Privacy Policy

Last updated: 22 September 2026

Introduction

This Privacy Policy explains how INFECTA B.V. (“INFECTA”, “we”, “our”, or “us”) handles your personal data when you visit www.infecta.org, interact with us or apply for a job with us.

This Privacy Notice is structured in a general and a more specific section:

1. General section (part 1): applies to everyone who visits our website or contacts us. This section sets out who we are, what your rights are and how we handle security and data transfers.
2. Specific sections (part 2). Each section describes one specific use of your data, including the associated purposes, legal basis and retention period. You only need to read the sections that apply to you.

   PART 1 – GENERAL

   1. Definitions

   The following terms are used through this privacy policy and shall have the meaning set out below, whether capitalised or not:

   Controller:                    The natural or legal person that determines the means and purposes of the processing.

   GDPR                          Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

   Personal Data:             Any information that can directly or indirectly identify you.

   Process/Processing:     Any action with personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, erasure, or destruction.

   Processor:                   The natural or legal person that processes Personal Data on behalf of the Controller.

   Purpose:                      The reason(s) for which personal data is processed.   

   2. Your Data Subject Rights (GDPR)

   You have the following rights regarding your personal data:

   • The right of access. You have the right to obtain information as to whether or not personal data concerning you is being processed and, where that is the case, request a copy of your personal data
   • The right to rectification. You have the right to correct inaccurate or incomplete personal data
   • The right to erasure (“Right to be forgotten”). You have the right to request the deletion of personal data concerning you, if, among other things, the personal data are no longer necessary in relation to the purposes for which they were collected, you withdraw your consent or the personal data has been unlawfully processed.
   • The right of restriction. Under certain circumstances, you may restrict the processing of personal data concerning you. This is, for example, the case where you contest the accuracy of the personal data or where the processing is unlawful but you do not wish the data to be deleted.
   • The right to data portability. You have the right to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format and to transmit those data to another controller. This only applies to data that we process on the basis of your consent or on a contract, and by automated means.
   • The right to object. Where we base the processing of your personal data on our legitimate interest and you object to the processing of personal data concerning you, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims.
   • The right to withdraw consent. Where we process personal data concerning you based on your consent, you may withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on your consent before its withdrawal.

   You have, at all times, the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, www.autoriteitpersoonsgegevens.nl). We would, however, appreciate the chance to address any concerns you may have before you approach the supervising authority. We are committed to working with you to find a satisfactory resolution to any concern you may have.

   If you wish to exercise your rights under the GDPR, please contact us via privacy@infecta.org.  

   You are never obliged to share your personal data with us. However, you will need to do so in order to receive our newsletter. Without your details, we will also be unable to receive or respond to any contact requests or to receive any donations from you.

   INFECTA does not make decisions based solely on automated processing, including profiling, as referred to in Article 22 of the GDPR.

   Data Sharing

   To carry out the processing activities described in this privacy notice, we share data with the following categories of recipients:

   • Hosting and infrastructure providers (e.g., cloud servers)
   • Providers of analytics and performance tools
   • Providers of communication tools
   • Providers of CRM and customer-support systems

   These recipients only process personal data under our instructions. We enter into processing agreements with these parties, to ensure that their compliance with the GDPR is sufficient.

   • External professional service providers (e.g., accounting, legal, compliance)

   In certain cases, INFECTA is legally obliged to disclose your personal data to governmental or regulatory authorities, for example in the event of a court order or a binding request from a competent supervisory or law enforcement authority. Where we receive such a request, we will verify the lawfulness of the request and will only disclose the personal data that is strictly necessary to comply with the applicable legal obligation.  

   3. International Transfers

   Personal data processed by INFECTA in accordance with this privacy notice are not shared with parties outside of the European Economic Area.

   4. Questions or Requests

   If you have questions about this Privacy Policy or how we process your data, please contact us at:

   INFECTA B.V. (INFECT-NL B.V.)

   Attn. Data Protection Officer

   Rijnsburgerweg 10, 2333 AA Leiden

   The Netherlands

   Email: info@infecta.org

   Website: www.infecta.org 

   Our DPO can be contacted via: privacy@infecta.org

   5. Changes to This Privacy Policy

   We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal obligations. The “Last updated” date at the top of the page indicates when this policy was most recently revised.

   PART 2 – ADDITIONAL INFORMATION PER PROCESSING PURPOSE

   Processing Activities

   INFECTA processes personal data for the purposes set out below. For each of these processing purposes, INFECTA acts as the Controller. Where INFECTA acts as a Processor on behalf of healthcare institutions, research partners, or clients (e.g., in the context of clinical research), such processing is governed by a separate data processing agreement (DPA) and falls outside the scope of this privacy policy. No health data is processed through the public website www.infecta.org.

   Under the GDPR, we may only process personal data where we can rely on a valid legal basis, which is specified below. Please note that your personal data may be processed for more than one purpose simultaneously. If the legal basis for a particular processing purpose ceases to apply, we will stop processing your personal data for that purpose. This does not affect any processing of the same personal data that is carried out on the basis of a separate purpose and legal basis in accordance with this privacy policy.

   A. Business relationships and communication with (potential) partners and donors and contact requests

   Legal basis: legitimate interest (Article 6(1)(f) GDPR).

   We process personal data of our (potential) business partners, donators, and other professional contacts in the context of establishing, maintaining, and extending our business relationships. This includes communicating with you about our services, responding to your inquiries, and managing our ongoing collaborations. For this purpose, we process your name, email address, telephone number, organisation name and job title, as well as any further personal data you share with us during our contact or collaboration We consider this processing necessary for the effective management of our business relationships. 

   We retain your personal data for this purpose for as long as we maintain an active relationship with you or your organisation, and for a period of two (2) years thereafter, except where we have a legal obligation to retain parts of your data longer, for example for tax reasons as set forth hereinafter Where you contact us via a web form or by telephone without an ongoing business relationship being established, we will retain your data for a maximum period of one (1) year from the date of your inquiry, unless a business relationship is subsequently established. Where your personal data is relevant for tax or accounting purposes, we retain the relevant records for seven (7) years from the end of the relevant financial year, in accordance with applicable statutory obligations. We periodically review whether we still need to retain your personal data before the end of the applicable retention period.

   B. Donation administration

   Legal basis: performance of a contract (Article 6(1)(b) GDPR) for the processing of personal data in connection with the conclusion and performance of a donation agreement; compliance with a legal obligation (Article 6(1)(c) GDPR) for the fulfilment of our financial and tax record-keeping obligations under the Dutch General Tax Act and Article 2:10 of the Dutch Civil Code (Burgerlijk Wetboek, “BW”).

   If you enter into a donation agreement with INFECTA, whether directly or through a wealth manager (vermogensbeheerder) acting on your behalf, we process your personal data to conclude and perform the donation agreement, to process, record, and confirm receipt of your donation, and to comply with our financial and tax record-keeping obligations under Article 52 of the Dutch General Tax Act (Algemene wet inzake rijksbelastingen, “AWR”) and our obligation to maintain an adequate financial administration under Article 2:10 of the Dutch Civil Code (Burgerlijk Wetboek, “BW”). For this purpose, we process your name, contact details, payment information, donation history, and, where applicable, the name and contact details of your wealth manager. Where a wealth manager provides personal data to us on your behalf, we assume that the wealth manager is duly authorised to do so.

   We retain personal data processed in connection with donation administration for a period of seven (7) years from the end of the financial year in which the donation was made, in accordance with the record-keeping obligation set out in Article 52 AWR. Any personal data that is not subject to this statutory retention obligation will be deleted as soon as it is no longer necessary for the purposes for which it was collected.

   C. Newsletter and communications

   Legal basis: consent (Article 6(1)(a) GDPR; Article 11.7(1) Telecommunication Act, “TW”) for new subscribers; legitimate interest (Article 6(1)(f) GDPR; Article 11.7(5) Tw) for existing contacts.

   If you subscribe to our newsletter, we process your e-mail address, name (if provided), communication preferences, and subscription date to send you updates about our activities and services. We retain your personal data for this purpose until you withdraw your consent by unsubscribing. You may unsubscribe at any time by using the unsubscribe link included in each communication or by contacting us. Upon withdrawal of your consent, we will delete your personal data without undue delay.

   D. Recruitment and job applications

   Legal basis: consent (Article 6(1)(a) GDPR) and, where applicable, the performance of pre-contractual measures at your request (Article 6(1)(b) GDPR).

   If you apply for a vacancy at INFECTA or submit a spontaneous application, we process your personal data to assess your suitability for the position and to manage the recruitment process. For this purpose, we may process your name, contact details, curriculum vitae, cover letter, education and employment history, references, and any other information you provide as part of your application. Where an assessment forms part of the application procedure, you will be informed of this in the relevant vacancy text and your explicit consent will be obtained prior to the assessment being carried out. If your letter contains information about your health or any accessibility needs, we process such personal data with your explicit consent. We ask you not to share such information with us in your first application, unless this is essential for us to judge the application in a correct manner.

   If we do not offer you a position with INFECTA, we will delete your personal data within four (4) weeks after the end of the application procedure, unless you have given us your explicit consent to retain your data for future vacancies, in which case we will retain your data for a maximum period of one (1) year from the date of your consent.

   E. Data received from third parties

   Legal basis: legitimate interest (Article 6(1)(f) GDPR). Our legitimate interest consists of identifying and engaging with potential partners, donors, and other professional contacts whose activities or expertise are relevant to our mission, and of maintaining and developing our professional network.

   We may receive personal data about you from the following categories of sources: (i) professional networks and publicly available business sources (e.g., LinkedIn, trade registers, and public company websites); (ii) research collaboration partners with whom we cooperate in the context of our mission; and (iii) integration partners and service providers that support our operations. The categories of personal data we may receive include your name, contact details, organisation name, job title, and professional background. We process such data only to the extent necessary for the purposes described in this privacy policy and in accordance with applicable data protection law. Where we receive your personal data from a source other than yourself, we will inform you of the source of the data and the purposes of the processing within one month of obtaining the data, or at the latest at the time of our first communication with you, in accordance with Article 14 GDPR. Personal data received from third parties is used exclusively for individual business communication and is not used for the purpose of sending newsletters or other forms of direct marketing.

   Personal data received from third parties is retained only for as long as necessary for the purpose for which it was received, as described in the relevant processing activity in this privacy policy. Where such data relates to a business relationship, the retention period applicable to business relationship data applies. Where no business relationship is established within three (3) months of receipt of the data, the data will be deleted. Where it relates to another processing purpose, the retention period applicable to that purpose applies.

   F. Events

   Legal basis: legitimate interest (Article 6(1)(f) GDPR) for the organisation and administration of events; performance of a contract (Article 6(1)(b) GDPR) for the processing of personal data in connection with the registration for and invoicing of paid events if you register in your personal capacity; consent (Article 6(1)(a) and Article 9(2)(a) GDPR) for the processing of special categories of personal data, such as dietary requirements or accessibility needs, where applicable.

   We organise events, including seminars, conferences, and other activities related to our mission. In connection with these events, we process personal data of participants, speakers, and other attendees. For this purpose, we may process your name, contact details, organisation name and job title, dietary requirements, accessibility needs (where provided by you), attendance records, and, where the event requires payment of a participation fee, we process your billing address, payment information, and invoice details.

   We process your personal data to manage registrations, communicate relevant event information, and ensure the safe and effective organisation of the event. Where an event requires payment of a participation fee, we also process your personal data for the purpose of issuing and sending invoices, processing payments, and maintaining our financial administration. Where you provide us with information about dietary requirements or other special needs, we process this information solely for the purpose of accommodating your needs during the event. We do so based on your consent.

   We retain your personal data for this purpose for a period of six (6) months from the date of the relevant event. Where your personal data is processed in connection with the invoicing of paid events or is otherwise relevant for tax or accounting purposes, we retain the relevant records, including invoices and payment records, for seven (7) years from the end of the relevant financial year, in accordance with the record-keeping obligation set out in Article 52 of the Dutch General Tax Act  and Article 2:10 of the Dutch Civil Code. Any special category data, such as dietary requirements, will be deleted as soon as it is no longer necessary for the purpose for which it was collected, and in any event no later than three (3) months after the conclusion of the event.

   G. Social media

   Legal basis: legitimate interest (Article 6(1)(f) GDPR) for the management of our LinkedIn page and the processing of Personal Data contained in direct messages sent to us via LinkedIn.

   INFECTA maintains a LinkedIn page to share information about its activities, mission and publications, and to engage with its professional network. When you visit or interact with our LinkedIn page, LinkedIn processes your Personal Data (such as your IP address, browser information, and interaction data) in accordance with its own privacy policy. Our legitimate interest consists of maintaining an online professional presence and engaging with our network.

   In respect of this processing by LinkedIn, INFECTA and LinkedIn Ireland Unlimited Company act as joint controllers pursuant to Article 26 GDPR, in accordance with the Page Controller Insights Joint Controller Addendum made available by LinkedIn. INFECTA’s responsibility as joint controller is limited to the decision to operate a LinkedIn page; LinkedIn is responsible for the technical processing of visitors’ Personal Data. INFECTA does not receive any Personal Data that would allow it to identify individual visitors to its LinkedIn page. The page statistics INFECTA receives from LinkedIn are aggregated and anonymised and do not constitute Personal Data within the meaning of the GDPR. For more information about how LinkedIn processes your Personal Data and about your rights in relation to LinkedIn’s processing, please refer to LinkedIn’s Privacy Policy, available at www.linkedin.com/legal/privacy-policy.

   We retain Personal Data relating to your interactions with our LinkedIn page (such as your name, profile information, and the content of your comments, likes, or other engagement visible to us as page administrator) for a maximum period of two (2) years from the date of the relevant interaction, unless you unfollow our page or request deletion of your data. Personal Data contained in direct messages sent to us via LinkedIn (such as your name and the content of your message) is retained for a maximum period of one (1) year from the date of the last communication, unless a business relationship is established, in which case the retention period applicable to business relationship data applies.

   H. Cookies & Tracking Technologies

   Legal basis: legitimate interest (Article 6(1)(f) GDPR) for essential cookies and basic website functionality; consent (Article 6(1)(a) GDPR) for all other and non-essential cookies.

   When you visit our website, we may automatically collect certain technical and usage data, including your IP address, browser type and version, device information, pages viewed and time spent on site, referral source, cookie identifiers and general location information (city-level, not precise GPS). We use cookies and similar technologies to ensure website functionality, improve user experience, and analyse website performance. Our legitimate interest consists of ensuring the technical functioning of our websites.

   Analytics and performance data collected via cookies is retained for a maximum period of twenty-six (26) months, or a shorter period depending on the configuration of the relevant tool. Strictly necessary cookies are retained only for the duration of your browser session or for a short period thereafter as technically required. For consent-based cookies, data is retained until you withdraw your consent via the cookie banner or your browser settings. Technical logs are retained for a maximum period of twelve (12) months for security and diagnostic purposes.

   Types of Cookies We Use:

   Type of Cookie	Provider + location	Data collected	Purpose	Duration
   Strictly necessary	Elementor, Netherlands	Website layout and content display preferences	Enable the website owner to manage and display website content correctly	Persistent
   Strictly necessary	Google Ireland Limited, Ireland	Bot detection score, bbot detection session token, IP address (hashed), browser and device fingerprint	Protect the website against automated spam and malicious attacks (reCAPTCHA)	Persistent
   Strictly necessary	WordPress, Netherlands	Browser emoji rendering capability	Determine whether the browser can display emojis properly	During session
   Strictly necessary	CookieYes, Netherlands	Cookie consent preferences and status	Record and manage your cookie consent choices	1 year
   Analytics	Matomo, Netherlands	Unique user ID, pages visited, referral source, browser and device type, general location (city-level)	Analyse how visitors use the website and generate anonymised usage statics	13 months
   Analytics	Matomo, Netherlands	Unique session ID, pages visited during session, session duration	Store a unique session ID to track user activity during a single browsing session	1 hour

   You can manage or disable cookies via the cookie banner on our website, your browser settings or by clearing your browser history. 

   I. Legal claims

   Legal basis: legitimate interest (Article 6(1)(f) GDPR). Our legitimate interest consists of the establishment, exercise or defence of legal claims to which INFECTA is or may become a party.

   We may process Personal Data where this is necessary for the establishment, exercise or defence of legal claims. This includes, but is not limited to, the retention of correspondence, contractual documentation, transaction records, and any other Personal Data that may be relevant as evidence in actual or anticipated legal proceedings, regulatory investigations, or dispute resolution procedures. The categories of Personal Data processed for this purpose depend on the nature of the claim and may include your name, contact details, contractual and payment information, correspondence, and any other data relevant to the claim in question.

   We retain Personal Data for this purpose for as long as reasonably necessary in connection with the relevant claim. Where no legal proceedings have been initiated, we will in any event delete the data no later than twelve (12) months after the expiry of the applicable statutory limitation period. Where legal proceedings are pending or reasonably anticipated, we retain the relevant data for this processing purpose until the proceedings (including any appeals) have been finally resolved and the applicable enforcement period has expired.

   J. Corporate transactions

   Legal basis: legitimate interest (Article 6(1)(f) GDPR). Our legitimate interest consists of evaluating, preparing, and implementing corporate transactions, including funding rounds, mergers, acquisitions, asset sales, reorganisations, or similar transactions involving INFECTA or its assets.

   In the context of a prospective or actual corporate transaction, we may disclose or otherwise make available Personal Data to the prospective counterparty and its advisers as part of a due diligence process. The categories of Personal Data disclosed depend on the nature and scope of the transaction and may include data relating to business relationships, contractual arrangements, personnel, and operational records. Before disclosing any Personal Data in this context, we take appropriate measures to safeguard your rights and freedoms, including limiting disclosure to what is strictly necessary, requiring the recipient to enter into confidentiality undertakings, and, where applicable, pseudonymising or aggregating data.

   We retain Personal Data processed in connection with a corporate transaction for as long as necessary for the evaluation and, where applicable, the implementation of the transaction. Where a transaction does not proceed, we will delete or return the Personal Data disclosed in the due diligence process without undue delay, and in any event no later than six (6) months after the termination of negotiations, unless retention is required for another processing purpose as set forth in this privacy notice.