Privacy Policy
How we process personal data when you use Burgerplatform.
1. Scope
This Privacy Policy explains how we collect, use, store, and share personal data when you visit or use the Burgerplatform website and related services (the “Platform”). It applies to registered users and visitors who interact with features that process personal data.
Our Terms and Conditions govern your use of the Platform. Where this policy refers to processing necessary to perform our contract with you, that refers to those Terms.
2. Personal data we process
Depending on how you use the Platform, we may process:
- Account data — email address, password hash (for local accounts), display name, optional first and last name, optional Dutch postcode, profile photo URL, headline, bio, location, and account timestamps.
- Authentication data — identifiers and tokens received from third-party sign-in providers (Google, and where enabled Microsoft or LinkedIn), CMS bridge identifiers, email confirmation and password-reset tokens.
- Civic participation data — votes, vote comments, proposal reactions, comments and replies, expertise declarations, personal value selections, mandate relationships, and related metadata.
- Chat and survey data — messages you send to the AI assistant, structured survey answers, chat session identifiers, and conversation history linked to your account.
- Technical and usage data — IP address, browser type, device information, request logs, security logs, session identifiers, and cookies required for authentication and language preferences.
- Terms acceptance records — whether you accepted the Terms, the version accepted, and the time of acceptance.
We do not intentionally collect special categories of personal data (such as health data or political opinions) unless you voluntarily include them in free-text fields. Please avoid sharing sensitive information in comments, chat, or profile text unless necessary.
3. Purposes and legal bases (GDPR)
We process personal data only where a legal basis applies:
- Contract — to create and manage your account, provide voting, commenting, mandates, profiles, chat, and other features you request.
- Legitimate interests — to secure the Platform, prevent abuse, improve reliability, and understand aggregated usage, balanced against your rights.
- Legal obligation — where we must retain or disclose data to comply with applicable law.
- Consent — where required, for example optional features or non-essential cookies. You may withdraw consent without affecting the lawfulness of prior processing.
4. AI processing
When you use the chat assistant, your messages and relevant session context are sent to our AI provider (Google Gemini) to generate responses. Do not submit confidential, third-party, or unnecessary personal data in chat. AI outputs may be inaccurate; verify important information independently.
5. Sharing and processors
We share personal data only as needed to operate the Platform, including with:
- Hosting and infrastructure providers that store and run the application and database.
- Authentication providers (Google, Microsoft, LinkedIn) when you choose those sign-in methods.
- Email delivery providers for account verification and password reset messages.
- Google Gemini for AI chat functionality.
- Professional advisers or authorities when required by law or to protect rights and safety.
We require processors to protect data under appropriate agreements. We do not sell your personal data.
6. International transfers
Some providers may process data outside the European Economic Area. Where this occurs, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions, as applicable.
7. Retention
We retain personal data only as long as needed for the purposes above:
- Account and profile data — while your account is active and for a reasonable period thereafter if you delete your account or request erasure, subject to legal retention duties.
- Civic content you publish — may remain visible for transparency unless removed under moderation rules or your deletion request where applicable.
- Security and server logs — typically up to 90 days unless needed for incident investigation.
- Terms acceptance records — retained as proof of consent for as long as your account exists and as required by law.
8. Cookies and similar technologies
We use essential cookies for authentication, session management, anti-forgery protection, and language preference. These are necessary for the Platform to function. We do not use non-essential tracking cookies without consent where required by law.
9. Your rights
Under the GDPR, you may have the right to access, rectify, erase, restrict, or object to certain processing, and to data portability where applicable. You may also lodge a complaint with your local supervisory authority (in the Netherlands: Autoriteit Persoonsgegevens).
To exercise your rights, contact info@burgerplatform.net. We may need to verify your identity before responding.
10. Security
We implement appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access controls, and monitoring. Report suspected vulnerabilities to info@burgerplatform.net.
11. Children
The Platform is not directed at children under 16. We do not knowingly collect personal data from children under 16. Contact us if you believe we have collected such data.
12. Changes to this policy
We may update this Privacy Policy from time to time. The effective date at the top indicates the current version. Material changes will be communicated through the Platform where appropriate.
13. Contact
Questions about this Privacy Policy or our processing activities: info@burgerplatform.net.