Privacy statement

WoodYouCare B.V. provides the WoodYouCare Platform: the tools companies use to show how many trees they contribute to through WoodYouCare Foundation.

• WoodYouCare B.V.
• Pampuslaan 15, 1382 JM Weesp
• Chamber of Commerce (KVK) 82110034
• E-mail: wood@woodyou.care

For the data of Partners, Users and visitors, we are the controller within the meaning of the General Data Protection Regulation (GDPR).

When Partners enter data about their own customers or contacts, for example the recipients of a tree per customer or a personal certificate, the Partner is the controller and we are the processor. For that data we follow the Partner's instructions; the arrangements are in our terms and conditions.

WoodYouCare Foundation is a separate foundation and responsible for the data of donors and for its own website. It has its own privacy statement on woodyoucare.foundation.

Account and Users. Name, business e-mail address, password (only as an encrypted hash), language, role within the company and login settings, such as two-factor authentication or a passkey.

Company. Company name, logo, branding, website and the address of your public impact page. These are usually not personal data, but for a sole trader they can be.

Link with the foundation. The e-mail addresses you confirm to link your donations, a temporary confirmation code, and the data the foundation shares with us about those donations, such as date, project, planting and number of trees.

Payment. Your plan, your billing period, invoice details (company name, address, VAT number) and, of your payment method, only the type and the last four digits. Your full card or account number never reaches us; Stripe processes it.

Recipients. Name and e-mail address of people a Partner gives a tree or certificate to, and of people who redeem a gift code.

Contact and demos. What you fill in on the contact or demo form: name, company, e-mail address, a phone number if you give one, and your message.

Technical data. IP address, browser, time and the pages you request, in log files and error reports. When you use the API, also the requests made with your API key.

• Creating and securing your Account, and giving you access to the Platform.
• Linking your donations at the foundation to your Account and showing your trees, plantings and statements.
• Creating your impact page, widget, badge and certificates, which you share yourself.
• Billing your plan, creating invoices and keeping our accounts in order.
• Sending you service messages, such as a confirmation code, a notice that your trial is ending or a change to our terms.
• Answering your questions, demo requests and complaints.
• Securing the Platform, preventing misuse and finding and fixing errors.
• Meeting legal obligations, such as the tax retention obligation.

We do not send newsletters or advertising without your consent. We do not make decisions about you based solely on automated processing.

• Performance of the contract (Article 6(1)(b) GDPR): for your Account, linking donations, showing your data, payment and service messages.
• Legal obligation (point c): for keeping invoices and accounts.
• Legitimate interest (point f): for security, log files and error reports, for answering contact and demo requests, and for processing the data of contact persons at companies. We always weigh whether your interests prevail.
• Consent (point a): when we ask you for it. You can always withdraw consent.

WoodYouCare Foundation. When you confirm an e-mail address to link your donations, we send that address to the foundation. The foundation then shares the donations and planting data belonging to that address with the Platform. The foundation also shares its planting data with the Platform in general, such as projects, plantings, monitoring and statements. The foundation is responsible for its own data.

Stripe. Payments go through Stripe Payments Europe. You pay on a Stripe payment page and manage your payment details and invoices in the Stripe customer portal. Stripe processes your payment data partly as our processor and partly under its own responsibility, for example to prevent fraud. See Stripe's privacy policy.

Other service providers. We use processors for hosting, sending e-mail and finding errors (Sentry). We have data processing agreements with them. They may only use your data to provide their service to us.

Public. Your impact page, widget, badge and your listing in the partner overview are public. They show your company name, logo and the number of trees you contribute to. Personal certificates are visible to anyone who has the link.

Authorities. We only give data to authorities when the law requires us to.

If a service provider processes data outside the European Economic Area, this only happens with appropriate safeguards, such as an adequacy decision or the standard contractual clauses of the European Commission.

• Account and company: as long as your Account exists. After your Account is deleted, we erase the data within thirty days, except what we are legally required to keep.
• Invoices and accounts: seven years, because of the tax retention obligation.
• Confirmation codes: valid for fifteen minutes, unusable afterwards.
• Contact and demo requests: up to twelve months after the last contact, unless an agreement follows.
• Log files and error reports: at most ninety days.
• Recipients: as long as the Partner keeps that data on the Platform, or until the Partner deletes its Account.

Backups contain a copy of this data and are overwritten automatically after a short period.

The Platform and this website only use cookies that are needed to make them work:

• a session cookie, so you stay logged in and your choices are remembered during your visit;
• a security cookie against forged forms (CSRF);
• a cookie to keep you logged in, only if you choose to be remembered when you log in.

We use no analytics cookies, no advertising cookies and no third-party tracking. That is why we do not ask for consent with a cookie banner. If we ever start using cookies that are not necessary, we will ask for your consent first.

When you pay, you go to a Stripe page. Stripe sets its own cookies there, among other things to prevent fraud.

You have the right to:

• access your data;
• have incorrect data corrected;
• have your data erased;
• have the processing restricted;
• receive your data in a common format or have it transferred;
• object to processing based on legitimate interest;
• withdraw consent you have given.

You can change much of your data yourself in your Account. For the rest, send us a request through contact. We reply within one month. If a request is complex, we can extend that period by two months; we will then let you know within the first month. We may ask you to confirm your identity.

If your request concerns data a Partner entered about you, for example as the recipient of a tree, we forward it to that Partner and help them handle it.

If you have a question about this privacy statement or about how we handle your data, please contact us. If you are not satisfied, our complaints procedure explains how we handle complaints.

You also always have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), the supervisory authority in the Netherlands: autoriteitpersoonsgegevens.nl.

We may change this privacy statement, for example when the Platform changes. The top of this page shows when that last happened. We will tell you about important changes by e-mail or in the Platform.

This is a translation of the Dutch privacy statement. In case of any difference between this translation and the Dutch text, the Dutch text prevails.