De Krim Texel: Legal Information

What data does De Krim process?
When you make a booking to stay at one of our parks, we need certain information from you. We also process data in other cases, such as information requests, the administration of competitions, requests for quotations, ordering e-tickets, for example for the swimming pool or events, and visits to our websites. In doing so, we also use third parties who receive certain personal data and process it on behalf of De Krim. This happens, for example, for the sending of newsletters. In the case of a booking, your data will naturally be shared with the park where you will be staying.

Below, we describe in more detail which data we may process and what we use it for:

1. First name, surname and gender
   To be able to address you personally at the park and in our further communication, we like to use your personal details. These are, of course, also necessary in order to register your booking and include the details in our reservation system.
2. Address and town/city
   We send most booking details to you by e-mail. However, some information is sent to your home address.
3. Telephone number
   We may need to contact you about your booking. We will give you a quick call if there are any questions. Sometimes we call before arrival or after your stay to ask whether everything is clear and whether everything was to your satisfaction. We also have your telephone number if you contact us via our Whatsapp Service, so that we can provide you with a response.
4. Date of birth
   The person booking accommodation with De Krim must be at least 18 years old. Discounts granted may also depend on the age of the people staying in the accommodation. We therefore need dates of birth.
5. Payment details
   To process your booking financially, we use a secure payment environment. When you pay by iDeal/Wero or bank transfer, your details are stored in our administration so that we can link your payment to your booking. We only use your bank account number if we need to refund money to you. When you pay by credit card, we send your credit card details directly from our secure environment to our credit card partner. They process our credit card payments. We do not see your credit card details. Our partner only informs us whether your payment was successful.
6. IP address
   On the internet, we may look at your IP address. We remember your preferences and can therefore provide suitable advice.
7. Email address
   You will receive an e-mail about your reservation, invoice and the bookings you have made. You will also receive newsletters by e-mail. If you would rather no longer receive newsletters and offers, you can easily unsubscribe using the link in the newsletter.
8. Car registration number
   At some parks there are barriers that register your vehicle registration number, so that the next time you pass through you no longer need a PIN code or pass to access the park. Very convenient!
9. Visual material from camera surveillance
   Cameras may be installed in parts of our parks in places where this is necessary for safety and security, for example at entrances, parking and barrier areas, and at facilities where additional supervision is desirable, such as swimming pool slides. In doing so, we process camera images and associated metadata such as date, time and location in order to prevent and handle incidents, promote the safety of guests and employees, and protect property. The legal basis is our legitimate interest in safety and security. We place cameras visibly, film as specifically as possible, and do not use covert camera recording or facial recognition.
   
   Access to the footage is restricted to authorised employees or engaged security service providers. Camera footage is generally stored for a maximum of 14 days and then automatically deleted or overwritten, unless the footage is needed to handle an incident, for example in the case of damage, an accident or unlawful conduct. In that case, we retain relevant fragments for as long as necessary for investigation, handling and/or legal proceedings. Where necessary, footage may be provided to the police, an insurer or other competent authorities.

Why does De Krim collect data?
De Krim uses the above-mentioned data to send you the necessary information about your stay, to process your booking optimally, for your safety during your stay, and to keep you informed of interesting offers for our products and services.

1. Service to our guests
   You can contact us by telephone, e-mail and via social media. To ensure that you do not have to tell your story twice, we store data. In order to keep improving our service, we analyse contact moments.
2. Our parks and partners
   Your data is passed on to the park where you are staying and to organisations that carry out activities in connection with your booking. This also includes parties that are not part of De Krim. For example, this may include the bicycle rental company if you have reserved a bicycle as part of your booking.
3. Account
   Your personal details may be included in your ‘Mijn Vakantie’ account. These include your name, postal and billing address, date of birth, telephone number and login details. Convenient, as it means you do not have to enter these details again every time. We also store data about your previous bookings and your preferences. This enables us to help you more quickly and in a more targeted way.
4. Newsletters
   You may receive newsletters and other offers from us. For their content, we may look at your interests and previous bookings. If you would rather no longer receive newsletters and offers, you can easily unsubscribe via the link in the newsletter, via your ‘Mijn Vakantie’ account, or by sending an e-mail to reserveringen@krim.nl.
5. Reviews and guest survey
   You can help future guests with your review. By sharing experiences, you give others an even better impression of De Krim, a specific park or accommodation. The answers you provide in our guest survey are read by us in order to further improve our services. In that context, we may also share your answers and data with our parks and partners, such as the bicycle rental company. We may also contact you in response to a completed survey, for example to ask additional questions or to thank you for your feedback.
   
   If you leave a review via our guest survey, it may be published anonymously on our website or other communication channels. In this way, we help other guests when making a choice.
6. Night register
   When you stay at one of our parks, your data is processed on behalf of the Municipality of Texel, among other things in case of emergencies. This processing takes place on the basis of a legal obligation under Article 6(1)(c) GDPR, including Article 438 of the Dutch Criminal Code and municipal regulations such as the General Local By-law and tourist tax regulation. The data is processed in our systems.
7. Improvements
   We may sometimes contact you for a guest survey or a place in our guest panel. We also want to know how a complaint was handled and what you think of our newsletter. We therefore collect guest behaviour. This enables us to analyse your reading behaviour and create content that matches your wishes. We do this by registering unique visits, including all activities that take place within them. This includes viewing pages, zooming in on something or clicking on links. Sometimes a third party carries out these checks for us.
8. Campaigns
   If you have taken part in a campaign or competition, we may contact you and inform you if you have won. We also use this data to analyse our campaigns. This makes them even more enjoyable each time.
9. Customised advice
   This may mean that profiling within the meaning of Article 4 GDPR takes place. Profiling means that personal data is used to analyse personal preferences and interests. This may affect the offers you see. You have the right to object to profiling and direct marketing at any time under Article 21 GDPR.
   
   Depending on your cookie settings, this may also mean that we use cookies and similar technologies to compile target groups, profiling, for remarketing campaigns on platforms such as Google and Meta. You can object to this and/or withdraw your consent via the cookie settings or by contacting us.
   
   If you visit our website, like us on Facebook, make a booking with us or stay at one of our parks, we remember what you like. We do the searching and help you with attractive offers, for example by e-mail. We also use your data to improve our services and websites, and to show useful advertisements, for example on Facebook. Among other things, when you use social media on different devices, it is possible that you will also see these advertisements on those other devices. Cookies play a role in this. In order to tailor information and offers as closely as possible to your interests, we may have your data compared or combined with data known to other companies. Where legally required, De Krim will ask for your consent before providing your data to third parties.

Does De Krim share data with third parties?
We do not sell your personal data. In order to provide our services and optimise our marketing, we may share personal data with selected service providers, processors, and, for marketing and advertising purposes, with advertising platforms, often as independent controllers. We do this only within the limits of the GDPR and, where required, on the basis of your consent or after we have carried out a balancing of interests. You can unsubscribe or object to this at any time.

We may upload customer data, for example an e-mail address and/or telephone number, in hashed form to Google Ads in order to create audiences for remarketing and segmentation. Google compares this data with its own user base and then displays advertisements to potential guests. We only receive aggregated reports from Google. Where required, you can give or withdraw consent for this via our cookie and marketing preferences, and you can also object to direct marketing at any time. When using Google, personal data may be transferred to the United States. In that case, appropriate safeguards apply, such as the use of Standard Contractual Clauses approved by the European Commission, supplemented by technical and organisational measures such as encryption and pseudonymisation, and, where applicable, certification under the EU-US Data Privacy Framework.

In order to properly provide our services, we do pass on your personal data to the following categories of recipients:

1. IT partner for the hosting and maintenance of the website, the booking system and the ‘Mijn Vakantie’ environment;
2. the accountant for auditing the administration;
3. government bodies such as the Tax and Customs Administration, the Municipality of Texel and other supervisory authorities;
4. other third parties for the performance of De Krim’s activities, such as printers, e-mail and postal processors. To the extent that these third parties process your personal data when carrying out the relevant services and business activities, they do so in the capacity of processor for De Krim. De Krim has taken the required technical and organisational measures to ensure that your personal data is processed solely for the agreed purposes and is properly secured.

How does De Krim protect data?
Your payment and personal details are sent via the internet to our information system. This website uses HTTPS, HyperText Transfer Protocol Secure. Data that you send via this website is encrypted, so that it is protected against interception by third parties during transmission. You can recognise a secure connection by the padlock in your browser’s address bar. We use these registered security techniques to protect your data and to prevent its loss, corruption or theft. However, we accept no liability for this, to the extent permitted by law.

After you send data to us, it is stored in a secure database, where this data is kept in a secure environment.

How long De Krim store data?
Where possible, we apply specific retention periods. Examples: (i) financial and administrative data and invoices: 7 years, in line with the tax retention obligation; (ii) booking and stay history in the reservation system: up to 2 years after the last contact or last stay, unless longer retention is necessary for claims or disputes; (iii) marketing consents: for as long as the consent is valid and up to no later than 2 years after the last interaction; (iv) data in the night register: in accordance with municipal regulations. We retain camera footage for a maximum of 14 days and then automatically delete or overwrite it, unless parts of the footage are needed to investigate or handle an incident. In that case, we retain relevant fragments for as long as necessary.

De Krim does not retain user data for longer than is necessary for the purposes for which it is collected or subsequently processed.

Confidentiality
All employees of De Krim who have access to your data are bound by a strict duty of confidentiality with regard to all personal data of which they become aware as a result of that access.

Legal bases
On the basis of the General Data Protection Regulation, GDPR, we process personal data on the following legal bases:

1. performance of a contract;
2. compliance with a legal obligation;
3. legitimate interest;
4. consent.

For the use of personal data for direct marketing purposes, prior consent is generally required. Profiling takes place solely on the basis of prior consent.

We mainly use your data in connection with your booking and therefore on the basis of a contract with you. Your booking is registered, and we do everything we can to make your stay as pleasant as possible. Additional contact moments, such as reviews, marketing activities and the registration and analysis of your actions, take place in connection with a legitimate interest of De Krim. De Krim’s legitimate interest is its interest in being able to carry out direct marketing activities. The legitimate interest may also be that the processing takes place within a customer relationship and that De Krim wishes to maintain contact with you.

You can also register for a newsletter yourself. In that case, you give us consent to use your data for this purpose. We are also legally obliged to include your data in the night register.

Your rights
Under the General Data Protection Regulation (GDPR), you have various rights in relation to the processing of your personal data. We explain these rights below.

Right of access
You have the right to know whether we process personal data about you and, if so, to access that data.

Right to rectification
If your data is incorrect or incomplete, you have the right to have it corrected or supplemented.

Right to erasure (“right to be forgotten”)
You have the right to ask us to delete your personal data. We will delete your data if:

• the data is no longer necessary for the purposes for which it was collected;
• you withdraw your consent and there is no other legal basis for the processing;
• you object to the processing and there are no overriding legitimate grounds;
• the data has been processed unlawfully; or
• we are legally obliged to delete the data.

Please note that in some cases we must retain certain data, for example due to legal obligations or in connection with ongoing disputes.

Right to restriction of processing
You have the right to restrict the processing of your personal data.

Right to data portability
You have the right to receive your data in a structured, commonly used and machine-readable format.

Right to object
You have the right to object to the processing of your personal data, in particular for direct marketing and profiling under Article 21 GDPR.

Right to withdraw consent
Where processing is based on your consent, you may withdraw that consent at any time.

Exercising your rights
You can exercise your rights or object by contacting the Privacy Officer via privacy-officer@krim.nl, stating “AVG-verzoek”.

Upon request, we will inform you whether we process personal data about you. In addition, under certain circumstances, you can request, correct, supplement, delete or block this data, for example if it is factually incorrect. You may also exercise any other right you have under applicable privacy legislation, such as objecting to the processing of your personal data. This may mean that you can no longer use all or part of our services.
You can submit a written request to the postal or e-mail address below. If necessary to verify your identity, we may ask you for a copy of your proof of identity. In that case, we ask you to black out your citizen service number (BSN) and passport photo. For example, you can use the Dutch government’s KopieID app for this purpose. If you do not wish to provide a copy of your proof of identity, we offer an alternative form of verification, such as verification via contact details already known to us.

We will respond to your request within one month.

De Krim Texel
Privacy Officer
Roggeslootweg 6
1795 JV De Cocksdorp

Or by e-mail: privacy-officer@krim.nl

Complaints
If you believe that we are not processing your personal data correctly, you have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, under Article 77 GDPR.