Privacy Policy

1. Who We Are

FriendShaping ("we", "us", "our") is a community platform operated from the Netherlands, dedicated to helping adults form genuine real-world friendships. As data controller, we are responsible for how your personal data is used.

Contact: privacy@friendshaping.com

2. Data We Collect

We collect the following categories of personal data:

• Account data: first name, last name, email address, password (hashed), registration date.
• Profile data: optional information you choose to share, such as age range, city, and interests.
• Activity data: event registrations, check-ins, and community interactions.
• Technical data: IP address, browser type, device type, pages visited, and session duration — collected via server logs.
• Communication data: messages sent to our support team and responses to community surveys.

We do not collect sensitive personal data such as racial origin, health information, or political opinions.

3. Legal Basis for Processing

We process your data on the following legal bases under GDPR Article 6:

• Contract performance (Art. 6(1)(b)): processing necessary to provide you with the FriendShaping service, including account management and event participation.
• Legitimate interest (Art. 6(1)(f)): improving platform security, fraud prevention, and aggregate analytics.
• Consent (Art. 6(1)(a)): optional communications such as newsletters, if you have opted in.
• Legal obligation (Art. 6(1)(c)): retaining records to comply with Dutch tax and administrative law.

4. How We Use Your Data

Your personal data is used to:

• Create and manage your account.
• Match you with community events and activities in your area.
• Send service-related notifications (account confirmations, event reminders).
• Improve platform features and user experience through anonymised analytics.
• Detect and prevent fraud, abuse, or violations of our Terms of Use.
• Comply with legal obligations.

5. Data Sharing

We do not sell your personal data. We may share data with:

• Hosting provider: our website, database and mail server run on a server of OVHcloud in a data centre in Limburg, Germany, within the European Economic Area (EEA); bound by a data processing agreement.
• Email service providers: to send transactional emails; bound by a data processing agreement.
• Legal authorities: if required by a court order or statutory obligation under Dutch law.

6. Data Retention

We retain personal data only as long as necessary:

• Account data: for as long as you have an account. When you delete your account, your personal data is deleted immediately, except where the law requires us to keep it. Records of the pages you visited stay only as anonymous statistics; the link to you is removed at the same moment.
• Backups: copies of the database in our backups are overwritten as the backups rotate, at the latest 30 days after you deleted your account.
• Technical logs: 90 days, then automatically purged.
• Support correspondence: 2 years after the case is closed.
• Financial records: 7 years as required by Dutch fiscal law.

7. Your Rights (GDPR)

Under the GDPR you have the right to:

• Access — request a copy of the data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data ("right to be forgotten"), subject to legal retention obligations. You can delete your account yourself at any time from your profile page.
• Restriction — ask us to limit processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — at any time for consent-based processing (e.g. newsletters).

To exercise any right, email privacy@friendshaping.com. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Measures include encrypted storage of passwords, HTTPS-only access, and role-based access controls for staff.

9. Cookies

We use cookies to operate the platform and improve your experience. See our Cookie Policy for full details.

10. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated by email or a prominent notice on the platform at least 14 days before taking effect. The effective date at the top of this page always reflects the current version.