Privacy & cookies

At Stichting SOLAR, everything is about openness. That includes how we handle your data. We ask for no more than we need, we don't sell anything on, and below we say exactly what we do. In doing so, we comply with the General Data Protection Regulation (GDPR).

Who is responsible?

Stichting SOLAR is responsible for processing the personal data described on this page.

Stichting SOLAR

Pijnacker, the Netherlands

Chamber of Commerce (KvK) 42111679 · RSIN 869783786

Email: contact@stichting.solar

For any questions about privacy, email contact@stichting.solar. One contact person handles these.

What data do we process, and why?

Contact form

There is a contact form on the home page and the contact page. If you fill it in, we receive only your name, your email address and your message.

• Purpose: answering your question and staying in touch where needed.

• Legal basis: our legitimate interest in answering messages (Art. 6(1)(f) GDPR).

Signing up as a volunteer

Through the volunteer form we receive your name, your email address, your phone number (only if you fill it in), the hubs or roles you're interested in, what you can do or want to learn, roughly how much time you have, and any message you add.

• Purpose: getting in touch with you, finding a suitable task together and supporting you as a volunteer. If you ask for a reference letter, we also use your data for that.

• Legal basis: the steps towards volunteering and carrying out the arrangements we make with you (Art. 6(1)(b) GDPR).

Do you receive an allowance as a volunteer within the Dutch legal volunteer scheme? Then we also process your bank account number and the amounts paid, because we have to keep these in our accounts (Art. 6(1)(c) GDPR).

Proposing a project

Through the project proposal form we receive your name, your email address, your organisation if you give one, the content of your proposal and any links you send.

• Purpose: assessing your proposal, getting in touch with you and, if we take on your project, naming you as its originator.

• Legal basis: our legitimate interest in assessing proposals, and the steps towards a collaboration (Art. 6(1)(b) and (f) GDPR).

Donating

Through the donation form on the site. Payment runs through our payment partner (Stripe and/or PayPal, via Squarespace). We receive your name, your email address, the amount, the date and the purpose you choose. We don't see your full card or bank details; they stay with the payment service.

By bank transfer. If you transfer money to our account yourself (IBAN NL14 TRIO 0321 2883 27), we see your name, your account number, the amount and the description on our bank statement.

• Purpose: processing your donation, thanking you and keeping our accounts.

• Legal basis: carrying out your donation (Art. 6(1)(b) GDPR) and our legal obligation to keep accounts (Art. 6(1)(c) GDPR).

The shop and Kickstarter rewards

We sell our hoodies through The SOLAR Foundation Shop, a separate web shop on Shopify. Orders are made and shipped by Printful. When you order, we process your name, your email address, your delivery address, your order and the payment status. Here too, we don't see your full payment details.

If you back our Kickstarter campaign for the archive, Kickstarter handles the payment. Kickstarter is itself responsible for your data under its own privacy policy. To send your reward, we receive your name, your email address, the reward you chose and your delivery address from Kickstarter, and we pass these on to Printful so it can make and ship your hoodie.

• Purpose: making and shipping your order or reward, and handling any returns or complaints.

• Legal basis: carrying out the purchase agreement or the reward arrangement (Art. 6(1)(b) GDPR) and our obligation to keep accounts (Art. 6(1)(c) GDPR).

Visiting the website

When you visit our site, Squarespace processes technical data such as your IP address, your browser and device, the pages you view and the site you came from. This is needed to keep the site working securely, and we use it for visitor statistics in Squarespace Analytics, without persistent tracking cookies. We only see these statistics as totals, not per person. Our forms use Google reCAPTCHA to stop spam; in doing so, Google processes data about your device and your behaviour on the page.

• Purpose: a secure, working website, stopping spam and understanding which pages visitors find useful.

• Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). See also the section on cookies below.

What we don't do

• We don't sell your data or give it to others for their own marketing.

• We don't use Google Analytics, a Meta pixel or advertising cookies.

• We don't send you a newsletter or other mailings unless you signed up for them yourself.

• We don't make decisions about you that are taken by a computer alone.

Newsletter

We send a newsletter about every three months. You only get it if you sign up for it yourself (consent). For this we use your email address and, if you fill it in, your name. Every newsletter contains an unsubscribe link; if you unsubscribe, we stop sending you the newsletter and remove your address from the list.

How long do we keep your data?

We don't keep data longer than necessary. These are our retention periods:

• Data: Retention period

• Contact messages and attached files: Up to 12 months after your question has been dealt with

• Volunteer sign-up that does not lead to volunteering: At most 6 months after you sign up, unless you ask us to keep it longer

• Data of active volunteers: As long as you volunteer, plus 12 months after that (so we can still write a reference letter)

• Volunteer allowances paid: 7 years (legal retention requirement)

• Project proposal we don't take on: At most 12 months after our decision

• Project proposal we do take on: As long as the project runs. Your name as its originator stays as long as the project or the knowledge is public, unless you ask us to remove it

• Donations (personal data): 7 years (legal tax retention requirement). After that we delete your personal data and keep only anonymised totals and annual overviews, without personal data

• Orders and Kickstarter rewards: Address details until the order has been delivered and the return and complaints period has passed; financial data 7 years (legal retention requirement)

• Newsletter subscription: Until you unsubscribe

• Statistics in Squarespace Analytics: As long as Squarespace keeps them; we only see totals

Who do we share your data with?

We work with a few services that process data on our behalf. We have agreements with them on security and confidentiality (data processing agreements).

• Squarespace: Hosting the website, forms, donation block and statistics

• Google (reCAPTCHA): Spam protection for the forms

• Zoho: Our email: form messages and mail to contact@stichting.solar arrive here

• Payment service for donations: Our payment partner (Stripe and/or PayPal, via Squarespace)

• Triodos Bank: Our bank account, for transfers

• Shopify: The web shop The SOLAR Foundation Shop, including checkout

• Printful: Making and shipping hoodies from the shop and Kickstarter rewards

• Kickstarter: The platform for our campaign; Kickstarter is itself responsible for your account and payment

Some of these services are based in the United States or store data there. This only happens with appropriate safeguards, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Beyond that, we only share your data if the law requires us to.

archive.solar is our online knowledge archive. If you create an account there, the privacy policy and terms on archive.solar itself apply.

Security

We protect your data as well as we reasonably can. Only the board and the volunteers who need your data for their task can access it. We use accounts with strong passwords and two-step verification where possible. If something does go wrong with your data, we report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and to you where required.

Your rights

It's your data. You have the right to:

• see what data we hold about you;

• have incorrect data corrected;

• have your data deleted;

• have the processing restricted;

• object to processing based on our legitimate interest;

• receive your data in a common file format (data portability);

• withdraw your consent, if we do something based on consent.

Email your request to contact@stichting.solar. We respond within one month. Sometimes we first ask you to confirm that it's you, so we don't give data to the wrong person. Data we are legally required to keep, such as donations in our accounts, can only be deleted after the retention period.

A complaint?

Not happy with how we handle your data? Let us know first via contact@stichting.solar, and we'll look for a solution together. You always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Under 16?

Are you under 16? Then ask your parent or guardian to look along with you before you fill in a form or order something.

Cookies

Cookies are small files that a website stores on your device. Our site runs on Squarespace, and Squarespace places a few cookies. We do not use advertising cookies, Google Analytics or a Meta pixel.

Necessary cookies

These cookies are needed to make the site work securely and properly. They don't require consent.

• crumb: Protecting forms against misuse (CSRF) – Until you close your browser

• CART, hasCart: Remembering what's in your cart (only if you use it) – 2 weeks

• _ssid: Fraud prevention for payments – Up to 4 years

• RecentRedirect: Preventing redirects from going round in circles – 30 minutes

• Google reCAPTCHA: Stopping spam in forms – As set by Google

No analytics or tracking cookies

We only use functional and necessary cookies. We have switched off Squarespace's non-essential analytics cookies (in Squarespace the cookie setting is "Restrict"). Squarespace then counts visits without recognising your device: we see how many visitors there are and which pages they view, only as totals and without persistent tracking cookies. That's also why we don't need a cookie banner.

• ss_cvr, ss_cid, ss_cpvisit: Recognising unique visitors (analytics, 2 years) – Switched off

• ss_cvt, ss_cvisit: Counting a visit as one session (analytics, 30 minutes) – Switched off

Deleting or blocking cookies

You can always delete or block cookies yourself in your browser settings. If you block necessary cookies, forms, donating or the cart may no longer work properly.

Changes

If our site or the way we work changes, we update this page.