GDPR
Our privacy policy
Read our privacy policy below.
Last updated: 5 November 2026
The Zakat Foundation Belgium (hereinafter “we”, “our” or “the Foundation”), whose registered office is at Rue Emile Feron 153, 1060 Saint-Gilles, Brussels, Belgium, is committed to protecting your privacy. As data controller, we comply with the General Data Protection Regulation (GDPR – Regulation (EU) 2016/679) and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
This policy explains how we collect, use, share and protect your personal data through our website www.zakat.be (the “Site”). The Site is an application developed by the Foundation and hosted by OVHcloud in the European Union; online donations are processed by Stripe.
1. Data we collect
We only collect the data you send us through the Site’s forms, together with the technical data needed for the Site to work:
Contact form and applications: first name, surname, email address, subject, position applied for, your message and the documents you attach (CV, cover letter, supporting documents).
Guide downloads: first name, surname and email address, to send you the download link.
Zakat calculator: your amounts stay in your browser. If you choose to save your calculation, we use your name and email address to send you a link to pick up where you left off; the amounts are contained in that link and are not stored by us.
Newsletter: email address and, if you provide them, first name and surname.
Donations: amount, surname, first name, email address, phone number, postal address and, where applicable, company name and VAT number, as well as your national register number if you provide it for a tax certificate. Card details are entered directly with Stripe: they do not pass through our servers and we have no access to them.
Technical data: IP address, browser type and pages requested, recorded in the server logs and in the session to keep the Site secure (protection against abuse and spam). We do not use any analytics or advertising tools.
To protect the forms against bots, your browser performs a small calculation (ALTCHA proof of work, hosted on our own servers): no data is sent to any third party in the process.
2. How we use your data
Your data is used to:
Process your donations and send you a receipt (legal basis: performance of a contract and legal obligations).
Remind you once, by email, of a donation you started but did not complete, with a link to resume it (legal basis: legitimate interest; you can simply ignore this message).
Reply to your messages and manage volunteer applications (legal basis: pre-contractual measures or legitimate interest).
Send you the guide or the link to resume your calculation that you requested (legal basis: carrying out your request).
Send you our newsletter (legal basis: your consent, confirmed by a double opt-in email and withdrawable at any time via the unsubscribe link in every mailing).
Keep the Site secure and prevent fraud (legal basis: legitimate interest).
Meet our legal obligations (accounting, anti-money laundering).
3. Sharing your data
We do not sell or rent out your data. It is entrusted only to the following processors, and only as far as necessary:
OVHcloud (OVH SAS, France): hosting of the Site and its database, and sending of the Site’s emails. The data is hosted in the European Union.
Stripe (Stripe Payments Europe, Ltd., Ireland): secure processing of donations, PCI DSS certified. Stripe receives the payment and billing data needed for the donation. See its privacy policy.
Mailchimp (The Rocket Science Group LLC, Intuit group, United States): management of the mailing list and sending of the newsletter, if you have subscribed. See its privacy policy.
YouTube (Google Ireland Limited): only if you allow videos to play. The player is then loaded from the youtube-nocookie.com domain.
Authorities: only where we are legally required to.
Where data is transferred outside the European Union (Mailchimp and, where applicable, Stripe or Google for certain processing), the transfer is covered by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses.
The gold and silver prices shown by the calculator are fetched by our servers from price data providers; no data about you is sent to them.
4. Cookies and trackers
The Site only uses cookies and local storage that are strictly necessary for it to work (session, form security, calculator draft) and, on the donation pages, Stripe’s fraud-prevention cookies. It uses no analytics or advertising cookies, which is why no consent banner is shown. The YouTube video player, disabled by default, only loads with your consent, which you can change at any time via “Manage cookies” at the bottom of every page. Details are in our cookie policy.
5. Security of your data
All transmissions are encrypted (HTTPS). The forms are protected against spam and abuse, the guides and the documents attached to the contact form can only be accessed through temporary links (and those documents are also encrypted on our servers), and access to data is restricted to the people who need it. In the event of a data breach, we will notify the Data Protection Authority within 72 hours and inform you where necessary.
6. Data retention
Donations: 10 years (accounting and tax obligations).
Donations started but not completed: deleted after 30 days, together with your contact details if you have made no other donation.
Contact messages and applications: received by email in the Foundation’s mailbox and kept for a maximum of 2 years; the Site does not store the message itself. Attached documents (CV, cover letter, supporting documents) are stored encrypted on our servers for 90 days, accessible only through secure links sent to the Foundation, and then deleted automatically.
Newsletter: until you unsubscribe.
Guide download links: valid for 7 days; your request is not stored on the Site.
Session and security data (IP address, browser): 2 hours for the session, a few minutes for rate limiting; server logs for a limited period.
Calculator draft: 30 days in your browser, which you can delete at any time.
7. Your GDPR rights
You have rights over your data:
Access, rectification, erasure (“right to be forgotten”).
Objection, restriction, portability.
Withdrawal of your consent at any time (for example via the newsletter’s unsubscribe link).
Exercise them by emailing info@zakat.be with proof of identity. We reply within 1 month.
8. Contact and complaints
Data protection contact: info@zakat.be
Supervisory authority: the Belgian Data Protection Authority (APD/GBA) – www.dataprotectionauthority.be.
We may amend this policy; the date of the last update is shown at the top of the page. Please check it regularly.
Thank you for your trust in our solidarity mission.