Privacy policy
We collect only what is needed to record a donation and answer your messages. No newsletter, no marketing, no resale of data.
Last updated: 14 October 2026
Who is responsible for your data
The data controller is ASBL Pieds Nus, a non-profit association (ASBL) under Belgian law (company number (à renseigner)).
For any question about your data, write to [to be provided by the ASBL]. We have not appointed a data protection officer: the size of the organisation and the nature of the processing do not require one.
Top of pageData collected, purposes and legal bases
Here is each processing activity, the data involved, what makes it lawful and how long we keep the data.
| Processing | Data | Legal basis | Retention period |
|---|---|---|---|
| Online donation and email confirmation | Email, first and last name (optional), display name for a named donation, amount, date, project, payment identifier | Performance of the donation; legal obligation (accounting) | 7 years for accounting records, then anonymisation |
| Project follow-up by WhatsApp | Phone number | Your agreement: you give us the number for this follow-up | Same as the donation it relates to; deleted on simple request |
| Public display of a donor's name | Display name | Your explicit consent | Until you withdraw it |
| Contact form | Name, email, message | Legitimate interest (answering your request) and your consent (checkbox) | 12 months after the last exchange |
| Unfinished donation attempt | The same data as a donation | Pre-contractual steps | 30 days, then automatic deletion |
| Security and abuse prevention | IP address, anti-robot token | Legitimate interest (protecting the site) | IP address: a few minutes to an hour in server memory, not stored with your message |
| Site administration | Team accounts, audit log | Legitimate interest (security) | Life of the account + 12 months |
The technical logs of our hosting and protection providers (OVH, Cloudflare) may contain your IP address for a short time, for security purposes.
Top of pageYour phone number
We ask for your number only so that we can keep you informed about the progress of the project you funded (photos, videos) by WhatsApp. It is never used for anything else, never shared with third parties and never used for marketing.
WhatsApp is a third-party service: if you communicate with us through it, its own terms apply. You can ask at any time to be followed up by email instead.
Top of pageWho receives your data
Within the organisation, only the people who handle donations and correspondence have access. We also use providers (processors) who act only on our instructions, with whom a data processing agreement is or will be in place.
| Provider | Role | Note |
|---|---|---|
| OVH | Hosting of the site and the database (virtual private server) | Data centre location: [to be provided by the ASBL] |
| Cloudflare | Domain name system, protection and acceleration of the site, Turnstile anti-robot check, storage of encrypted backups | US company; sees traffic in clear text because the secure connection ends with them |
| Stripe | Card and other payments | Controller for payment data, subject to its own privacy policy; the payment page is hosted by Stripe |
| Resend | Sending donation confirmation emails and forwarding contact messages to the team | Receives the email address and the content of the message |
Links to Instagram, Facebook and TikTok are simple links: no visitor data is sent to these networks until you click.
Top of pageTransfers outside the European Union
Cloudflare, Stripe and Resend are US companies or are linked to US companies and may process data outside the European Economic Area. These transfers rely on the safeguards provided by the GDPR: standard contractual clauses of the European Commission and, where the provider participates, the EU-US Data Privacy Framework.
We aim to host with OVH in a data centre located in the European Union. Current location: [to be provided by the ASBL]. If the server were located outside the Union (for example in the United Kingdom), the transfer would rely on an adequacy decision of the European Commission or on standard contractual clauses, and this page would be updated.
Top of pageRetention periods at a glance
- Accounting records linked to a donation: 7 years, then anonymisation
- Contact form messages: 12 months after the last exchange, then automatic deletion
- Unfinished donation attempts: 30 days
- Encrypted server backups: 30 days
- A donor's display name: until consent is withdrawn
Your rights and how to exercise them
You can ask for access to your data, its rectification, its erasure (except accounting records that the law requires us to keep), restriction of processing; you can object to processing based on legitimate interest, receive your data in a reusable format, and withdraw your consent at any time without affecting what happened before.
To exercise a right, write to [to be provided by the ASBL]. We reply within one month. If there is doubt about your identity, we may ask you to confirm it. Exercising your rights is free of charge.
Top of pageComplaint to the supervisory authority
If you believe your rights are not being respected, you can lodge a complaint with the Belgian Data Protection Authority (APD/GBA), rue de la Presse 35, 1000 Brussels: autoriteprotectiondonnees.be. We encourage you to write to us first: we would rather solve the problem directly.
Top of pageSecurity
- Encrypted connection (HTTPS) across the whole site
- No card number passes through our servers: payment takes place with our payment provider
- Inputs checked on the server, protection against automated submissions (anti-robot check, limit on the number of messages)
- Administration access protected by password and two-factor authentication, actions recorded in an audit log
- Encrypted backups, server with restricted access and regularly updated
No system is infallible. In the event of a data breach likely to harm you, we will inform you and notify the APD within the legal deadlines.
Top of pageChanges to this policy
We update this page when our practices change. The date of the last update is shown at the top of the page.
Top of page