Privacy

Data controller

The controller responsible for processing personal data, and the user of this privacy statement, is the Institute. This means that the Institute decides which personal data is processed, for what purpose and in what manner. The Institute is responsible for ensuring that your personal data is handled in accordance with the GDPR.

Processing personal data

If you register for one of our services, such as the newsletter, information sessions or information about human rights, or if you complete a report or complaint form on our website, we will ask you for your personal data. These are personal data as defined in Article 4, paragraph 1 of the GDPR, such as name, address, gender, date of birth and telephone number.

In addition, when necessary, we also process special categories of personal data about you if you use our services and or if you yourself have provided the data to us. The following special categories of personal data may be used:

• medical information
• political opinions
• religious or philosophical beliefs
• race or ethnic origin
• sexual orientation

For what purpose does the Institute use your personal data?

Personal data are necessary for the proper and careful performance of the legal tasks of the Institute. These tasks are set out in the National Institute for Human Rights Act and include the following activities:

• providing information and education about human rights
• conducting research on human rights
• handling requests for a decision on whether discrimination has occurred under equal treatment legislation
• reporting on and making recommendations about human rights
• providing advice on (draft) policies that directly or indirectly relate to human rights

The Institute uses your personal data only for the purposes mentioned above. We only use the data that we consider necessary or useful for the situation.

Storage of your data

The data you provide is stored in a secure manner. Storing emails, letters or telephone information is necessary for carrying out our services, such as providing information and education. Storage takes place in accordance with the requirements of the GDPR and the Archives Act 1995.

Anonymous contact is possible

The Institute also stores data from emails, letters and telephone conversations in order to analyze the number of questions and reports per topic.

The Institute does not share your data with third parties unless you have given explicit permission for this. It is also possible to contact the Institute anonymously, or to request that no personal data be recorded in relation to a question or report.

Request for a decision (complaint form)

One of the Institute’s legal tasks is to investigate, upon request, whether discrimination has occurred under equal treatment legislation in individual cases, and to issue a decision on this. Requests for a decision submitted via the internet are stored on a highly secured server. The personal data you provide, including special categories of personal data, are used to assess whether the Institute can process your complaint.

Anonymous complaints are not possible

For proper performance of this task, it is necessary to process your data. Without your data, the Institute cannot determine whether a complaint can be handled. It is therefore not possible to submit a complaint anonymously.

Procedure

If the Institute has decided to process a complaint and a procedure has started, your personal data will be shared with the other party (the opposing party). This is done to ensure that both sides are heard. Data may also be shared with an expert who is commissioned by the Institute to provide advice in your case. Parties will be informed in advance about who their personal data will be shared with. For proper and careful assessment of requests, it is necessary to process your personal data, including special categories of personal data. You are legally required to provide this information according to Article 6 of the National Institute for Human Rights Act. The Institute only processes data that are reasonably (or: logically) necessary for the fulfilment of its task.

Decisions on the website

The Institute publishes its decisions on the website. The names of complainant(s) are not included in the published decisions. The names of respondent(s) are included unless there are compelling reasons not to do so. Read more about our publication rules for decisions.

Decisions on one’s own actions

Even when organizations and companies request an opinion on their own actions, processing (special) personal data is essential for a proper assessment of the case. These organizations and companies can submit a reasoned request to the Board not to disclose their names in the published decision.

Research and surveys

The Institute has a statutory task to conduct sociological and empirical research on the human rights situation in the Netherlands. To do this, the Institute may use surveys. In that context, the Institute may store (special) personal data, when necessary. Published research contains only (anonymous) data relevant to the research results.

Recruitment and selection

Application data are destroyed within four weeks after rejection. The Institute may ask the applicant for permission to retain the application data for six months for possible future vacancies. For further guidelines on processing and storing application data, please refer to the application code of the Dutch Association for Personnel Management & Organisation Development (NVP).

Our website

Web statistics

The Institute’s website uses web statistics. The website www.humanrightsincn.nl (including its subdomains) uses analytical and functional cookies. The same applies to the English and Papiamentu versions of the website. These cookies do not contain personal data. These data are also not shared with third parties.

We use cookies to collect statistics on website usage, such as the number of visitors, popular pages and topics. The purpose is to improve the website and better align it with the needs of its users.

These cookies cannot be traced back to a computer or individual. Therefore, we do not collect personal data via cookies and do not use the information for any other purpose than described above. Certainly not for commercial purposes. Read more about the use of cookies.

Photos on the website

Some photos are taken by a photographer on behalf of the Institute. The photographer or the Institute arranges the consent of the people being photographed. This is recorded in a so-called quit claim (image rights).

Sometimes you may be asked, as part of a publicity campaign, to submit or upload personal data or photos (selfies). By submitting or uploading such data, you give consent to the Institute to use this information or photos for the specific campaign. You may later withdraw this consent and request removal of the submitted data. Read more about copyright on photos.

Online third parties

The Institute handles the personal data you provide confidentially. We regularly refer to websites of other organizations. We never use your personal data for this purpose and we do not share them. If you reach other websites via links on our website, the rules of those parties apply for the handling of your personal information and privacy. We strongly recommend reading their privacy statements carefully.

Retention period

The Institute does not retain your personal data longer than necessary for the purposes described in this privacy statement and in accordance with the GDPR. The Institute must also comply with the rules of the Archives Act 1995, according to the document “Selection List of the Ministry of Justice and Security and its predecessors since May 5, 1945”, published in the Government Gazette of April 12, 2021, under number 17848.

Sharing with third parties

The Institute does not share your data with third parties unless necessary for carrying out its legal tasks. With organizations that process data on our behalf, we conclude a processing agreement to ensure the same level of security and confidentiality. The Institute remains responsible for these processing activities.

Security

The Institute takes appropriate measures to prevent misuse, loss, unauthorized access and other unwanted actions involving personal data. Your data are not processed outside of the EU. Personal data stored in physical form, such as in case files, are kept in a locked space to prevent unauthorized access.

Your rights as a data subject

You have the right to access, correct or delete your personal data. You also have the right to restrict the processing of your data. If you have given your consent for the processing of your personal data, you also have the right to receive this data (in machine-readable form).

Privacy request

For all these matters (deletion of your data, restriction of the processing of your data, etc.), you can submit a privacy request to the Institute. This can only be done in writing and must include a motivation. To do this, download the privacy request form, complete it fully and send it by email or regular mail to the privacy officer of the Institute. The contact details are listed at the bottom of this webpage. No later than one month after receiving the request, the Institute will send you a (substantive) response to your request.

Identification in person

It is important that, when submitting a request, you can identify yourself and demonstrate that the data you wish to access, correct or delete actually belongs to you. It is not permitted to access the data of other individuals. For identification purposes, you may therefore be invited to appear in person at the Institute.

For minors (under 16 years of age) and persons under legal guardianship, requests for access, correction or deletion must be submitted by their legal representatives. The Institute will therefore respond to the legal representatives.

Costs

Submitting a privacy request is usually free of charge, but for very extensive and complex requests, costs may be charged.

More information

About privacy rights

Would you like to know more about your rights regarding your registered personal data? Then read more about your privacy rights.

About privacy legislation

• More information about privacy legislation can be found on the website of the Dutch government.
• The Institute has a data protection officer. This (external) independent officer monitors compliance with privacy legislation at the Institute and can be reached at fg@mensenrechten.nl.
• The Institute is happy to assist you if you have complaints about the processing of your personal data. If we are unable to resolve the matter together, then under privacy legislation you also have the right to file a complaint with the privacy supervisor (the Dutch Data Protection Authority).

Changes

The Institute may amend this privacy statement from time to time. The most current version can always be found on this webpage.

Questions and contact details

If you have questions about this privacy statement, you can contact the privacy officer of the Institute by email (privacy@mensenrechten.nl). You can also send a letter to the following address:

National Institute for Human Rights
Attn: the Privacy Officer
PO Box 16001
3500 DA Utrecht

Date of last modification: December 16th 2025.