Privacy policy
Your trust matters to us. Thamarat exists to support refugee families, and that work depends on relationships built on care and respect, including respect for your privacy. This policy explains in plain language what personal data we collect, why, and the rights you have over it.
We follow the EU General Data Protection Regulation (GDPR) and Dutch data protection law. If anything here is unclear, write to us at .
Last updated: 7 October 2026
Who we are
Thamarat is a community initiative in the Netherlands that supports refugee families. Thamarat is the data controller for the personal data described here: we decide what is collected and how it is used.
You can reach us about anything in this policy at .
What personal data we collect
We only collect what we need. Depending on how you deal with us, that may include:
When you contact us
- Through the form on our contact page: your name (optional), your email address or phone number, what your message is about, and your message.
- When you email us: your email address, your name if you give it, and your message.
When you donate clothes or toys
- Your name, how to reach you, and the address where our team picks the donation up.
When you volunteer
- Your name and contact details.
- What you tell us about your skills, your availability and how you would like to help.
When you visit this website
- Technical data that every web server receives: your IP address, the pages you request, the time, and your browser type. Our servers keep this in log files for security and to fix problems.
Photos from our activities
- We publish photos from our events on this website. We blur the faces of guests and of every child; volunteers at work may be recognisable.
Why we use it, and our legal basis
Under the GDPR we need a lawful reason to use your data. This is how that maps to what we do:
- To answer your message: our legitimate interest in replying to you, and in taking steps you ask for.
- To pick up donated goods: our legitimate interest in collecting what you offered us.
- To coordinate volunteering: our legitimate interest in organising our work, and your consent where we ask for it.
- To keep the website safe and working: our legitimate interest in running a secure site.
- To show our work with photos: our legitimate interest in telling people what we do, limited by blurring faces as described above.
How we store and protect your data
We limit who can see your data to the people in our team who need it, use reputable service providers, and store information securely. No system is free of risk, but we protect your data as if it were our own.
How long we keep it
- Messages and contact details: as long as we need them to help you and follow up, then we delete them. You can ask us to delete them sooner.
- Donation pick-up details: until the pick-up is done and any follow-up is finished.
- Volunteer details: while you volunteer with us and a reasonable time afterwards, unless you ask us to remove them sooner.
- Website log files: 14 days.
Who we share your data with
We never sell or rent your personal data. We share it only with service providers who help us run Thamarat, and only as much as they need:
- Tally (tally.so), which runs the form on our contact page and stores what you send through it.
- Fastmail, which hosts our email.
- Hetzner, which hosts this website on a server in Germany.
- Cloudflare, which sits in front of this website to deliver it quickly and protect it from attacks, and so handles your IP address and the pages you request.
We may also disclose data when the law requires it.
Transfers outside Europe
We aim to keep your data within the European Economic Area (EEA). Some of our service providers, such as Cloudflare and Fastmail, may process data outside the EEA. Where that happens, they rely on safeguards recognised under the GDPR, such as the European Commission's Standard Contractual Clauses.
Cookies and analytics
This website sets no cookies when you read it, and we use no analytics or tracking. The form on our contact page is loaded from Tally; what Tally does inside the form is described in Tally's own privacy policy. Our team's admin area uses the cookies it needs to sign in.
Your rights under the GDPR
You are in control of your data. You have the right to:
- Access: ask for a copy of the personal data we hold about you.
- Rectification: ask us to correct data that is wrong or incomplete.
- Erasure: ask us to delete your data.
- Restriction: ask us to limit how we use your data.
- Portability: ask for your data in a format you can reuse elsewhere.
- Objection: object to our use of your data where we rely on legitimate interest, for example a photo you appear in.
- Withdraw consent: change your mind at any time where we relied on your consent.
How to use your rights or make a complaint
To use any of these rights, email us at . We answer as soon as we can, and within one month at the latest. It costs you nothing.
If you are unhappy with how we handled your data, please tell us first so we can put it right. You also have the right to complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Children's data
Our work supports many families with children, but this website is meant for adults. We do not knowingly collect personal data directly from children. Where we hold information about a child as part of supporting a family, we do so with the family's involvement and treat it with extra care. If you believe we hold a child's data without proper consent, contact us and we will remove it.
Changes to this policy
We update this policy when our work or the law changes, and then change the date at the top of this page. We will announce significant changes clearly.
Contact us
For any privacy question, or to use your rights, write to us at .