Privacy Statement

Stichting CWM Education (Culture.World.Me) is a human rights education
foundation registered in Amsterdam, the Netherlands. This statement explains
what we do with your personal data when you visit this website, join our
community, apply for a role, sign up for an event, or subscribe to updates.

We try to write this the way we'd explain it in a workshop: plainly, and
without asking for more than we need.


IN ONE MINUTE

- We only collect what a specific opportunity actually requires.
- We never sell your data, and we never use your story in public without
your explicit, specific consent.
- You can ask us what we hold, correct it, or delete it, at any time.
- If you're under 16, a parent or guardian needs to be involved before we
process your data online — see "If you are under 18" below.


WHO WE ARE

Stichting CWM Education, trading as Culture.World.Me, is the data
controller for the personal data described in this statement.

Herengracht 449A, 1017 BR Amsterdam, the Netherlands
cultureworldme@gmail.com


WHAT THIS STATEMENT COVERS

This statement applies to:
- this website (cultureworldme.com) and its forms;
- our Join pathway and the CWM Community & Events form;
- workshops, trainings, and the Rights in the Room corporate offer, for the
general handling of participant data (project-specific consent forms used
in the room take precedence for anything they cover more specifically,
such as photo or story consent for a particular session);
- our mailing list and Substack.


WHAT INFORMATION WE COLLECT

What we ask for depends entirely on which door you choose on the Join page.
We design each door to ask for the minimum needed for that specific
pathway — a newsletter signup asks for far less than a job application.

Depending on your pathway, this may include:

- Basic contact details — name, email, phone number, city/country.
- Profile information — age range, languages, professional background,
the role(s) you're interested in (participant, volunteer, facilitator,
trainer-in-training, intern, partner).
- Application information — motivation, availability, CV or short bio,
references, portfolio or writing samples, if relevant to the specific
opportunity.
- Access needs — anything you choose to tell us about disability, health,
or support needs, so we can make participation possible. You are never
required to share this; we only use it to plan access.
- Consent records — your specific choices about photography, filming,
quotes, and whether and how we may use your words or story publicly.

We do not ask you to disclose a diagnosis, a trauma history, or your
immigration or legal status as a condition of joining a workshop, our
mailing list, or the general community pathway. Where a specific funded
project genuinely requires narrower eligibility data (for example, an
Erasmus+ mobility requiring country of residence), we'll say so at the
point we ask, and only for that project.


WHY WE PROCESS YOUR DATA, AND ON WHAT LEGAL BASIS

Under the GDPR, we need a lawful basis for each thing we do with your data.
Here is ours, activity by activity:

- Sending you the newsletter or community updates you signed up for
→ Consent. You can withdraw this at any time by unsubscribing or
emailing us; this doesn't affect anything already sent.

- Considering your application for a role, internship, job shadowing,
trainer pathway, or project participation
→ Contractual necessity / steps taken at your request before entering
into an agreement (a role or placement).

- Running a workshop or training you're registered for, including
arranging access support
→ Contractual necessity, and consent for anything sensitive you choose
to share (e.g. access needs).

- Photography, filming, quotes, or using your story publicly
→ Consent, always collected separately and specifically, never bundled
into a general "I agree to the terms" checkbox. You can withdraw this at
any time for future use; we can't always retract material already
published or handed to a funder, and we'll tell you when that's the
case before you consent.

- Keeping records our funders require (e.g. Erasmus+ National Agencies,
consortium partners)
→ Legal obligation / legitimate interest in meeting grant-agreement
reporting duties, limited to what the specific grant agreement requires.

- Keeping a secure record of participants, applicants, and partners so we
can run a safe, well-organised organisation
→ Legitimate interest, balanced against your right to privacy. You can
object to this at any time; see "Your rights" below.

Where our lawful basis is consent, you can withdraw it whenever you like.
Withdrawing consent doesn't affect processing already carried out, or
processing that rests on a different lawful basis (for example, a
placement already under way, or a funder reporting obligation).


IF YOU ARE UNDER 18

Some CWM programmes work with participants under 18. Where that's the
case, a project-specific consent process applies (see our Human Rights
Education Framework and Consent Protocol), including, where relevant,
parental or guardian consent and any safeguarding steps required under
Dutch law or the law of the country where the programme runs.

For online data processing specifically — signing up on this website, our
Join form, or our mailing list — Dutch law (the GDPR as implemented via
the Uitvoeringswet AVG) sets the age at which someone can independently
consent at 16. If you are under 16, we ask that a parent or guardian
completes the relevant form with you, or contacts us directly at
cultureworldme@gmail.com so we can arrange this properly.

If you are 16 or 17, you can sign up yourself; for a small number of
project pathways (e.g. an international mobility, or a role involving
independent travel) we may still ask for a parent or guardian's
confirmation, and we'll tell you clearly when that applies.


WHO WE SHARE YOUR DATA WITH

We do not sell or rent your data, to anyone, ever. We may share it with:

- Project partners and consortium members (for example, other
organisations in a shared Erasmus+ project), only where needed to run
the specific activity you're part of.
- Funders and National Agencies (for example, an Erasmus+ National
Agency), for reporting and audit, as required by the relevant grant
agreement.
- Service providers who help us run our operations — for example, Google
(forms, email, cloud storage) and any email or CRM tool we use for the
mailing list — under their standard data-processing terms, and only for
the purposes described in this statement.

Some of these providers (notably Google) may process data outside the
European Economic Area, including in the United States. Where that
happens, we rely on the provider's Standard Contractual Clauses and other
GDPR-recognised safeguards for the transfer. You can ask us for more
detail on this at any time.


HOW LONG WE KEEP YOUR DATA

- Newsletter / community list: until you unsubscribe, or ask us to
delete it.
- General applications (role, internship, project, trainer pathway, "keep
me in mind"): up to 2 years after our last contact with you, so we can
consider you for future opportunities — unless you ask us to delete it
sooner.
- Successful placements / active roles: for the duration of the role or
project, plus any period required for funder audit (this can be several
years under EU grant rules), then deleted or anonymised.
- Workshop and training participant records: as required by the specific
funder's rules, then anonymised or deleted.

We review what we hold on a regular basis and delete what we no longer
have a reason to keep.


YOUR RIGHTS

Under the GDPR, you have the right to:

- ask what personal data we hold about you, and get a copy;
- ask us to correct data that's inaccurate or incomplete;
- ask us to delete your data, in the situations where that applies;
- object to, or ask us to restrict, certain processing;
- receive your data in a portable format, where that applies;
- withdraw consent at any time, for anything based on consent.

To use any of these rights, or to ask us anything about your data, email
cultureworldme@gmail.com. We'll respond within one month.

If you're not satisfied with how we've handled your data, you can lodge a
complaint with the Dutch data protection authority, the Autoriteit
Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the authority in
your own EU country.


SECURITY

We store data in access-controlled systems and limit who can see it to the
people who need it to do their work — the core team, named project
coordinators, and named supervisors. We choose providers who offer
reasonable, current security measures, and we avoid collecting sensitive
data unless it's clearly necessary for the specific pathway and you've
chosen to share it.


COOKIES AND WEBSITE ANALYTICS

[To confirm and insert once your website tooling is finalised: which
analytics tool is active (if any), what it tracks, and whether a cookie
consent banner is shown. If the site currently sets no non-essential
cookies, say so plainly here instead of a generic cookie clause.]


TAX-DEDUCTIBLE DONATIONS (ANBI)

Where we state that donations to Stichting CWM Education are
tax-deductible under the Dutch ANBI regime, that statement is only made
once our ANBI status is confirmed and current with the Belastingdienst.
We do not make donor-facing tax claims before that confirmation is in
place and published alongside our registration details.


HOW THIS CONNECTS TO OUR OTHER FRAMEWORKS

This statement should be read alongside our Human Rights Education
Framework (our research and data-ethics protocol, and our Consent
Protocol) and our Quality Framework (which governs consent, access, and
"what is recorded, what is returned, what is not extracted" for every
session we run). Where a project-specific consent form is more detailed
than this general statement — for example, photo consent collected in a
specific workshop — the specific form governs that specific use.


CHANGES TO THIS STATEMENT

We'll update this statement as our work, tools, or legal obligations
change. The current version is always here. For significant changes (for
example, a new category of data we start collecting), we'll tell people
directly wherever we reasonably can, not just update the page silently.

Last updated: 1 January 2026 · Version 1.0