Privacy policy
What we do with your data, why, and how you stay in control of it.
Last updated: 10 October 2026
Your trust matters as much as your donation. We ask only for the data we need, we protect it and we never sell it. This page explains everything in plain terms, in accordance with the General Data Protection Regulation (GDPR).
1. Who is the data controller?
Beldefi ASBL, Boulevard Industriel 9, 1070 Brussels (Belgium), company number 0723.596.244.
For any question about your data: info@beldefi.org or +32 2 315 13 15.
2. What data we process, and why
Your online donation
- Data: surname, first name, email address, amount, date, project(s) supported, one-off or monthly donation. For a company: its registered name.
- Your banking details (card, account) are entered directly with our payment service provider, Stripe. Beldefi never sees your full card number.
- Purpose: to collect your donation, send you your receipt, manage your monthly donation and keep our accounts.
- Legal basis: performance of a contract, i.e. your donation (Art. 6(1)(b) GDPR) and our accounting obligations (Art. 6(1)(c)).
- Retention period: for the statutory retention period for accounting and tax records (in principle 7 years).
Your tax certificate
- Data: surname, first name, address, national register number (or company number for a company), total of your donations for the year. If you do not have a Belgian national register number: date of birth and country. If you donate by bank transfer: the account number (IBAN) you give us, so that we can match your transfers to your record.
- Purpose: to issue your tax certificate (form 281.71) and submit it to the Federal Public Service Finance via its Belcotax-on-web application, so that your tax reduction is taken into account.
- Legal basis: a legal obligation (Art. 6(1)(c) GDPR): Belgian tax legislation requires this data to appear on the certificate and to be sent to the Federal Public Service Finance. You are free to choose whether to request a certificate; without a national register number, we cannot issue it.
- Retention period: for the statutory retention period for accounting and tax records (in principle 7 years).
Your donor area
- Data: email address, password (stored in an unreadable form, even to us), date of last login, history of your donations and certificates.
- Purpose: to enable you to track your donations, correct your contact details and download your certificates.
- Legal basis: performance of a contract, i.e. the service you request (Art. 6(1)(b) GDPR).
- Retention period: for as long as your account exists. If you ask us to close it, we keep only what the law requires us to retain (see above).
The contact form
- Data: name, email address, subject and message.
- Purpose: to reply to you and follow up on your request.
- Legal basis: our legitimate interest in replying to people who write to us (Art. 6(1)(f) GDPR).
- Retention period: for the time needed to handle your request, then no more than 3 years after our last exchange.
Our email news
- Data: email address, name, date and source of your consent (donation, sign-up, contact form).
- Purpose: to keep you informed about our projects and campaigns.
- Legal basis: your consent (Art. 6(1)(a) GDPR). The tick box is separate from the others and is never pre-ticked.
- Changed your mind? Every email contains a one-click unsubscribe link. You can also withdraw your consent in your donor area, or write to us.
- Retention period: until you unsubscribe. We then keep the date of unsubscription, so that we do not write to you again.
Website security
- Data: to block abusive submissions (bots, repeated login attempts), a one-way (hashed) fingerprint of your IP address, never the address itself, erased after 24 hours. The server’s technical logs (IP address, page requested, date and time), of limited size: the oldest entries are erased automatically, usually after a few weeks. A log of actions performed by the Beldefi team (who did what, and when), without any donor name or number.
- Purpose: to protect the website, your data and our accounts against abuse and fraud.
- Legal basis: our legitimate interest in ensuring the security of the website (Art. 6(1)(f) GDPR).
We do not use your data for advertising and we do not carry out any automated decision-making about you, including profiling.
3. Who receives your data
Only those people at Beldefi who need your data have access to it. Outside the association, your data is disclosed only to:
- the Federal Public Service Finance, for tax certificates (legal obligation);
- Stripe Payments Europe, Ltd. (Ireland), our payment service provider;
- Infomaniak, which hosts the website and the donor area;
- an email delivery provider established in the European Union, for receipts, certificates and our news;
- our accountant, who is bound by professional secrecy, for bookkeeping and certificates.
Our processors act solely on our instructions and are bound by a contract that protects your data. We never sell, rent or exchange your data.
4. Where your data is stored
The website and the donor area are hosted in Switzerland, by Infomaniak. The European Commission recognises that Switzerland provides a level of protection for personal data equivalent to that of the European Union (adequacy decision).
Stripe and Google (see section 7) may transfer certain data to the United States. These transfers are subject to the safeguards provided for by the GDPR (EU–US Data Privacy Framework or the European Commission’s standard contractual clauses).
5. How we protect your data
- All pages are encrypted (HTTPS).
- National register numbers and company numbers are encrypted in our database and always masked on screen.
- Passwords are stored in an unreadable form.
- The Beldefi team logs in using two-factor authentication.
- Backups are encrypted.
6. Your rights
You may at any time request:
- access to your data, and a copy of it;
- rectification of inaccurate data;
- erasure of your data;
- restriction of its processing;
- objection to its processing, where this is based on our legitimate interest;
- data portability: to receive your data in a machine-readable format;
- withdrawal of your consent, for example for our emails, without affecting the lawfulness of processing carried out before its withdrawal.
In your donor area, on the “My data” page, you can exercise most of these rights yourself:
- view everything we hold about you and download it in a machine-readable file (access and portability), together with all your tax certificates in a single ZIP file;
- correct your contact details: any amended tax data is checked by Beldefi before your next certificate;
- withdraw your consent to our emails, or to the transmission of your data to the Federal Public Service Finance: without this consent, we will no longer issue tax certificates in your name, but those already issued remain valid;
- request erasure, restriction or objection: a button sends your request to our team, which will reply to you in writing within one month. You can track it in your donor area.
No donor area? Write to info@beldefi.org. We reply within one month. We may ask you to prove your identity, so that we never disclose your data to anyone else.
One limitation: we cannot erase what the law requires us to keep (accounting records, tax certificates) before the end of the statutory retention period.
7. Cookies and third-party services
On this website
Beldefi places no cookies on this website: no analytics, no advertising, no tracking. Your browser simply stores the latest figures for our fundraising campaigns, so that they display faster. This stored information contains no personal data.
In our donation application
On the pages of our application (donation, “I have made a bank transfer”, donor area), only one cookie is used: the session cookie. It protects forms against fraudulent submissions and, in the donor area, keeps you logged in. It is strictly necessary for the service to function and therefore does not require your consent.
Content provided by other websites
Some pages display content from other websites. To display it, your browser connects to those websites, which then receive your IP address:
- the map on the Access to water page (OpenStreetMap, and the Leaflet library served by Cloudflare);
- the map on the Contact page (Google Maps), only if you click “Show the map”; it may then place its own cookies;
- Stripe’s payment page, which uses its own cookies to prevent fraud.
These services apply their own privacy policies. The links to Facebook and Instagram transmit nothing unless you click on them.
8. Complaints
A concern about your data? Please contact us first at info@beldefi.org: we will find a solution. You may also lodge a complaint with the Belgian Data Protection Authority (APD/GBA): Rue de la Presse 35, 1000 Brussels, www.autoriteprotectiondonnees.be.
9. Changes
We may update this page, for example when we add a service. The date of the last update is shown at the top of the page.