This privacy notice explains how FFCheck ("we", "us") processes personal data when you visit ffcheck.nl. We deliberately collect as little as possible. No accounts. No tracking pixels. No data resale.
1. Who we are
FFCheck is an independent Amsterdam-based project publishing consumer-protection tools: a scam-checker, a live city dashboard, a contact-finder for Dutch government services, and more. We are not affiliated with the Dutch government, the Gemeente Amsterdam, the Belastingdienst, UWV, the Politie, or any other public-sector body — references to those institutions on the site are informational. The data controller is the operator of FFCheck, reachable at privacy@ffcheck.nl.
2. What we collect
- Server access logs
- On each request our web server records your IP address, browser user-agent, and the URL you requested. Used for security (rate-limiting, abuse prevention) and debugging. Retention: 30 days, then automatically deleted.
- Analytics (Google Analytics 4) — only with your consent
- If you accept the analytics cookie, Google Analytics records anonymized page-view events. IP is masked before storage. Retention: 14 months. See our Cookie Policy for details.
- Citizen reports (Wat Nu?)
- If you submit a report on our Amsterdam dashboard, we store: latitude/longitude, report category, and a randomly-generated session token. No name, no email, no IP, no device identifiers. Reports are public and retained indefinitely.
- What we don't collect
- Names, email addresses, phone numbers, location data outside of citizen reports, payment data, advertising identifiers, third-party tracking pixels, social-media cookies.
3. Legal basis (GDPR Art. 6)
- Server logs: legitimate interest (Art. 6(1)(f)) — operating and securing the service.
- Analytics cookies: consent (Art. 6(1)(a)) — you choose via the cookie banner.
- Citizen reports: consent (Art. 6(1)(a)) at submission, and legitimate interest in publishing aggregated city signals.
4. Who we share data with
No one, except as follows:
- Google LLC processes Analytics events on our behalf (data processor under a standard DPA). IP is masked before transmission.
- Our hosting provider stores server access logs on infrastructure located in the EU.
- We will respond to lawful requests from Dutch or EU authorities if legally compelled, but we have nothing useful to share — we don't link reports to identifiable persons.
We do not sell, rent, trade, or share data for advertising, marketing, or commercial purposes.
5. Your rights under GDPR
You have the right to:
- Access the personal data we hold about you
- Rectify inaccurate data
- Erase ("right to be forgotten")
- Restrict processing
- Object to processing
- Data portability
- Withdraw consent at any time (does not affect prior lawful processing)
- Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl)
To exercise these rights, email privacy@ffcheck.nl. We respond within 30 days as required by GDPR Art. 12.
6. International transfers
Google Analytics involves data transfer to Google LLC infrastructure that may include the US. Google has certified under the EU-US Data Privacy Framework, providing an adequate level of protection per Commission Decision 2023/1795. If you'd rather not have this transfer happen, reject analytics cookies — that's the entire point of consent-mode.
7. Children
This site is not directed at children under 16. We do not knowingly collect data from children. If a parent or guardian becomes aware that a child has submitted data via a citizen report, contact us at privacy@ffcheck.nl and we'll remove the entry.
8. Changes to this notice
We may update this policy from time to time. The "Last updated" date at the top reflects the most recent revision. For material changes (new data uses, new processors), we'll re-prompt for cookie consent and clearly flag the change.