Privacy Policy

1. Introduction

Stichting Al-ikhlaas (hereinafter "we", "us", or "our") is a non-profit foundation (stichting) registered in the Netherlands. We are committed to protecting your personal data and respecting your privacy in accordance with the General Data Protection Regulation (GDPR – EU Regulation 2016/679) and the Dutch implementation act (Uitvoeringswet AVG – UAVG).

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and what rights you have regarding your data when you use our website and services.

2. Data Controller

The data controller responsible for processing your personal data is:

Stichting Al-ikhlaas
Bessemoerstraat 6, 9741 AJ, Groningen
Email: info@al-ikhlaas-stichting.com
Phone: +31 6 39720555

3. What Personal Data We Collect

We may collect and process the following categories of personal data:

3.1 Student Enrolment

Parent/guardian name, email address, phone number
Home address (street, house number, postal code, city)
Child's name, date of birth, gender
Educational information (Arabic language level, current school attendance)
Special needs or medical information (if voluntarily provided)

3.2 Newsletter Subscription

Email address
Subscription status and date

3.3 Contact Form

Full name
Email address
Phone number (optional)
Message content

3.4 Volunteer Applications

Full name, email address, phone number
City, gender
Experience and motivation

3.5 Donations

Payment is processed through Stripe. We do not store credit card or bank details on our servers. Please refer to Stripe's Privacy Policy for details on how they handle payment data.

3.6 Technical Data

IP address
Browser type and device information
Pages visited and timestamps

4. Legal Basis for Processing

Under the GDPR, we process your personal data based on the following legal grounds:

Purpose	Legal Basis (Art. 6 GDPR)
Student enrolment administration	Performance of a contract (Art. 6(1)(b))
Sending newsletters	Consent (Art. 6(1)(a))
Responding to contact messages	Legitimate interest (Art. 6(1)(f))
Processing volunteer applications	Consent (Art. 6(1)(a))
Processing donations	Performance of a contract (Art. 6(1)(b))
Website security and analytics	Legitimate interest (Art. 6(1)(f))

5. How We Use Your Data

We use your personal data for the following purposes:

To process and manage student enrolments
To communicate with parents/guardians about school matters
To send newsletters and updates (only with your consent)
To respond to your inquiries via the contact form
To process and manage volunteer applications
To process donations securely via Stripe
To maintain website security and prevent misuse
To comply with legal obligations

6. Data Sharing

We do not sell, rent, or trade your personal data to third parties. We may share your data with:

Stripe Inc. – for secure payment processing of donations
Hostinger International Ltd. – our web hosting provider (data processing agreement in place)
Google – for reCAPTCHA anti-spam protection (subject to Google's Privacy Policy)
Authorities – when required by Dutch or EU law

All third-party processors are bound by data processing agreements (verwerkersovereenkomsten) in accordance with Article 28 GDPR.

7. Data Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected:

Data Category	Retention Period
Student enrolment data	Duration of enrolment + 2 years
Newsletter subscribers	Until unsubscription
Contact form messages	12 months
Volunteer applications	12 months after application
Donation records	7 years (Dutch fiscal obligation)
Website access logs	6 months

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

SSL/TLS encryption for data in transit
Secure password hashing for user accounts
Access controls limiting data access to authorised personnel only
Regular security updates and monitoring

9. Your Rights Under GDPR

As a data subject in the EU/EEA, you have the following rights:

Right of Access (Art. 15) – Request a copy of your personal data
Right to Rectification (Art. 16) – Request correction of inaccurate data
Right to Erasure (Art. 17) – Request deletion of your data ("right to be forgotten")
Right to Restriction (Art. 18) – Request limitation of data processing
Right to Data Portability (Art. 20) – Receive your data in a structured, machine-readable format
Right to Object (Art. 21) – Object to processing based on legitimate interests
Right to Withdraw Consent (Art. 7(3)) – Withdraw consent at any time without affecting prior processing

To exercise any of these rights, please contact us at info@al-ikhlaas-stichting.com. We will respond to your request within 30 days.

10. Cookies

Our website uses only essential cookies that are strictly necessary for the functioning of the website (e.g., session cookies). We do not use tracking cookies or third-party advertising cookies.

Google reCAPTCHA may set cookies to verify that you are not a robot. These are functional cookies required for spam protection.

11. International Data Transfers

Some of our service providers (such as Stripe and Google) may process data outside the European Economic Area (EEA). In such cases, we ensure that appropriate safeguards are in place, such as:

EU-US Data Privacy Framework
Standard Contractual Clauses (SCCs) approved by the European Commission

12. Children's Privacy

Our enrolment services involve processing data about children. We collect children's data only through their parents or legal guardians, who provide consent on their behalf. We do not knowingly collect personal data directly from children under 16 years of age without parental consent.

13. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):

Autoriteit Persoonsgegevens
Bezuidenhoutseweg 30
2594 AV Den Haag
Website: autoriteitpersoonsgegevens.nl
Phone: 088 - 1805 250

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be published on this page with a revised "Last updated" date. We encourage you to review this policy periodically.

15. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us: