Introduction
This privacy statement explains how Marula Foundation collects personal data: (i) from you through this website (www.Marula Foundation.com), or (ii) when you are, or work at, one of our business contacts or partners. We invite you to read this privacy statement to understand our practices regarding your personal data. Please note that this privacy statement may be amended from time to time.

Controller of your personal data
Marula Foundation is the controller of the personal data collected through this website and the personal data collected from partners. Marula Foundation is a foundation under Dutch law, located at Vinkenstraat 120-A, 1013 JV Amsterdam, the Netherlands.

Information we collect from you
Marula Foundation processes personal data we collect from you directly online or offline, either (i) when we are in contact through email, telephone or via the contact forms on our websites, (ii) when you visit our offices or events, (iii) when you enter into transactions or business arrangements with us, or (iv) when we contact you in the context of our learning and development activities. We may also collect your personal data via other sources, such as professional social media websites or trade registers.

Our use of your personal data

• When you submit a request via the contact form on our website, we will use your personal data to communicate with you.
• When you are or will become our partner, we may use your personal data for the purpose of verifying identities and conducting due diligence and screening.
• We will also process personal data necessary to conclude and execute agreements with our partners, including to record and financially settle delivered services and projects.
• As our partner, your personal data may also be processed by Marula Foundation for purposes of audits, accounting, management reporting and analysis or compliance with legal obligations such as tax obligations.
• We may also process your personal data for purposes related to relationship management and learning and development, including maintaining and promoting contact with partners, sending out surveys and establishing partnerships and alliances.

The grounds for processing your personal data are either to fulfil certain contractual or legal obligations or our legitimate business interest. Where we rely on legitimate interest as a legal ground, we will always maintain a balance between our legitimate business interests as described above and your privacy rights.

Disclosure of your personal data
To support our business, we engage a number of parties that work on our behalf, such as IT service providers, payment providers or professional providers like accountants or consultants. Marula Foundation makes sure that, if required, socalled data processing agreements are signed with the other parties, under which these parties are obliged, amongst other things, to protect the personal data and to handle these in compliance with the law. We do not undertake marketing activities for third parties nor do we provide information to third parties for their own marketing purposes.

How long do we retain personal data
In general, Marula Foundation will retain your personal data for the duration of your business relationship and for the time it is necessary to keep your personal data after the end of that relationship. This period will depend on our purpose of use of your personal data. Examples are:

• Where your business contact details are included in invoices, we will keep your personal data together with our invoices (usually 7 years based on tax legislation); and
• Where we need your personal data for identification and screening purposes, we will keep your personal data for as long as we are required to keep proof of the screening based on local law.

Other websites
This statement relates only to Marula Foundation websites. Our website may from time to time contain links to third party websites. If you follow such link please note that these website may have their own policies. We recommend that you check the policies of third party websites before submitting any personal data. We do not accept any responsibility for third party websites or policies.

Your rights with regard to your personal data
You have several rights related to your personal data. Below you find an explanation of these rights.

• Right of access: You have the right to request a copy of your personal data which are processed by or on behalf of Marula Foundation. You can also ask for other information on the processing of your personal data, such as details of the storage period and third-party recipients.
• Right of rectification: If your personal data is incorrect or incomplete or are not processed in compliance with the GDPR, you have the right to have your data rectified or completed by Marula Foundation.
• Right of restriction: You have the right to have the processing of your personal data restricted by Marula Foundation. In that case, we will not process your data for a certain period of time, for instance while we are checking the rectification of your personal data.
• Right of erasure of personal data: You have the right to have your personal data deleted. Please note that this right may not apply when we have a legal obligation or other pressing need to keep your personal data.
• Right of data portability: At your request, Marula Foundation will provide you with a structured copy of your personal data, which is suitable for common digital use. You also have the right to have these personal data transferred by Marula Foundation to a third party.
• Right to object: You have the right to object to the processing of your personal data by Marula Foundation.

You may also be able to request a transfer of your personal data. To submit a request or a complaint to us in this respect, please write to elvira.dejong@marulafoundation.com. If you feel that we have not satisfactorily addressed any complaint that you have, you can submit a complaint to the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).