Privacy Policy

Privacy statement Take Back Your Privacy Foundation

Take Back Your Privacy Foundation (hereinafter “the Foundation“) aims to promote the interests of natural persons who face privacy violations and/or a violation of their consumer rights, or violation of other fundamental or legal rights. You can read more about this in our articles of incorporation (in Dutch).

In order to promote these interests, we may process personal data, for example when you contact us, when you deliver products or services to us, when you visit our website www.stichtingtakebackyourprivacy.nl or when you participate as a participant in a collective action or other proceedings we initiate.

The term “personal data” means any information about an identified or identifiable natural person. When processing your personal data, the Foundation qualifies as the data controller within the meaning of the General Data Protection Regulation (EU) 2016/679 (“GDPR“).

For the processing of your personal data in the context of the collective action against TikTok, this Privacy Statement does not apply. Instead, a separate privacy statement applies which you can consult here.

The contact details of the Foundation can be found below:

Stichting Take Back Your Privacy

Keizersgracht 2411016 EA Amsterdam

+ 31 (0)20 8082064

info@stichtingtakebackyourprivacy.nl

What personal data do we process?

When you contact us, the Foundation may process the following (categories of) personal data:

• Name and address details (surname, first names, initials, titles, gender, address, zip code, place of residence) as provided by you;
• Other (contact) data (telephone number, e-mail address and similar data required for communication), as provided by you;
• The content of your question, request or message, as provided by you and our response to it.

When you provide products or services to us, the Foundation may process the following (categories of) personal data of persons from whom the Foundation purchases products or services or who are employed by these suppliers:

• Name and address details (surname, first names, initials, title, gender, address, zip code, place of residence) as provided by supplier;
• Other contact data (telephone number, e-mail address and similar data required for communication) as provided by supplier;
• data for the purpose of placing orders or purchasing services; calculating and recording fees and expenses and making payments and collecting receivables, including the bank account number as provided by supplier;
• other data from suppliers whose processing is required by or necessary to comply with applicable laws or regulations.

When you visit our website, we may process the following personal data from you:

• Your IP address and the time of your visit.

We do not use cookies on our website.

In order to protect our interests and more specifically in connection with the (preparation of the) legal proceedings we conduct, we may process the following personal data of those involved (which may also include children), counterparties and other third parties (e.g. journalists or representatives of those involved):

• Name and address details (surname, first names, initials, title, gender, address, zip code, place of residence) to the extent disclosed to us;
• Other contact data (telephone number, e-mail address and similar data required for communication) to the extent disclosed to us;
• Data relating to electronic messages sent from or intended for third parties and data necessary to maintain contact with such third parties;
• data regarding the handling of the proceedings, also including data with regard to the other party and/or data with regard to other persons involved; and
• other third-party data obtained from public sources or provided to the Foundation by you, other parties or third parties.

If you are a participant in the collective action against TikTok, a separate privacy statement applies which you can consult here.

On the basis of which legal processing grounds and for which purposes does the Foundation process your personal data?

The Foundation processes your personal data on the basis of one or more of the following legal processing grounds:

1. If this is necessary for the performance of an agreement to which you are a party or to perform precontractual acts at your request;
2. If this is necessary to comply with statutory obligations;
3. If this is necessary to justify our legitimate interests or the interests of a third party;
4. Your consent.

When the Foundation processes your personal data on the basis of your consent, the Foundation will ask you for it separately. You may withdraw your consent at any time. The Foundation reminds you that withdrawing your consent does not affect the lawfulness of the processing of your personal data before the withdrawal of your consent.

The Foundation uses the above personal data for the purposes set out below, indicating for each purpose on the basis of which basis (1 to 4 mentioned above) the Foundation does so. If the processing is based on the basis of the ‘legitimate interest’, we briefly explain this interest. If you have specific in this respect, please do not hesitate to contact us.

Purposes with corresponding processing grounds:

• To further our statutory objectives, including but not limited to the conduct of legal proceedings (a, b, c: our legitimate interest to take action against violations of privacy, violations of consumer law, or violations of other fundamental or legal rights, d);
• for the administration of the Foundation, including the calculation or recording of fees or benefits, income and expenses, payment and collection of debts (including the use of collection agencies or bailiffs) (a, b, c: the importance of keeping proper records);
• to be able to deal with any complaints and disputes involving the Foundation (a, b and c: to defend rights, to maintain and improve existing relationships through proper complaint handling, to improve the quality of services);
• to provide you with access to our website and to be able to secure it adequately (c: the importance of being able to offer you a properly functioning website);
• To keep in touch with you and to communicate with you; (a, b, c: the importance of being able to answer your questions and respond to your requests and messages, d);
• for placing orders or purchasing services (a, b, c: the importance of being able to keep proper records);
• for conducting audits and other internal controls (a, b and c: the importance of keeping accurate records);
• to comply with our legal and statutory obligations (b, c: the importance of being able to fulfil these obligations).

To whom do we provide your personal data?

The Foundation does not provide your personal data to third parties (‘recipients’ within the meaning of the applicable privacy legislation), unless this is necessary for the proper performance of the purposes set out in this Privacy Statement, if the law requires us to do so or if you have provided your consent to this end. For example, in the event of a DDoS attack or other suspicious activity, our website administrator has access to your IP address and the corresponding time of your visit.

The third parties to whom the personal data is made available are obliged to treat your personal data confidentially. If these parties are classified as “processors” within the meaning of the privacy legislation, the Foundation will ensure that a processing agreement is concluded with these parties that meets the requirements defined in the GDPR. Third parties engaged by the Foundation who offer services as independent processors are themselves responsible for the (further) processing of your personal data in compliance with the applicable privacy legislation. These include accountants, lawyers and parties who are engaged to provide an expert opinion or expert report.

Personal data may be shared with:

• suppliers (e.g., our website’s hosting provider, Amazon Web Services, our website operator, software vendors, our attorneys (Scott+Scott Attorneys at Law LLP), accountants, etc.);
• counterparties, other attorneys or consultants;
• courts and government institutions;
• other parties, such as regulators and other agencies if required by law or with your consent.

The Foundation may need to transfer personal data to a recipient in a country outside the European Union that provides a lower level of protection of personal data than European law offers. In that case, the Foundation will ensure that such a transfer of personal data is in accordance with the applicable laws and regulations, for example by concluding a model contract drawn up and approved for that purpose by the European Commission, and will assess whether additional measures are still needed to ensure an adequate level of protection for your personal data. Please do not hesitate to contact us if you would like to receive further information on the appropriate or suitable safeguards in place for the transfer of your personal data outside the European Union or if you would like to receive a copy of them.

How long do we keep your personal data?

The Foundation does not retain your personal data in an identifiable form for longer than is necessary to achieve the purposes included in this Privacy Statement. More specifically, we apply the following retention periods:

• We keep the personal data we process when you contact us as long as this is necessary to be able to answer your question or request and to settle it definitively. If we can use the content of your message in legal proceedings, we will keep your message as long as this is necessary for the proceedings and up to five years after the final settlement of the legal proceedings;
• Your IP address and the corresponding time of your visit is kept for one week after your visit to our website;
• If you submit a complaint to us, we will delete the personal data processed in the context of this complaint no later than two years after the complaint and/or the resulting legal proceedings have been finally settled;
• Personal data that must be kept on the basis of Article 52 of the Dutch State Taxes Act will be kept for 7 years (from the end of the year in which the data in question have lost their current value for the (tax-) related business operations) in connection with the tax retention obligation incumbent on the Foundation pursuant to Article 52(4) of the Dutch State Taxes Act.

The abovementioned specific retention periods can be extended if statutory retention obligations apply or will become applicable. The Foundation may also retain personal data for a longer period if this is necessary for the settlement of incidents and/or legal disputes (e.g. between you and the Foundation).

Security

The Foundation has taken appropriate technical and organizational measures to secure your personal data against unauthorized or unlawful processing and against loss, destruction, damage, modification or publication. For questions about the security of your personal data, or if you suspect or see signs of misuse, please contact us at info@stichtingtakebackyourprivacy.nl.

Your privacy rights

For the exercise of your privacy rights in connection with your participation in the collective action against TikTok, please contact the Consumers’ Association (Consumentenbond). More information can be found here.

You have the following rights in respect of the processing of your personal data by the Foundation:

• the right to request whether the Foundation processes your personal data and if so, the right to access your personal data and to receive information about the processing of your personal data;
• the right to rectification of your personal data if these are incorrect or incomplete; – the right to have your personal data deleted (‘right to be forgotten’)
• the right to object to the processing of your personal data or to limit the processing of your personal data;
• the right to withdraw your consent for the processing of your personal data, if the processing is based on your consent;
• the right to receive or surrender your personal data to a third party appointed by you in a structured, customary and machine-readable form (‘right to data portability’).

The Foundation does not use automated decision-making within the meaning of Article 22 GDPR.

To exercise your rights, please contact the Foundation at info@stichtingtakebackyourprivacy.nl or by post using the contact details set out at the beginning of this Privacy Statement.

In order to prevent that the Foundation discloses information to the wrong person, the Foundation can ask you for additional information to verify your identity. In principle, Hunter Legal will inform you of whether the Foundation can comply with your request, within one month after receipt. In specific cases, for example when it concerns a complex request, this term may be extended by two months. The Foundation will inform you of such an extension within one month after receiving your request. On the basis of the applicable privacy legislation, the Foundation can refuse your request under certain circumstances. If this is the case, the Foundation will explain to you why. You can find more information about your privacy rights on the website of the Dutch Data Protection Authority.

Complaints

If you have a complaint about the processing of your personal data by the Foundation, the Foundation will try to resolve it with you. If this does not lead to the desired result, you have the right to submit a complaint to the competent supervisor. In the Netherlands this is the Dutch Data Protection Authority. If you live or work in another country of the European Union, you can submit a complaint to the supervisory authority in that country.

Amendments

The Foundation reserves the right to amend this Privacy Statement. The most recent version of this Privacy Statement will always be posted on our website, www.stichtingtakebackyourprivacy.nl. If there are substantial changes that could significantly affect one or more data subjects, the Foundation will strive to inform those data subjects immediately. This Privacy Statement was last updated on June 22, 2021.