Last updated July 2026
Privacy Policy
This is the whole of it, in plain language. If any sentence here needs a lawyer to decode, that is our failure and we want to hear about it.
Version 1.0 — July 2026
The short version
We collect the details you type into a form, and nothing you did not choose to give us. We do not sell data, we do not run advertising trackers, and our analytics are cookie-free and collect no personal data — you can still switch them off. Every right below can be exercised with one email and no explanation.
Who we are
EOSYN Space VZW/ASBL is a registered non-profit organisation (VZW/ASBL) based in Belgium. We are the data controller for all personal data collected on this website. Our registered office address and enterprise number are provided on request at privacy@eosynspace.org and are published in our annual report.
What data we collect
| Data type | Why we collect it | Legal basis |
|---|---|---|
| Name, email | Volunteer applications, partnership enquiries, newsletter subscription | Consent (GDPR Art. 6(1)(a)) |
| Child's first name, age, parent/guardian name and email | Programme registration for minors | Parental consent (GDPR Art. 8) |
| Donation amount, email | Donation processing and receipts | Contract performance (GDPR Art. 6(1)(b)) |
| Aggregated, anonymised traffic data | Website analytics | Legitimate interest (GDPR Art. 6(1)(f)) |
| IP address (temporary) | Security and fraud prevention | Legitimate interest (GDPR Art. 6(1)(f)) |
| Consent logs | Proof of consent for cookies and data processing | Compliance obligation (GDPR Art. 7(1)) |
How long we keep your data
We delete on a schedule, not when someone remembers to:
- Programme participant data (under 18): Until the participant turns 18, plus one year
- Mentor and volunteer data: Three years after last engagement
- Donor records: Seven years (Belgian accounting law)
- Newsletter subscribers: Until you unsubscribe, then deleted within 30 days
- Safeguarding records: Seven years, encrypted, restricted access
Your rights
- Right to access: you can request a copy of your personal data
- Right to rectification: you can ask us to correct inaccurate data
- Right to erasure: you can ask us to delete your data
- Right to data portability: you can request your data in a machine-readable format
- Right to withdraw consent: you can withdraw consent at any time, without affecting processing that already happened
- Right to object: you can object to processing based on legitimate interest
- Right to complain: you can complain to the Belgian Data Protection Authority (APD/GBA)
How to exercise your rights
Email us at privacy@eosynspace.org. We respond within 30 days. There is no charge for exercising your rights, you do not need to give a reason, and asking will never affect your place on a programme.
Data sharing
We do not sell your data. We share it only with our payment processor (Stripe, via Donorbox — payment data only, never stored on our servers), our email provider (email addresses only), and our hosting and database provider (EU region). All processors are GDPR-compliant and covered by Data Processing Agreements. We do not share personal data with partners, funders or sponsors.
Cookies and analytics
Analytics are privacy-first (Plausible): cookie-free, no cross-site identifier, no personal data, so no consent is required under GDPR. Everything else non-essential loads only if you choose it. You can opt out of analytics at any time on our cookie settings page — withdrawing is exactly as easy as giving.
Data breaches
If a data breach occurs that poses a risk to your rights, we will notify the Belgian Data Protection Authority (APD/GBA) within 72 hours and notify affected individuals without undue delay.
Children's data
We collect data from children under 16 only with verified parental consent (GDPR Article 8). Parents and guardians can request access, rectification, or erasure of their child's data at privacy@eosynspace.org. Safeguarding practice is set out in full on our safeguarding page.
Changes to this policy
We will update this policy as needed. Every version is dated and archived. Material changes will be communicated to affected users by email, and the cookie banner will ask again.
Complaints
If we handle a request poorly, you can complain to the Belgian Data Protection Authority (APD/GBA), Rue de la Presse 35, 1000 Brussels. We would rather you told us first at privacy@eosynspace.org, but that is your right and not our permission to give.