Ark van NoachFind my tickets

Privacy statement

1. Data controller

Spelen bij Beelen B.V. (hereinafter: “we”, “us” or “our”) is responsible for the processing of personal data via the ticket platform tickets.spelenbijbeelen.nl. Contact details: Spelen bij Beelen B.V., Apollolaan 171f, 1077 AS Amsterdam · KvK: 42054928 · Email: info@spelenbijbeelen.nl.

2. Which personal data do we process?

When purchasing a Ticket, we process the following personal data:

  • Email address: to send the e-ticket and any messages about your order.
  • Name (optional): if you provide it with your order.
  • Payment status and transaction reference: to confirm that payment has taken place. We do not store full payment details (such as card number); these are processed exclusively by Adyen N.V.
  • IP address and technical connection data: recorded automatically for security and fraud prevention.

We do not process any special categories of personal data as referred to in Article 9 GDPR.

3. Purposes and legal bases

We process your data for the following purposes:

  • Performance of the contract (Art. 6(1)(b) GDPR): processing your order, delivering the e-ticket by email and answering questions about your purchase.
  • Legal obligation (Art. 6(1)(c) GDPR): retaining accounting and transaction data for the statutory tax retention obligation.
  • Legitimate interest (Art. 6(1)(f) GDPR): security of the Website, detection of fraud and misuse of Tickets.
  • Consent (Art. 6(1)(a) GDPR): if, during the ordering process, you ticked the box “Keep me informed of offers and events from Spelen bij Beelen”, we use your email address to send newsletters and promotional messages. You can withdraw your consent at any time via the unsubscribe link in every marketing email or by sending an email to info@spelenbijbeelen.nl. Withdrawing consent does not affect the lawfulness of messages sent earlier on the basis of that consent.

4. Retention periods

We do not retain your personal data longer than necessary for the purposes for which they were collected, unless a statutory retention obligation requires a longer period. In particular:

  • Order data and transaction references: 7 years after the financial year of purchase (statutory tax retention obligation, Art. 52 AWR).
  • Email address and e-ticket: up to 3 months after the park visit date, then deleted unless there is an open dispute.
  • Technical log files: maximum 90 days.
  • Email address for marketing purposes: until you withdraw your consent. After withdrawal, the address is removed from the marketing list within 30 days.

5. Processors and third parties

We use the following sub-processors. A processor agreement has been concluded with each of them:

  • Adyen N.V. (Amsterdam / worldwide): payment processing. Adyen processes payment data as an independent controller in accordance with the PCI DSS standard and its own privacy policy (adyen.com/policies-and-disclaimer/privacy-policy/).
  • Supabase Inc. (US, with storage in EU region): database management for storing orders and ticket data. Data is stored in an EU region (Frankfurt). Supabase is ISO 27001 certified.
  • Resend Inc. (US): email delivery for both transactional messages (e-tickets, order confirmations) and marketing messages (only to recipients who have given consent).
  • Scaleway SAS (France, EU): hosting of the application servers. Data remains within the EU.
  • Sentry (Functional Software Inc., EU region): error tracking to detect technical problems. Error events are stripped of personal data (PII scrubbing).

We also share data with the following party, which acts as an independent controller and is therefore not a processor:

  • Rotterdam Leisure Group (Rotterdam): operator of the canal cruise boats. If you book a cruise with us, we place that booking in their system and pass on your name, email address and phone number for that purpose — nothing more. They need this to receive you on board and to reach you about the sailing. They process this data under their own privacy policy and are responsible for it themselves. We do not book our own tenders with them, so nothing is passed on for those.

Beyond this we do not share your data with third parties unless we are legally obliged to do so (e.g. at the request of a judicial authority).

6. Transfer outside the EEA

Supabase and Resend are US companies. Transfer to the US takes place, where applicable, on the basis of the EU Standard Contractual Clauses as referred to in Article 46 GDPR. We prefer to store data in the EU regions of our processors.

7. Security

We take appropriate technical and organisational measures to secure your personal data. The Website uses TLS encryption (HTTPS). Access to customer data is limited to staff who need it for their task.

8. Your rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR): you can request which data we process about you.
  • Right to rectification (Art. 16 GDPR): you can have incorrect data corrected.
  • Right to erasure (Art. 17 GDPR): you can request deletion of your data, unless we have a legal ground to retain it.
  • Right to restriction of processing (Art. 18 GDPR).
  • Right to data portability (Art. 20 GDPR).
  • Right to object (Art. 21 GDPR): you can object to processing based on legitimate interest.

You can submit requests via info@spelenbijbeelen.nl. We respond within 30 days. We may ask you to confirm your identity. If you have given consent for marketing messages, you can withdraw that consent at any time free of charge, without this affecting the performance of your ticket order.

9. Lodging a complaint with the supervisory authority

Do you have a complaint about the way we handle your data? You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP): Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag · www.autoriteitpersoonsgegevens.nl · T: 0900-2001201.

10. Cookies

The Website may use functional and analytical cookies. Functional cookies are strictly necessary for the operation of the ordering environment. For non-functional cookies we ask for your consent via a cookie banner. Detailed information about the use of cookies is set out in our separate Cookie Statement.

11. Changes

We may amend this Privacy Statement. The most current version can always be consulted at tickets.spelenbijbeelen.nl/privacy. In the event of material changes, we will notify you by email where possible.

Version 1.0 · Adopted 30 June 2026

Privacyverklaring — Spelen bij Beelen