Privacy statement
Two forms on this site ask you for personal details. This page says exactly which details, why we ask, who else touches them, how long we keep them, and what you can require of us. It is written to be read, not to be survived.
The short version
We ask for the least we can. We use it to answer you and nothing else. We do not sell it, we do not advertise to you, and we do not pass it to anyone beyond the service that carries your message to our inbox. This site sets no cookies and runs no analytics. If you want your details gone, email info@tharan.nl and they are gone.
The rest of this page is the same thing said precisely, because a promise you cannot check is not worth much.
The controller is a person, not yet the foundation
Under the AVG, someone must be answerable for what happens to your data. Right now that is a named individual, and we would rather explain why than leave you to work it out.
- Controller
- Wael Bokhaiti, founder of Stichting Tharan (in oprichting), Rotterdam, the Netherlands.
- Why a person
- Stichting Tharan is not yet registered with the KVK, so the foundation does not yet exist as a legal entity and cannot hold responsibility for anything. Until it does, the founder is the controller in a personal capacity — personally answerable for how these details are handled.
- When that changes
- This responsibility transfers to Stichting Tharan as soon as the foundation is formally established. This page is updated on the day it does. Transfer at incorporation
- How to reach the controller
- For any question, correction or deletion request: info@tharan.nl. A person reads it, and a person answers.
Exactly these fields, and no others
We collect nothing in the background. Everything below is something you typed and chose to send. If a field is not listed here, we do not ask for it.
- The contact form
- Your name, your email address, your organisation, your city, your reason for contact, and your message. Organisation and city are optional — the form sends without them.
- The get-involved form
- Your name, your email address, your city, the role or way you want to be involved, your background or profession, your availability, and your message. City, background and availability are optional.
- Both forms
- A record of your consent, given by ticking a checkbox that you tick yourself. It is not pre-ticked and the form will not send without it.
One request about the message box
Please keep it to what we need in order to help. You do not have to tell us about your health, your religion, your asylum procedure, your political views or your family's situation in order to start a conversation with us — and a web form is not the place for any of it. If those things become relevant later, we will ask you properly, in person, with separate written consent and an explanation of exactly what happens to it.
Your consent, and only your consent
The legal basis is consent — Article 6(1)(a) AVG. You choose to fill in the form, you choose to tick the box, and you choose to press send. We do not rely on legitimate interest, we have no contract with you, and there is no other basis hiding behind this one.
The purpose is equally narrow: to read what you sent and reply to it, and to carry on that conversation if it goes somewhere. We do not use your details for anything you did not write to us about.
Consent that cannot be withdrawn is not consent. Email info@tharan.nl and say you want your details deleted, and we delete them. You do not owe us a reason, and withdrawing does not cost you anything — it does not affect anything that was already lawful before you withdrew.
We use established services rather than build our own
This is the part most organisations blur. We would rather be plain about it.
Tharan is a small foundation in formation. We do not run our own data infrastructure and we do not employ a dedicated security team — claiming otherwise would be untrue, and a claim you cannot verify is worth nothing to you. What we do instead is use established services and keep the amount of data flowing through them as small as possible.
Form submissions on this site are handled by Web3Forms, an established third-party form-processing service. It receives what you typed, and delivers it to us as an email in our info@tharan.nl inbox. That is the chain for the form itself: you, Web3Forms, us. After that your message sits in our mailbox — hosted for us the way any organisation's mail is hosted — and is treated like any other email we receive.
No other organisation is given your details. We do not sell them, we do not use them for advertising, and we do not pass them to anyone for their own purposes.
- Processor
- Web3Forms — receives each submission and forwards it to us by email. It is the only third party involved in sending the form, and it acts on our instructions rather than for its own purposes.
- Storage, retention & transfers
- Web3Forms processes each contact-form submission as our processor under a data processing agreement, and forwards it to us by email. Submissions may be retained by the service for up to three years. Processing involves sub-processors inside and outside the European Economic Area; transfers outside the EEA are covered by Standard Contractual Clauses. We do not use these submissions for any purpose beyond responding to you. (Source: Web3Forms Data Processing Agreement, checked 2026.)
- If you would rather not use a form
- Email info@tharan.nl directly and no form service is involved at all. That option is always open and we will not think less of you for taking it.
As long as the conversation is live, and no longer
We keep what you sent for as long as we need it to answer you, and to stay in contact about the thing you wrote to us about. A question we answered and that went nowhere does not need keeping; an offer to mentor that turns into mentoring obviously does.
We have deliberately not published a fixed number of months here, because we would only be inventing one. What we will commit to is the part that matters: ask us to delete your details and we delete them, whenever you ask, without needing to be persuaded.
There are none, and that is not an accident
This site sets no cookies. It runs no analytics, no advertising pixels, no session recording and no profiling. We do not know who you are, which pages you read, or that you visited at all. That is why you have not been asked to dismiss a consent banner — there is nothing to consent to.
Nor does this site make any request to a third party — not for typefaces, not for a charting library, not for anything. Every file a page needs is served from tharan.nl itself. Loading a file from somebody else's server hands that server your IP address as a matter of course, so we stopped doing it: the fonts and the code behind our data pages are hosted here. Reading anything on this site tells no third party that you were here.
We mention this because it is the sort of claim that is usually made loosely. It is meant exactly: open your browser's network panel on any page here and you will find nothing leaving tharan.nl.
What you can require of us
These are rights the AVG gives you. They are not favours, and you do not need a reason to use them.
- Access. Ask what we hold about you, and we send you all of it.
- Rectification. If something we hold is wrong, tell us and we correct it.
- Erasure. Ask us to delete your details and we delete them.
- Restriction. Ask us to stop using your details while something is being sorted out, and we stop.
- Objection. Object to what we are doing with your details, and we address the objection.
- Portability. Ask for a copy of what you gave us in a machine-readable file, and we provide it. This right applies here because the processing rests on your consent.
- Withdrawal of consent. Withdraw at any time, for any reason or none, without consequence.
How to exercise any of them
Email info@tharan.nl. One address, all seven rights, no form to fill in and no process to navigate. We answer within a month, as the AVG requires, and usually a great deal sooner than that.
You can complain about us, to someone above us
If you are not satisfied with how we have handled your data or your request, you have the right to complain to the Autoriteit Persoonsgegevens, the Dutch data protection authority. They can be contacted at autoriteitpersoonsgegevens.nl.
You do not have to come to us first — but we would like the chance. Write to info@tharan.nl, or, if the complaint is about the foundation itself rather than a data question, to governance@tharan.nl, where it is reviewed by a board member with no involvement in the matter. Our governance page sets out how that works.
This version, and what happens to the next one
This version: 22 July 2026. It is the first published version of this statement.
When something material changes — a new processor, a different legal basis, the transfer of control to the registered foundation — we rewrite this page rather than bolt a correction onto the end of it, so there is only ever one current version. If a change affects what you already consented to, we tell the people it affects rather than quietly updating a page and hoping.
Anything here you want to ask about?
A privacy statement nobody can question is just decoration. If something on this page is unclear, or you want your details out of our inbox, one email does it.