Privacy information

Who is responsible

Organisation name, registered address and data protection contact: TBD - Founder/Legal confirmation required.

Personal data we process

Account data: email address, username and password (passwords are managed by our authentication provider and never visible to BuurUnion staff).

Profile data: display name, city or town, and optionally a profile photo and unit/apartment number (the unit is only shown to neighbours if you switch this on).

Building membership: which building you belong to, how your access was verified and its status.

Community content: activities you create or join, messages, and reports you submit.

Records of your Terms acceptance (version and time), access requests and account deletion requests.

Why we process it

To create and secure your account, verify that you live in the building, and let neighbours organise and join activities.

To keep the community safe through moderation, reports and protection against misuse.

Lawful basis for each purpose: TBD - Founder/Legal confirmation required.

Who can see your data

Neighbours in your own building see your display name, city, optional photo and, only if you allow it, your unit. Your email is never shown to other residents.

Your Building Administrator sees what is needed to approve and manage access. Platform administrators can access data only to operate and protect the service.

Service providers

Supabase provides our database, authentication and file storage.

The website is hosted on cloud infrastructure; the page font is loaded from Google Fonts.

Processor agreements, hosting locations and any transfers outside the EU: TBD - Founder/Legal confirmation required.

Cookies and browser storage

BuurUnion uses only strictly necessary browser storage: a sign-in session so you stay logged in, and a last-activity timestamp used to sign you out after 24 hours of inactivity.

We do not use analytics, advertising or marketing cookies.

How long we keep data

Retention periods for each type of data: TBD - Founder/Legal confirmation required.

Your rights

Under the GDPR you can ask for access to your data, correction, deletion, restriction of processing, a copy in a portable format, and you can object to processing. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

You can correct most profile details yourself on your Profile page, and request deletion of your account under Profile, Account & personal data.

How to send other privacy requests and expected response times: TBD - Founder/Legal confirmation required.

Account deletion

Deletion requests are recorded securely and reviewed before data is removed, so shared building records stay consistent.

Which data is deleted, anonymised or retained, and for how long: TBD - Founder/Legal confirmation required.

Security

Access to data is restricted per building and per role at database level, passwords are handled by our authentication provider, registration codes are stored only in protected (hashed) form, and inactive sessions end after 24 hours.

Contact

Privacy contact method: TBD - Founder/Legal confirmation required.