Privacy statement
Last updated on 24 March 2026
What changed: We updated this privacy statement to reflect our migration to a new community platform (Circle.so), added details on diversity monitoring data collected during fellowship applications, specified Plausible Analytics for website analytics, added international transfer safeguards and data breach notification sections, added data controller and governing law sections, and updated contact details. For questions about these changes, contact us at privacy@moralambition.org.
Stichting School for Moral Ambition (hereinafter "SMA", "we", or "us") believes it's crucial to handle your personal data with care. In processing personal data, we adhere to relevant laws and regulations, such as the General Data Protection Regulation (GDPR). It's important for us to clearly and comprehensively explain what we do with your data and what control you have over it. Therefore, in this privacy statement, we extensively outline the data we collect from you and how we handle it. We encourage you to read this privacy statement carefully. We may revise this privacy statement at any time. We recommend that you regularly review this privacy statement to stay informed of any changes.
Contact Details
Stichting School for Moral Ambition
Strawinskylaan 339
1077 XX Amsterdam
Chamber of Commerce number in The Netherlands: 92257461
If you have any questions about the processing of your personal data or about this privacy statement, you can contact us at privacy@moralambition.org. We're here to assist you!
Data Controller
Stichting School for Moral Ambition (Netherlands) is the data controller for all personal data processing described in this privacy statement. Where services are provided in coordination with The School for Moral Ambition Inc (United States, EIN 33-2502997), SMA remains the data controller for personal data of individuals in the European Economic Area (EEA).
Concerned Parties
We process your personal data when you visit our website, use our Community platform, contact us, or if you are a funder, supplier, or business relation. We typically receive this data directly from you or your employer.
Community Platform & Account
Personal Data
When you create an account in our Community platform, we may process the following personal data:
- First and last name
- Email address
- Login credentials
- Profile information (photo, bio, interests, location)
- Posts, comments, reactions, and other content you create
- Direct messages to other community members
- Community engagement data (groups joined, content viewed)
- Device and browser information, IP address
- Other personal data you provide to us
Purposes and Legal Basis
We process your personal data for the following purposes:
- Creating and managing your account (contract performance)
- Providing community features including posting, messaging, and networking (contract performance)
- Moderating content and enforcing community guidelines (legitimate interest)
- Improving the Community experience (legitimate interest)
- Preventing abuse and ensuring platform security (legitimate interest)
- Informing you about changes to the Community or your account (legitimate interest)
Platform Provider and Data Processing
The Community is hosted on a platform operated by CircleCo, Inc. (United States). Circle acts as a data processor on our behalf under a Data Processing Addendum (DPA) that includes:
- EU Standard Contractual Clauses (SCCs), Module Two (controller to processor)
- Irish law as governing law for the SCCs
- SOC 2 Type II certification
- AES-256 encryption at rest, TLS 1.2+ in transit
- 30-day notice period for sub-processor changes, with objection rights
Circle also processes certain data as an independent controller for its own contract administration and platform usage analytics, as described in its own privacy documentation. SMA has no control over this processing but has selected Circle in part based on its data protection commitments.
AI-Powered Features
The Community may use AI-powered features to enhance your experience (such as content recommendations or search). These features are operated by third-party sub-processors (including OpenAI, LLC and Amazon Web Services, Inc.) contracted by Circle under its DPA. Your personal data is not used to train, fine-tune, or improve any external AI models.
Retention Period
We retain your account and community data as long as you have an active account. Upon account deletion, your personal profile data will be removed within 30 days. Content you posted that has been shared with or relied upon by other community members may remain visible but will be anonymized where possible. We retain archived data for up to five years after account deletion for legitimate administrative purposes.
Newsletter
Personal Data
When you subscribe to our newsletter, we process the following personal data:
- First and last name
- Email address
- Email engagement data (opens, clicks)
Purpose and Legal Basis
We process your personal data to send our newsletter based on your consent (Article 6(1)(a) GDPR). When you create a Community account, we may invite you to subscribe to our newsletter. Subscribing is entirely voluntary and requires your explicit opt-in.
Retention Period
We retain your data for as long as you wish to receive the newsletter. We use software to send our newsletter. Unsubscribing from a newsletter means you will no longer receive it. However, your data is not automatically deleted by the software. If you want your data completely removed, please contact us.
Unsubscribe
You can unsubscribe from the newsletter at any time by clicking the unsubscribe link in any email, or by contacting us at privacy@moralambition.org. Unsubscribing from the newsletter does not affect your Community membership or account. You will continue to receive essential service communications (account notifications, security alerts) regardless of your newsletter preferences.
Consent
If we process your personal data based on your consent, you can always withdraw it by emailing us at privacy@moralambition.org.
Data Migration Notice
In May of 2026, we migrate our Community from Hivebrite to Circle.so. As part of this migration, your existing account information (name, email address, profile data) was transferred to the new platform. Previous posts and content may not have been migrated. If you have questions about the migration or wish to exercise your data rights, please contact us at privacy@moralambition.org.
Webinars and Other Free Services
Personal Data
When you sign up for a webinar or other free service we offer, we may process the following personal data:
- First and last name
- Email address
Purpose and Legal Basis
We process your personal data to provide you access to the requested free service (legitimate interest).
Retention Period
We will only use your data to provide access to the requested service. We store all data in our archive. We retain our archive for at least five years.
Questions and Requests
Personal Data
When you contact us by phone, email, via the contact form on our website, or in any other way, we may process the following personal data:
- First and last name
- Phone number
- Email address
- Correspondence, including emails
- Other personal data you provide to us
Purpose and Legal Basis
We process your personal data for the following purposes:
- Contacting you or taking action in accordance with the form you filled out (legitimate interest)
- Handling your question or request (legitimate interest)
Retention Period
We will only use your data to handle your question or request. We store all data in our archive. We retain our archive for at least five years.
Stories
Personal Data
When you share your story with us, we may process the following data:
- First and last name
- Email address
- Photo
- Your story
- Other personal data you actively provide
Purpose and Legal Basis
We process your personal data to share your story on our website and social media (consent).
Retention Period
We retain your data until you withdraw your consent. Please note that when your story is shared on social media, it may not always be possible to completely remove it due to sharing and liking by others.
Consent
If we process your personal data based on your consent, you can always withdraw it by emailing us at privacy@moralambition.org.
Funders
Personal Data
If you become a funder and financially support us, we may process the following personal data:
- First and last name
- Email address
- Phone number
- Address details
- Financial data
- Correspondence, including emails
- Other personal data you provide to us
Purpose and Legal Basis
We process your personal data for the following purposes:
- Administration (legal obligation)
- Personal contact (legitimate interest)
- Informing about developments at SMA (legitimate interest)
- Mention on our website as a funder (consent)
Retention Period
We retain financial data for at least 7 years in accordance with the fiscal retention period. We retain all other data for the duration of the agreement and at least 5 years thereafter.
Consent
If we process your personal data based on your consent, you can always withdraw it by emailing us at privacy@moralambition.org.
Fellowships
Personal Data
If you apply for a fellowship with us, we may process the following personal data:
- First and last name
- Email address, phone number, address details
- CV with information about your employment history and education/training
- Your answers to the assessment questions
- Video and written submissions
- Gender identity (optional, provided with your explicit consent)
- Ethnic or racial background (optional, provided with your explicit consent)
- Correspondence, including emails
- Other personal data you provide to us
Purpose and Legal Basis
We process your personal data for the following purposes:
- Conducting the application procedure (legitimate interest)
- Retaining data after rejection for a subsequent application (consent)
- Retaining data in your personnel file if you are hired for the fellowship (contract)
- Monitoring the diversity of our applicant pool and identifying potential barriers in our selection process (explicit consent — Article 9(2)(a) GDPR)
Diversity Monitoring Data
We collect optional data about gender and ethnicity to monitor the diversity of our applicant pool and identify potential barriers in our selection process. This data is classified as special category data under GDPR Article 9 and is processed solely on the basis of your explicit consent.
This data is managed by our process coordinator and is not visible to anyone involved in selection decisions. Analysis is conducted on aggregate data only. You can skip these questions or select "Prefer not to say" with no effect on your application.
If you provide this data, your consent can be withdrawn at any time by emailing privacy@moralambition.org. Your diversity data will then be deleted while your application continues normally.
Retention Period
We retain application data until four weeks after the completion of the application procedure. Only with your explicit consent do we retain your data (each time) for up to one year. If you are hired for a fellowship, your application data will be stored in your personnel file.
Diversity monitoring data (gender, ethnicity) is retained for the duration of the selection cycle and up to two years thereafter for longitudinal analysis, then deleted or fully anonymized.
Consent
If we process your personal data based on your consent, you can always withdraw it by emailing us at privacy@moralambition.org.
Consequences of Not Providing Data
We use the information requested to assess whether the fellowship is suitable for you. Failure or incomplete provision of the requested information means that we will not process your application. The diversity monitoring questions are entirely optional and have no effect on your application.
Relationship Management
Personal Data
In the context of relationship management, we may process the following personal data:
- First and last name
- Email address
- Phone number
- Company name
- Chamber of Commerce (KvK) number
- Address details
- Correspondence, including emails
- Other personal data you provide to us
Purpose and Legal Basis
We process your personal data for the following purposes:
- Retaining contact details (legitimate interest)
- Making personal contact (legitimate interest)
- Building and maintaining a business network (legitimate interest)
Retention Period
We do not retain your data longer than necessary for the benefit of our organization or until you request us to delete it.
Website Visitors: Cookies
Personal Data
A cookie is a small file that can be stored on your computer, tablet, or smartphone when you visit our website. With a cookie, personal data can be processed. When you visit our website, we may process the following personal data through cookies:
- IP address
- Location data
- Other data for which you have given consent via the cookie banner on our website
Purpose and Legal Basis
We process your personal data for the following purposes:
- Improving access to and operation of our website
- Providing a good user experience of our website
- Offering a personalized experience of our website
- Analyzing information for marketing purposes
Where we can achieve these purposes without using personal data or by using only functional cookies, the legal basis for processing lies in the legitimate interest we have in a well-functioning website. This includes functionalities such as the operation of spam filters, the use of caching to make the website faster, and cookies for tracking session and login information.
Where we can only achieve these purposes by using personal data differently, we process your personal data only with your consent. More information about this can be found in our cookie statement and via the tool we use for this purpose on our website.
Website Analytics
We use Plausible Analytics to understand how visitors use our website. Plausible is a privacy-focused analytics tool that does not use cookies, does not collect personal data, and is hosted entirely within the European Union. Because Plausible does not process personal data, no consent is required for its use.
If we introduce additional analytics or advertising tools in the future (such as Google Ads, Meta Pixel, or LinkedIn Insight Tag), these may use cookies and process personal data. We will only enable such tools with your explicit consent via the cookie banner on our website, and we will update this privacy statement accordingly.
Social Media and Other Plugins
Using services from other parties sometimes involves placing cookies and sharing data with these parties without us having a choice. We will enable the most privacy-friendly option possible. We have placed 'social media buttons' from LinkedIn and Instagram, among others, on our website. We also embed videos from YouTube and Vimeo on our website. Once you click to play, they may collect data from you via a third-party cookie. This is the most privacy-friendly setting possible that we have set. We have no further control over this. We refer you to the privacy policy of these parties. Some of these parties store data in the United States.
Marketing Cookies
If enabled, we may place marketing cookies from advertising platforms (such as Google Ads, LinkedIn, or Meta) for advertising purposes including retargeting. These cookies will only be placed with your explicit consent via the cookie banner on our website.
IP Address and Web Servers
Your IP address may be stored in the log files of our web server when you visit our website. This is necessary to manage and secure the website correctly. We do not use your IP address to track or record your online behavior. In principle, we are unable to link your IP address to your name, address, or other identifying information unless you provide us with such information and continue to use the same IP address.
Retention Period
Depending on the type of cookies and the reason for placing cookies, cookies are stored either for the duration of the (browser) session or for a longer period. You can actively delete cookies yourself at any time. In that case, no new data will be shared with us or other parties until new cookies are placed (with consent). We have no control over how other parties handle the cookies they place and the data collected via these cookies.
Consent
Via the cookie banner on our website, you can give consent for the placement of non-functional cookies. You can also set your browser to no longer store non-functional cookies or delete all information previously stored through your browser's settings, whether automatically or not.
Consequences of Not Accepting Cookies
You are not obligated to accept cookies. If you set your browser not to store cookies or if you delete information previously stored, whether automatically or not, you may have a less optimal user experience on our website and may not be able to use all functionalities.
Website Visitors Under 16 Years of Age
We do not intend to process personal data of website visitors under the age of 16 without the consent of parents or guardians. However, we cannot control this. If you suspect that we are processing personal data of a person under the age of 16 without consent, please contact us so that we can delete the information if we are not lawfully processing it.
Automated Decision-Making
We do not engage in automated individual decision-making and profiling that may have adverse effects on you as an individual.
If in the future we enable advertising tools (such as Google Ads, Meta, or LinkedIn), data may be shared via cookies in connection with those platforms' profiling. We have no control over how they handle data collected via their cookies. We will only enable such tools with your explicit consent.
Your Rights
You may always ask us to access your data (right to access), correct your data if it is incorrect or incomplete (right to rectification), and delete your data (right to erasure). You also have the right to object to data processing, the right to restrict data processing, and the right to data portability.
If you wish to exercise any of these rights, you can email your request to privacy@moralambition.org. We may need to verify your identity to fulfill your request.
We will respond to your request within one month. If your request is complex, we may extend this period by two additional months, in which case we will inform you of the extension within the first month.
If you have a complaint about how we handle your data, we would like to resolve it with you. Please contact us to do so. If you are not satisfied with the handling of your request or complaint, you can contact the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.
Sharing with Others
We use multiple processors to operate our services. We have entered into data processing agreements with all our processors. We will never sell your personal data to third parties.
We share your personal data with the following categories of processors:
- Community platform provider (CircleCo, Inc. — US, DPA with SCCs in place)
- Email and newsletter software
- Accounting and financial administration software
- Online working environment, including email and document storage
- Website hosting
- Accountant (under confidentiality agreement)
- Application and survey management tools (e.g., Typeform) — processor
Our platform provider (Circle) uses sub-processors for hosting, email delivery, AI features, payment processing, and other platform functions. These sub-processors are contracted under Circle's Data Processing Addendum and are subject to appropriate safeguards including EU Standard Contractual Clauses.
A complete and up-to-date list of our processors and their key sub-processors is available on request. We update the list when our processor relationships change.
International Transfer of Personal Data
We primarily process your data within the European Economic Area (EEA). However, some of our processors are based outside the EEA, including in the United States. For these transfers, we rely on the following safeguards:
- EU Standard Contractual Clauses (SCCs) — for transfers to Circle and its sub-processors, governed by Irish law
- EU-US Data Privacy Framework — for transfers to processors certified under this framework (where applicable)
- Adequacy decisions — for transfers to countries recognized by the European Commission as providing adequate protection
You can request a copy of the relevant transfer safeguards by contacting us at privacy@moralambition.org.
Data Breach Notification
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay. We will also notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of becoming aware of a qualifying breach.
Security
We have taken extensive measures to secure your data both organizationally and technically. We have secured our systems and various communication methods to ensure that your data does not fall into the hands of others. Your data is safe with us. We also ensure that your data is only used by people who have received permission from us.
Child Safety Standards Policy
Any explicit content or child sexual abuse and exploitation (CSAE) is strongly prohibited on our application.
Compliance with Child Safety Laws & Reporting
Our app complies with applicable child safety laws and regulations.
Our app ensures all content shared within the app is appropriate for a mixed audience, including children. User-generated content is moderated to prevent inappropriate material from being accessible.
Any CSAM (Child Safety Abuse Material) content will be automatically removed when flagged or reported through our moderation features or if we are directly contacted for this purpose.
We will systematically take action to report confirmed CSAM content to the National Center for Missing and Exploited Children. CSAM consists of any visual depiction, including but not limited to photos, videos and computer-generated imagery, involving the use of a minor engaging in sexually explicit conduct.
Child Safety Point of Contact
You can reach out to niki@moralambition.org if CSAM content is detected.
Privacy and Data Protection
Our app is committed to protecting user data, especially for children under 13, in compliance with applicable regulations.
The privacy policy is displayed clearly and is accessible from the app settings and our website.
All data is encrypted during transmission and stored securely.
Ads and Monetization
Our app does not include ads or monetized content.
Transparency and Disclosures
Data safety: Detailed information is provided as per Google Play's Data safety form.
Content ratings: IARC 3+, L, E, 3, 3, USK 0
Validation and Updates
Regular internal testing is conducted to ensure compliance with Google Play's child safety standards, including functionality reviews and content audits.
Policies are reviewed quarterly or as required to align with updated child safety standards.
Governing Law
This privacy statement is governed by Dutch law. The competent court in Amsterdam, the Netherlands, has exclusive jurisdiction over any disputes arising from or in connection with this privacy statement.