Privacy

Updated 27 September 2026

Stichting KIRAF (Keeping It Real Art Foundation), KvK 97644307, is responsible for personal information used to run KIRAC.com. Contact support@kirac.com about your information. Our postal address and telephone number are on the About KIRAC page.

What we use and why

• Sign-in and archive access. Your email address, verified account identifier, login session and membership status let us identify you and give you access. We use this information to provide the account and access you request.
• Donations. We record amounts, currencies, payment and renewal status, payment-provider references and your renewal authorisation. This lets us process your donation, manage cancellation, resolve payment questions and keep required financial records. We notify the foundation's designated administrator of new donations and cancellations, including your email address, amount and payer name when Mollie provides it. Mollie handles card and bank payment details; our website does not store your full card number or security code.
• Existing supporters. Where you already support KIRAC, we match your email address with membership or donation records from Patreon, Substack and its payment provider Stripe, or the existing Cultuurbord donation system. For Substack we check your email address, subscription and payment status, and the paid access period. Administrators can also grant complimentary access. We use these records to recognise your existing entitlement and, where applicable, manage your cancellation request.
• Email. We use your address for sign-in codes, payment and account messages, and film announcements according to your email preferences. We record delivery, bounce, complaint and unsubscribe status. Film-announcement open and click tracking is currently disabled. You can withdraw permission for announcements or object to them at any time using the email’s unsubscribe link or Your account.
• Introductions. Members can introduce another person by email. We confirm the request with the member before sending an invitation. We record both addresses, confirmation and invitation dates, and the access expiry. The invited person receives seven days of free access after their first verified sign-in, with no payment or automatic subscription. An introduction does not subscribe anyone to announcements. We keep a minimal record of redeemed invitations to prevent repeated trials.
• Event updates. If you sign up for KIRAC event emails, we keep your email address, signup time and event-email preference. This is a separate list from film announcements and does not create a membership. We use it with your consent to contact you about future KIRAC events. You can unsubscribe through the link in an event email or contact support@kirac.com to unsubscribe or ask for deletion.
• Security and support. Technical request information, including IP addresses, browser information, temporary abuse-prevention records and support correspondence, helps us protect accounts, deliver films and resolve problems.

Our legal bases are providing the account and donation arrangements you request, meeting legal record-keeping duties, and our legitimate interests in protecting the website and recognising existing supporters. Where consent is required for optional email, we rely on that consent; withdrawing it does not affect earlier lawful processing.

Cookies and video

Essential cookies keep you signed in and remember choices such as currency. A sign-in session lasts up to 30 days unless you sign out or revoke it. We do not use advertising cookies on KIRAC.com. Opening a film connects your browser to Bunny, which processes technical information needed to stream and protect the video.

Who processes information

Authorised KIRAC administrators can manage accounts, access, donations and email. We use Cloudflare for hosting and the website database, Supabase for sign-in, Mollie for payments, Resend for email, Bunny for video delivery, and GitHub for encrypted database backups. Patreon, Substack, Stripe and the existing donation service supply the membership information described above. We do not sell your personal information.

Some providers operate internationally and may process information outside the European Economic Area. Their data-protection terms describe the applicable transfer safeguards, including adequacy decisions and standard contractual clauses where required. Provider information: Cloudflare, Supabase, Mollie, Resend, Bunny, Substack, Stripe and GitHub.

How long we keep information

We keep account and membership records while needed to provide or verify access, manage renewals and resolve related questions. You can ask us to close your account. Financial records are kept for the statutory retention period, generally seven years. We retain the minimum unsubscribe and suppression information needed to respect your choices and avoid sending unwanted mail. Support and security records are kept only as long as needed for the issue or security purpose. Our daily encrypted website-database backups are retained for 30 days.

Your rights

You can request access to, correction or deletion of your information, restriction of processing or a portable copy where applicable, and object to processing based on legitimate interests. Email support@kirac.com; we may ask you to verify your identity. Legal record-keeping obligations may prevent immediate deletion of some information.

You may also complain to the Dutch data-protection authority, the Autoriteit Persoonsgegevens. We will update this notice when how the website uses personal information changes.