Privacy Statement

1. INTRODUCTION HOTEL KOFFIEHUIS VOYAGERS PRIVACY STATEMENT

This is the privacy statement of Hotel Koffiehuis Voyagers. This privacy statement applies to all privacy-sensitive information or personal data that you provide to us, for example when you send an e-mail to us. We clearly explain how we store your data, how long it is stored and what exactly the purpose of the data processing is. In addition, we give you clear insight into how you can exercise your rights with regard to data processing.

WHAT EXACTLY DOES HOTEL KOFFIEHUIS VOYAGERS DO?

Hotel Koffiehuis Voyagers is a beautiful hotel located right in the heart of Amsterdam. We rent neat and comfortable rooms to travelers, tourists and passers-by. Guests can visit the city here, spend the night with comfort after a trade fair or as a stopover between flights.

Because we process (or have processed) personal data in various situations, we have opted for an extensive privacy statement. Occasionally there are situations in which Hotel Koffiehuis Voyagers has to collect and process/use your personal data. It is important that you are informed as to what happens to your personal data and how you can communicate your wishes with regard to the handling of personal data.

Hotel Koffiehuis Voyagers takes your privacy very seriously and will use and process personal information in a secure manner. All articles in this privacy statement are in accordance with the applicable (General Data Protection Regulation GDPR legislation). This European privacy legislation has been applicable in the Netherlands since 25 May 2018. 2. CATEGORIES OF PERSONAL DATA

2. Categories of personal data

In order to be able to support our visitors and customers as well as possible, it is necessary for us to collect/process certain data, including personal data. Personal data is all data that can be traced back to a natural person. The personal data that we (generally) process are:

• First and last name;
• Address;
• Contact information;
• Payment information;
• Nationality;
• Place of birth;
• Date of birth;
• Occupation or purpose of visit;
• (Personal) e-mail address (please note: under the GDPR, certain company e-mail addresses may be designated as personal e-mail addresses. Think of the e-mail address [email protected]).

We only store and use the personal data that are provided directly by you, or of which it is clear that they are provided for processing by Hotel Koffiehuis Voyagers, for example when filling in a registration form.

3. BASIS AND PURPOSES FOR DATA PROCESSING

Under the GDPR legislation, we are obligated to have a lawful basis for the processing of your personal data. Article 6 paragraph 1 sub a, sub b and sub c of the GDPR are applicable to our situation: the processing of your personal data is done on the basis of consent, because it is necessary for the execution of an agreement between you and Hotel Koffiehuis Voyagers or because it is necessary to comply with our legal obligations.

Article 13 paragraph 1 sub c of the GDPRArticle 13 paragraph 1 sub c of the GDPR then requires us to clearly indicate for which 'processing purposes' the personal data are intended. Below is therefore an overview with the applicable processing purposes.

There are a number of purposes for which Hotel Koffiehuis Voyagers collects your data:

1. Contact us

If you have contacted Hotel Koffiehuis Voyagers in any way, the data you provide will be stored and used for the course of further contact. The contact can be via e-mail or telephone. This data is collected by, for example, filling in the contact form.

2. The Agreement

When an agreement is made, Hotel Koffiehuis Voyagers needs certain information. Without this information, it is not possible to properly execute the agreement. Think of first and last name, contact information, payment information and date of birth.

3. Night register (nachtregister)

As a hotel, we are obliged to keep the night register. The municipality of Amsterdam has set additional requirements for this in the APV. When you stay at a hotel in Amsterdam you will be included in this register. The data that are included are your name, address, place of residence, nationality, date of birth, place of birth, profession or job, day of arrival and day of departure.

4. Accounting

Hotel Koffiehuis Voyagers is legally obligated to keep a thorough accounting. For this purpose, the data that is usually present on quotations or invoices are stored. Think of data such as your name and, if necessary, bank details.

5. Social Media

Hotel Koffiehuis Voyagers uses social media. When you contact the organization through one of these channels, the organization processes the relevant data that you share in the communication.

6. Invoicing

Certain data are processed for sending the invoices, including name and address details and billing address.

4. Storage Period

Above we have indicated for which processing purposes we use your personal data. According to Article 13 paragraph 2 sub a of the GDPR, we additionally must indicate the storage period of personal data.

1. Contact us

If the contact does not lead to the performance of a service or work, the data provided by you, such as the e-mail address, will be stored for a maximum period of two (2) years.

2. The agreement

All data relating to an agreement will in any case be kept for the period that the agreement is active. At the time the agreement has expired or been completed, we will retain this data for two (2) years.

3. Accounting

In order to do our bookkeeping, we must keep personal data related to financial purposes for a statutory period of at least seven (7) years, possibly increased by five (5) years for internal accounting.

4. Invoicing

The data for this purpose will be kept for seven (7) years after the preparation of the documentation. This is unless a longer storage period is necessary in connection with legal obligations, limitation periods and/or an expected legal dispute.

5. Night register (nachtregister)

The municipality of Amsterdam requires that the (sub)administration is kept for at least seven (7) years, including the night register (nachtregister).

6. Social media

The data you have shared will be kept for a maximum of four (4) weeks, unless this data needs to be kept longer for another purpose.

7. Camera surveillance

According to the GDPR directive, camera images are stored for a maximum of two (2) weeks, unless an incident has occured such as theft or vandalism. In this case, the data is kept until the incident has been resolved.

5. RECIPIENTS OF PERSONAL DATA

Hotel Koffiehuis Voyagers shares personal data with third parties in certain cases: this only happens when this is strictly necessary. In all cases, Hotel Koffiehuis Voyagers will comply with the GDPR legislation, specifically Article 28 et seq. GDPR, as the controller.

Below we offer you an overview of external parties with whom we share your personal data.

OVERVIEW OF THIRD PARTY(S) WHO RECEIVE PERSONAL DATA FROM YOU:

• Google

Certain cookies on this website may collect certain data, this data may be shared with Google. For more information about Google's privacy policy, please see Google's Privacy Statement.

• Booking.com

Booking.com offers an overview of available accommodations in the region. You can book at Hotel Koffiehuis Voyagers through the services of Booking.com. If you choose to do so, this party will also process your personal data. For more information about Booking.com's privacy policy, please consult the relevant privacy statement.

• Great Stay

The Great Stay application gives us the opportunity to communicate with you about requests, your reservation and more. You can choose to put information in this app, in which case this can be processed. Would you like to know more about how Great Stay handles your personal data? You can consult the privacy statement for more information.

• Pronk & Alleman BV

We use a third party to do our accounting. We only share the necessary with this office. We have concluded a processing agreement to restrict the processing of your personal data.

Furthermore, we will not provide the data you provide to other parties, unless this is required by law. If we share personal data with a party other than the parties mentioned above, we will first ask your permission for this, for example by amending the privacy statement of Hotel Koffiehuis Voyagers.

6. Security

Personal data are only accessible to the authorized employees of Hotel Koffiehuis Voyagers. The devices on which your data is stored are locked with a password and/or fingerprint scan and/or facial recognition. This concerns the necessary devices, such as computers, laptops and mobile phones.

Hotel Koffiehuis Voyagers keeps a secure backup of your personal data. The backup is offline and is not connected to the Hotel Koffiehuis Voyagers network by default. This backup resists ransomware attacks, hackers, and less obvious things like bit rot.

For the website or digital data Hotel Koffiehuis Voyagers uses firewalls and virus scanners. Your visit to the Hotel Koffiehuis Voyagers website is also secured by 'https' security. This means that your connection to Hotel Koffiehuis Voyagers is private.

Furthermore, we use a closed software that is additionally protected with a password. Only the authorized personnel have access to this system.

For the sake of completeness, below is more information regarding our online security:

• All devices that have access to your personal data and are part of the processing of personal data are password protected.
• Security software, such as a firewall and secure programs.
• We send your data via a secure internet connection. You can see this in the address bar 'https' and the padlock in the address bar.
• We use a closed software.
• No personal data is physically stored.

7. YOUR RIGHTS WITH REGARD TO YOUR PERSONAL DATA

Below are the rights that you can exercise with regard to your personal data. We hereby indicate in as much detail as possible how the relevant right can be used.

• Right of access (Article 15 GDPR)

You always have the right to view the data processed and stored by Hotel Koffiehuis Voyagers. To exercise this right, you can send an e-mail with your request to: [email protected].

• Right to rectification (Article 16 GDPR)

If the data stored by Hotel Koffiehuis Voyagers turns out to be incorrect, you have the right to have this data rectified. Hotel Koffiehuis Voyagers will then replace the current incorrect data with the correct data.

• Right to data portability (Article 20 GDPR)

You have the right to have personal data transferred by Hotel Koffiehuis Voyagers to a similar party. This refers to a party that offers and performs roughly the same services as Hotel Koffiehuis Voyagers.

• Right to erasure (Article 17 GDPR)
In certain cases you can request Hotel Koffiehuis Voyagers to have data removed. To this end, you have the option with the right to be forgotten. Below you will find a list of situations in which Hotel Koffiehuis Voyagers must delete your data:
• If the data processed by Hotel Koffiehuis Voyagers is no longer necessary for the processing purpose.
• If the consent to the use of the personal data is withdrawn by you. For example, by responding to the newsletter with your request, or by emailing [email protected].
• If you object to the processing of your data. In the case of direct marketing, you always have an absolute right to object. If your interests with regard to the processing of personal data outweigh those of Hotel Koffiehuis Voyagers, you have a relative right. The deletion of the data will then only take place if it has been demonstrated that your interests outweigh those of Hotel Koffiehuis Voyagers.
• If Hotel Koffiehuis Voyagers processes data unlawfully, you have the right to have the data deleted by Hotel Koffiehuis Voyagers. This is the case, for example, if there is no legal basis for the processing of personal data.
• If a statutory retention period has been exceeded, Hotel Koffiehuis Voyagers is obligated to delete the processed personal data.
• If you, as a data subject, are younger than 16 years old and no consent has been granted by a parent or guardian for the processing of the personal data. In this case, Hotel Koffiehuis Voyagers will immediately delete your personal data.
It is possible that there are exceptions to the right to be forgotten. For more information, please refer to the following page.
• Right to file a complaint with the Dutch Data Protection Authority

The moment you are of the opinion that Hotel Koffiehuis Voyagers does not handle your personal data in a thorough manner, you always have the right to file a complaint with the Dutch Data Protection Authority. You can do so via this link. The Dutch Data Protection Authority will handle your complaint.

• Right to stop data consumption, objection (Article 21 GDPR)

You have the right to object to data processing at any time. Especially in the case of 'direct marketing'.

Furthermore, we point out the following rights:
• Right to restrict (part of) the processing: under certain conditions you have the right to obtain from Hotel Koffiehuis Voyagers the restriction of the processing of your personal data. In short, this means that Hotel Koffiehuis Voyagers temporarily "freezes" the processing of the data. You can invoke this right in four situations: (1) pending the assessment of a correction request, (2) if data should actually be deleted but you do not want deletion, (3) if Hotel Koffiehuis Voyagers no longer needs the data while it is still necessary for (the preparation for) a lawsuit and (4) pending the assessment of an objection.
• Withdrawal of consent: you have this right insofar as we process your data on the basis of your consent. You have the right to withdraw consent once given at any time. This has no consequences for the past, but it does mean that we will no longer be allowed to use this data. It may be that Hotel Koffiehuis Voyagers can no longer provide you with certain services.

WANT TO MAKE USE OF THE ABOVE RIGHTS?

In most cases, an e-mail to [email protected] is enough to make use of the aforementioned rights. If we have doubts about the validity of your identity, we can use other measures to determine your identity. For example, we may ask you to provide us with a copy of your passport or ID. This is always done in the way prescribed by the Dutch government. In most cases, a less invasive method of proof of identity will suffice. The use of the aforementioned rights is free of charge; barring abuse.

We would like to point out that the rights described above are not absolute rights. There may be circumstances that prevent Hotel Koffiehuis Voyagers from complying with a certain request. We will always assess each request on its own merits. If we do not (or cannot) comply with a certain request, we will of course inform you of this motivated.

8. Duties

Hotel Koffiehuis Voyagers processes your personal data, as indicated, on the basis of various legitimate interests. Your personal data will never be sold to a third party.

The data that is required to provide are the minimum personal data required for the provision of our services. If you do not provide us with this mandatory information, Hotel Koffiehuis Voyagers will not be able to offer the services (properly).

If it is necessary to share your data with parties other than the parties mentioned above, your permission will of course first be requested by changing our privacy statement. We always make changes known via the website of Hotel Koffiehuis Voyagers.

Hotel Koffiehuis Voyagers reserves the right to disclose or share data when required to do so by law, or when Hotel Koffiehuis Voyagers deems it justified to comply with a legal request or process. Hotel Koffiehuis Voyagers will do the same when it comes to protecting (our) property or the organization. We will respect your right to privacy as much as possible.