Privacy policy

1. Who is responsible?

The data controller is uithoorn.online (a private initiative, Uithoorn). You can reach us at sam@uithoorn.online or through the contact form at uithoorn.online/en/contact.

uithoorn.online is a private initiative. It is not a website of the municipality of Uithoorn and has no connection with it.

We have not appointed a data protection officer; an organisation of our size is not required to. Send privacy requests (access, correction, deletion, objection, a copy of your data) and any other privacy question to sam@uithoorn.online.

2. What data do we process?

Account: name, email address, phone number (if you add one), whether you are a resident or a business owner, your language, a hashed version of your password, and when you signed up, last logged in and accepted the terms.

If you post a request without an account, we keep your name, email address, phone number (if you add one) and the request as a draft until you click the confirmation link. After that click we create an account for you without a password (you sign in with a link by email). If you don’t confirm, the draft is deleted automatically.

Jobs and requests: category, description, postcode, preferred timing, urgency, any budget, and photos you add yourself. We remove hidden data from photos (such as location and camera) before storing them.

Content reports: if you report something (for example a review or listing), your name, email address, the link and your explanation.

Chat and messages: messages, photos, price offers and appointments between you and a business, and messages you send us through “Urgent message to uithoorn.online”.

Reviews you write. Your name is not shown with a review.

Business profiles that owners create themselves: business name, category, description, address or postcode, website, phone number and business email. These are public once the profile is approved.

Public business listings not (yet) claimed by the business: business name, type of business, town or postcode, website and phone number, collected from public sources such as OpenStreetMap and the business’s own website. For a sole trader this can be personal data.

Contact form: your name, email address and message.

Push notifications: if you turn them on, we store the address your browser creates for them (a technical key, not your name or email).

Technical data: to prevent abuse we briefly count requests per IP address and per email address, storing only an unreadable hash, never the IP address itself. We also count page views anonymously, without cookies (see section 7), and keep a log of the emails we send.

3. Why, and on what legal basis?

Your account, sending your jobs to suitable businesses, the chat, appointments and reviews, and the emails and push notifications that go with them: needed to provide the service you use (performance of a contract, Art. 6(1)(b) GDPR).

If no business responds in time, we email your job (without your name or contact details) to all suitable businesses nearby, and we read your urgent messages so we can find a business for you ourselves. This is also performance of the contract.

Public business listings, security, fraud and spam prevention, content moderation and anonymous visitor statistics: legitimate interest (Art. 6(1)(f) GDPR). Our interest is a complete, reliable and safe local guide. We only show business details the business itself has made public.

We may email a publicly listed business once, at its general business address, to invite it to claim its listing (legitimate interest). Every email has an unsubscribe link; once you unsubscribe, we stop.

Records for paid plans, once these exist: legal obligation (tax record-keeping).

We do not send residents newsletters or advertising, and we never sell data. We make no decisions based solely on automated processing: jobs are matched by category and postcode, and you choose which business to continue with.

4. Who do we share data with?

Businesses: when you post a job, suitable businesses see the description, category, timing, budget, your photos, your first name and your town with the digits of your postcode (without the letters). Phone numbers and email addresses you type into the description are hidden from businesses. Your full name, email address and phone number are only shown to the business you confirm an appointment with yourself, so it can contact you. What you share in a chat is seen by the business in that chat.

Service providers that run the site for us (processors): Vercel Inc. (website hosting and anonymous visitor statistics), Neon Inc. (database, stored in the EU, Frankfurt region) and Resend (sending and receiving email). They only process data on our instructions, under their data processing terms.

Our team receives copies of service emails, contact messages and urgent messages in a Gmail mailbox (Google), helped by Tab (tab.bot), a digital assistant that reads the admin mailbox and handles notifications.

Push notifications are delivered through the push service of your browser maker (for example Google, Apple, Mozilla or Microsoft). The content is encrypted; that service cannot read it.

Some of these companies are based in, or process data in, the United States. This is covered by the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

We disclose data to authorities when the law requires us to.

5. How long do we keep your data?

Account: as long as it exists. Resident accounts that have not been used for 36 months and have no business are deleted automatically.

Live jobs and their chats (including photos and urgent messages): 12 months after the last message. Other requests with their leads and messages: 24 months after posting.

Reviews: as long as the business profile exists, unless you have them removed earlier or delete your account.

Unconfirmed requests (drafts without an account): 2 days after the confirmation link expired. Queue of request emails still to be sent: 30 days.

Contact messages, content reports and submissions: 24 months. Push addresses: until you turn notifications off, or after 12 months without use.

Public business listings: until the business claims it or asks us to remove it, or until we find the details are no longer correct.

Anonymous statistics: 26 months. Email log: 12 months. Admin action log: 24 months.

Invoices and payment records, once paid plans are billed online: 7 years (tax law).

Backups: the database keeps automatic restore points that are overwritten after a short time; manual backups are kept for at most 30 days.

6. Security

The site only works over encrypted connections (HTTPS). Passwords are stored only as hashes (scrypt). Your session uses a secure cookie that scripts cannot read, and only our server can access the database. Admin functions are limited to admins, and their actions are logged.

7. Cookies and statistics

We only use functional cookies the site needs to work (staying logged in and your language). We use no tracking, advertising or analytics cookies. For statistics we use Vercel Web Analytics, which sets no cookies and does not follow you across other websites. See our cookie policy for details.

8. Your rights

You have the right to access, correct and delete your data, to restrict processing, to data portability, and to object to processing based on legitimate interest.

You can do much of this yourself under Account settings: edit your details, download all your data and delete your account permanently.

Is your business listed and would you rather it wasn’t? Use the “Remove my listing” button on the business page or email us, and we will take the listing down.

For anything else, email sam@uithoorn.online. We reply within one month and may ask you to confirm who you are.

Unhappy with how we handle your data? Please tell us first. You can always file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

9. Changes

We may update this privacy policy. The date at the top shows when it last changed. We email registered users about important changes.