Privacy

    Privacy statement

    Version 2.0, adopted on 8 July 2026. Supplemented on 14 October 2026 with section 12 (data via this website) and the correct phone number. On 2 November 2026 the explanation of visitor statistics was updated. This is a translation; the Dutch version is leading. This privacy statement explains how ZorgtVuldig handles the personal data of clients, their representatives, others involved and visitors to this website.

    1. Purpose of this document

    This privacy statement briefly explains how ZorgtVuldig handles personal data. It is provided with the support agreement and published on www.zorgtvuldig.nl.

    2. Who is responsible

    ZorgtVuldig, Verstolkstraat 30, 8933 DZ Leeuwarden (Chamber of Commerce 84230150, AGB code 41551021), is the controller for personal data processed for the support and through this website. For all privacy questions, Jermaine Sprott, owner, is the contact person: info@zorgtvuldig.nl or 06 2622 8214.

    3. What data does ZorgtVuldig process

    • Identification and contact details: name, date of birth, address, phone number, email address and, only where a legal regulation requires it, the citizen service number (BSN).
    • Data about the support request and support: registration and intake data, support plan, goals, reports, evaluations and agreements.
    • Health data, insofar as relevant for safe and suitable support (for example an autism, mild intellectual disability or mental health background).
    • Safety information and, only within a forensic framework, judicial information such as risk assessments, early warning plans and contact with the probation service, only insofar as necessary.
    • Financial and administrative data, such as indication or decision data, insofar as needed for invoicing the municipality, care office, SVB or PGB budget holder.
    • Contact details of representatives, relatives and referrers, insofar as needed for the support.
    • Data you enter on this website or that is processed during a visit (see section 12).

    4. Why and on what legal basis

    ZorgtVuldig processes personal data only for purposes related to the support, and always on a valid legal basis under the GDPR:

    • Performance of the agreement: registration, intake, support, reporting, evaluation and closing of the trajectory.
    • Legal obligation or task in the public interest: for example accountability to the municipality or care office, obligations under the Wkkgz and mandatory reports within a forensic framework.
    • Consent: for example when sharing information with relatives, referrers or therapists beyond legal obligations. Consent is recorded and can always be withdrawn.
    • Legitimate or vital interest: for example in an acute safety situation.

    ZorgtVuldig processes health data and judicial data only when the GDPR and the Dutch GDPR Implementation Act allow it, and never more than necessary.

    5. Sharing with others

    ZorgtVuldig shares data only when necessary and permitted, for example with the municipality, the care office, the SVB, the referrer, a therapist or, within a forensic framework, the probation service or another judicial partner. This is based on consent, a legal obligation or another valid basis, and never more than needed for the purpose.

    With parties that process data on behalf of ZorgtVuldig, such as the electronic client record (ZilliZ), Microsoft 365 and administrative services, a data processing agreement has been concluded. For the parties behind this website, see section 12. ZorgtVuldig never sells data and does not transfer data outside the EEA without appropriate safeguards.

    6. How long does ZorgtVuldig keep your data

    • Support under the Wmo: 15 years (article 5.3.4 Wmo 2015), or longer if reasonably necessary.
    • Support under the Wlz and health data: 20 years after the end of support, in line with the WGBO.
    • Support within a forensic framework: 20 years, with possible additional requirements from the judicial framework.
    • PGB care: 15 or 20 years, depending on the legal basis (Wmo or Wlz).
    • Financial records: 7 years (tax retention obligation).

    After the retention period the file is securely destroyed. You can ask for earlier destruction insofar as no legal retention obligation applies. Retention periods for website data are in section 12.

    7. Security and data breaches

    • Files are stored securely, digitally and/or physically, and are only accessible to people who need the information for their work, according to the authorisation matrix.
    • ZorgtVuldig uses secure systems, strong passwords and two-factor authentication where possible.
    • A (possible) data breach is investigated immediately and registered internally. If the breach poses a risk, ZorgtVuldig reports it to the Dutch Data Protection Authority within 72 hours. In case of a high risk, the people concerned are also informed.

    8. Your rights

    Under the GDPR you have the following rights over your own data:

    • the right to information about which data is processed and why;
    • the right to access your own data and receive a copy;
    • the right to correct factual errors, and the right to have your own view added to the file;
    • the right to erasure, insofar as no legal retention obligation applies;
    • the right to restriction of processing;
    • the right to portability of digital data you provided yourself;
    • the right to object to processing based on a legitimate or public interest;
    • the right to withdraw consent at any time.

    You can submit a request in writing or by email to info@zorgtvuldig.nl. ZorgtVuldig first carefully verifies your identity and responds within one month. For a complex request this period can be extended by up to two months, with an explanation. Submitting a request is free of charge. If a request cannot be fully granted, you will receive a clear, reasoned explanation.

    9. Representatives and relatives

    The starting point is that clients decide about their own data. If a client has a legal representative, a mentor or guardian helps decide on care matters. A financial administrator only receives information needed for financial matters. Information is shared with parents, family and other relatives only with the consent of the client (or their legal representative), unless the law provides otherwise.

    10. Support within a forensic framework

    If support takes place within a forensic framework, ZorgtVuldig may be obliged to report to judicial partners, for example on progress and keeping agreements. These reports are limited to what is necessary. At the start of the trajectory we discuss what information is shared with whom and why, so you know where you stand.

    11. Complaints about privacy

    You can first discuss a complaint about the handling of personal data with ZorgtVuldig, under the ZorgtVuldig complaints procedure (with an independent complaints officer). You always have the right to file a complaint with the Dutch Data Protection Authority via www.autoriteitpersoonsgegevens.nl.

    Read the complaints procedure

    12. Data via this website

    ZorgtVuldig also processes personal data when you visit this website or fill in a form. Below you can read which data, why and for how long.

    Contact form. You enter who the contact is for, your name, your phone number and/or email address, your contact preference and your message. We only use this data to contact you about your question. Legal basis: your request for contact prior to a possible agreement. Retention: 12 months after the last contact, unless support starts; then the periods in section 6 apply.

    Quickscan. You answer questions about who the registration is for, the type of support, age, place of residence, applicable situations, the support need and funding, and you leave your name, phone number, email address and optionally an explanation. Because the answers may contain health data, we ask for your explicit consent with a checkbox. Your answers stay in your own browser until you send them. If our support is not a good fit, we only keep the answers, without name or contact details, for statistics. Retention: 12 months.

    Notifications. After a form is sent, ZorgtVuldig receives an email with the details at info@zorgtvuldig.nl. That email is sent via Brevo and received in Microsoft 365.

    Spam protection. To protect forms against misuse by computer programs, we use Cloudflare Turnstile. This processes your IP address and technical data about your browser. Legal basis: our legitimate interest in a secure website.

    Cookies and similar techniques. We store your cookie choice in your browser, and during the quickscan your answers. This is needed for the website to work. For visitor statistics we use Vercel Web Analytics. It works without cookies and without storing your IP address, and measures which pages are visited, which website you came from, which country you are in and which type of device and browser you use. We cannot recognise you with it. Only if you consent to analytical cookies do we also count how often the call, WhatsApp and email buttons are clicked. We store those counts in our own database. We do not use Google Analytics and share nothing with advertising parties. Retention: 26 months. You can change your choice at any time via 'Cookie preferences' at the bottom of every page.

    External services. We fetch the Google reviews on the homepage through our own server. If you click the WhatsApp button, you go to WhatsApp and WhatsApp's privacy rules apply. The fonts are hosted on our own server.

    These parties process data for the website:

    • Supabase: database and form processing, servers in the EU (Ireland).
    • Brevo: sending notification emails, servers in the EU.
    • Microsoft 365: receiving email at info@zorgtvuldig.nl.
    • Cloudflare: spam protection for forms.
    • Vercel: website hosting. IP addresses are kept briefly in server logs.

    With Supabase, Brevo, Cloudflare and Vercel a data processing agreement has been concluded as part of their terms. Cloudflare and Vercel are American companies. Transfers outside the EEA only take place with appropriate safeguards, such as the EU-US Data Privacy Framework or standard contractual clauses.

    13. Changes

    ZorgtVuldig may update this privacy statement, for example when legislation or working methods change. The current version is on this page and is available on request.

    Questions about this privacy statement? Contact us at info@zorgtvuldig.nl or 06 2622 8214.

    See also