Privacy policy

1. Who we are

Stichting Dienstbaar (Serving His Way) is responsible for the processing of personal data through this website (servinghisway.org) and our Dutch website (dienstbaar.org). This means we decide which data we use and for what purpose.

Name: Stichting Dienstbaar
Address: Craaienhof 42, 4041 BV Kesteren, the Netherlands
Chamber of Commerce (KvK) number: 58870563
Email: info@dienstbaar.org

Do you have a question about your data, or would you like to exercise one of your rights? Feel free to email us.

2. What we do with your data

Below, for each part of the website, you can read which data we use, why, on what legal basis under the GDPR and how long we keep it. We never collect more than we need for that purpose. We never sell your data and do not use it for advertising.

Visiting the website

We keep track of how many people visit the website and which pages are popular, without cookies and without following you. From your IP address and browser we make, per day, a code that cannot be traced back to you, using a key that changes every day. At the end of the day we keep only totals (number of visits, type of device, language, the website you came from), and the raw data and that day's key are erased. After that nobody, including us, can link a visit to a person. We do not store your IP address itself for this.

Legal basis: legitimate interest (improving the website).
Retention: raw data for at most one day; after that only anonymous totals.

Like every web server, our web host keeps technical log files, including your IP address, to keep the website secure and working. These log files are kept for 60 days.

Protection against abuse

To prevent our forms from being abused by spam or automated programs, we use Cloudflare Turnstile when you sign in, on the contact form, the sign-up for pastoral care, the newsletter, donations and checkout. Turnstile looks at your IP address and characteristics of your browser, among other things, to determine whether you are a human. We also briefly keep track of how often a form is sent from an IP address, so that nobody can keep trying endlessly.

Legal basis: legitimate interest (securing the website and your data).
Retention: the counts per IP address are deleted as soon as the measuring period is over (usually within an hour).

The contact form

If you send us a message, we use your first name, last name, email address, the subject and your message to answer your question. Your message is stored encrypted and is visible only to staff who have specific permission for it.

Legal basis: legitimate interest (answering your question).
Retention: one year, after which your message is deleted automatically.

Prayer, deliverance and emotional healing

This is the most sensitive part of what we do, which is why we describe it in detail. Anyone who seeks pastoral help from us shares data about their faith and health. These are special categories of personal data, which the law protects extra carefully. We use them only to help you, and only the staff who provide your care can see them.

1. Your sign-up. Through the sign-up form we ask for your first name, last name, email address, your phone number if you wish, the kind of help you are looking for and, if you wish, an explanation. We use this to contact you.

2. The intake form. If you go further, we ask you to fill in a more detailed form, including:

your address and phone number;
whether you have been baptised, and questions about your faith in Jesus;
a questionnaire about spiritual and personal problems you recognise in yourself, and that you recognise in your family;
space for additional remarks and personal details you want to share with us.

If you fill in anything about your family, do not give names or other details by which family members could be identified. We only need what you recognise.

3. The agreement. Before you receive care, you sign an agreement with the foundation. It sets out the arrangements for the care and the responsibilities of you and of the foundation. This agreement shows that you sought pastoral help, so we keep it separately from your intake form and just as carefully.

For all of this data:

we ask for your explicit consent before you send anything;
we store it encrypted, and only staff with specific permission can see it; we record who opened it and when;
we never include its content in an email;
you can withdraw your consent at any time by emailing us; we will then delete your data, except the agreement (see below).

Legal basis: for your sign-up and the intake form, your explicit consent (Article 9(2)(a) GDPR). For the agreement, carrying out that agreement and, afterwards, the need to be able to show what we agreed with you should a dispute ever arise (Article 9(2)(f) GDPR).

Retention periods:

your sign-up: one year, after which it is deleted automatically;
the intake form: we destroy it one month after your last appointment for deliverance or prayer;
the agreement: seven years after your last appointment. If a complaint or dispute is ongoing at that moment, we keep it until that has been settled. After that it is destroyed.

The newsletter

If you sign up for our newsletter, we keep your email address, your first name (if you fill it in), the language you signed up in and when you signed up and confirmed. You first receive an email to confirm your sign-up; only after that do we send you the newsletter. We do not measure whether you open the newsletter or click its links.

Legal basis: your consent. You can unsubscribe at any time using the link at the bottom of every newsletter.
Retention: as long as you are subscribed. If you do not confirm your sign-up, we delete your data as soon as the confirmation link expires. After you unsubscribe we keep your data for one more year, so that we can show that you unsubscribed and you do not receive mail again by mistake. After that it is deleted automatically.

Donating

If you make a gift through the website, we use your name, email address, the amount and whether it is a one-off or recurring gift. Payment is handled by our payment provider Mollie: you enter your bank or card details with Mollie, not with us. From Mollie we only receive whether the payment succeeded and, for a recurring gift, a reference to the mandate. You receive a confirmation with a link to your receipt. For your gift we create an account for you (or link the gift to your existing account), so that you can view your gifts and pause or stop a recurring gift yourself.

If you transfer a gift through your bank, our bank gives us your name, account number, the amount and the description.

Legal basis: carrying out your gift (contract) and our legal obligation to keep our accounts.
Retention: seven years, as Dutch tax law requires. After that the data is deleted automatically.

The shop

If you order something, we use your first name, last name, email address, your phone number if you give it, your delivery address, what you ordered and the payment status. We use this data to process and ship your order, to send you an invoice and the confirmation and, for digital products, to give you a personal download link. As with donations, we create an account for you or link the order to your existing account.

When you fill in your postcode and house number, the website completes your street and town through PDOK, the public address register of the Dutch government (Kadaster). Our server asks the question; PDOK only sees the postcode and house number, not your name or IP address.
We send parcels with PostNL. PostNL receives your name, address and email address, so that the parcel can be delivered and you receive the track-and-trace messages.
Payment is handled by Mollie, as described above under donating.

If you tick the box to receive the newsletter when checking out, what is written above about the newsletter applies.

Legal basis: carrying out the purchase contract and our legal obligation to keep records.
Retention: seven years, as Dutch tax law requires. After that the order, the invoice and any shipping labels are deleted automatically.

Your account

With your account you can view your orders, gifts and downloads. You sign in with a one-time code that we send to your email address. We keep your email address and your name. While you are signed in, we keep your IP address and browser type for each session, so that you can see where you are signed in and we can warn you when someone signs in from a new device.

Legal basis: carrying out the contract (your account) and legitimate interest (securing your account).
Retention: we keep your account as long as you use it. If you want us to delete it, email us. Data we are legally required to keep (such as orders and gifts) remains until the end of its retention period. Expired sessions and sign-in codes are deleted automatically, as are devices that have not been used for a year.

Emails we send you

All emails the website sends (sign-in codes, confirmations, newsletters) go through our mail server. We keep an overview of sent messages so that we can solve delivery problems. The content is erased immediately after sending; what remains is a copy in which sign-in codes and personal links have been made unreadable.

Legal basis: legitimate interest (making sure messages arrive).
Retention: three months, after which the overview and the copy are deleted automatically.

Videos from YouTube

Some pages show a video from YouTube. It is only loaded when you click play, through YouTube's privacy-enhanced version (youtube-nocookie.com). Only at that moment does YouTube (Google) receive data from you, such as your IP address. Google's privacy policy applies to that.

Links to social media

Our links to Instagram and YouTube are ordinary links. Our website contains no buttons, pixels or other social media code that follows you.

3. Cookies

We only use cookies that are needed to make the website work. No consent is needed for these. We do not place cookies for statistics, advertising or tracking your browsing.

In your browser the cookies have __Host- before their name, for example __Host-session. This is a security setting: it means only this website can read them, and only over a secure connection.

session: keeps you signed in. Removed when you sign out, when you have not been active for a long time, or after one year at most.
login: remembers that you are signing in or confirming an extra step. Removed after signing in or after a few minutes.
consent: remembers your cookie choice. One year.
cart: remembers what is in your basket. Thirty days.
order and gift: show your own order or gift on the thank-you page after payment. One day.
flash: shows a short message after an action, such as "saved". Two minutes.
language_hint: remembers that you closed the notice about the other language. Until you close your browser, or one year if you have allowed functional cookies.

You can change your choice at any time on the Cookies page.

We only share your data with parties we need to make the website and our services work. They process your data only on our behalf and under agreements about security and confidentiality, or are themselves responsible for what they do with it.

ConsulHosting (the Netherlands): our web host and email provider. The website and the database are on their servers, and the website's emails go through their mail server.
Mollie (the Netherlands): processes payments for gifts and orders.
PostNL (the Netherlands): delivers parcels.
Cloudflare (United States): protects forms with Turnstile.
Kadaster / PDOK (the Netherlands): completes your address at checkout.
YouTube / Google: only when you play a video yourself.

Otherwise we only pass on your data when the law requires us to.

5. Data outside Europe

Cloudflare and Google are American companies and may process data outside the European Economic Area. They take part in the EU-U.S. Data Privacy Framework, on the basis of which the European Commission considers their protection adequate. Our other parties process your data within the European Union.

6. How we protect your data

We take appropriate technical and organisational measures to protect your data against loss, theft and unauthorised access. Among other things:

The website only works over a secure connection (https).
We store sensitive data, such as sign-ups and messages sent through forms, encrypted. The access keys of the services the website is connected to are encrypted too.
Staff can only see the data they need for their task. They sign in with two-step verification, and for sensitive actions they must confirm who they are again.
We record who viewed the most sensitive data and when.
Anyone who has not been active for a while is signed out automatically.
Forms are protected against abuse by automated programs.
The website loads no scripts, fonts or other files from other parties (apart from the protection of forms), and strict security rules prevent unknown code from running in your browser.
The website runs behind a Web Application Firewall, and the server is checked with antivirus software.
The website's software is checked with security scans.
Retention periods are enforced automatically: data is deleted as soon as its period is over.

Should something nevertheless go wrong with your data, we will report it to the Dutch Data Protection Authority within 72 hours where required and inform you if necessary.

7. No automated decisions

We do not take decisions about you that are made by a computer alone, and we do not build profiles of you.

8. Your rights

You have the right to:

access your data;
have incorrect data corrected;
have your data deleted;
have the processing of your data restricted;
receive your data in a common file format to give to someone else;
object to processing based on our legitimate interest;
withdraw your consent, where we use your data on the basis of consent. What we did on that basis before remains lawful.

Email your request to info@dienstbaar.org, preferably from the email address we know you by. That way we know the request comes from you; sometimes we may ask for additional confirmation. We respond within one month. Data we are legally required to keep, such as the records of gifts and orders, can only be deleted once its retention period has ended. We will let you know if that is the case.

Are you unhappy with how we handle your data? Please let us know first, so that we can look for a solution together. You also always have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the supervisory authority in the country where you live.

9. Children

Our website and services are not intended for children under 16. If you are under 16, only sign up for the newsletter or for pastoral help with the consent of your parent or guardian.

10. Changes

We may change this privacy policy, for example when the website or the law changes. The latest version is always on this page.

Google Tag Manager

We use Google Tag Manager to measure how the website is used. It is loaded on every visit. Without your consent to Statistics, Google places no cookies; it does receive technical data such as your IP address, your browser and the page you view, based on our legitimate interest in improving the website (you can object to this). With consent, Google may also place cookies and measure how you use the website.

Google may process data outside the European Economic Area, such as in the United States, based on the EU-U.S. Data Privacy Framework or standard contractual clauses. You can change your choice at any time on the Cookies page.