Privacy Policy

In short

This website stores nothing about you. It has no database, no accounts, no analytics and no tracking cookies. It is a set of static pages.

Everything that does involve your personal data happens with three other companies: beehiiv, which runs our mailing list,Luma, which runs our events, and Netlify, which serves these pages. Each is described below.

Who we are

Business for Good is a community of professionals, founders and business owners based in the Netherlands. We are the data controller for the personal data described in this policy.

TODO: the registered legal entity name, its postal address, and an email address for privacy enquiries. A controller must be identifiable and reachable — this cannot ship blank, and several sections below point at the contact address.

What this website does on its own

Nothing that reaches us. These pages are static files. There is no server-side code, no database and no login, so there is nowhere for the site to keep anything about you.

• No analytics and no tracking.We run no analytics product, no advertising pixel and no tracking cookie of any kind. This is a deliberate decision, not an oversight.
• One local preference. If you switch between the light and dark theme, that choice is saved in your own browser's local storage under the nameappTheme. It never leaves your device and we cannot read it.
• Three embedded third parties.The subscribe form, the events calendar and the page's typefaces are loaded from other companies' servers. Loading them tells those companies your IP address, as described next.

Who receives your data, and what they get

beehiiv — the mailing list

The subscribe form on this site is embedded frombeehiiv Inc.(228 Park Avenue #2329976, New York, NY 10003, USA). When you submit it, what you type goes to beehiiv and is stored there. We never hold it on this site.

The form asks for your email address and your LinkedIn profile URL. beehiiv also records technical information of its own, including your IP address.

beehiiv acts as our processor: itsData Protection Addendumstates that the customer is the controller and beehiiv the processor, and it is incorporated into beehiiv's terms automatically. Its subprocessors are listed atsubprocessors.beehiiv.com. See also beehiiv'sprivacy policy.

Luma — events

Our events calendar is embedded from, and our events run on,Luma Labs, Inc.(San Francisco, California, USA). If you register for an event, the details you give — your name and email address, and the answers to any additional questions on that event's form — are collected and stored by Luma. They never reach this website.

Luma'sData Processing Addendumstates plainly that "Luma is a Data Processor or Service Provider" and the "Host is the Data Controller or Business" for event data, and it is incorporated into Luma's terms automatically. See also Luma'sprivacy policy.

TODO: Luma is also a controller in its own right for people who hold a Luma account, separately from its role as our processor. Have the review decide how much of that split this policy should explain, and confirm the additional questions actually asked on our own event forms.

Netlify — hosting

These pages are served byNetlify, Inc.(101 2nd Street, San Francisco, CA 94105, USA). Like any web host, Netlify processes technical data in order to deliver the pages and keep the service secure — your IP address, your browser type and version, your device and operating system, and the requests you make. SeeNetlify's privacy statement.

TODO: Netlify'sData Processing Agreementis a separate document rather than one incorporated automatically the way beehiiv's and Luma's are. Confirm it has actually been entered into, and how long Netlify retains request logs — its privacy statement does not say.

Google — typefaces

The page's typefaces, Syne and Nunito, are loaded from Google Fonts (fonts.googleapis.com andfonts.gstatic.com), operated by Google. Loading a font discloses your IP address to Google. No cookie is set by the font request, and we receive nothing back from it.

TODO: this one is a disclosure, not a processing relationship — we have no agreement with Google and get no service from it beyond the files. Serving the two fonts from this site instead would remove the third-party request altogether. Decide which way to go, on review, and correct or remove this section accordingly.

Why we process it, and our legal basis

• Mailing list — to send you the occasional email about the community that you asked for. Legal basis: your consent, given by submitting the form. You can withdraw it at any time, and the unsubscribe link in every email does exactly that.
• Event registration — to run the event you registered for and to tell you about changes to it. TODO: confirm the basis on review — performance of a contract and consent are both arguable, and free events and paid events may not land the same way.
• Technical data — to serve these pages and keep them secure. Legal basis: our legitimate interest in operating a website that works and is not abused.

We do not sell personal data, and we do not use it to profile you or to advertise to you.

Your data leaving the EEA

beehiiv, Luma, Netlify and Google are all established in the United States, so using this site involves transferring personal data out of the European Economic Area.

beehiiv and Luma both rely on the European Commission's Standard Contractual Clauses under Implementing Decision (EU) 2021/914, and both incorporate them through the addenda linked above; beehiiv's DPA also carries the UK addendum. Netlify's privacy statement likewise cites the 2021/914 clauses.

TODO: have the review confirm this is a sufficient account of the safeguards, and decide whether a transfer impact assessment is expected of an organisation of this size.

How long it is kept

Your subscription stays on the mailing list until you unsubscribe. Every email we send carries an unsubscribe link, and using it removes you from the list.

TODO: set concrete retention periods for event registration data and for server logs, and confirm what beehiiv and Luma retain after a deletion request — both describe retention only in general terms, and beehiiv notes that backups may persist longer than the original data. Do not state a period here that has not been checked against the provider and against Dutch record-keeping requirements.

Your rights

Under the GDPR you have the right to ask for a copy of the personal data we hold about you, to have it corrected or erased, to restrict or object to how we process it, to receive it in a portable form, and to withdraw your consent at any time. Withdrawing consent does not affect anything we did with your data before you withdrew it.

In practice most of that data sits with beehiiv or Luma rather than with us, and we will pass your request on to them where that is what it takes to answer it.

To exercise any of these rights, write to us at TODO: privacy contact email address.

You also have the right to complain to a supervisory authority. In the Netherlands that is theAutoriteit Persoonsgegevens. If you live in another EU country, you may complain to your own national authority instead.

Changes to this policy

If we change this policy we will update the date at the top of this page.