Privacy Policy

1. Who are we?

Vesile is a matchmaking platform for Muslims in the Netherlands, accessible via vesile.nl. The data controller is Vesile, registered with the Dutch Chamber of Commerce under number 96497521, VAT number NL005213001B24, phone number 06 4458 7707 (WhatsApp messages only, no phone calls). For questions about this privacy policy, contact us at info@vesile.nl.

2. What data do we process?

We process the following categories of personal data:

• •Identification data: first name, date of birth (from which your age follows) and gender.
• •Contact details: email address and phone number. We do not ask for a street address or postal code.
• •Place of residence: your city and its geographic coordinates; the city is looked up through the Locatieserver of PDOK, a Dutch government service. We use the coordinates only to calculate the distance between two profiles — we do not track your location.
• •Background: education, occupation, height, languages spoken, marital status, whether you have children, and the text in which you describe yourself.
• •Photos: optional, up to 3.
• •Partner preferences: age range, education, marital status and optionally ethnic background.
• •Special categories (GDPR Art. 9): your religious practice and lifestyle (prayer, hijab, halal diet, smoking, and what you write about your faith) and your ethnic background — processed only on the basis of your explicit consent.
• •Technical data: we record your IP address and browser details at the moment you give consent (as proof of it) and on login attempts to your account (against abuse).
• •Where your visit came from: campaign and referral data from the link you arrive through, for example utm parameters or a Facebook click id.
• •Correspondence: which emails we sent you and whether they arrived, and the content of any feedback you send us. For some emails about an introduction we record whether and when you first click the button. This shows us whether these emails work.

3. What is our legal basis?

We process your personal data based on your explicit consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)). You can withdraw your consent at any time. A small part is processed on the basis of our legitimate interest (Art. 6(1)(f)): recording login attempts and limiting the number of requests per IP address, to prevent abuse of accounts. Finally, the law may oblige us to process or disclose data, for example in response to a legally valid request from the police or judicial authorities (legal obligation, Art. 6(1)(c)).

4. Verification of your email address and phone number

• •Email address: you are only introduced to someone after you have clicked the link in our verification email. Without that confirmation you stay outside the matchable group.
• •Phone number: we check through Twilio Lookup whether the number you entered exists and is a Dutch number. Only the number itself is sent; we do not request any additional data about its holder.

5. Photos

• •Photos are stored in an encrypted, non-public AWS S3 bucket.
• •On upload we resize every photo and re-encode it as WebP. That removes all metadata from the file, including any GPS location a camera may have written into it.
• •Photos are reachable only through a temporary, signed link — there is no public URL.
• •Someone who has not uploaded a photo themselves does not see the photos of a proposed match.

6. Where and how do we store your data?

• •Registration data is held in a secure MySQL database on a server in the Netherlands.
• •Photos are held in AWS S3, as described above.
• •Logging in to your account works through a link we email you; we store no password. The session cookie expires after 60 minutes.

7. Who sees your data?

• •Our matchmakers: they review every registration themselves and put matches together by hand. There is no algorithm making a decision on your behalf.
• •A proposed match: the moment we introduce you to someone, that person sees your first name, age, city, background, your answers about faith and lifestyle and — if they have uploaded photos themselves — your photos. If you have accepted an introduction and the other person has not yet, we may let them know that you said yes.
• •Your phone number is only shared after both you and the other person have accepted the introduction.
• •For support purposes an administrator can temporarily view your account through a short-lived link. That access is recorded in our access log.
• •We do not sell your data and do not share it with third parties for commercial purposes.
• •The police, judicial authorities or another competent authority only receive your data if the law obliges us to disclose it, with one exception: we report child sexual abuse material on our own initiative to the police and to Meldpunt Kinderporno. How we handle such requests and reports is described in our law enforcement protocol.

8. Payment data

If a one-off fee applies to your account, we process payment data for it as well.

• •The payment runs through Stripe. Our contracting party for this is Stripe Payments Europe, Limited in Dublin. You complete the payment on Stripe's payment page, where you choose between iDEAL and credit card. You enter your payment details at Stripe and they do not reach us.
• •Stripe processes part of this data in the United States, at its parent company Stripe, Inc. That transfer takes place under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
• •We send Stripe the amount, an internal order number, your email address and the addresses you return to after paying. Your email address goes along so you do not have to enter it again on the payment page. We do not send your name or phone number.
• •Of the payment itself we keep the amount, the status, the time, the session number Stripe assigns to the payment and which proposal the payment belonged to.
• •When you sign the declaration of intent we record which text you read at that moment, in which language, together with your IP address and browser details. That record is the proof of your consent.

This data disappears with your account: if you withdraw your registration, we delete your payment data from our database as well.

9. Processors and third parties

To run our service we use the following parties. Each processes only what its task requires:

• •Hosting and database: our website and database run on a server in the Netherlands.
• •AWS (Amazon Web Services): storage of photos in S3.
• •Twilio: checking whether an entered phone number exists.
• •Our mail server and Resend: sending the emails about your registration and your matches.
• •Sentry: error reports from the website so we can fix outages. An email address or internal id may be included in such a report.
• •PDOK (Dutch government): looking up your city while you fill in the form.
• •Stripe Payments Europe, Limited (Dublin): handling your payment, if a fee applies to your account.
• •Meta, Google and Hotjar: see the next chapter.

Some of these parties are established in the United States or process data outside the EU. Such transfers take place under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

10. Cookies, measurement and advertising

Besides functional cookies, vesile.nl carries cookies and scripts that measure how the site is used. Specifically:

• •Functional: a session cookie that keeps you logged in to your account, and a local storage value remembering that you dismissed the cookie notice. Without these the site does not work.
• •Google Analytics 4: how many visitors the site has and which pages they view.
• •Hotjar: recordings and heatmaps of how pages are used, to improve the site.
• •Meta Pixel and the Meta Conversions API: measuring the result of our advertising on Facebook and Instagram. On a registration we also send your email address and phone number in encrypted (hashed) form, together with your IP address and browser details, so Meta can attribute the registration to an ad.
• •Google AdSense: Google's AdSense script is present on every page for verification of our site. No advertisements are shown at this time.
• •Fonts are served from our own server; your browser makes no connection to Google for them.

You can block these scripts through your browser settings or a blocking extension. If you want us to have your data deleted at Meta, send us an email.

11. How long do we keep your data?

We keep your data for as long as your registration is active. If you withdraw your registration, we permanently delete your profile, your photos and all associated data.

12. Your rights

Under the GDPR you have the following rights:

• •Right of access: you can request what data we hold about you.
• •Right to rectification: you can have incorrect data corrected.
• •Right to erasure: you can request deletion of all your data.
• •Right to withdraw consent: you can withdraw your consent at any time.
• •Right to object: you can object to the processing of your data.
• •In your account you can edit your profile yourself, pause and resume your registration, and permanently withdraw it along with all your data.

Send an email to info@vesile.nl to exercise your rights. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

13. Changes

We reserve the right to modify this privacy policy. We will notify you by email of any material changes.