Privacy statement
The World Resilience Consortium (WRC) handles your data with care. This statement explains what data we process when you visit wrcon.org or use the VeerkrachtScan on app.wrcon.org, why we do so, how long we keep it and what your rights are.
This is a translation. If the Dutch and English versions differ, the Dutch version applies.
Is your organisation taking part in the VeerkrachtScan? Privacy for organisations (in Dutch) explains what employers and HR can and cannot see, and what we agree with organisations.
In short
- Your employer never sees your answers or scores. Only how many colleagues take part, and only from five people upwards.
- The scan never asks for your name. Your answers are stored under a number.
- Without an account, everything stays on your own device. We do not receive your answers.
- No cookies and no advertising. We do not track you and we do not sell data.
- Your answers are stored on servers in the European Union.
Who is responsible
Curious Crew B.V. is the company behind the World Resilience Consortium. It is responsible for what happens to your data. In legal terms, it is the controller. Where this statement says “WRC” or “we”, it means Curious Crew B.V.
This also applies if you take part in the VeerkrachtScan through your employer. Your employer is not responsible for your data in the scan and cannot access it.
- Company: Curious Crew B.V. (World Resilience Consortium)
- Chamber of Commerce number: 95722793
- Address: Panoramaweg 5, 6721 MK Bennekom
- Email: privacy@wrcon.org
When you visit wrcon.org
Technical data
The website is hosted by Vercel. When you open a page, your browser sends technical data, such as your IP address, your browser and the page you request. Vercel uses this data to show the page and to secure the site, and keeps it briefly in logs. We do this because we want a website that works and is secure. In legal terms, that is a legitimate interest.
No cookies and no analytics
We do not place cookies and we do not measure who visits the site. Fonts, images and videos come from our own website, not from other companies.
Does the site show a bar offering another language? Then your browser remembers your choice, so the question does not come back. That choice is stored only on your own device.
The contact form
If you fill in the contact form, we receive your name and email address, and your organisation and phone number if you enter them. We use this data only to get in touch with you. We may do so because you ask us to.
The form is sent to our mailbox through a service called Web3Forms. Web3Forms does not store the content of the form. It does keep technical logs, including your IP address, and deletes them after two months at most.
We keep your message for as long as we are in contact with you, and then for two years at most. If it leads to an assignment, we keep what our accounts require, for as long as the law requires.
Links to other websites
Our knowledge base links to other websites. What happens to your data there is explained in the privacy statement of those websites.
When you use the VeerkrachtScan
The VeerkrachtScan runs on app.wrcon.org and is currently available in Dutch only. You rate 24 statements about six topics, such as composure, health and collaboration. You then see a score for each topic and get a learning path with the modules that suit you best. After about eighteen weeks you can take the scan again, to see what has changed.
There are three ways to take part. What we store depends on the way you choose.
Without an account
Your answers, scores and reflections stay in your own browser. We do not receive them. If you clear your browser data, everything is gone.
With a code from your organisation
You enter your organisation’s code. You then get a personal code, which lets you continue later, also on another device. We then store:
- your answers and your scores, with the date;
- your progress in the learning path and your reflections. Only you can see your reflections;
- what you do in the app, for example when you start or finish a module;
- which organisation you belong to;
- your personal code, but only in encrypted form. Nobody can read it back, not even us.
All of this is stored under a random number. We do not ask for a name or an email address. Nobody knows who is behind the number: not your employer, and not us. Have you lost your personal code? Then we cannot find your data for you either.
With your email address
You log in with a code that we send to your email address. You can also do this later, by linking an email address to your personal code. We then store the same as above, plus your email address.
Your email address is kept in the login system, separate from your answers. Nowhere in the app or in the admin environment can anyone see which email address belongs to which answers. Someone with direct access to the database could technically make that link. Only the few staff members who manage the app technically have that access, and they are bound to confidentiality.
The login emails
We send the emails with your login code through Resend. Resend sees your email address, the email itself and whether it was delivered, and keeps this for 30 days. We do not track whether you open the email or click a link.
What your employer sees
If you take part through your employer, your employer only sees numbers:
- how many places in the licence are in use;
- how many colleagues took part in the last 30 days, for example how many started or completed the scan. If that is fewer than five, it only says “fewer than 5”.
Your employer never sees your answers, your scores, your reflections or your learning path. Nor does your employer see who takes part, or which email address belongs to whom. The database itself enforces this, and we make no exceptions.
What WRC sees
WRC’s administrators see the same numbers, but exact. To improve the scan, they can download the measurements: under a number, without reflections and without email addresses. WRC cannot see in the admin environment which email address belongs to which answers either.
Why we do this
- To give you the scan, your result and your learning path, and later the second measurement. Some questions are about your health, such as your energy, your workload and your rest and sleep. That is why we ask for your explicit consent before we store your answers.
- To improve the scan and to study how resilience changes. For this we only use measurements under a number, without reflections and without email addresses. Whatever we show or publish about this is always combined and can never be traced back to one person. We ask for your consent for this as well.
- To keep the app secure and to prevent misuse. For example, we count how often someone enters a wrong code, and our suppliers keep technical logs. That is our legitimate interest.
You can withdraw your consent at any time. Stop using the scan and email privacy@wrcon.org; we will then delete your data. What we did with your data before then remains lawful.
Automated advice
The app calculates your scores and uses them to suggest a learning path automatically. This is advice for yourself. It has no consequences for your work, and your employer does not get to see it. Nor is it medical advice; see our disclaimer.
What the app stores in your browser
The app does not use cookies. Your browser does store your session, so you stay logged in. If you take part without an account, your browser also stores your answers. This is kept in your browser’s storage. If you clear your browser data, it is gone.
The fonts come from our own app, not from Google or any other company.
How long we keep data
| Data | How long |
|---|---|
| A session without a participant | 1 day |
| How often someone entered a wrong code | 1 day |
| Your data if you take part through an organisation | As long as the licence runs, and 12 months after that, so you can still view your result. Then we delete everything. |
| An account with an email address, without an organisation | Up to 24 months after your last visit |
| An account you ask us to delete | Everything is gone the following night, including your measurements and progress |
| Logs of the login emails | 30 days |
| Data of administrators | As long as they are an administrator |
| Messages sent through the contact form | Up to 2 years after the last contact |
Who we share data with
We never sell your data and we do not share it with advertisers. We do work with a few suppliers who process data on our behalf. We have agreed on security and confidentiality with them in a data processing agreement.
| Supplier | What for | Where |
|---|---|---|
| Supabase | The database, logging in and the storage of the scan | Servers in the EU (Stockholm). Company in the United States. |
| Vercel | Serving the website and the app | Worldwide network. Company in the United States. |
| Resend | Sending the login emails | Sent from Ireland. Logs in the United States. |
| Web3Forms | Forwarding the contact form | Servers in the United States. Company in India. |
Apart from that, we only share data with others when the law requires us to, for example with the police or a regulator.
Outside the European Union
A few suppliers are based outside the European Union, or can access the data from there. For the American companies, the agreements between the EU and the United States (the EU-U.S. Data Privacy Framework) or the European Commission’s standard contractual clauses apply.
Security
We protect your data carefully. For example:
- all connections are encrypted, and so is the stored data;
- the database itself decides who may see what, even if the app makes a mistake;
- administrators log in with a code by email and an authenticator app;
- we store your personal code in encrypted form only;
- only people who need it for their work can access the data.
Your rights
You may:
- view your data;
- have incorrect data corrected;
- have your data deleted;
- ask us to restrict the use of your data;
- object when we use your data because of our legitimate interest;
- receive a copy of your data, to take with you;
- withdraw your consent.
This is how:
- With an email address: email privacy@wrcon.org from the address you log in with. If you want us to delete everything, we delete your account and everything linked to it.
- With a personal code: we do not know who you are. Send your personal code to privacy@wrcon.org and we can find your data. We use your email only for your request.
- Without an account: everything is on your own device. Clear your browser data.
We respond within one month. Sometimes we first ask you to show that the data is yours.
A complaint
Are you unhappy with how we handle your data? Let us know, and we will look for a solution together. You may also lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.
Changes
We update this statement when needed, for example when the app changes. The date of the latest version is shown at the top.
Contact
Do you have a question about privacy? Email privacy@wrcon.org.