary for the provision of a service or the involvement of the third party. Sub-contractors, for example, will in principle only get access to the data that they require for their part of the service provision.
  • The persons within the third party that have access to the data are under an obligation to treat your data confidentially. Where necessary this is also contractually agreed on.
  • The third party is obliged to comply with the applicable regulations for the protection of personal data, for instance because we have concluded an (data processing) agreement with this party. This includes that the party is obliged to ensure appropriate technical and organizational security measures, and that any transfer of personal data to countries outside the EEA is adequately legitimized.

We could share your data on a need-to-know basis with the parties mentioned below. In this context, “need-to-know” means that a party only gets access to your data if and insofar as this is required for the professional services provided by this party.

  • Authorized persons, working at Takecarebnb (as an employee or a volunteer), who are involved with the processing activity concerned. Such as, the members of the team you have had contact within the context of your registration or your questions.
  • Authorized persons, employed by service providers or sub-contractors engaged by Takecarebnb, who are involved with the processing activity concerned. Such as, the service providers of Takecarebnb, such as Microsoft OneDrive, Microsoft Outlook, Webex, Zoho Campaigns, the Zoho CRM-system, Zoho Forms and Zoho Surveys.
  • RefugeeHomeNL. In the context of housing Ukrainian refugees, Takecarebnb is involved in the RefugeeHomeNL partnership. In this partnership, parties collaborate to find a host family for Ukrainian refugees. In the context of this collaboration, personal data may be exchanged. Currently, other than Takecarebnb, the Salvation Army (Leger des Heils), the Red Cross (het Rode Kruis) and the Dutch Council for Refugees (Vluchtelingenwerk Nederland) are part of this partnership.
  • Authorized government institutions. In some situations, Takecarebnb shares your pseudonymized and aggregated personal data with the Ministry of Justice and Security. Additional examples include courts, police and law enforcement agencies. We might disclose information about our website visitors, including the IP-address, when we are legally required to do so, at the request of government institutions conducting an investigation or to verify or enforce compliance with the policies governing the Takecarebnb Website applicable laws. We may also disclose user information when we believe that  that releasing this information is necessary to protect the rights, properties or safety of Takecarebnb, or any of our respective business partners, customers or others.
  • Aggregate information. We may also disclose non-identifying, aggregated user statistics to third parties for a variety of purposes, including describing our services to prospective partners and other third parties. Examples of such non-personal information include the number of users who visited our Website during a specific time period.

Article 6.             How do we secure your data?

Protecting your privacy and data is very important to us. Therefore, Takecarebnb has implemented appropriate technical and organizational measures to protect and secure personal data, in order to prevent violations of the confidentiality, integrity and availability of the data. All Takecarebnb employees, volunteers and other persons engaged by Takecarebnb for the processing of data are obliged to respect the confidentiality of personal data.

Takecarebnb has internal documentation in which it is described how we safeguard an appropriate level of technical and organizational security. In addition, a data breach procedure is applicable within Takecarebnb, in which it is explained how (potential) data breaches need to be handled. We will, for example, inform the competent supervisory authority and involved data subjects when this is required by the applicable law.

Article 7.             To which countries will we transfer your data?

Parties involved with the processing of your data originating from the EU, may be located in a different country. In case the data is processed outside the European Economic Area (“EEA”), the transfer is legitimized in the manner described below.

See this link  for an overview of the EEA countries.

Transfers outside the EEA. The transfer of your data to a third party outside the EEA can in the first place be legitimized based on an adequacy decision of the European Commission, in which it is decided that the (part within the) third country in question ensures an adequate level of data protection. See  this link for a summary of the applicable adequacy decisions.

If your personal data is transferred to a country outside the EEA for which there is no adequacy decision or adequacy regulation in place, we agree on the applicability of the relevant version of the Standard Contractual Clauses with the relevant party. This is a standard contract to safeguard the protection of your data, which is approved by the European Commission in which the parties fill out the appendices. See  this link for the various versions of the Standard Contractual Clauses. Where appropriate, additional safeguards should be taken. 

In specific situations we can also rely on the derogations from article 49 GDPR to legitimize the data transfer. This means that we may transfer your data: (i) with your explicit consent, (ii) if this is necessary for the performance of a contract that has been concluded with you or has been concluded in your interest, or (iii) if this is necessary for the establishment, exercise or defence of legal claims. Lastly, in exceptional cases we may also transfer your data if the data transfer is necessary for our compelling legitimate interests and is not overridden by your interests or rights and freedoms. You can contact us if you want additional information about the way in which we legitimize the transfer of your data to countries outside the EEA. Our contact details are stated at the bottom of this Privacy Statement.

Article 8.             How do we determine how long we retain your data?

In general, we do not keep your data for longer than what is necessary in relation to the purposes for which we process the data. There could however be exceptions applicable to the general retention terms.

Exception: shorter retention period. If you exercise certain privacy rights, it is possible that Takecarebnb will remove your data earlier than the general applicable retention period based on our policies or – oppositely – retain it for a longer period of time. For more information about this, please refer to the header “What are your privacy rights?”

Exception: longer retention period. In certain situations, we process your data for a longer period of time than what is necessary for the purpose of the processing. This is for instance the case when we have to process your data for a longer period of time:

  • Retention obligation. To comply with a minimum retention period or other legal obligation to which we are subject based on the applicable law;
  • Procedure. Your personal data is necessary in relation to a legal procedure; or
  • Freedom of expression. When further processing of your personal data is necessary in order to exercise the right to freedom of expression and information.

Article 9.             What are your privacy rights?

Based on the General Data Protection Regulation (“GDPR“; (EU) 2016/679) you have various privacy rights. To what extent you can exercise these rights may depend on the circumstances of the processing, such as the manner in which Takecarebnb processes the personal data and the legal basis for the processing. Below, we included a summary of your privacy rights under the GDPR. For more information about your privacy rights, go to this webpage or this webpage of the European Commission.

We will respond to all requests without undue delay. If our full response will ever take more than a month due to complexity or number of requests, we will notify you of this and keep you updated. Furthermore, please note that we may request more information to confirm your identity before acting on any request.

Your privacy rights. In relation to our processing of your personal data, you have the following privacy rights:

  1. Right to withdraw consent. In so far as our processing of your data is based on your consent, you have the right to withdraw your consent at any time via our contact details stated below. Withdrawal of consent does not influence the legitimacy of the processing before you withdrew your consent. If you withdraw your consent, Takecarebnb will no longer process your data for the purpose that you consented to. It can however be possible that we still process the personal data for another purpose, such as to comply with a minimum retention period. In that case you will be informed about this.
  2. Right of access. You have the right to request access to your data. This enables you to receive a copy of the data we hold about you (but not necessarily the documents themselves). We will then also provide you with further specifics of our processing of your personal data. For example, the purposes for which we process your data, where we got it from, and with whom we share it.
  3. Right to rectification. In certain circumstances, you have the right to request rectification of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected. You have this right in case we process personal data about you that: (i) is factually incorrect; (ii) is incomplete or not related to the purpose it was collected for; or (iii) is in any other way used in a manner that is in conflict with an applicable law.

The right of rectification is not intended for the correction of professional opinions, findings or conclusions that you do not agree with. However, Takecarebnb could in such case consider adding your opinion about this to your data.

  • Right to erasure. In certain circumstances, you have the right to request erasure of your personal data. This enables you to ask us to delete or remove your data where: (i) the data is no longer necessary, (ii) you have withdrawn your consent, (iii) you have objected to the processing activities, (iv) the data has been unlawfully processed, (v) the data has to be erased on the basis of a legal requirement, or (vi) where the data has been collected in relation to the offer of information society services.

However, we do not have to honour your request to the extent that the processing is necessary: (i) for exercising the right of freedom of expression and information, (ii) for compliance with a legal obligation which requires processing, (iii) for reasons of public interest in the area of public health, (iv) for archiving purposes, or (v) for the establishment, exercise or defence of legal claims.

  • Right to object. You have the right to object to the processing of your data where we are relying on legitimate interest as processing ground (see above). Insofar as the processing of your data takes place for direct marketing purposes, we will always honour your request. For processing for other purposes, we will also cease and desist processing, unless we have compelling legitimate grounds which override your interests, rights and freedoms or that are related to the institution, exercise or substantiation of a legal claim. If such is the case, we will inform you on our compelling grounds and the balance of interests made
  • Right to restriction. The right to restriction of processing means that Takecarebnb will continue to store personal data at your request but may in principle not do anything further with it. In short, you have this right when Takecarebnb does not have (or no longer has) any legal grounds for the processing of your data or if this is under discussion. This right is specifically applicable in the following situations:
    • Unlawful processing. We may not (or no longer) process certain personal data, but you do not want us to erase the data. For example, because you still want to request the data at a later stage.
    • Data no longer required. Takecarebnb no longer needs your data for our processing purposes, but you still require the personal data for a legal claim. For example, in case of a dispute.
    • Pending an appeal. You objected against the processing of your data by Takecarebnb (see the right to object above). Pending the verification of your appeal we shall no longer process this personal data at your request.
    • Contesting the accuracy of data. You contest the accuracy of certain data that we process about you (e.g. via your right to rectification; see above). During the period in which we assess your contest we shall no longer process this personal data at your request.
  • Right to data portability. You have the right to request the transfer of your data to you or to a third party of your choice (right to data portability). We will provide you, or such third party, with your personal data in a structured, commonly used, machine-readable format. Please note that this right only applies if it concerns processing that is carried out by us by automated means, and only if our processing ground for such processing is your consent or the performance of a contract to which you are a party (see above).
  • Automated decision-making. You have the right not to be subject to a decision based solely on automated processing, which significantly impacts you (“which produces legal effects concerning you or similarly significantly affects you”). In this respect, please be informed that when processing your personal data, we do not make use of automated decision-making which significantly impacts you.
  • Right to complaint. In addition to the above-mentioned rights, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or where an alleged infringement took place. Please refer to this webpage for an overview of the supervisory authorities in the EU and their contact details. However, we would appreciate the chance to deal with your concerns before you approach them, so please contact us beforehand.

How to exercise your rights. You can exercise your privacy rights free of charge, by phone or by email via the contact details displayed below. If requests are manifestly unfounded or excessive, in particular because of the repetitive character, we will either charge you a reasonable fee or refuse to comply with the request.

Verification of your identity. We may request specific information from you to help us confirm your identity before we further respond to your privacy request.

Follow-up of your requests. We will provide you with information about the follow-up of the request without undue delay and in principle within one month of receipt of the request. Depending on the complexity of the request and on the number of requests, this period can be extended by another two months. We will notify you of such an extension within one month of receipt of the request. The applicable (privacy) legislation may allow or require us to refuse your request. If we cannot comply with your request, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

Article 10.            Contact details and changes

Takecarebnb is located at Science Park 608-A, 1098 XH in Amsterdam. Our Chamber of Commerce number is 64636917.

If you have any questions concerning this Privacy Statement or data collection in particular, please contact us at info@takecarebnb.org.

We may change this Privacy Statement from time to time to accommodate new technologies, industry practices, regulatory requirements or for other purposes. The latest version can always be consulted via the Takecarebnb Website. Important changes will also be communicated to you.

Our Privacy Statement was lastly adjusted on 23 November 2022.