Privacy policy

This website is run by the Yemeni Community in the Kingdom of the Netherlands, a voluntary non-profit body set up under Dutch law and officially registered in the Netherlands as “De Jemenitische Gemeenschap Vereniging in Nederland” (Article 4 of the community’s statute). The community is the data controller (verwerkingsverantwoordelijke) for the personal data processed on this website under the General Data Protection Regulation (AVG/GDPR). Its board manages the website and its content and takes decisions about data on the community’s behalf; under the statute, the board’s public relations and media officer oversees the website. Please address any questions or requests about your data to the board.

• We collect as little data as possible, and only for a specific purpose.
• We do not sell your data, we do not use it for advertising, and we do not track your browsing.
• We do not use visitor analytics tools or advertising cookies.
• We delete data automatically once it is no longer needed, within the periods set out below.
• We respect the principle of freedom and privacy for the community’s members set out in the statute (Article 5).

Browsing the website. You can read the news, articles and events without an account and without us asking you for any data. The website’s server processes technical data needed to show the pages and protect them, such as your IP address and browser type; we do not use it to identify or track you.

Your account. The display name you choose (which may be a pseudonym), your email address, your password and your newsletter preference. Your password is stored with one-way encryption, and nobody can see it. Legal basis: performance of the agreement set out in the terms of use (Article 6(1)(b) of the GDPR).

Comments. The text of your comment, when it was posted, your display name, and the moderation decisions about it. Your email address is not shown to anyone. Legal basis: performance of the agreement, and our legitimate interest in running a safe and respectful discussion (Article 6(1)(f)).

Event registration. Your name, email address, phone number (optional) and the number of people attending, and attendance recorded on the day of the event. Legal basis: carrying out your request to register (Article 6(1)(b)).

Contact form. The type of message, your name, email address and message, any phone number, city or subject you choose to add, and the internal notes the team makes while following up your message. Legal basis: our legitimate interest in answering and following up your message (Article 6(1)(f)).

Newsletter. Your email address, when you subscribed, when you confirmed, and the version of the consent text you agreed to. Your subscription only becomes active once you have confirmed it from your email. Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time through the unsubscribe link in every email or from your account page.

Reports about comments. A description of the violation and a link to it, and your name and email address if you choose to give them. Legal basis: our obligation to handle reports under the EU Digital Services Act (DSA), and our legitimate interest in protecting users.

Protection against abuse. To prevent spam and automated attempts, we store an encrypted fingerprint of your IP address combined with a secret value, not the IP address itself, and use it only to count attempts. We also use the Cloudflare Turnstile service to check that the person sending a form is a human and not an automated program. Legal basis: our legitimate interest in the security of the website (Article 6(1)(f)).

The staff team. For the team members who manage the website: their roles and a log of the actions they take in the admin dashboard, for security and accountability.

Board and committee members. On the About us and Committees pages we publish the names and positions of the members of the board, the oversight committee and the other committees, and the photo of those who agree to it, so that people know who represents the community. Legal basis: their consent (Article 6(1)(a)); any of them can ask at any time for their photo or details to be removed.

• Account and comments: for as long as the account exists. When you delete your account, its data is deleted immediately, and your published comments either stay under the name “Former member” or have their text deleted, as you choose.
• Event registrations: deleted automatically three months after the event ends; only the number of people registered is kept, without names.
• Contact messages: deleted automatically twelve months after they are closed, and complaints after twenty-four months.
• Newsletter: unconfirmed subscription requests are deleted after thirty days. If you unsubscribe, your email address is deleted after thirty days; after that, for two years, we keep a record that proves your consent and your unsubscription (the date of consent, the date of unsubscription and the version of the consent text, with an encrypted fingerprint of your email address that does not reveal the address itself), and then it is deleted.
• The log of the staff team’s actions: kept for accountability; it contains no passwords or IP addresses.

We share your data only with service providers that process it on our behalf under data processing agreements, and only as far as is needed to run the website:

• The website’s hosting provider.
• Supabase: the database, account management and image storage.
• Brevo (email provider): to send account activation emails, registration confirmations and replies to messages, and the newsletter.
• Cloudflare (the Turnstile service): to check that the person using a form is not an automated program.

Wherever possible, we choose providers that process data within the European Union. If one of them processes data outside the European Economic Area, this only happens with safeguards recognised by the GDPR, such as an adequacy decision or the European standard contractual clauses.

We do not sell or rent your data to anyone. We only hand it over to a public authority if the law requires us to, or to protect someone from serious danger, such as a threat of violence.

If you tap the WhatsApp button or a link to one of the community’s social media accounts, you go to that service, and your data there is subject to its own privacy policy. Our website loads nothing from these services until you tap the link.

Cookies are small text files that your browser stores on your device. We only use the ones the website needs in order to work or that you ask for yourself, which is why we do not show a pop-up asking for your consent:

• Session cookies (necessary). When you sign in, the website stores cookies whose names begin with “sb-” and which hold your session token, so that you stay signed in and we can check your permissions. They are deleted when you sign out or when the session expires, and are not used for any other purpose.
• Language cookie (at your request). When you choose a language with the language button at the top of the page, the website stores a cookie named “site_lang” that holds only your choice (such as “en”) for one year, so that the home page opens in your language when you come back.
• Night mode (at your request). If you choose night mode, your browser keeps your choice under the name “site_theme” on your device only; it is not sent to us or to anyone else.

These are necessary to provide the service you asked for, and are therefore exempt from the requirement of prior consent under the Dutch Telecommunications Act (Telecommunicatiewet, Article 11.7a). We use no tools for analysing or measuring visits, no advertising and no tracking cookies from social networks, and we do not share browsing data with anyone for marketing purposes.

On pages with forms (creating an account, signing in, resetting your password, commenting, reporting, contacting us, registering for events and subscribing to the newsletter), the Turnstile service from Cloudflare is loaded. It processes technical data about your browser and connection to tell visitors apart from automated programs, and for that purpose only.

You can delete or block cookies in your browser settings. If you block the session cookies, you will not be able to sign in, but you can still read the website.

You have the right to access, correct and delete your data, to restrict and object to its processing, to receive a copy of it in a portable format, and to withdraw your consent at any time.

• Changing your display name and your newsletter subscription: on your account page.
• Downloading a copy of your data: from your account page, in JSON format.
• Deleting your account: on the account deletion page, without needing to write to us.
• Any other request: through the contact form or the email address given above.

We respond to your request within one month, and to protect your data we may ask you to prove your identity before carrying it out. If you are not satisfied with our response, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) through its website, autoriteitpersoonsgegevens.nl.

• Your connection to the website is fully encrypted (HTTPS).
• Passwords are stored encrypted, and nobody can see them.
• Every member of the staff team signs in with their own account and can only reach the sections they need for their work.
• Sensitive actions in the admin dashboard are recorded in a log that cannot be changed from the dashboard.
• If a data breach occurs that may affect your rights, we notify the Dutch Data Protection Authority within seventy-two hours, and we also inform you when necessary.

You must be sixteen or older to create an account. Younger people can read the website without an account, or register for events with the consent of a parent or guardian.

We may update this policy when the way the website works or the law changes. The date of the last update is shown at the top of the page, and we announce significant changes on the website or tell account holders about them by email.