How we handle your data.
A short statement of what we collect, what we do with it, and the rights you have over it. Written to be read, not to comply.
REV 01 · 26 MAY 2026
The short version
We run no analytics. We set no advertising cookies. We do not sell, share, or rent your data. The only personal data we hold is what you have written to us — through the contact form, on the course application, or in correspondence with mentors and the board. We use it to reply to you, to run programmes you have signed up for, and to meet our legal obligations as a Dutch ANBI foundation. That is all.
Who is responsible
Stichting Grotius is the controller of personal data collected through this site and through our programmes. The board, listed on the Board & team page, is responsible for compliance. Day-to-day data questions go to the secretary at privacy@grotius.org.
What we collect
- Through the contact form — the name, email address, subject, and message you choose to send us. Nothing else is recorded.
- Through programme applications — the information requested on the application (name, contact, sector, written letter of interest, references). Held only for the duration of the cohort cycle and for governance records as required by Dutch law.
- In correspondence — anything you write to us by email or in writing. Mentor conversations are not recorded or transcribed.
- On the donation page — we do not process payments on this site. Bank transfers are made directly to our IBAN; the bank holds those records, not us.
What we do not collect
- No analytics — no Google Analytics, no Plausible, no Fathom, no first-party telemetry of any kind.
- No advertising cookies. No tracking pixels. No fingerprinting.
- No social-media embeds that would call third parties as the page loads.
- No newsletter list shared with a third-party provider; if you ask to be on our mailing list, the list lives in one inbox read by one person.
How long we keep it
Contact-form messages are kept for as long as the conversation is live, and for one year afterwards in case it resumes. Programme records are kept for the standard Dutch governance term — seven years for financial records, longer for board minutes — and are destroyed at the end of that term. Mentor and participant correspondence is kept while the relationship is active and destroyed at the participant's request after that.
Your rights
Under the GDPR, you have the right to ask us what we hold about you, to correct it, to delete it, to restrict its use, and to receive it in a portable form. Write to privacy@grotius.org with the request. We reply within thirty days, usually within two. If you are not satisfied with the answer, you may complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Hosting & sub-processors
The site is hosted in the EU. Fonts are loaded from Bunny Fonts, which proxies them without setting cookies or logging the visitor's IP. Email is run on a standard EU provider. We hold a current data-processing agreement (verwerkersovereenkomst) with each.
Changes to this policy
If the policy changes, the date at the top of this page changes with it. Substantive changes are also noted in the year's report. The most recent revision is always linked from the footer of every page.