VERBLIJFMAKERS · PRIVACY POLICY

How we handle personal data

Version dated October 4, 2026. This statement applies to all Verblijfmakers websites, introductory tours, payment and account environments, and digital products.

1. Who is responsible?

Verblijfmakers is the data controller: Multatulistraat 30, 2985 BJ Ridderkerk, Chamber of Commerce registration number 42138983, VAT number NL005528582B52. Please send any questions or requests to privacy@verblijfmakers.nl.

2. What data do we process?

Depending on what you use, we process your name, email address, company and billing details, payment and subscription status, login and security details, contact messages, preferences and marketing consent. In onboarding pathways and products, we process your answers, progress and results. For Verblijfmakers Content, we also process your Content Profile, brand and product information, schedule, feedback, usage data, and any photos, videos and logos you have uploaded. We do not receive full payment card or bank details from Mollie.

3. Objectives and principles

• Agreement and preparation: processing requests, setting up accounts and granting access, delivering products, creating content, managing subscriptions and providing support.
• Legal obligation: Handle invoicing, tax records, refunds and statutory requests.
• Legitimate interest: to secure websites, prevent misuse, investigate faults, carry out limited usage measurements and improve our services. We balance this interest against your privacy.
• Permission: only for optional marketing or other purposes for which consent is required. You may withdraw your consent at any time, without this affecting the lawfulness of any processing carried out prior to that.

Where data is required for an application or contract, we cannot process it without the requested information. Marketing is always voluntary and is separate from the provision of services.

Waiting list Guest folder

When you register, we will store your email address, your name, your guest name (if applicable), your enquiry or question, your place in the registration queue, the time and the version of your consent. We use this data solely to email you about the launch and availability of the ‘Guest folder’. You will not be subscribed to a general newsletter. Consent is disabled by default. You can unsubscribe via privacy@verblijfmakers.nl. Registrations remain on the active waiting list for a maximum of 12 months. The data is stored in our secure database; only authorised administrators can export it. We will forward your registration via our email service, Resend, to hallo@verblijfmakers.nl, so that we can answer your enquiry and keep you informed about the launch. The form does not use any external analytics.

Guest folder: guest details, security and deletion

As the owner of the property, you are the data controller for your guests’ personal data. Verblijfmakers processes this data on your behalf to provide the personal guest folder, pre-registration, and management services. We remain solely responsible for your account, payments, and support. The Data Processor Agreements for Guest folder are part of this service.

This includes booking and contact details, room allocation, arrival and departure times, meal preferences, messages between the guest and the accommodation provider, and the registration details required by the selected country form. Private details from the booking and the registration details provided are stored in encrypted form. The connection is secure and administrative access is linked to the owner’s account. Guest details are not included in the general PDF or hardcover guide provided in the room. A guest cannot access other guests’ completed registration details via their personal link.

Temporary pre-registration entries are deleted during the next clean-up task as soon as the departure occurred more than 30 days ago. Upon submission, an encrypted archive copy is also automatically created. In the absence of a confirmed retention policy, this copy remains available for 30 full days after departure. Following confirmation by the operator, the archive copy is subject to the applicable national policy: for professional Spanish rentals, three years after departure; for a French police record, six months from the date of signature; for German notification forms, one year after departure; for the Belgian register, seven years after departure; for the Austrian electronic register, seven years from the date of registration. In the Netherlands, the operator must specify the local authority’s retention period and source. Italian digital receipts from Alloggiati Web can be uploaded separately and remain available for five years from the date of issue. The retention period for Portuguese data in SIBA is not a general retention period for a property’s own guest register; Portuguese pre-registration data is stored here temporarily. Meal preferences are deleted during the next clean-up task following check-out. Record versions in the private test environment are purged 30 days after creation. The archive manages storage and export, but does not carry out identity checks, digital signing or official reporting. It does not guarantee that all statutory registration obligations have been fulfilled. Once the retention period has expired, the app blocks access and downloads; the encrypted content is deleted during the next clean-up task.

Check the details, the correct retention policy and the specified departure date. Keep any required signed originals yourself. Export documents in good time if you need them outside the archive as well. You are responsible for retaining your own legally required records, signed originals and exports in accordance with the rules applicable to your stay. Exports that you download or print yourself will not be deleted by us. The retention periods for account and payment details apply separately and do not extend the availability of pre-registration.

Messages in the guest folder are visible to the travel group with the same guest link and to the administrator. Both the original and the translation are stored in encrypted form. For translation, the message text is sent to DeepL; we ask guests not to send any identity documents, payment details or medical information in a conversation. Messages are deleted 30 days after departure during the next clean-up task. Mobile notifications are optional and require permission on the device. The push service provided by Apple, Google or Mozilla receives the notification data; the notification does not contain any message content or registration details. A guest notification may contain the personal guest link, exclusively within the encrypted push content, to open the guest’s own conversation. You can disable notifications on the device.

As the owner, you are responsible for handling guest requests to access, correct, or delete their data. We’ll support you in this process via privacy@verblijfmakers.nl. An invitation to return will only be sent with the guest’s explicit consent; consent can be withdrawn via the unsubscribe link.

4. AI and client materials

The free IdeeSpiegel from From Idea to Dream does not use any external AI API. Within Verblijfmakers Content, verified profile data and instructions may be processed via an AI service to generate and check draft content. Customer images and customer data are not used for public marketing, other customers or model training by Verblijfmakers. Automated suggestions are reviewed by you; no decisions are made that have legal consequences or similar significant implications.

5. Recipients and disclosure

Only authorised persons and essential suppliers are granted access. We currently use Sites/Cloudflare for hosting, databases and storage, Resend for transactional email, Mollie for payments and OpenAI for the content support described. For the ‘Guest folder’, we also use DeepL to translate guest information and PrintAPI for ordering a hardback and the necessary delivery details. They only process what is necessary for their task. Where data is processed outside the European Economic Area, we use a valid data transfer mechanism, such as an adequacy decision or the EU Standard Contractual Clauses, with additional measures where necessary.

6. Retention periods

• contact and introduction requests: up to 12 months after completion, unless earlier deletion is possible or longer retention is necessary for a dispute;
• account, product and progress data: for as long as access or the contract remains in force, and for up to 24 months thereafter for support and recovery purposes;
• Content subscription: active until the end date of the paid period, followed by 60 days of read-only access; thereafter, your profile, uploads, designs and usage history will be deleted. Technical backups will expire no later than 30 days after that;
• marketing data: until withdrawal or, at the latest, 24 months after the last verifiable interaction;
• invoices, payments and tax records: 7 years, or longer if required by a legal obligation or ongoing dispute;
• security logs and temporary login tokens: for as short a period as possible and, in principle, no longer than 12 months or the technical validity period, respectively.

7. Telephone notifications and security

Phone notifications are disabled by default. When you enable them yourself, we store the technical push notification log from your device so that the app can notify you when new content is available. We do not use this log for advertising purposes. You can disable notifications at any time in the Content Profile or via your phone’s settings; when your content data is deleted, the log is also deleted.

We restrict access by account and role, use encrypted connections, secure sessions and temporary login links, log administrative access where appropriate, and enter into agreements with suppliers. In the event of a data breach, we act in accordance with the GDPR and notify those affected where required by law.

8. Your rights

You can request access to, rectification, erasure, restriction, portability or object to the processing of your data, and you can withdraw your consent. Email privacy@verblijfmakers.nl. We may ask for additional identification and will, in principle, respond within one month. You can also lodge a complaint with the Dutch Data Protection Authority.

9. Cookies and local storage

Our websites use functional technologies for login, security and session management. With your consent, we also track visits, product interest, click behaviour and usage using random browser and session codes. We do not link these to names, responses or individual payments. We do not place advertising cookies. Further details can be found in the Cookie Policy.

10. Amendments

We may amend this statement should our services or legislation change. The current version is always available here. In the event of significant changes, we will inform active customers directly where reasonably necessary.