Privacy statement

English summary — the Dutch text is authoritative. This is a best-effort translation for international visitors. The legally binding version is the Dutch one at /privacy?lang=nl.

This privacy statement applies to the website virtuelegemeenteassistent.nl (Gem, the virtual municipal assistant).

Who is responsible for your data?

Controller: Stichting ICTU, Wilhelmina van Pruisenweg 104, 2595 AN The Hague, the Netherlands. For privacy questions you can contact us via the contact form on this website.

ICTU has a Data Protection Officer (DPO). The DPO supervises the handling of personal data internally and can be reached at fg@ictu.nl.

Which data do we process?

We only process data that you provide to us yourself. Filling in a form is always voluntary; if you do not share your data, the only consequence is that we cannot contact you or send you the newsletter.

Sign-up form

First name, last name, email address, municipality
Purpose: to contact you about connecting your municipality to Gem
Legal basis: legitimate interest (Article 6(1)(f) GDPR)
Retention: up to 12 months after the last contact

First name, last name, email address
Purpose: to send you the newsletter about Gem
Legal basis: consent (Article 6(1)(a) GDPR); you can withdraw your consent at any time via the unsubscribe link at the bottom of every email
Retention: until you unsubscribe

Logging

IP hash (one-way hash with a server-side key: HMAC-SHA256, first 16 characters), user agent, form timestamp
Purpose: rate limiting and spam detection
Legal basis: legitimate interest (Article 6(1)(f) GDPR) — a secure, available website
Retention: 14 days

With whom do we share your data?

We do not sell or share your data with third parties for commercial purposes. A limited number of service providers (processors) process data on our behalf:

the website runs on the Standaard Platform provided by Logius (the shared government hosting facility) and is managed by ICTU itself;
the email service we use to send the emails around sign-ups and the newsletter.
Piwik PRO, via the shared statistics facility of the Dutch central government (see below).

With processors we conclude processor agreements that guarantee the same level of protection. Beyond that, we only provide data to others where a legal obligation compels us to.

Transfers outside the EEA: your data is processed within the European Economic Area and not transferred to countries outside it.

Automated decision-making

We do not make decisions about you based on automated processing or profiling.

How do we protect your data?

We take appropriate technical and organisational measures to protect your data against loss and unlawful processing, in line with the GDPR and the Dutch Baseline Information Security Government (BIO). Examples: encrypted connections (HTTPS), access to data only for those who need it for their work, and hashing IP addresses immediately instead of storing them.

Your rights

Under the GDPR you have the right to:

Access — request which data we hold
Rectification — have data corrected
Erasure — have data deleted ("right to be forgotten")
Restriction — pause processing
Objection — to processing based on legitimate interest
Data portability — receive data in a machine-readable form
Withdrawal of consent — for processing based on consent (such as the newsletter), without affecting the lawfulness of processing before withdrawal

Use the contact form to exercise a right. To prevent us from providing data to the wrong person, we may ask you to make your identity plausible. We respond within one month; for complex requests this term may be extended by two months — we will let you know within the first month.

Cookies and website statistics

Functional cookies (always active)

We store your language choice in a functional cookie (lang) so the site stays in your own language. No consent is needed for this: the cookie is strictly necessary for the website to work.

Statistics (privacy-friendly, without cookies)

To improve the website we measure website visits anonymously with Piwik PRO via the shared statistics facility of the Dutch central government (statistiek.rijksoverheid.nl). This measurement is set up so privacy-friendly that we do not have to ask your consent and do not show a cookie banner:

the measurement works without cookies; we do not place analytics cookies on your device;
we recognise a visit within the same session without storing anything on your device;
your IP address is masked/anonymised;
data is not shared with third parties and not used for advertising;
we do not track you across multiple websites;
the data is processed within a shielded government environment.

Legal basis: because the statistics are cookieless and privacy-friendly, reading or storing information on your device falls under the exception to the consent requirement (Article 11.7a(3) of the Dutch Telecommunications Act). We base the processing itself on our legitimate interest in improving the website (Article 6(1)(f) GDPR).

Objection: you can object to this measurement (Article 21 GDPR). Contact us via the contact form; we will then look for a solution together.

Complaint

Not satisfied with how we handle your data or your request? Please first contact our Data Protection Officer at fg@ictu.nl. You always also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Changes

We may amend this privacy statement, for example if the website or legislation changes. At the bottom of this page you can see when the statement was last updated.

Last updated 9 July 2026.

← Home