Privacy Statement - ORTEC Foundation

Version: 16-08-2026

1. Introduction

ORTEC Foundation respects the privacy of the organizations and individuals with whom it works. This Privacy Statement explains how we process personal data in connection with applications, donations, partnerships and projects.

The Foundation mainly processes information relating to organizations, such as charities, scientific institutions, educational organizations and other public-benefit initiatives. In some cases, this information includes personal data of contact persons, board members, representatives or other individuals involved in an application or project.

We process personal data carefully, confidentially and only for the purposes described below.

2. Who is responsible?

ORTEC Foundation is the controller for the processing of personal data described in this Privacy Statement.

Contact details:

ORTEC Foundation
Houtsingel 5
2719 EA Zoetermeer
Email: [email protected]
Website: ortecfoundation.com
Chamber of Commerce number: 99201747
RSIN: 868862307

Questions about this Privacy Statement or about the processing of personal data may be sent to [email protected].

3. What personal data do we process?

We process personal data that are necessary for assessing, managing and administering applications, donations and projects. This may include:

name, position, business email address and business telephone number of contact persons;
information about board members, representatives or authorised signatories;
information about the applicant organization, including Chamber of Commerce details, RSIN, ANBI status, statutes, annual accounts, policy plans, budgets and project documentation;
information included in application forms, project proposals, reports and correspondence.

4. Why do we process personal data?

We process personal data for the following purposes:

receiving, registering and assessing applications;
carrying out due diligence, including checks on governance, financial information, ANBI status and publicly available registers;
deciding whether an application fits within the Foundation's objectives, criteria and available resources;
preparing and performing donation agreements or other cooperation arrangements;
maintaining contact with applicants, recipients and project partners;
monitoring, evaluating and reporting on projects and the use of funds;
complying with administrative, tax, legal, governance and ANBI-related obligations;
preventing or investigating misuse, conflicts of interest or fraud;
protecting the rights and legitimate interests of the Foundation.

We do not sell personal data and do not use personal data for commercial purposes.

5. Legal bases

Depending on the situation, we process personal data on one or more of the following legal bases:

legitimate interests, such as assessing applications, carrying out due diligence, maintaining business contact, internal decision-making, governance and fraud prevention;
performance of an agreement or pre-contractual steps, where we prepare or perform a donation agreement or cooperation arrangement;
legal obligation, where processing is necessary to comply with administrative, tax, ANBI-related or other legal requirements;
consent, where we specifically ask for consent, for example for optional communications.

Where processing is based on consent, consent may be withdrawn at any time. This does not affect the lawfulness of processing before the withdrawal.

6. With whom do we share personal data?

Personal data are only shared where necessary for the purposes described in this Privacy Statement. Within the Foundation, personal data may be accessed by persons involved in the assessment, decision-making, administration, monitoring or governance of applications and projects.

In case relevant for the Foundation’s activities and only to the extent necessary, we may also share personal data with:

IT, hosting, cloud and email service providers;
accountants, auditors, legal advisers or other professional advisers;
banks and payment service providers;
external experts involved in assessing or supporting a project;
public authorities, regulators or other third parties where required by law.

Where third parties process personal data on our behalf, we make appropriate contractual arrangements to protect the data.

7. International transfers

We store and process personal data within the European Economic Area. If personal data are transferred to a country outside the European Economic Area, we will ensure that appropriate safeguards are in place in accordance with applicable data protection law.

8. How long do we keep personal data?

We do not keep personal data longer than necessary for the purposes for which they were collected.

In principle, we apply the following retention periods:

unsuccessful applications: up to two years after the decision, unless a longer period is necessary for accountability or legal reasons;
approved applications and project files: up to five years after completion of the project or final payment, unless a longer period is required by law or necessary for accountability, reporting or dispute purposes;
financial and administrative records: for the period required under applicable statutory retention obligations;
general correspondence: for as long as necessary to handle the matter concerned.

After the applicable retention period, personal data will be deleted or anonymised where reasonably possible.

9. Security

We take appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction. Access to personal data is limited to persons who need such access for the performance of their role.

10. Rights of individuals

Individuals whose personal data we process may, subject to the conditions of applicable law, request access to their personal data or request that their personal data be corrected, deleted or restricted. They may also object to certain processing activities or request data portability where applicable.

If personal data are processed on the basis of consent, consent may be withdrawn at any time.

Requests may be sent to [email address]. We may ask for additional information to verify the identity of the person making the request.

11. No automated decision-making

The Foundation does not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects for individuals.

12. Complaints

If you have a question or complaint about the way we process personal data, please contact us first via [email protected]

You also have the right to lodge a complaint with the Dutch Data Protection Authority.

13. Changes to this Privacy Statement

We may update this Privacy Statement from time to time. The most recent version will be published on our website or otherwise made available upon request.