Privacy policy

This privacy policy has five parts. Part A describes who we are and when this policy applies. Part B describes which data we process and why. Part C covers our website, cookies and measurement tools. Part D covers sharing, retention and security. Part E describes your rights.

AvonturenEvents.nl is a trading name of the business based in Enschede and registered with the Chamber of Commerce (KvK) under number 93253192. This business is the data controller within the meaning of the General Data Protection Regulation (GDPR) for the personal data we process.

Besides AvonturenEvents.nl, the same business also operates other trading names, including vincentborgers.nl, and may operate further trading names in future under the same KvK number. Legally, these trading names are one and the same business and therefore one data controller.

This means that data you leave with one of these trading names is processed and used within the same organisation, and that this is not a disclosure to a third party. We use that data only for the purposes listed in article 4, or for a compatible purpose within the meaning of Article 6(4) GDPR, for example to handle an enquiry faster when you were previously a customer under another trading name.

This policy applies to all our trading names and their websites, to our public events, to bespoke bookings for private customers and to business bookings.

For business bookings, we sometimes process data on behalf of and on the instructions of our client, for example for lead capture on an exhibition stand, a quiz in which visitors leave their details, or a game in which participants register. In those cases the client is the data controller and we act as the processor. The client then determines the purpose and means, is responsible for informing participants and for having a valid legal basis. We record this in a data processing agreement and process that data only on the client's instructions. This privacy policy does not apply to those processing activities; the privacy policy of the client concerned applies instead.

Contact: info@avonturenevents.nl, Piet Heinstraat 12, 7511 JE Enschede. We have not appointed a data protection officer, as we are not required to. Wherever this policy says you can report something to us or request something from us, you can do so via this email address.

An additional privacy statement may apply to specific events, concepts or partnerships, for example for the matching process of Speed Dating Overijssel, an external ticketing platform or a partnership with another party.

Additional statements are published on the event page, at ticket sale or in the confirmation email. If they conflict with this policy, the additional statement prevails, unless mandatory law prevents this.

Where an external party, such as a ticketing platform, acts as a data controller itself, that party's privacy policy applies to the processing it carries out for its own purposes.

Articles 3 to 7 describe, for each situation, which data we process, for what purpose and on which legal basis.

We do not process more data than is needed for the purpose for which we collect it. Which data that is depends on the situation. It includes the following:

- contact details: name, email address, phone number and, where applicable, company name, address, postcode and town;

- enquiry details: type of event, preferred date, venue, number of participants, budget estimate and your notes;

- ticket and participation details: chosen event, date, time slot and number of tickets;

- date of birth or an indication of age, only where a minimum age applies;

- age and gender when you sign up for Speed Dating Overijssel, solely to keep the age groups and the ratio between participants balanced each evening. We do not share this data with anyone else and do not use it for advertising;

- invoice and payment details;

- answers to questionnaires for specific events, such as the matching process of Speed Dating Overijssel;

- photos and video taken at events;

- data generated during an event or activation, such as a team name, a chosen player name, scores, progress, answers given and the time of participation;

- technical and usage data from our website, such as IP address, browser type, device type, pages visited, click and scroll behaviour and the source through which you reached our site.

For a specific event, concept or activation, additional data may be needed that is not listed above. We will tell you which data that is and what we use it for at that time, for example on the event page, in the registration form or on site.

We do not ask for special category personal data within the meaning of Article 9 GDPR, such as data about health, and we ask you not to include it in a form or email unprompted. If you tell us about a medical condition at an event, we use that information only for safety during that event and keep it no longer than necessary for that purpose.

We process personal data only for the following purposes, in each case on the legal basis under Article 6 GDPR stated alongside:

- preparing a quote and performing the agreement, including ticket sales, registration, planning and delivery of an event. Legal basis: performance of the agreement or steps taken at your request before entering into it;

- communication about your enquiry, order or the event. Legal basis: performance of the agreement;

- invoicing, administration and meeting tax and other legal obligations. Legal basis: legal obligation;

- the matching process at Speed Dating Overijssel, in which your preferences are shared with another participant if the interest is mutual. Legal basis: performance of the agreement, based on your explicit participation in that process;

- securing our website, preventing misuse and handling complaints or disputes. Legal basis: legitimate interest;

- measuring and improving the use of our website and measuring the effect of our adverts. Legal basis: legitimate interest, and for placing and reading non-essential cookies, your consent, as described in article 8;

- keeping interest lists for our own events, such as Speed Dating Overijssel. If you sign up, we will email you about that edition, about future editions and about our other events, concepts and activities. Think of a date we propose, the venue, registration and practical information. Every message contains an unsubscribe link. Legal basis: your consent, which you can withdraw at any time;

- recording an unsubscribe as a status on your data, instead of deleting that data, so that we can show that you have unsubscribed and do not contact you again by mistake. Legal basis: legal obligation and legitimate interest;

- promoting our events and services, including the use of photos and video. Legal basis: legitimate interest, as explained in articles 5 and 6;

- sending information about similar events and services to existing customers and to people who have made an enquiry with us, with an unsubscribe option in every message. Legal basis: legitimate interest under Article 11.7(3) of the Dutch Telecommunications Act;

- grouping customers and enquirers into general segments, for example private or business, type of event and region, so that we can send messages that match what you were previously interested in. Legal basis: legitimate interest;

- sharing an irreversibly hashed version of your email address or phone number with advertising platforms, so that we can reach you more precisely, build similar audiences or exclude you from adverts. The platforms do not receive any readable data. Legal basis: legitimate interest, and for placing the related cookies, your consent;

- measuring which of our campaigns, channels and messages lead to enquiries, so that we can spend our marketing budget efficiently. Legal basis: legitimate interest;

- analysing data about enquiries and bookings, including origin by postcode area or region, type of occasion, group size, season and price level, to determine which concepts and which areas work well and to align our planning, offering and marketing accordingly. We do this at group level and not to assess individuals. Legal basis: legitimate interest.

Where we rely on a legitimate interest, we have weighed your interests and rights against ours. Our interests are: bringing our events to people's attention, securing our systems, being able to show what was agreed and improving our services.

We limit the impact on your privacy by not processing more data than necessary, by carrying out analyses at group level rather than individual level, and by including a simple unsubscribe or objection option in every communication.

Under Article 21 GDPR you can object to processing based on legitimate interest. We will then stop the processing, unless there are compelling legitimate grounds that outweigh your interests. If you object to direct marketing, we will always stop.

Photos and videos are taken during our events and assignments. This material may be used on our website, on social media, in newsletters and in adverts.

We base this on our legitimate interest in being able to show our events in a recognisable and realistic way. We take your interests into account: we do not publish images that could be harmful or defamatory, nor images in which a single person is clearly and recognisably the focus without good reason, and we announce in advance that photos and video will be taken.

If you do not want to be photographed or filmed, tell the on-site organisers before the start. We will take this into account.

If you object to an image that has already been published, you can report this via info@avonturenevents.nl. We will then remove the image in question from our own channels as soon as possible, as far as removal is reasonably possible. We have no influence over material that has already been printed, taken over by third parties or shared by others, or over content that has already been distributed or archived, and removal does not apply to those.

Where a person is clearly recognisable as the main subject of an image, we give that person's interest extra weight before using the image in targeted adverts. If you object to such use, we will no longer use the image for that purpose.

For children's parties, family days and similar bookings, children's data is processed only via the parent or carer who makes the booking. We do not collect data directly from children ourselves.

The parent or carer is responsible for the accuracy of the data they provide and, where applicable, for consent on behalf of the child.

For children we keep no more than the first name, the age and any interests needed to tailor the programme. We delete this data within three months of the event.

Articles 8 to 10 describe which technologies we use on our website and which parties are involved.

Our website uses cookies and similar technologies, such as local storage in your browser. We place some of these ourselves from our own domain, and some are placed by the parties named in article 9. We distinguish between:

- essential technologies that make the website work and remember your choice in the cookie notice. No consent is required for these;

- analytical technologies with which we measure how the website is used, so that we can improve it;

- marketing technologies with which we measure the effect of our adverts and can show visitors more relevant adverts.

Under Article 11.7a of the Dutch Telecommunications Act, consent is required for analytical and marketing technologies. You can refuse or delete these technologies at any time via your browser settings, and you can opt out separately with the parties concerned in the ways described in article 9.

Refusing cookies has no effect on how the website works or on your ability to make an enquiry.

We use the following services. For each service we state what is processed and how you can opt out.

- Google Analytics 4, for measuring website use. We have enabled IP anonymisation and measure via our own server container on our own domain, so less data goes directly to Google. You can opt out via Google's browser add-on.

- Google Ads, for measuring the results of our adverts. An encrypted, irreversibly hashed version of your email address or phone number may be sent along so that a conversion can be attributed. Google does not receive any readable data.

- Meta Pixel and the Meta Conversions API, for measuring the results of our adverts on Facebook and Instagram and for showing more relevant adverts. Here too, contact details are passed on only in irreversibly hashed form. You can opt out via your ad preferences within Facebook or Instagram.

- our own measurement on our own server in the Netherlands. With this we record which pages you view, how far you scroll, what you click on, whether you start a form and whether you finish it, how long you are active, which device and browser language you use and which source or advert you came from. We store a random identification number in a cookie and in your browser's storage, so that we can recognise a repeat visit as the same visitor. That identification number expires after twelve months. We do not store your IP address, only a daily-changing, irreversibly hashed version of it, so that we can recognise bots. We receive this data ourselves and do not share it with third parties. You can opt out as described in article 8.

As regards placing cookies via Meta Pixel, Meta and AvonturenEvents are joint controllers. Any further processing by Meta for its own purposes falls under Meta's privacy policy.

We do not use this data to identify individual visitors, and we do not take decisions with legal effect based on automated processing or profiling.

Some of the parties named in article 9 are based in the United States or process data outside the European Economic Area.

Data is transferred only to parties that are certified under the EU-US Data Privacy Framework, or on the basis of the standard contractual clauses adopted by the European Commission, supplemented by suitable technical measures such as encryption and hashing.

Articles 11 to 13 describe who we share data with, how long we keep it and how we protect it.

We do not sell your data or rent it out to third parties. We do use service providers who support us, such as a ticketing platform, payment provider, email provider, hosting provider, accountant and the analytics and advertising parties named in article 9. We enter into a data processing agreement with parties that process data solely on our instructions.

For a business booking, we may share essential contact details with the venue or with the staff we engage to deliver the event, only as far as needed for delivery.

Where we are legally obliged to, or where a competent authority makes a valid request, we may provide data to the body concerned.

Use of data across our different trading names, as described in article 1, does not count as disclosure to a third party. This is processing within the same business, with the same customer records, invoicing and support.

If our business were split up in future, or activities were moved to a separate legal entity under the same control, data could also be exchanged within that group for internal administrative purposes. We base this on our legitimate interest, as expressly recognised in recital 48 of the GDPR. You can object to this, as described in article 14.

In the event of a takeover, merger or transfer of our business or part of our activities, personal data may pass to the acquiring party, solely to continue the same services. We will inform you beforehand, as far as reasonably possible.

We keep data no longer than necessary for the purpose for which we process it, or than the law allows. As a guideline we use the following periods:

- invoices, payments and the financial records: 7 years, under the statutory tax retention requirement;

- agreements, quotes and the correspondence about them: 7 years after the agreement ends, so that we can still show what was agreed afterwards and meet our administrative obligations;

- enquiries that did not lead to a booking: 24 months, because enquirers often get back in touch in a later season and we can then refer to the earlier contact;

- ticket and participation details: 24 months after the event, in connection with follow-up editions and the handling of any complaints or disputes;

- data from the matching process of Speed Dating Overijssel: 3 months after the evening in question;

- data on an interest list: for as long as you remain on the list. There is no fixed period, because our events recur periodically and you have said you want to stay informed. Every message contains an unsubscribe link, and when you unsubscribe we remove you from the mailing list straight away. We then keep only your email address and the date of unsubscribing, so that we do not contact you again and can show that we carried out your request;

- children's data: 3 months after the event;

- data generated during an event or activation, such as scores and answers: 24 months;

- customer data and the associated booking history: for as long as the customer relationship lasts and then 7 years after the last contact, so that we can draw on what we did for you before if you make a follow-up enquiry;

- data for mailings and other marketing: for as long as you are subscribed or a customer, and afterwards for as long as you have not said you no longer want to receive messages;

- an unsubscribe register with a minimal set of data, such as an encrypted version of your email address: indefinitely, because we need it to keep guaranteeing that you are not contacted again;

- website and measurement data: in line with the retention periods of the services named in article 9, usually a maximum of 14 months. We keep the data from our own measurement for a maximum of 26 months, after which we delete it or irreversibly combine it into statistics.

We keep photos and video of our events with no fixed period. This material forms the archive and portfolio of our events and we use it on an ongoing basis for promotion and to show what we have made before. We base this on our legitimate interest and on the archiving purpose referred to in Article 5(1)(b) and (e) GDPR. You can object to a specific image at any time, after which we will remove it from our own channels as described in article 6.

When a retention period ends, we delete the data, or make it irreversibly anonymous so that it can no longer be traced to a person. Anonymised data is no longer personal data and does not fall under this privacy policy. We keep and use it with no time limit for statistics, trend analysis, capacity planning, assessing the return on our marketing and developing our concepts further.

We take appropriate technical and organisational measures to protect data against loss, misuse and unauthorised access. These include encrypted connections, restricted access to systems, multi-factor authentication where available and irreversibly hashing contact details before they are shared with advertising partners.

Access to personal data is limited to people who need it to carry out their work.

In the event of a data breach that poses a risk to your rights and freedoms, we will report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours and, where the law requires, to you as well.

Articles 14 to 16 describe which rights you have and how to exercise them.

You have the right to access your data, to rectification, to erasure, to restriction of processing, to portability of data you have provided, and the right to object to processing based on legitimate interest.

If you have given consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before that.

You can submit a request via info@avonturenevents.nl. To protect your data, we may ask for additional information to verify your identity. Without that verification we cannot process a request.

We respond within one month. For a complex or extensive request, we may extend this period by up to two months, and we will tell you about this within the first month.

We may refuse a request in whole or in part where a statutory retention obligation, the rights of others or a compelling legitimate ground prevents us from granting it. We will explain this to you.

If you ask for erasure, we will delete your data as far as that is possible and permitted. Please note that the right to erasure is not unlimited. Under Article 17(3) GDPR, we continue to keep data where that is necessary to comply with a legal obligation, such as the 7-year tax retention requirement, or for the establishment, exercise or defence of legal claims. In those cases we delete the rest and limit the use of the remaining data to that purpose.

Where complete erasure is technically not possible, for example in backups that rotate on a fixed schedule, we mark the data for deletion, no longer use it and it disappears in the next cycle. We do not restore such data from a backup.

Instead of deleting data, we can also make it irreversibly anonymous. It can then no longer be traced to you and no longer counts as personal data.

For manifestly unfounded or excessive requests, in particular repeated ones, we may charge a reasonable fee or refuse the request, in line with Article 12(5) GDPR.

If you have a complaint about how we handle your data, please contact us first via info@avonturenevents.nl. We would like to resolve it together with you.

You also always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We may amend this privacy policy, for example if our services or the law and regulations change. The most recent version is always on this page, with the version number and the date.

For significant changes that directly affect you, we will actively inform you where reasonably possible.