Initial commit

references/gdpr/timebank_cc/2026-01-01/privacy-policy-CONDENSED-en.md

@@ -0,0 +1,118 @@
+# Privacy Policy - Timebank.cc
+
+**Last Updated:** January 1, 2026
+
+## Introduction
+
+Timebank.cc protects your privacy. We collect only necessary data, never sell it, use no tracking, and give you full control.
+
+## Data Controller
+
+**Timebank.cc** (vereniging Timebank.cc)  
+Zoutkeetsingel 77, 2515 HN Den Haag, The Netherlands  
+Email: support@timebank.cc
+
+## Data We Collect
+
+**Account:** Username (public), full name, email, password (encrypted), phone (optional)
+
+**Profile (your choice):** Description, skills, interests, availability, location (you control precision)
+
+**Transaction:** Time exchanges, credits balance, service offerings, messages
+
+**Technical:** IP address (last login, 180 days), online presence (status, last seen), browser/device type, login times, error logs
+
+**We don't collect:** browsing history, location tracking, third-party cookies, analytics.
+
+## Legal Basis
+
+Contract performance, consent (optional features), legitimate interests (security), legal obligation.
+
+## How We Use Data
+
+Account management, administration of time exchanges, communication, email notifications, account recovery, security, fraud detection. Your username appears on events/posts you create (may be shared on social media).
+
+## Data Sharing
+
+**Within platform:** Usernames visible to members (may appear on social media if events/posts shared). Full names never public or on social media. Profile info you choose visible to logged-in users. Online status visible to facilitate messaging. Phone numbers only if you permit. Inactive/unverified profiles have limited visibility.
+
+**External:** We don't sell data, share with advertisers, use external analytics, or allow search engine indexing.
+
+**Social media:** Events/posts may be shared showing your username (not full name), controlled by event/post creator.
+
+**Legal:** Only when legally required (by court order).
+
+**Service providers:** Greenhost.nl (Netherlands, EU) for hosting and email. Privacy-focused, sustainable, Data Processing Agreement in place ensuring GDPR compliance and data protection.
+
+## Data Location
+
+EU (Netherlands) via Greenhost.nl. No transfers outside EU.
+
+## Retention
+
+**Active accounts:** While active  
+**Inactive accounts:** After 2 years no login: 3 warnings (at 2 years, +30 days, +60 days), then auto-deletion at +90 days  
+**Deleted accounts:** 30-day recovery, then permanent deletion  
+**IP addresses:** 180 days, then auto-deleted  
+**Transactions/messages:** Anonymized after deletion/inactivity
+
+## Your Rights
+
+**Access:** Download all data via profile settings  
+**Rectification:** Correct inaccurate data  
+**Erasure:** One-click deletion (30-day recovery, optional balance donation)  
+**Restriction:** Limit processing  
+**Portability:** Export in CSV/JSON  
+**Object:** Oppose legitimate interest processing  
+**Withdraw consent:** Anytime  
+**Complaint:** Contact your data protection authority
+
+Exercise via profile settings or email support@timebank.cc. We respond within 30 days.
+
+## Cookies
+
+**Only essential:** Session (keeps you logged in), security (CSRF protection), preferences (settings)
+
+**No:** analytics, advertising, tracking, third-party, social media, or profiling cookies.
+
+No cookie banner needed.
+
+## Security
+
+TLS/SSL encryption, strict access controls, 2-hour session timeouts, password hashing, optional 2FA via authenticator app, breach notification within 72 hours.
+
+## Open Source
+
+All platform software is open source for community auditing and transparency verification.
+
+## Age Requirement
+
+18+ required. Mandatory checkbox confirmation at registration.
+
+## Phone Number Use
+
+Optional. Used only for account recovery (last resort) and voluntary profile display. 2FA uses authenticator apps (not SMS). Never shared outside platform or with third parties. Visible to others only if you choose. Remove anytime.
+
+## Policy Changes
+
+Important changes notified via email or platform notice.
+
+## Data Protection Officer
+
+Privacy inquiries: support@timebank.cc  
+Response time: 30 days maximum
+
+## Contact
+
+**Email:** info@timebank.cc | support@timebank.cc  
+**Address:** Zoutkeetsingel 77, 2515 HN Den Haag, The Netherlands  
+**Languages:** English, Dutch, French, Spanish, German
+
+## Supervisory Authority
+
+File complaints with your national data protection authority: https://edpb.europa.eu/about-edpb/board/members_en
+
+---
+
+
+**By using Timebank.cc, you acknowledge reading and understanding this Privacy Policy.**