Privacy statement
This is a translation. In case of differences, the Dutch version prevails.
Last updated: 8 October 2026
Stichting Layan Foundation handles your personal data with care. Here you can read which data we process, why, how long we keep it and what rights you have.
Who we are
Stichting Layan Foundation
Kranenburgweg 145, 2583 ER The Hague
KvK 92031943 · RSIN 865858238
info@layanfoundation.org
We are responsible for processing your data as described in the General Data Protection Regulation (GDPR).
What data we process and why
When you donate through the website
- Data: your first name, surname and email address, your company name if you fill it in, and the amount, the date and the project you choose.
- Payment details: your payment details (such as your account or card) go directly to our payment provider Stripe. We do not see or store them.
- Purpose: to process your donation, send you a confirmation and keep our accounts.
- Legal basis: carrying out your donation, and our legal obligation to keep accounts.
- Retention period: 7 years, the statutory retention period for tax purposes.
- Giving anonymously: if you choose to give anonymously, we do not mention your name anywhere. It is, however, recorded in our accounts.
When you transfer money to our bank account
- Data: your name, your account number, the amount and the payment reference.
- Purpose: our accounts.
- Legal basis: legal obligation.
- Retention period: 7 years.
When you contact us
- Data: through the contact form or by email: your name and email address, your phone number if you fill it in, and your message.
- Purpose: to answer your question.
- Legal basis: our legitimate interest in being able to answer questions.
- Retention period: up to 2 years after the last contact.
When you sign up for our newsletter
- Data: your email address, and your name if you fill it in.
- Purpose: to tell you about our work once a quarter. We only email you if you have signed up yourself.
- Legal basis: your consent. You can unsubscribe at any time, using the link at the bottom of every newsletter.
- Retention period: until you unsubscribe.
When you visit our website
- Data: we keep visitor statistics on our own server. We do not use cookies for this, and your IP address is anonymised and made unrecognisable.
- Purpose: to see which pages are read, so that we can improve the site.
- Legal basis: our legitimate interest.
When you watch a video
Videos come from YouTube (Google) and only load once you give your consent. YouTube may then place cookies and process data in line with Google’s privacy policy.
We do not take decisions that are made solely by a computer. We do not create profiles of you and we do not show adverts.
Cookies
Without your consent, we only place cookies that are necessary: to remember your cookie choice and to keep payments secure (Stripe, to prevent fraud). With your consent, we also load videos from YouTube. You can change your choice at any time. See our Cookie policy.
Who we share data with
We never sell or rent out your data. We work with these service providers:
| Service provider | Purpose |
|---|---|
| Stripe (Ireland) | processing payments. Stripe itself is responsible for fraud prevention and its own legal obligations |
| Google (Ireland) | email (Google Workspace) and backups of the website (Google Drive) |
| TransIP (the Netherlands) | hosting the website |
| bunq (the Netherlands) | our bank account |
| Newsletter | sign-ups currently go by email (Google Workspace); once we use a newsletter service, we will name it here |
| YouTube (Google) | videos, only after your consent |
We sign a data processing agreement with service providers that process data on our behalf. We only provide data to authorities such as the Dutch Tax and Customs Administration if the law requires us to.
Some service providers, such as Stripe and Google, may also process data in the United States. This is covered by the safeguards that the GDPR requires, such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.
Children
- Our website is not intended for children under 16. We do not knowingly ask for their data.
- We do not publish recognisable images or full names of children under 13.
- Data of children and families in the project areas is processed by our partners on the ground, not by us.
Security
- Data is always sent over a secure connection (https).
- Only board members and our web developer have access to the admin area.
- We make regular backups of the website.
Your rights
You have the right to access your data, to have it corrected or deleted, to have its processing restricted, to object to its processing and to have your data transferred. Have you given consent? Then you can withdraw it at any time.
Send your request to info@layanfoundation.org. We will respond within one month. Sometimes we may ask you to show that you are who you say you are; we will not ask for more than is necessary. Data that we are required by law to keep, such as donations in our accounts, can only be deleted once the retention period has ended.
Not happy with how we handle your data? Let us know. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Changes
If we change this statement, the new date will appear at the top.
