Zandvoort Pass is a digital tourist pass and local guide for visitors of Zandvoort. Through the service, users can access local deals, tourist information, routes, recommendations and other content related to Zandvoort.

1. Who we are

The data controller responsible for the processing of your personal data is:

2. Scope of this Privacy Policy

This Privacy Policy applies to:

• the Zandvoort Pass website;
• the Zandvoort Pass mobile app for iOS and Android;
• user accounts;
• digital passes;
• deal usage and validation;
• customer support;
• related services provided under the Zandvoort Pass name.

This Privacy Policy does not apply to websites, apps or services of third parties that we may link to, such as local businesses, payment providers, map services, app stores or external websites.

3. Personal data we collect

We only collect personal data that is necessary for providing and improving Zandvoort Pass.

3.1 Account data

When you create or use a Zandvoort Pass account, we may collect:

• first name;
• last name;
• email address;
• preferred language;
• account status;
• account creation date;
• last login date.

The public website can be used without an account. The mobile app requires an account to access the pass functionality.

3.2 Pass and purchase data

When you purchase or use a Zandvoort Pass, we may process:

• pass number or pass identifier;
• pass status;
• validity period;
• purchase source;
• payment provider;
• payment ID;
• amount paid;
• currency;
• payment status;
• purchase date.

We do not store your credit card number, bank account number or other full payment details. Payments are processed by Stripe or another payment provider shown during checkout.

3.3 Deal usage and redemption data

When you use a deal in the app, we may process:

• user ID;
• pass ID;
• deal ID;
• partner/business ID;
• redemption code or QR code;
• redemption status;
• date and time the deal was shown;
• date and time the deal was used;
• expiry date of the redemption;
• technical device identifier where necessary for fraud prevention and security.

This is necessary to check whether a deal is valid, unused and linked to an active pass.

3.4 Data shown to local businesses

When a local business checks or scans a Zandvoort Pass code, the business may see:

• your name;
• your pass number;
• whether the pass or deal is valid;
• relevant deal information.

Local businesses do not receive your email address, payment details or full account data through the validation page.

3.5 Support and communication data

If you contact us, we may process:

• your name;
• email address;
• message content;
• any information you choose to provide;
• our replies and support history.

We use this data to answer your questions, solve issues and provide support.

3.6 Technical and security data

When you use our website, app or services, we may process limited technical data, such as:

• IP address;
• device type;
• browser type;
• operating system;
• app version;
• server logs;
• date and time of requests;
• error logs;
• security logs.

We use this data to keep the service secure, prevent abuse, fix technical issues and maintain the reliability of Zandvoort Pass.

4. Data we do not collect

Zandvoort Pass does not currently collect or use:

• live location data;
• GPS location data;
• marketing tracking cookies;
• advertising pixels;
• behavioural advertising profiles;
• analytics data from third-party analytics platforms;
• push notification tokens;
• newsletter or marketing email preferences.

If this changes in the future, this Privacy Policy will be updated where necessary.

5. Cookies and similar technologies

The Zandvoort Pass website does not currently use marketing cookies, advertising cookies or third-party analytics cookies.

We may use strictly necessary technical cookies or similar technologies if required for basic website or app functionality, security, login sessions or fraud prevention. These do not require separate marketing consent.

If we introduce analytics, advertising cookies or similar tracking technologies in the future, we will update this Privacy Policy and, where legally required, ask for your consent.

6. How we use your personal data

We use your personal data for the following purposes:

• to create and manage your account;
• to provide access to the Zandvoort Pass app;
• to issue and manage digital passes;
• to process purchases and payment status;
• to validate deals and prevent duplicate or invalid use;
• to show local businesses whether a pass or deal is valid;
• to provide customer support;
• to protect the service against fraud, misuse and security threats;
• to maintain and improve the website, app and backend systems;
• to comply with legal, tax and accounting obligations.

We do not sell your personal data.

7. Legal bases for processing

We process personal data under the General Data Protection Regulation (GDPR) based on the following legal bases:

7.1 Performance of a contract

We process account data, pass data, purchase data and redemption data because this is necessary to provide Zandvoort Pass to you.

7.2 Legal obligation

We process and retain certain payment and administration data to comply with tax, accounting and other legal obligations.

7.3 Legitimate interests

We process limited technical, security and usage data for our legitimate interests, including:

• securing the service;
• preventing fraud and misuse;
• debugging technical issues;
• maintaining reliable app and website functionality;
• handling customer support.

We balance these interests against your privacy rights.

7.4 Consent

If we introduce optional features that require consent, such as marketing emails, push notifications, location-based features or advertising cookies, we will ask for your consent before using your data for those purposes.

8. Payments

Payments are processed by Stripe or another payment provider shown during checkout.

We may receive payment-related information such as:

• payment ID;
• payment status;
• amount;
• currency;
• date of payment;
• refund or cancellation status.

We do not store full credit card numbers, bank account numbers or full payment credentials. Your payment provider processes these details under its own privacy policy and security standards.

9. Maps and external links

Zandvoort Pass may contain map features, route buttons, addresses or links that open external map services, such as Apple Maps or Google Maps.

When you open or use these external services, the relevant third party may process your data under its own privacy policy. Zandvoort Pass is not responsible for how these external services process your data.

The same applies when you click links to local businesses, websites, social media pages or other third-party services.

10. App stores

The Zandvoort Pass app may be distributed through the Apple App Store and Google Play Store.

Apple and Google may process personal data when you download, install, purchase or use the app through their platforms. Their processing is governed by their own privacy policies, terms and platform rules.

11. Service providers

We use trusted service providers to operate Zandvoort Pass. These providers may process personal data on our behalf, for example for:

• hosting;
• database storage;
• email delivery;
• payment processing;
• app distribution;
• security;
• technical maintenance;
• customer support systems.

Where required, we enter into appropriate data processing agreements with service providers that process personal data on our behalf.

We do not give service providers permission to use your personal data for their own marketing purposes.

12. Sharing personal data with local businesses

When you use a deal, the local business participating in Zandvoort Pass may need to verify whether your pass and deal are valid.

For this purpose, the business may see limited information, such as your name, pass number, deal information and validity status.

This information is only shown to allow the business to validate the deal. Local businesses are not given access to your full account, email address, payment information or account history through the validation page.

13. International transfers

We aim to use service providers located in the European Economic Area where reasonably possible.

If personal data is transferred outside the European Economic Area, we will take appropriate safeguards where required by GDPR, such as using standard contractual clauses or relying on adequacy decisions.

14. Data retention

We do not keep personal data longer than necessary.

In general, we apply the following retention periods:

• account data: retained while your account is active;
• deleted account data: deleted or anonymised within 30 days, unless longer retention is legally required;
• pass and redemption data: retained for as long as needed to operate the pass, prevent fraud, handle disputes and maintain administration;
• payment and invoice-related data: retained for up to 7 years where required for Dutch tax and accounting obligations;
• support messages: retained for up to 2 years after the last contact, unless needed longer for a dispute or legal obligation;
• technical and security logs: usually retained for up to 90 days, unless longer retention is necessary for security, fraud prevention or investigation;
• anonymised data: may be kept indefinitely because it can no longer identify you.

If we need to retain certain data longer because of a legal claim, dispute, fraud investigation or legal obligation, we will retain only the data that is necessary for that purpose.

15. Account deletion

You may request deletion of your account by contacting:

[email protected]

After receiving your request, we will delete or anonymise your personal data where possible. Some data may need to be retained for legal, accounting, security or fraud prevention reasons.

Deleting your account may mean that you can no longer use your Zandvoort Pass, access purchased features or view your pass history.

16. Security

We take appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure, alteration and destruction.

These measures may include:

• restricted access to personal data;
• secure authentication;
• encrypted connections where appropriate;
• protected backend systems;
• logging and monitoring for security purposes;
• regular maintenance and updates.

No digital service can be guaranteed to be completely secure. You are responsible for keeping your login access and email account secure.

17. Children and minors

Zandvoort Pass is intended for tourists and visitors who are able to independently use the service or have permission from a parent or legal guardian.

We do not knowingly target children or knowingly collect personal data from children without appropriate permission. If you believe that a child has provided us with personal data without proper permission, please contact us at [email protected].

18. Your privacy rights

Under GDPR, you have the following rights regarding your personal data:

• the right to access your personal data;
• the right to correct inaccurate personal data;
• the right to request deletion of your personal data;
• the right to restrict processing;
• the right to object to certain processing;
• the right to data portability;
• the right to withdraw consent where processing is based on consent;
• the right to lodge a complaint with a supervisory authority.

To exercise your rights, contact us at:

[email protected]

We may ask you to verify your identity before handling your request.

19. Complaints

If you believe that we process your personal data unlawfully or do not handle your request properly, please contact us first at:

[email protected]

You also have the right to lodge a complaint with the Dutch Data Protection Authority:

20. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example when we add new features, change service providers or need to comply with new legal requirements.

The latest version will always be available through the Zandvoort Pass website or app. If the changes are important, we may notify you in a suitable way, such as through the app, website or email.

21. Contact

For questions about this Privacy Policy or the way we process personal data, contact: