VCWI Membership Application Privacy Notice
1. Data controller
Vereniging van Chinese Wetenschappers en Ingenieurs in Nederland (VCWI), also known in English as the Association of Chinese Scientists and Engineers in the Netherlands, is the data controller.
- Registered address: Kievit 20, 1422 WC Uithoorn, The Netherlands
- Netherlands Chamber of Commerce (KvK): 17102619
- Privacy and data-rights contact: board@vcwi.nl
- Membership administration: hr@vcwi.nl
2. Personal data we collect
The membership application requires a display name and email address. Applicants may also provide a phone number, city, country, employer, university, occupation, industry and motivation for joining VCWI.
We also record the privacy-policy version, newsletter preference, submission time and identifier, application status, reviewer identity, review decision and audit evidence. For abuse prevention, the service stores an HMAC-SHA256 fingerprint derived from the trusted proxy IP address; the raw IP address is not stored in the membership rate-limit table.
Please do not submit identity documents, financial information, special-category personal data or other unnecessary sensitive information in the motivation field.
3. Purposes and legal bases
- Processing the application and administering membership: Article 6(1)(b) GDPR.
- Identity matching, database accuracy, security, abuse prevention and audit evidence: Article 6(1)(f) GDPR.
- Optional newsletters and non-essential association communications: Article 6(1)(a) GDPR. Consent can be withdrawn at any time.
- Compliance with applicable legal obligations: Article 6(1)(c) GDPR where required.
Newsletter consent is separate from membership and does not affect the application decision.
4. Review, matching and automated decisions
Submitting the form creates a pending application only. An authorised VCWI staff member must approve it before active membership is created.
The system may compare the supplied email and name with governed member records. A unique and consistent record may receive missing information after approval. Ambiguous identity matches require manual resolution. VCWI does not make a fully automated decision on membership eligibility.
5. Access and service providers
Access is limited to authorised VCWI Board members and staff who need the information for review, administration, security or data-rights handling.
VCWI uses Supabase for the governed database, Vercel for application hosting, and Google Workspace for staff identity and operational collaboration. These providers operate under their applicable data-processing and transfer safeguards. VCWI does not sell membership application data or disclose it to unrelated third parties unless required by law or authorised by the applicant.
6. International transfers
The linked Supabase database is hosted in the EU. Vercel and Google may process limited request, authentication or operational data outside the European Economic Area, depending on service configuration. VCWI relies on applicable safeguards, including Standard Contractual Clauses or another valid GDPR transfer mechanism where required, and configures the service to minimise unnecessary transfers.
7. Retention
- Pending or needs-information applications: up to 12 months after submission.
- Rejected or withdrawn applications and related audit evidence: up to 12 months after the final decision.
- Approved applications and approval evidence: while membership remains active and up to 24 months after membership ends, unless a longer period is legally required.
- Rate-limit fingerprints: no longer than 30 days.
- Application-service security logs: no longer than 90 days, except during an active security investigation or legal preservation requirement.
8. Security
VCWI applies role-based access, signed staff sessions, server-side database credentials, row-level security, bounded request sizes, origin checks, rate limiting, audit records and manual approval gates. No system can guarantee absolute security.
9. Your rights
Subject to the GDPR and applicable exceptions, you may request access, correction, deletion, restriction, objection and data portability where applicable. You may withdraw consent at any time without affecting earlier lawful processing.
Send requests to board@vcwi.nl. You may also lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.
10. Changes to this notice
The application records the exact policy version accepted by the applicant. Material changes receive a new version and require renewed confirmation for new applications.