Forró Den Haag

Privacy Statement

Effective date: 17 August 2026

Forró Den Haag is the trading name of Stichting Forró Den Haag, a non-profit foundation (stichting) registered with the Dutch Chamber of Commerce (Kamer van Koophandel, KvK) under number 90395026, with its registered office at Soesterbergstraat 53, 2546 XM The Hague, the Netherlands. The foundation is the controller for the personal data described in this statement. You can reach us at contact@forrodenhaag.nl.

This statement explains in plain language which personal data we process, why we process it, how long we keep it, and which rights you have under the General Data Protection Regulation (GDPR / AVG). We process as little data as possible, we never sell personal data, and we do not use advertising, tracking or profiling.

What data we process and why

Class and course registrations

When you register for a class, course or summer course we process:

your first and last name,
your email address,
your dance role (leader/follower) and level, where applicable,
the course(s) and season you register for, and the registration date.

We use this data to administer your registration, to put together balanced classes, and to send you a confirmation. The legal basis is the performance of the contract (GDPR Article 6(1)(b)). Your registration is stored in our own database (hosted by Turso) and your payment is handled by Stripe.

Event tickets and workshops

When you buy a ticket for an event or workshop we process:

your name,
your email address,
the tickets and workshops you chose (including your dance role for a workshop, where applicable).

We use this data to issue your ticket, to check you in and to send you a confirmation. The legal basis is the performance of the contract (GDPR Article 6(1)(b)). Ticket purchases are processed through Stripe, which is the source of truth for your purchase; the order details above are part of the payment record Stripe processes for us.

Payments

Card payments are handled directly by Stripe. We never see, store or process your payment card details. Stripe (as processor, and in some cases as a separate controller, e.g. for fraud prevention and anti-money-laundering obligations) processes the payment data described in its own privacy policy — see "Processors and recipients" below.

Contact

If you email us with a question, we process your address and message to answer you. The legal basis is our legitimate interest in responding to enquiries (GDPR Article 6(1)(f)).

Contract (6(1)(b)): registrations, ticket purchases, confirmations.
Legitimate interest (6(1)(f)): running the school's administration and answering enquiries.
We currently do not process data on the basis of consent, and we do not send newsletters or marketing messages.

Processors and recipients

We share personal data only with the parties that help us run the school:

Stripe — payment processing (Stripe is also a separate controller for statutory purposes such as fraud prevention and anti-money-laundering; see stripe.com/privacy and its subprocessors list).
Turso — hosts our class registration database.
Vercel — hosts our website (including web-server logs).
Google — transports confirmation emails we send to you (Gmail SMTP), and provides the map, calendar and video embeds on our pages. These embeds load only after you click to load them; when you do, Google may process data (such as your IP address) under its own privacy policy.

We never sell, rent or trade personal data.

International transfers

Our payment provider Stripe is certified under the EU-U.S. Data Privacy Framework, and transfers to Stripe in the United States are additionally covered by Standard Contractual Clauses (EU 2021/914). Other processors store data within the European Economic Area or under equivalent safeguards. No personal data is otherwise transferred outside the EEA.

How long we keep data

Registrations: for as long as we need them to run the season you registered for and the administration that follows, and no longer than necessary. If you ask us to delete your registration we will do so (see "Your rights").
Financial and payment records: we keep the financial administration that is required by law — in the Netherlands, that is seven years (Algemene wet inzake rijksbelastingen, article 52).
Stripe keeps payment data according to its own retention policy (see stripe.com/privacy).

Cookies and local storage

We use no tracking, analytics or advertising cookies. The only storage on your device is technically necessary for the services you request:

your shopping cart and ticket access key (stored locally in your browser),
a session key for school administrators (a cookie),
cookies set by Stripe while you pay.

The map, calendar and video embeds on our pages load only after you click to load them, and are third-party content governed by the respective provider's privacy policy (see above). The embedded videos use YouTube's privacy-enhanced mode.

Your rights

Under the GDPR you have the right to:

access your personal data,
correct inaccurate data,
erase your data (the "right to be forgotten"),
restrict processing,
data portability (receive your data in a machine-readable form),
object to processing based on legitimate interest.

You can exercise these rights free of charge by emailing contact@forrodenhaag.nl. We respond within one month. In some cases we may need to keep data longer because the law requires it (for example financial records).

You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens — see autoriteitpersoonsgegevens.nl.