Privacy Policy

Last updated: 14 October 2026

This privacy policy explains how we process your personal data when you visit the zarokhub.be website, write to us through the contact form or the "Share Your Idea" form, or make a donation. We use your personal data only for the purposes described here. We do not sell your data and we do not use it for third-party advertising.

1. Who is responsible for your data?

The organisation responsible for your personal data (the controller) is:

ZAROK HUB VZW
Registered Belgian non-profit association (vereniging zonder winstoogmerk)
Enterprise number (KBO/BCE): 1037.330.866
Oude Vijversstraat 40, 1190 Brussels (Vorst/Forest), Belgium
Email: [email protected]
Phone:

We have not appointed a data protection officer (DPO). Please send any privacy questions to the email address above.

2. What data we process, why, and on what legal basis

For each activity below you will find which data we collect, why we use it, the legal basis under the EU General Data Protection Regulation (GDPR) and how long we keep it.

2.1 When you visit the website

When you open a page, our server automatically keeps an access log. It records your IP address, the date and time of the visit, the address of the page you opened and the identification string your browser sends (user agent).

Purpose: to keep the website secure, to detect and prevent attacks and misuse, and to fix technical problems.
Legal basis: our legitimate interest (Article 6(1)(f) GDPR), namely protecting the security of our website and systems.
Retention: access logs are kept for 60 days and then deleted automatically.

Traffic to our website passes through Cloudflare, a security and content delivery service (see section 4).

We do not use analytics, advertising or tracking tools. Our website contains no third-party scripts or embedded content (such as videos or maps), and our fonts are loaded from our own server.

2.2 Contact form and emails

When you use the contact form, we record your name, email address, subject, message and your IP address at the time of sending. Name, email address and message are required; without them we cannot reply to you. The subject is optional. If you email us directly at [email protected], we process your email for the same purpose.

Purpose: to read and answer your message. We use the IP address to prevent misuse of the form (for example spam).
Legal basis: our legitimate interest (Article 6(1)(f) GDPR) in answering the questions and requests you send us and in protecting our form against misuse. If your message concerns your donation (for example cancelling a monthly donation), the basis is the performance of our donation agreement with you (Article 6(1)(b) GDPR).
Retention: We delete your message once your request has been dealt with. Any remaining messages and IP addresses are deleted automatically after 2 years at the latest.

2.2a "Share Your Idea" form

When you write to us through the "Share Your Idea" window on the site, we record your name, occupation, email address, the city and country you live in, your idea, the page and language from which you sent the form, and your IP address at the time of sending. All fields are required; without them we cannot consider your idea or get back to you.

Purpose: to consider your idea or project proposal and, where needed, to contact you about it. We use the IP address to prevent misuse of the form (for example spam); if many submissions arrive from the same connection in a short time, the form shows a security question.
Legal basis: our legitimate interest (Article 6(1)(f) GDPR) in considering and answering the ideas and proposals you send us and in protecting our form against misuse.
Retention: We delete your idea once we have considered it and any correspondence about it has ended. Any remaining entries and IP addresses are deleted automatically after 2 years at the latest.

2.2b Membership applications (Full Membership and Supporting Membership)

What we collect

Full Membership application: your first and last name, ID card or passport number (optional), country and city of residence, full residential address, email address, phone number and date of birth (you must be at least 16 to apply); your motivation text, the areas of work ("kitchens") you are interested in, the time you can give, and the three consents on the form (with the time they were given).
Supporting Membership application: the package you choose (Standard / Founding), your first and last name, email address, country and city; your phone number and address if you provide them; for Founding Membership, if you wish, the name to show on the Pomegranate Tree, the message you leave in your pomegranate and your permission for them.
For both: the language and date of the application and the IP address it was sent from (to protect the form against abuse).
Payment: payments are taken on Stripe's secure payment page; your card or bank details never reach us. We keep the outcome of the payment (amount, currency, date, status, refund), the package and the transaction references provided by Stripe.

Why, and on what legal basis

To review your application and to start and manage your membership (fee, yearly renewal, refund): the membership relationship and the steps before it (GDPR Art. 6(1)(b)).
To keep members' names and addresses in the register of members required by Belgian law on associations (WVV/CSA Art. 9:3): legal obligation (Art. 6(1)(c)).
To keep payment records as required by accounting law: legal obligation (Art. 6(1)(c)).
To show your name and message on the Pomegranate Tree: your consent (Art. 6(1)(a)).
To protect the form against abuse using the IP address, submission limits and, when needed, a security question: legitimate interests (Art. 6(1)(f)).

How your ID number is protected. Giving your ID card/passport number is optional; if you enter it, it is stored encrypted in our database. Only the authorised people reviewing applications on behalf of the Board can see it, on the application's review page in our admin area; if that page is printed, it also appears on the paper copy (printouts are kept securely within the association and destroyed when no longer needed). The number never appears in lists, in emails to you or anyone else, or in the information sent to our payment provider.

Pomegranate Tree. If you give permission with a Founding Membership, your name (or the name you want to show on the tree) and your message of up to 120 characters for children appear as one of the pomegranates on the Pomegranate Tree on the "Our Founders" page of our website. Your name and message appear only after your payment has been received and the Board has approved your application; they are reviewed before they appear, and a message found inappropriate may be corrected or removed. You can withdraw your permission at any time: just write to [email protected] and your name and message will be removed from the tree; your founding membership is not affected. If your fee is refunded, your name and message are removed from the tree automatically.

Who we share it with. We share your data only with the following service providers, and only as far as the service requires:

Stripe Payments Europe Ltd. (Ireland) — processes payments. For the payment page we pass your name, email address, language preference and chosen package to Stripe. Stripe may process some data in the United States; this transfer relies on the EU–US Data Privacy Framework and Standard Contractual Clauses.
Hetzner Online GmbH (Germany) — server hosting.
Cloudflare, Inc. — secure connection (HTTPS) and protection service for our website; form data passes through Cloudflare's network on its way to our server.
Emails to you (approval and payment link, information) are sent from our association's own mail server (SMTP); no other email service is used for this. For each email we record who it was sent to, the subject, when it was sent and the result (not its content).

Your data is never sold or used for advertising.

How long we keep it. These periods are applied automatically every day.

Data	Period
Supporting application whose payment was not completed (payment page opened but not paid, expired or failed)	deleted 30 days after the application
Payment still in progress (e.g. SEPA, Bancontact processing)	kept until the outcome of the payment is known; then the rules above or below apply
Full Membership application not yet decided	kept until a decision is made
Rejected Full Membership application (all personal details and email records)	deleted 6 months after the decision
IP address on applications	deleted after 12 months
Approved membership and register entry	kept for the duration of the membership; not deleted automatically. When your membership ends (e.g. refund, end of subscription) you can ask us to delete it — except the register entry and payment records we are legally required to keep
Email sending records (recipient, subject, date, result)	deleted together with the application
Payment records (amount, currency, date, refund, package, application number, Stripe transaction and customer references)	7 years following the year of payment (accounting obligation), then deleted. If your application is deleted earlier, this record remains without your name or email, linked only by the application number and the Stripe transaction and customer references. Stripe keeps its customer record (with your name and email) under its own retention rules

Automatic emails. If your Full Membership application is approved, we email you a personal payment link for the membership fee (valid for 30 days; if needed a new one is sent and the old one stops working). If it is not accepted, the Board may send you a short information email without giving reasons. For Supporting Membership the payment is completed on Stripe's page; we do not send a separate email (Stripe may send you a receipt for your payment).

Your rights. You have the right to access, rectify or erase your data, to restrict or object to its processing, to data portability and to withdraw your consent (e.g. for the Pomegranate Tree). Records we are legally required to keep (register of members, accounting) cannot be erased before the legal period ends. To exercise your rights: [email protected]. You can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données).

2.3 Online donations

On the donation form you enter your name and email address and choose a one-time or monthly donation and an amount. Your name and email address are required. We cannot accept your donation without them, because we need them to record your donation, to let Stripe send you a receipt and to let you manage a monthly donation.

We record the following information about your donation:

your name and email address, as you entered them;
the amount, type (one-time or monthly) and date of the donation, and the language of the page you donated from;
your IP address at the time of the donation;
the payment status and the type of payment method (for example Visa, Bancontact, SEPA, Apple Pay). We never receive card numbers;
Stripe reference numbers, and your country as taken from the billing details you give Stripe;
for monthly donations, the status of the donation and any cancellation dates;
if you gave newsletter consent, your consent and its date (see 2.5);
internal notes that our administrators may add about a donor.

You enter your card or bank details only on Stripe's payment page (checkout.stripe.com). These details never reach our server.

Before sending you to the payment page, we create a customer record at Stripe with your name, email address and preferred language, or reuse an existing one. This allows Stripe to send your receipts in your language. If you do not complete the payment, a customer record newly created for that attempt is automatically deleted from Stripe.

Purposes and legal bases:

Receiving and processing your donation, running your monthly donation, and handling cancellation and refund requests: a donation is an agreement between you and the association, and this processing is necessary to perform it (Article 6(1)(b) GDPR).
Keeping donation records for our accounts: legal obligation (Article 6(1)(c) GDPR) under Articles III.86 and III.88 of the Belgian Code of Economic Law (WER).
Preventing fraudulent or unauthorised payments (IP address): our legitimate interest (Article 6(1)(f) GDPR) in protecting our donation system against fraud and misuse.
Internal notes: our legitimate interest (Article 6(1)(f) GDPR) in keeping track of matters concerning our donors (such as your requests) in an orderly and accurate way.

Retention:

Completed donations: donation records are accounting documents. Under Belgian accounting law (Articles III.86 and III.88 WER) we keep them for 7 years. We count this period from 1 January following the close of the financial year in which the donation was made. For monthly donations, the same period applies to each monthly payment. When the period ends, we delete the records.
Data in our Stripe account (customer record, payment history, saved payment method for monthly donations): kept for the same period as our accounting records (7 years); at the end of that period the customer record is also deleted from our Stripe account. Stripe also keeps certain data for its own legal obligations, under its own privacy policy.
IP address in the donation record: deleted automatically 12 months after the donation.
Internal notes: kept together with the donor's record and deleted with it.
Unfinished donation attempts (where the payment page was never completed): deleted automatically after 30 days.

2.4 Donations by bank transfer

You can also donate by transferring money to the bank account shown on our donation page. In that case our bank statement shows your name, your bank account number (IBAN), the amount, the date and the text you wrote in the payment reference.

Purpose: to record your donation, keep our accounts and handle any requests about your donation.
Legal basis: performance of the donation agreement (Article 6(1)(b) GDPR) and our obligation to keep accounting records (Article 6(1)(c) GDPR).
Retention: the same as for online donations, i.e. 7 years (see 2.3).

The transfer is processed by your bank and ours under their own legal obligations (see section 4).

2.5 Newsletter consent

On the donation form you can tick a box saying that you want to receive news about Zarok Hub's work by email. The box is unticked by default and ticking it is optional. If you tick it, we record your consent and the date. You can donate without ticking it.

Purpose: to send you news about our work by email.
Legal basis: your consent (Article 6(1)(a) GDPR; see also Article XII.13 WER).
Retention: until you withdraw your consent. When you withdraw it, we record this and will not send you newsletters.

We do not currently send newsletters and do not use any mailing tool. We will update this policy before we start. You can withdraw your consent at any time by emailing [email protected]. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

3. Cookies

We set only one cookie of our own:

ZHSESS (our own session cookie): used to secure our forms (CSRF protection), to run the security question (captcha) on the contact and idea forms, to remember what you typed in a form if an error occurs, to recognise on the thank-you page which donation was started from this browser, and to keep administrators logged in. It is sent only over encrypted connections and cannot be read by scripts on the page. It is deleted when you close your browser (it may last longer if your browser is set to restore previous sessions). The related session data on our server is cleared after about 6 hours of inactivity.

We set no other cookies ourselves and store no other data in your browser (such as localStorage).

Cloudflare, which runs in front of our website, may set its own strictly necessary security cookies on zarokhub.be:

__cf_bm (Cloudflare): protects against malicious automated traffic (bots). It expires after 30 minutes of inactivity. Its content is encrypted and can be read only by Cloudflare.
cf_clearance (Cloudflare): records that you have passed a security check. By default it is valid for about 30 minutes.

On Stripe's payment page (checkout.stripe.com), Stripe's own cookie and privacy rules apply.

The cookies above are strictly necessary for the website and for the service you request (such as sending a form) to work. Under Belgian law (Article 10/2 of the Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data) such cookies do not require your consent, which is why our website has no cookie consent banner. The legal basis is our legitimate interest in providing our website and forms securely (Article 6(1)(f) GDPR). You can block cookies in your browser, but our forms may then not work.

4. Who we share your data with

Our administrators: only a small group of the association's volunteers and board members can access the admin panel.
Stripe (Stripe Payments Europe, Limited, Ireland): processes donation payments. Stripe receives your name, email address, preferred language, the donation amount and the payment details you enter on its payment page. When processing payments for us, Stripe acts as our processor. For its own purposes, such as preventing and detecting fraud, meeting its own legal obligations (for example anti-money-laundering rules) and improving its services, Stripe is an independent controller. For these purposes it may also collect information about your device and browser (such as your IP address) on its payment page. For monthly donations, Stripe stores your payment method so that it can collect the payment each month. Details: Stripe Privacy Policy.
Payment method providers: if you pay with Apple Pay, Google Pay, Link, Bancontact, a card or SEPA Direct Debit, the provider concerned (for example Apple, Google, Stripe for Link, card schemes and your bank) processes your payment data as an independent controller under its own privacy policy.
Our bank: KBC Bank NV (Belgium). It processes donations made by bank transfer and the amounts Stripe pays out to the association, as an independent controller under its own legal obligations.
Cloudflare (Cloudflare, Inc., United States): provides security and content delivery in front of our website, and all website traffic passes through it. Cloudflare therefore sees your IP address and technical details of your requests. It acts as our processor. Details: Cloudflare Privacy Policy.
Hetzner (Hetzner Online GmbH, Gunzenhausen, Germany): the hosting provider from which we rent the server our website runs on. The server is located in Finland (European Union). Access logs, contact messages and donation records are stored on this server. Hetzner acts as our processor. Details: Hetzner Privacy Policy.
Email service: emails sent to [email protected] are stored on our own mail server, which runs on the Hetzner server described above (Finland); we do not use a separate email service company.

We make regular backups of our server. Deleted data may remain in these backups for a limited time until the backups are replaced. Only our system administrator can access the backups, and we use them solely to restore data after data loss.

We do not share your personal data with anyone else unless the law requires us to.

5. Transfers outside the European Union

Our website's data is stored on our server in Finland, within the European Union. However, Cloudflare and Stripe may also process data in the United States and other countries when providing their services. Stripe may also transfer data to the countries connected with the payment method you use, in order to carry out the payment.

Cloudflare, Inc. and Stripe, LLC are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision. Where the framework does not apply, the European Commission's standard contractual clauses (Decision 2021/914) are used. You can find information about these safeguards in the privacy policies linked in section 4, or ask us for it.

6. Automated decision-making

The association does not take decisions about you based solely on automated processing and does not create profiles.

Stripe, under its own responsibility, automatically assesses payments for fraud risk. As a result of this assessment, a payment may be declined. If this happens, you can try another payment method, write to us or contact Stripe. See the Stripe Privacy Policy for details.

7. Your rights

Under the GDPR you have the following rights:

Right of access: to find out which data we process about you and to receive a copy.
Right to rectification: to have incorrect or incomplete data corrected.
Right to erasure: to have your data deleted. Data we are legally required to keep (such as donation records) cannot be deleted before that period ends.
Right to restriction: to have the processing of your data limited in certain situations.
Right to data portability: to receive the data you gave us, and which we process on the basis of an agreement or your consent, in a commonly used, machine-readable format, or to have it sent to another organisation.
Right to withdraw consent: to withdraw your consent to processing based on consent (the newsletter) at any time. This does not affect the lawfulness of processing before the withdrawal.

Right to object: where we process your data on the basis of our legitimate interest (access logs, contact and idea forms, fraud prevention, internal notes, cookies), you can object at any time on grounds relating to your particular situation. We will stop the processing unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed to establish, exercise or defend legal claims.

How to exercise your rights: simply email [email protected]. We will respond free of charge and within one month at the latest. If a request is complex or we receive many requests, this period may be extended by a further two months; we will let you know if so. To avoid giving your data to the wrong person, we may ask for additional information to confirm your identity.

You can also manage and cancel a monthly donation yourself through Stripe's customer portal (see our Donation Terms).

8. Right to lodge a complaint

If you have a concern about how we process your personal data, we would appreciate the chance to resolve it first. You always have the right, however, to lodge a complaint with the Belgian data protection authority:

Gegevensbeschermingsautoriteit (GBA) / Autorité de protection des données (APD)
Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, Belgium
Phone: +32 2 274 48 00
Email: [email protected]
Website: www.dataprotectionauthority.be
Complaint page: autoriteprotectiondonnees.be/citoyen/agir/introduire-une-plainte

If you live or work in another EU country, you can also contact the data protection authority of that country.

9. Children

Our association works for children. However, we do not knowingly collect personal data from children through the contact and donation forms on this website, and we do not collect personal data about the children we support through this website. If you believe a child has sent us personal data, please write to us; we will look into it and delete the relevant data.

10. Security

Our website works only over encrypted connections (HTTPS). Only authorised administrators can log in to the admin panel. Your card and bank details never reach the association; only Stripe processes them.

11. Changes to this policy

We will update this policy when the way our website processes data changes (for example, when we start sending newsletters). The current version is always published on this page, and the date at the top will change. Before we use your data for a new purpose, we will inform you.

12. Contact

For questions about this policy or your personal data:
ZAROK HUB VZW, Oude Vijversstraat 40, 1190 Brussels, Belgium
Email: [email protected]
Phone:

Privacy Policy 🔒