Privacy Policy

Who We Are

Here2Gether is a community storytelling platform based in Europe, dedicated to amplifying the voices of migrants and people with diverse lived experiences. We take our responsibility to protect your personal data very seriously — particularly because some of the stories shared on this platform may involve sensitive personal circumstances, including migration, displacement, and undocumented status.

Data controller: Here2Gether
Contact: wearehere2gether@gmail.com

What Data We Collect and Why

Contact Form

We collect your name, email address, subject, and message. This data is used solely to respond to your enquiry. We also record your IP address to protect against spam and abuse. Legal basis: legitimate interest (GDPR Art. 6(1)(f)).

Story Submissions

We collect your name, email address, biography, and the content of your story. You may also submit a photo. This data may contain sensitive personal information — including details relating to race, ethnic origin, migration status, political opinions, or health — and is treated with the highest level of care under GDPR Art. 9.

Legal basis: explicit consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)), given through the consent checkbox on the submission form. Submission does not guarantee publication. All submissions are reviewed internally before any publication decision is made.

Your story, biography, and photo will only be published if you have given explicit consent and our team has approved the submission. Before publication, we may contact you to discuss protective measures such as pseudonymisation, redaction, or anonymisation — particularly if your story could expose you to risk.

Donations

We collect your name, email address, donation amount, and an optional message. If you choose to confirm your bank transfer, you may also submit a payment reference, date, and proof of transfer (image or PDF). This data is used solely to process and confirm your donation, maintain required financial records, and send you a receipt. Legal basis: performance of a contract / legitimate interest (GDPR Art. 6(1)(b) and (f)).

No payment information (card numbers, bank account details) is collected or stored on this website. Donations are completed by bank transfer initiated by you.

Uploaded Files

Documents (PDF, DOC, DOCX) and photos uploaded through story submissions, or payment proofs uploaded through the donation confirmation form, are stored in our secure server environment. Files are not publicly accessible unless a story is explicitly published.

How We Use Your Data

• To respond to your contact enquiries
• To review and potentially publish submitted stories, with your explicit consent
• To process and record donations
• To send you confirmation or receipt emails
• To protect the safety and dignity of contributors

We will never use your data for profiling, automated decision-making, marketing without your separate consent, or any purpose not described in this policy.

Protection of Stories, Photos, and Vulnerable Contributors

Stories, photographs, biographies, and personal materials submitted to this platform are protected. Contributors may include vulnerable individuals — including migrants, refugees, and undocumented persons — whose safety and dignity must be safeguarded above all else.

The following are strictly prohibited without explicit written authorisation from Here2Gether and the original contributor:

• Scraping, crawling, or automated harvesting of any story, photo, or personal content from this website
• Use of submitted content for AI model training, dataset building, or machine learning
• Face recognition, biometric profiling, or identity tracing of any contributor
• Commercial exploitation, resale, or licensing of contributed content
• Republication or redistribution of stories or photos without express permission
• Any secondary use of contributed materials outside the editorial mission of Here2Gether

Publication decisions always consider the safety, dignity, and risk exposure of the contributor. Where necessary, we will apply pseudonymisation, redaction, image removal, or full anonymisation — even after a contributor has given initial consent — if we assess that publication poses a risk.

Data Sharing and Third Parties

We do not sell, rent, license, or trade your personal data. We do not share it with third parties except where strictly required to operate the platform (e.g., hosting infrastructure). We do not use third-party advertising networks or behavioural tracking services.

If we ever need to share data with a third party for a legitimate purpose, we will inform you in advance and ensure appropriate safeguards are in place.

International Data Transfers

Our website is hosted in [your hosting location — e.g., the EU/Netherlands]. If any data is processed outside the European Economic Area, we will ensure appropriate safeguards under GDPR Chapter V (e.g., Standard Contractual Clauses). Please contact us if you have questions about transfer mechanisms.

How Long We Keep Your Data

• Contact messages: up to 2 years, then deleted.
• Story submissions (unpublished): up to 2 years from submission, then deleted unless you have requested earlier deletion.
• Published stories: retained for as long as the story is live on the platform, or until you withdraw consent.
• Donation records: up to 7 years, as required by Dutch/EU financial record-keeping regulations. Personal data within donation records is minimised after 2 years.
• Uploaded files: retained for the same period as the related record; deleted when the record is deleted.

Security

We take appropriate technical and organisational measures to protect your personal data, including:

• Encrypted transmission (HTTPS) for all data sent to and from this website
• Access controls limiting who can view submitted stories and personal data
• Form submission protection using WordPress nonces (CSRF tokens)
• Input validation and sanitisation on all form fields
• Restricted admin access to raw submission data

No system is completely secure. If you believe there has been a breach affecting your data, please contact us immediately.

Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you
• Right to rectification: request correction of inaccurate data
• Right to erasure (“right to be forgotten”): request deletion of your data, subject to legal and editorial constraints
• Right to restrict processing: ask us to pause processing your data while a dispute is resolved
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interest
• Right to withdraw consent: withdraw your consent for story submission at any time; withdrawal after publication may be subject to editorial constraints, but we will make every reasonable effort to comply

To exercise any of these rights, contact us at wearehere2gether@gmail.com. We will respond within 30 days.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Cookies

This website uses only technically necessary cookies required for basic functionality (e.g., session management, security tokens). We do not use tracking, advertising, or analytics cookies without your consent.

Changes to This Policy

We may update this policy as our platform evolves. Material changes will be noted on this page with an updated date. If changes significantly affect how we use your data, we will notify active contributors directly.

Last updated: March 2026