Privacy statement Van der Valk Diensten Centrum
We consider your privacy important. We therefore process personal data in accordance with the applicable laws and regulations, including the General Data Protection Regulation (GDPR).
Within the Van der Valk organisation, work is carried out with a facilitating entity (Van der Valk Diensten Centrum B.V., hereinafter: VDC) and separate, independently operating Hotel & Restaurants. This means that responsibility for the processing of your personal data may differ, depending on the situation.
VDC is the controller for personal data processed in the context of central services and supporting processes (such as central systems, websites and marketing initiatives, insofar as applicable).
The individual Van der Valk Hotel & Restaurants are independently the controller for personal data which they process in the context of their own business operations, such as reservations, stays, service provision and customer contact.
This privacy statement relates exclusively to the processing operations for which VDC acts as controller. The privacy statement of the hotel concerned applies to processing operations by an individual hotel.
We handle your data with care and ensure appropriate security. In this privacy statement we explain which personal data VDC processes, why we do so and with whom we may share data.
This privacy statement applies to persons whose personal data VDC processes, such as:
bookers, guests and customers (insofar as related to central processes);
suppliers and their contact persons;
prospects, relations and other business contacts;
visitors to our websites and digital environments.
Do you have questions or would you like to know which data VDC processes about you? If so, please contact VDC via privacy@vandervalkhotelgroup.com or the contact details at the bottom of this privacy statement.
For questions about the processing of your personal data by a specific Van der Valk Hotel & Restaurant, you can contact the hotel concerned directly.
Processes
Below you will find an overview of the processes for which VDC processes personal data. For each process it is described for what purpose the data are used.
In the table below that, you can see which categories of personal data we process. It is also indicated in which cases we share personal data with third parties or make use of processors that support us in carrying out these processes.
Marketing and orientation
Online advertisements via marketing cookies
Purpose
Displaying personalised online advertisements (for example via Google) to users on the basis of their behaviour on websites and their interaction with Van der Valk communications.
These advertisements are intended to show you relevant and suitable offers and content, tailored to your interests and previous visits.
VDC is the controller for the placing and use of marketing cookies on central websites and for the use of these data for online advertising purposes.
We only process your data for marketing cookies and online advertisements where you have given your consent for this. You give this consent, for example:
via the cookie banner on the website; or
via the cookie settings, which you can adjust at a later time.
You can withdraw or change your consent at any time via the cookie settings on the website.
In addition – if you have given separate consent for this (for example via a subscription to marketing communications) – contact details may be used to compile target groups for online advertisements.
Which data do we process? | On what legal basis do we process these data? | How long do we retain these data? | Parties involved |
Cookies, pixels and comparable technologies (e.g. marketing cookies such as _ga) | Consent | For as long as necessary for the purpose of the cookie, in accordance with the cookie settings | Bloomreach B.V. |
Contact (e-mail address, telephone number) | Consent (for marketing and target group formation, if applicable) | No longer than necessary for this purpose | (is shared with marketing partners, such as Bloomreach B.V.) |
Valk Life
Purpose
Managing and operating the website www.valklife.com and the associated communications, such as Valk Life newsletters and the Valk Magazine.
The website www.valklife.com is managed by VDC. VDC is the controller for the personal data collected via this website and processed in the context of central marketing and communication activities, such as Valk Life newsletters, Valk Magazine and prize draws.
Where a promotion, offer or communication relates to a specific Van der Valk Hotel & Restaurant, that hotel will be independently the controller for the further processing of your data (for example for awarding a prize or handling a reservation). In that case, the privacy statement of the hotel concerned applies.
The data below may be processed when you take part in prize draws, subscribe to the Valk Life newsletter or the Valk Magazine, or complete a contact form via www.valklife.com.
Which data do we process? | On what legal basis do we process these data? | How long do we retain these data? | Parties involved |
Name (surname, first name) | Consent | Up to 1 year after unsubscribing | Bloomreach B.V., Softmedia B.V., Microsoft Ireland Operations Limited |
Communication (correspondence) | Legitimate interest | Up to 1 year after unsubscribing | Microsoft Ireland Operations Limited, Softmedia B.V. |
Contact (e-mail address) | Consent | Up to 1 year after unsubscribing | Bloomreach B.V., Softmedia B.V., Microsoft Ireland Operations Limited |
Contact (telephone number) | Consent | Up to 1 year after unsubscribing | Softmedia B.V. |
Address (full address) | Performance of the contract (e.g. dispatch of a prize or magazine) | Up to 1 year after unsubscribing | Microsoft Ireland Operations Limited, Printcare B.V. |
Online advent calendar
Purpose
Offering an online advent calendar via (digital) channels, whereby participants can take part in promotions during a certain period and stand a chance of winning prizes.
The online advent calendar is organised and managed by VDC. VDC is the controller for the processing of personal data in the context of the registration, participation and organisation of the advent calendar.
If a prize is offered by or provided via a specific Van der Valk Hotel&Restaurant, that hotel may be involved in the handling thereof (for example delivery of the prize or contact with the winner). In that case, the hotel concerned is independently the controller for the processing of personal data that takes place in that context. The privacy statement of the hotel concerned then applies.
We may process the data below when you:
take part in the online advent calendar;
register for a promotion or prize competition;
are selected as a winner and you need to be contacted;
receive a prize or have a prize delivered.
Participation in the online advent calendar is voluntary and takes place on the basis of your consent. A minimum age may apply in order to participate. In order to verify this, we ask you for your date of birth.
Which data do we process? | On what legal basis do we process these data? | How long do we retain these data? | Parties involved |
Contact (e-mail address, telephone number) | Consent | 7 years on the basis of audit obligations | Bloomreach B.V., LiveWall Group B.V. |
Age (date of birth) | Consent (age verification) | 7 years on the basis of audit obligations | Bloomreach B.V., LiveWall Group B.V. |
Address (country) | Consent | 7 years on the basis of audit obligations | Bloomreach B.V., LiveWall Group B.V. |
Name (full name) | Consent | 7 years on the basis of audit obligations | Bloomreach B.V., LiveWall Group B.V. |
Valk Account
Purpose
The Valk Account offers guests the possibility of making use of personal benefits, and of easily making bookings with participating VDC Van der Valk hotels and Valk Exclusief Hotels. In addition, the account makes it possible to manage guest data and preferences centrally and to use these when a guest logs in.
The Valk Account is supported technically and functionally by VDC. For the processing of personal data within the central account environment, VDC acts as controller.
When you log in with your Valk Account at a Valk Exclusief Hotel, relevant account and booking data will be made available to that entity. Valk Exclusief is subsequently independently the controller for the further processing of your personal data, for example in the context of reservations, stays and the awarding of benefits. In that case, the privacy statement of Valk Exclusief and/or the hotel concerned applies.
We may process the data below when you:
create or use a Valk Account;
log in to your Valk Account;
make or manage a booking via your account;
make use of benefits linked to the Valk Account.
Data are only shared with Valk Exclusief or a hotel insofar as:
these data are also known there or are necessary for the provision of the services; and
you actively make use of the Valk Account (for example by logging in or booking).
Which data do we process? | On what legal basis do we process these data? | How long do we retain these data? | Parties involved |
Booking (arrival date, number of nights, accommodation, additional bookings, booking date, booking channel, hotel, products and packages, reservation number, departure date) | Legitimate interest (ease of use and functioning of the account) | No longer than necessary for the account functionality; data are shared upon active use of the account if they are also known to Valk Exclusief or the hotel | Valk Exclusief, New Story B.V., New Orange B.V. |
Account (account name, active since, active until, status) | Legitimate interest | For as long as the account is active | Valk Exclusief, New Story B.V., New Orange B.V. |
Contact (e-mail address, telephone number) | Legitimate interest | For as long as the account is active | Valk Exclusief, New Story B.V., New Orange B.V. |
Name (full name) | Legitimate interest | For as long as the account is active | Valk Exclusief, New Story B.V., New Orange B.V. |
Account (password) | Legitimate interest (security of the account) | For as long as the account is active | New Story B.V., New Orange B.V. |
Creating guest profiles
Purpose
Drawing up and using guest profiles in order to better tailor communication, offers and service provision to the interests and preferences of (former) guests.
VDC processes personal data for the compilation and management of guest profiles in the context of central marketing and analysis activities. VDC acts as controller for this purpose.
The data used for building guest profiles may originate from various sources, including data on stays at Van der Valk Hotel & Restaurants and interactions with central systems or marketing channels.
The individual Van der Valk hotels are independently the controller for the processing of personal data in the context of their own reservations, stays and guest relationships. Where hotels share data with VDC (for example for the purpose of central marketing activities), this takes place within the applicable statutory frameworks and responsibilities.
We may process the data below when you:
book an overnight stay or stay at a Van der Valk hotel;
make use of services or products;
interact with marketing communications or digital channels;
have given consent to receive marketing communications (if applicable).
Which data do we process? | On what legal basis do we process these data? | How long do we retain these data? | Parties involved |
Booking (arrival date, number of nights, additional bookings, booking date, booking channel, hotel, products and packages, travel party, reservation number, departure date) | Legitimate interest (personalisation and improvement of service provision) | 7 years | Microsoft Ireland Operations Limited, Bloomreach B.V. |
Order (payment method, date of order, products) | Legitimate interest | 7 years | Microsoft Ireland Operations Limited, Bloomreach B.V. |
Contact (e-mail address, telephone number) | Legitimate interest (or consent if used for marketing communications) | 7 years | Microsoft Ireland Operations Limited, Bloomreach B.V. |
Age (date of birth) | Legitimate interest | 7 years | Microsoft Ireland Operations Limited, Bloomreach B.V. |
Sex/gender (sex) | Legitimate interest | 7 years | Microsoft Ireland Operations Limited, Bloomreach B.V. |
Background (nationality) | Legitimate interest | 7 years | Microsoft Ireland Operations Limited, Bloomreach B.V. |
Address (full address) | Legitimate interest | 7 years | Microsoft Ireland Operations Limited, Bloomreach B.V. |
Name (full name) | Legitimate interest | 7 years | Microsoft Ireland Operations Limited, Bloomreach B.V. |
Hotel newsletters
Purpose: Informing guests and interested parties about various subjects related to the hotel concerned.
We are pleased to keep you informed of interesting developments and offers of the Hotel & Restaurants. For that reason we periodically send out Hotel newsletters. We process your data for this purpose when you have subscribed to a Hotel newsletter or when you have previously stayed at the hotel and we inform you about comparable services, offers or packages of that hotel. You can always unsubscribe from the Hotel newsletters.
Which data do we process? | On what legal basis do we process these data? | How long do we retain these data? | Parties involved |
Contact (e-mail address) | Consent or legitimate interest | Until opt-out | Bloomreach B.V. |
Reading & browsing behaviour (click behaviour, reading behaviour, opening page/newsletter) | Legitimate interest | For as long as necessary | Bloomreach B.V. |
Name (full name) | Consent or legitimate interest | Until opt-out | Bloomreach B.V. |
Online advertisements following a hotel visit
Purpose
Displaying relevant online advertisements (for example via Google Ads) to (former) guests on the basis of previous interactions, such as a stay at a Van der Valk Hotel & Restaurant or use of digital channels.
These advertisements are intended to inform you about offers, packages or other services that match your previous stay or interests.
VDC is the controller for the processing of personal data that takes place in the context of central marketing activities, such as the compilation of target groups and the deployment of online advertisements.
The data used for this purpose originate (in part) from a stay at a specific Van der Valk Hotel & Restaurant. That hotel is independently the controller for the processing of your personal data in the context of the booking and the stay.
We only process your data for online advertisements where you have given your consent for this, for example:
via the website (for example via cookie settings); and/or
when subscribing to marketing communications.
You can always withdraw your consent via the settings on the website or via the unsubscribe options in communications.
Which data do we process? | On what legal basis do we process these data? | How long do we retain these data? | Parties involved |
Booking (arrival date, number of nights, booking date, departure date) | Consent | Are used for determining target groups and not retained longer than necessary for this purpose | Bloomreach B.V. |
Contact (e-mail address) | Consent | Is used for linking to advertising platforms and not retained longer than necessary | Bloomreach B.V. |
Booking (hotel) | Consent | Is used for segmentation (e.g. preferences) and not retained longer than necessary | Bloomreach B.V. |
Support and additional services
Vouchers
Purpose
Creating, issuing, applying and administering vouchers (such as credit vouchers, compensation or promotional vouchers) in the context of a reservation, stay or customer relationship.
Vouchers are as a rule issued and used by the Van der Valk hotel concerned. That hotel is therefore generally independently the controller for the processing of personal data associated with the issuing and redemption of vouchers. For more information about the processing of your personal data by a specific hotel, we refer you to the privacy statement of the hotel concerned.
VDC provides supporting systems and technical infrastructure for the management of vouchers. For these processing operations, VDC acts as independent controller for specific elements (such as central registration or platform management).
An external platform (such as Piggy) is used for the registration and management of vouchers. This party supports the processing of personal data and acts, depending on the set-up, as processor or as independent controller.
The data below may be processed when you:
receive a voucher (for example in connection with a promotion, compensation or purchase);
use a voucher for a booking or during a stay;
have contact about a voucher (for example in the event of questions or problems).
Which data do we process? | On what legal basis do we process these data? | How long do we retain these data? | Parties involved |
Booking (arrival date, departure date) | Performance of the contract | Up to 1 day after check-out | Leat Germany GmbH |
Contact (e-mail address) | Performance of the contract | Up to 1 day after check-out | Leat Germany GmbH |
Communication (remarks) | Performance of the contract | Up to 1 day after check-out | Leat Germany GmbH |
Guest contact
Purpose
Supporting guests and other data subjects with questions, requests and reports that are not made and handled directly or exclusively by a Van der Valk Hotel & Restaurant, for example via central customer service channels or digital platforms.
In this context, VDC processes personal data in order to register and assess questions and to ensure correct and efficient handling. These processing operations take place on the basis of a legitimate interest, namely being able to offer adequate support and improving the provision of services.
Where your question relates to a specific Van der Valk hotel (for example about a reservation or stay), VDC may share your data with the hotel concerned. That hotel is subsequently independently the controller for the further handling of your request. In that case, the privacy statement of the hotel concerned applies.
We may process the data below when you:
contact customer service (for example by e-mail, telephone or a contact form);
ask a question about a booking, order or voucher;
submit a complaint, request or report;
provide additional information in order to handle your question or request.
Which data do we process? | On what legal basis do we process these data? | How long do we retain these data? | Parties involved |
Communication (correspondence) | Legitimate interest (customer support) | For as long as necessary for the handling | Freshworks Inc., Shopify Inc., Microsoft Ireland Operations Limited |
Date & time (date, time of contact) | Legitimate interest | For as long as necessary for the handling | Freshworks Inc., Shopify Inc., Microsoft Ireland Operations Limited |
Contact (e-mail address) | Legitimate interest | For as long as necessary for the handling | Freshworks Inc., Shopify Inc., Microsoft Ireland Operations Limited |
Communication (conversation notes, internal correspondence) | Legitimate interest | For as long as necessary for the handling | Freshworks Inc. |
Contact (telephone number) | Legitimate interest | For as long as necessary for the handling | Freshworks Inc. |
Address (full address) | Legitimate interest (if relevant for the handling) | For as long as necessary for the handling | Freshworks Inc., Shopify Inc., Microsoft Ireland Operations Limited |
Name (full name) | Legitimate interest | For as long as necessary for the handling | Freshworks Inc., Shopify Inc., Microsoft Ireland Operations Limited |
Order (e.g. order number, products, status, delivery details) | Legitimate interest (answering questions) | For as long as necessary for the handling | Freshworks Inc., Shopify Inc., Microsoft Ireland Operations Limited |
Business (company name/employer) | Legitimate interest | For as long as necessary for the handling | Freshworks Inc., Shopify Inc., Microsoft Ireland Operations Limited |
Valk Store
Purpose
Offering and facilitating the online sale of articles under the Van der Valk brands.
The Valk Store is managed by VDC. VDC is the controller for the processing of personal data that takes place in the context of the online sale and handling of orders via the Valk Store.
Use of Shopify
The Shopify platform is used for the functioning of the Valk Store. Shopify acts in part as processor on behalf of VDC. In addition, Shopify processes certain personal data for its own purposes, in respect of which Shopify is independently the controller. VDC has no influence over these processing operations. You can find more information about this in the privacy statement of Shopify.
We may process the data below when you:
visit the Valk Store;
create or use an account;
place or return an order;
make a payment;
contact us about an order.
For payment we make use of an external payment service provider (Adyen). For the delivery of orders we may engage logistics parties. In addition, we process certain data on the basis of a legitimate interest in order to keep the Valk Store secure and functioning properly.
Which data do we process? | On what legal basis do we process these data? | How long do we retain these data? | Parties involved |
Order (quantity, date delivered, date of order, invoice address, order number, order status, products, reason for return, status, shipping method) | Performance of the contract | 7 years | Shopify International Ltd. |
Account (account name, active since, active until, status) | Legitimate interest (functioning and management of the account) | Until deletion of the account | Shopify International Ltd. |
Order (delivery address) | Performance of the contract | 7 years | Arli Group B.V., Monta, Shopify International Ltd. |
Financial (amount) | Performance of the contract | 7 years | Adyen, Shopify International Ltd. |
Order (payment method) | Performance of the contract | 7 years | Adyen, Shopify International Ltd. |
Contact (e-mail address) | Performance of the contract | 7 years | Shopify International Ltd. |
Financial (invoice address, invoice date, invoice number, products/services delivered, discount percentage and/or amount, transactions) | Performance of the contract | 7 years | Shopify International Ltd. |
Financial (IBAN) | Performance of the contract | Is processed by Valk Store exclusively in masked form | Adyen |
Address (full address) | Performance of the contract | 7 years | Arli Group B.V., Monta, Shopify International Ltd. |
Name (full name) | Performance of the contract | 7 years | Arli Group B.V., Monta, Shopify International Ltd. |
Account (password) | Legitimate interest (security of accounts) | For as long as the account is active | Shopify International Ltd. |
Business relations
Prospects
Purpose
Registering and managing potential business relations.
We process your data when you show interest in our services, contact us or when we investigate whether business cooperation is possible. We use these data in order to maintain contact and to provide information with a view to entering into a business relationship.
Which data do we process? | On what legal basis do we process these data? | How long do we retain these data? | Parties involved |
Company name | Legitimate interest | For as long as the relationship is active | Freshworks Inc. |
Particulars about the contact person or company | Legitimate interest | For as long as the relationship is active | Freshworks Inc. |
Correspondence | Legitimate interest | For as long as the relationship is active | Freshworks Inc. |
Contact (e-mail address) | Legitimate interest | For as long as the relationship is active | Freshworks Inc. |
Position of contact person | Legitimate interest | For as long as the relationship is active | Freshworks Inc. |
Date of birth of contact person | Legitimate interest | For as long as the relationship is active | Freshworks Inc. |
Conversation notes | Legitimate interest | For as long as the relationship is active | Freshworks Inc. |
Remarks about contact | Legitimate interest | For as long as the relationship is active | Freshworks Inc. |
Contact (telephone number) | Legitimate interest | For as long as the relationship is active | Freshworks Inc. |
Full name of contact person | Legitimate interest | For as long as the relationship is active | Freshworks Inc. |
Registration of business relations
Purpose
Registering and managing business relations.
We process your data when an organisation enters into or maintains a business relationship with us. We use these data for recording and managing business arrangements and overarching cooperation relationships.
Which data do we process? | On what legal basis do we process these data? | How long do we retain these data? | Parties involved |
Company name | Performance of the contract | For as long as the contract is renewed | Freshworks Inc., Shiji Deutschland GmbH |
Contractual arrangements | Performance of the contract | For as long as the contract is renewed | Freshworks Inc., Shiji Deutschland GmbH |
Contact (e-mail address) | Performance of the contract | For as long as the contract is renewed | Freshworks Inc., Shiji Deutschland GmbH |
Chamber of Commerce number | Performance of the contract | For as long as the contract is renewed | Freshworks Inc., Shiji Deutschland GmbH |
Business address | Performance of the contract | For as long as the contract is renewed | Freshworks Inc., Shiji Deutschland GmbH |
Full name | Performance of the contract | For as long as the contract is renewed | Freshworks Inc., Shiji Deutschland GmbH |
Corporate Portal
Purpose
Offering and managing a portal for business relations
Which data do we process? | On what legal basis do we process these data? | How long do we retain these data? | Parties involved |
Arrival date | Performance of the contract | 7 years | Valk Exclusief |
Number of nights | Performance of the contract | 7 years | Valk Exclusief |
Company name | Performance of the contract | 7 years | Valk Exclusief |
Booking date | Performance of the contract | 7 years | Valk Exclusief |
Hotel concerned | Performance of the contract | 7 years | Valk Exclusief |
Products and packages | Performance of the contract | 7 years | Valk Exclusief |
Reservation number | Performance of the contract | 7 years | Valk Exclusief |
Departure date | Performance of the contract | 7 years | Valk Exclusief |
Full name | Performance of the contract | 7 years | Valk Exclusief |
Account name | Performance of the contract | 7 years | Valk Exclusief |
Active since | Performance of the contract | 7 years | Valk Exclusief |
Active until | Performance of the contract | 7 years | Valk Exclusief |
Company name | Performance of the contract | 7 years | Valk Exclusief |
Status | Performance of the contract | 7 years | Valk Exclusief |
Full name | Performance of the contract | 7 years | Valk Exclusief |
Password | Performance of the contract | 7 years | Valk Exclusief |
Recipients of personal data
In the sections above you have been able to read that VDC makes use of external parties for certain processing operations. We refer to these parties as ‘recipients’. This overview includes only those recipients that are engaged by VDC in the context of the processing operations for which it is itself the controller.
Individual Van der Valk Hotel & Restaurants additionally make use of their own recipients for their business operations (such as reservations, payments and stays). These recipients fall under the responsibility of the hotel concerned and are therefore not included in this overview. For more information on this, we refer to the privacy statement of the hotel concerned.
We make arrangements with recipients that process personal data on our instructions in order to process your data carefully and securely. In that case, these parties act as processor. Some parties process personal data (in part) for their own purposes and are therefore independently the controller.
Sometimes your personal data are processed outside the European Economic Area (EEA). This is only permitted if appropriate safeguards are provided, such as the use of Standard Contractual Clauses (SCCs) approved by the European Commission. Where this is applicable, we have put these safeguards in place.
Overview of recipients
Recipient | Explanation | Recipient’s details |
Microsoft Ireland Operations Limited | IT environment (Microsoft 365) | One Microsoft Place, South County Business Park, Leopardstown, Dublin, Ireland |
Bloomreach B.V. | Marketing automation and personalisation | Fred. Roeskestraat 109, 1076 EE Amsterdam, the Netherlands |
Exact Netherlands B.V. | Financial administration and HR systems | Molengraaffsingel 33, 2629 JD Delft, the Netherlands |
Freshworks Inc. | Customer service and ticketing system | 2950 S. Delaware Street (Suite 201), San Mateo, CA, United States (outside the EEA – SCCs applicable) |
Shopify International Ltd. | E-commerce platform (Valk Store) | 1-2 Haddington Road, Dublin, Ireland |
Shopify Inc. | E-commerce platform | 151 O’Connor Street, Ottawa, ON, Canada |
LiveWall Group B.V. | Technical support for campaigns (e.g. advent calendar) | Stationsstraat 5, 5038 EA Tilburg, the Netherlands |
New Story B.V. | Support for booking and account systems | Erasmusweg 19, 2202 CA Noordwijk, the Netherlands |
Postcode.nl B.V. | Address enrichment | Haarlemmerweg 317-H, 1051 LG Amsterdam, the Netherlands |
Leat Germany GmbH | Support for loyalty programme/vouchers | Stadtweide 17, 46446 Emmerich am Rhein, Germany |
ActiveCampaign LLC | E-mail marketing | 1 N Dearborn St, 5th Floor, Chicago, IL, United States (outside the EEA – SCCs applicable) |
New Orange B.V. | Support for loyalty programme | Graaf Reinaldweg 22, 4176 LX Tuil, the Netherlands |
Softmedia B.V. | Website management (e.g. valklife.com) | Kanaaldijk-Zuid 15A, 5611 VA Eindhoven, the Netherlands |
Printcare B.V. | Distribution of printed matter (e.g. magazine) | Honderdland 120, 2676 LV Maasdijk, the Netherlands |
Valk Exclusief | Owner of the corporate portal | Winthontlaan 4-6, 3526 KV in Utrecht, the Netherlands |
Changes to this privacy statement
VDC may amend this privacy statement if developments within our organisation or changes in laws and regulations give cause to do so. If changes have consequences for the manner in which we process your personal data, we will inform you about this via our website or other appropriate channels. At the top of this privacy statement you will always find the most recent version and the effective date.
Please note: individual Van der Valk Hotel & Restaurants apply their own privacy statement for the processing operations for which they are responsible. Changes to those statements are communicated by the hotels concerned themselves.
Your rights
If VDC processes your personal data, you have various rights under the General Data Protection Regulation (GDPR). Would you like to exercise your rights? If so, please contact VDC via privacy@vandervalkhotelgroup.com or the contact details at the bottom of this privacy statement. Please clearly indicate which right is involved.
If your request relates to processing by a specific Van der Valk hotel, we may refer you to the hotel concerned. That hotel is, after all, independently the controller for that processing operation. In order to be able to handle your request properly, we may ask you to confirm your identity.
We will in principle respond to your request within 1 month. If that is not possible, we will inform you in good time of the reason and the possible extension.
You have the following rights:
Right of access
You can request which personal data VDC processes about you. Please indicate as specifically as possible which data you wish to access.
Right to rectification
You can ask us to correct or supplement your data if these are inaccurate or incomplete.
Right to erasure
You can request us to delete your personal data. We assess for each request whether we can comply with it (for example because of statutory retention obligations).
Right to data portability
You can ask us to receive or have transferred certain personal data in a structured, commonly used and machine-readable format, insofar as this right is applicable.
Right to restriction of processing
In certain cases you can ask us to temporarily restrict the use of your personal data.
Right to object
You can object to the processing of your personal data, for example in the case of use for direct marketing or because of your specific situation.
Right to withdraw consent
If we process your personal data on the basis of your consent, you can withdraw that consent at any time.
You can find more information about your rights on the website of the Dutch Data Protection Authority.
Security of your personal data
VDC takes appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access.
These measures are aimed, among other things, at:
securing systems and networks;
restricting access to personal data to authorised persons;
safeguarding the confidentiality and integrity of data.
Technical measures:
Encryption of personal data at rest and in transit (AES-256, TLS 1.2+)
Multi-factor authentication (MFA) mandatory for access to systems containing personal data
Role-based access control (RBAC) via Microsoft Entra ID — employees only have access to data that are necessary for their position
Logging and monitoring of access to systems and personal data (audit trails)
Endpoint protection on workstations and servers
Automatic time-out and locking of sessions
Encrypted e-mail communication and secure file transfer
Organisational measures:
Information security policy established and periodically reviewed (in line with ISO 27001)
Processors are only engaged by means of a signed data processing agreement (GDPR art. 28)
Employees are bound by a duty of confidentiality and receive periodic privacy awareness training
Procedure for reporting and handling data breaches (including notification to the Dutch Data Protection Authority within 72 hours where applicable)
Data classification policy — personal data are identified, labelled and treated accordingly
Retention periods policy with periodic data clean-up
Access requests and data subjects’ rights are handled via an established process
Periodic internal audits on compliance with the privacy policy
Submitting a complaint
Do you have a complaint about the use of your personal data by VDC? If so, please first contact us via privacy@vandervalkhotelgroup.com. We handle every complaint with care.
In addition, you of course always have the right to submit a complaint to the supervisory authority, the Dutch Data Protection Authority.
Contact details
Do you have questions about this privacy statement or would you like to know which personal data VDC processes about you? If so, please contact us via the details below:
Van der Valk Diensten Centrum B.V.
Stationsweg 91
6321 LK
privacy@vandervalkhotelgroup.com
+31 (0)88 024 6301