In doing so, we apply the following principles:

• We process your personal data only for the purposes for which it was collected and/or for further processing that is compatible with those purposes.
• We only process personal data that is necessary for the purposes described in this Privacy Statement.
• We take appropriate technical and organisational measures to ensure the security and confidentiality of your personal data.
• We only share personal data where this is necessary for the purposes described in this Privacy Statement.
• We respect your rights regarding your personal data.

1. General

1.1 About the data we process

We have drawn up a record of processing activities in accordance with applicable legal requirements. This record is available upon request for individuals whose personal data we process.

We do not make decisions based solely on automated processing and do not engage in profiling.

We do not use your personal data for direct marketing.

We do not process the personal data of minors (persons younger than 16 years).

1.2 Security

We have taken appropriate technical and organisational measures to protect your personal data against unlawful processing and against loss, deletion, damage, alteration or unauthorised disclosure.

These measures include:

• All persons who have access to your personal data on our behalf are obliged to observe confidentiality.
• We use username and password policies for our systems.
• We use authorisations to control access to systems.
• We make back-ups of personal data to enable recovery in case of physical or technical incidents.
• Our employees have been informed about the importance of protecting personal data.
• Where we share personal data with other parties, we ensure that appropriate agreements are in place regarding the handling and protection of this data.

1.3 Your rights

We store the personal data that we receive from you in our systems. You have the right to request:

• Access to the personal data we process about you.
• Rectification of your personal data if you find that there are factual inaccuracies. You can adjust some data yourself if you are able to log in to our system, such as your CV information or address details.
• Erasure of your personal data or restriction of processing. We cannot always comply with such requests, for example where we have a legal obligation to retain your data.
• Data portability, where applicable, by receiving your personal data in a structured, commonly used and machine-readable format.
• To object to the processing of your personal data where we rely on our legitimate interests as the legal basis for processing.

Where we process your personal data based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

You can exercise these rights by submitting a request to privacy@pum.nl. We may ask you to verify your identity before processing your request.

We will respond to your request within four weeks. If we cannot comply with your request because, for example, this would adversely affect the rights of others or is not legally permitted, we will explain the reason.

1.4 Questions/comments

If you have any questions or comments about this Privacy Statement, the way we protect your personal data, or if you suspect misuse of your data, please contact us via email: privacy@pum.nl.

If you believe that we do not comply with applicable privacy legislation, you can submit a complaint to the Dutch Data Protection Authority.

1.5 Changes to this Privacy Statement

We may amend this Privacy Statement from time to time, for example when legislation changes or when our processing activities change.

We inform our clients, volunteers and employees about relevant changes. The latest version can always be found on our website: https://www.pum.nl/en/privacy-statement

2. Personal data processing details

The personal data we process depends on the services or activities in which you participate with PUM.

We collect personal data when you contact us, register for or participate in our services or activities, enter into an agreement with us, submit information to us, or use our website.

In some situations, we may receive personal data from other sources, such as organisations or individuals involved in our activities, or from publicly available sources, including the Trade Register.

Processing personal data means that we collect, store, use, share and delete personal data where necessary for the purposes described in this Privacy Statement.

2.1 Personal data

Personal data comprises any information relating to an identified or identifiable natural person. We may process, among other things, the following personal data:

• Basic information such as your first and last name, middle name and title.
• Contact details such as your email address, postal address and telephone number.
• Information regarding the device you use to visit our website, such as an IP address.
• Data regarding your visit to our website.
• Personal data that you provide to us in the context of attending events or meetings, such as accessibility requirements and dietary preferences.
• Personal data that you provide to us when applying as an employee, volunteer or representative, such as your first and last name, date of birth, address, telephone number, nationality, marital status, photograph and other information included in your application, including education, expertise and experience.
• Other personal data that you provide to us or that we process for the purposes described in this Privacy Statement.

2.2 Purposes and bases for processing

We may use your personal data for the following purposes:

• To provide our services to our clients.
• To comply with legal obligations.
• To implement an employment agreement, volunteer agreement or other agreement between you and PUM.
• To facilitate collaboration, knowledge sharing, networking and community building within the PUM community, including volunteers, representatives, country managers and employees, in support of PUM’s mission and activities.
• To communicate with you regarding the services or activities at PUM, including operational updates, newsletters, invitations to events, meetings and activities, and expressions of appreciation.
• To process your application or registration for our events.
• To generate statistics regarding the use of the website and/or to analyse and improve the website.

Depending on the purpose of the processing, PUM relies on one or more of the following legal bases:

• Performance of an agreement.
• Compliance with a legal obligation.
• Legitimate interest.
• Your consent.

Not every legal basis applies to every processing activity. The applicable legal basis depends on the specific purpose for which your personal data is processed.

If you refuse to provide certain information, this may affect our ability to provide services or enter into an agreement with you.

2.3 Retention period

PUM retains personal data only for as long as necessary to achieve the purposes described in this Privacy Statement or to comply with applicable legal obligations. Different categories of personal data may be retained for different periods depending on the purpose of the processing and the applicable legal requirements.

2.4 Sharing your personal data

For the purposes described in this Privacy Statement, we may share your personal data with:

• Members of the PUM community, including volunteers, representatives, country managers and employees, where necessary to facilitate collaboration, knowledge sharing, networking and community building in support of PUM’s mission and activities. The personal data shared will be limited to what is necessary for these purposes.
• Clients, regulators and other authorities, where this is necessary to comply with legal obligations or to execute an agreement.
• External suppliers and service providers who process personal data on behalf of PUM, such as payroll administrators, accountants, Travel agent, ICT suppliers, communication service providers or other suppliers supporting our activities.

We only share personal data for the purposes described in this Privacy Statement and in accordance with applicable privacy legislation.

Where third parties process your personal data as independent controllers, they are responsible for complying with applicable privacy legislation regarding their own processing activities.

Where a third-party processes personal data on behalf of PUM as a processor, PUM will enter into a data processing agreement that meets the requirements of the GDPR.

To provide our services, we may need to transfer your personal data to a recipient in a country outside the European Economic Area. Where this occurs, PUM ensures that appropriate safeguards are in place in accordance with the GDPR and applicable legislation.

2.5 Cookies

We use cookies and similar technologies. For more information, please see our Cookie Policy: https://www.pum.nl/en/cookie-policy

We also communicate via social media channels such as Facebook, Instagram and LinkedIn and use Google Analytics to better understand how our website is used and how it can be improved.

Updated and approved August 2026