Privacy Policy

1. What data we collect

When you make a booking

Name, email address, phone number, the details of your booking, and correspondence about it.

When you pay

Payment is handled entirely by Stripe. We receive confirmation that a payment succeeded, the amount, and the last four digits of the card where applicable. We never see or store your full card details.

When you contact us

Your name, email address and whatever you write to us, by email, through the contact form or through the chat function on the site.

When you sign up for our newsletter or waitlist

Your name and email address.

When you visit the site

IP address, device and browser information, pages visited and how you arrived. This is collected through cookies and similar technologies. Analytics and advertising cookies are only set if you accept them through our cookie banner.

2. Why we use it, and on what legal basis

Where we rely on consent, you can withdraw it at any time. Change your cookie preferences through the cookie settings link on the site, or unsubscribe from any newsletter using the link at the bottom of the email. Withdrawing consent doesn't affect anything we did before you withdrew it.

3. Who else is involved

We do not sell your personal data, and we do not pass it to other companies to use for their own purposes.

We share it in two situations.

With the local partner who delivers your booking. When you book a tour, a stay or an activity, we pass your name and the details needed to run it to the partner concerned, for example a tour operator or a guesthouse. Without this, the booking cannot happen. The partner is responsible for how it handles your data from that point on.

With service providers who process data on our behalf. These are companies whose tools we use to run the platform: our payment processor, our hosting and content management providers, our email and newsletter services, our analytics and advertising platforms, our map and cookie consent tools, and the provider of the chat assistant on the site. They act on our instructions and may not use your data for their own purposes, with one exception noted below.

Our advertising platforms, Meta and TikTok, also use data collected through their tracking pixels for their own advertising purposes. That's why those cookies only load if you accept them.

The chat assistant on the site sends what you type to an external AI provider in order to generate a reply. Please don't enter payment details or sensitive personal information into it. If you'd rather not use it, email us instead.

If you'd like to know which specific providers we use and what safeguards apply to them, email info@grietjebie.org and we'll tell you.

We may also disclose data where we're legally required to, for example to tax authorities or in response to a lawful order.

4. Data outside the European Economic Area

Several of our service providers are based in the United States or process data there. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses, by the provider's certification under the EU-US Data Privacy Framework, or both. You can ask us for details of the safeguards that apply to a particular provider by emailing info@grietjebie.org.

5. How long we keep it

After these periods the data is deleted or anonymised.

6. Cookies

We use cookies that are necessary to make the site work, and, if you accept them, cookies for analytics and advertising. You choose when you first visit, and you can change your choice at any time through the cookie settings on the site. Necessary cookies cannot be switched off, as the site won't function without them.

7. Your rights

Under the GDPR you have the right to:

• — Access — ask for a copy of the personal data we hold about you
• — Rectification — have inaccurate data corrected
• — Erasure — ask us to delete your data, where no legal obligation requires us to keep it
• — Restriction — ask us to pause processing while a dispute is resolved
• — Objection — object to processing based on legitimate interest
• — Portability — receive your data in a common machine-readable format
• — Withdraw consent — at any time, for anything we do on the basis of consent

Email info@grietjebie.org to exercise any of these. We'll respond within one month. We may ask you to confirm your identity first, so that we don't hand your data to someone else.

8. Security

We use encrypted connections, restrict access to personal data to those who need it, and work with established providers who maintain their own security standards. No system is perfect, but we take this seriously and will tell you promptly if something goes wrong in a way that affects you.

9. Children

Grietjebie is not intended for children under 16. We don't knowingly collect data from them. If you believe we have, contact us and we'll delete it.

10. Changes to this policy

We may update this policy as the platform develops. The date at the top shows when it last changed. Significant changes will be announced on the site.

11. Contact and complaints

For any question about this policy or about your data: info@grietjebie.org.

If you're not satisfied with how we've handled it, you have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.