Privacy and cookie statement
Who we are
Mastercard Hotelnacht is organised by HBMEO B.V., Reguliersgracht 56, 1017 LT Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce under number 27188914 (“we”). We are responsible for the processing of personal data described in this policy. Questions? Email info@hotel-night.com.
Who this policy applies to
This policy applies to everyone whose personal data we process in connection with Mastercard Hotelnacht: visitors to hotel-night.com and the app, buyers of packages and tickets, people who book a programme item, visitors to the event, newsletter subscribers and contact persons at participating hotels, spots and partners.
Mastercard Hotelnacht is open only to visitors aged 18 and over. We do not knowingly process data of younger people.
What data we use, why, and on what legal basis
The table below shows, for each situation, what data we process, why, and on what legal basis under the GDPR.
You book a package
- Data
- Name, home address, email address, phone number, date of birth, dates of stay, number of guests, payment status
- Purpose
- Carrying out and confirming the booking; checking that you live in the Amsterdam region, that there is one booking per address and that you are 18 or over
- Legal basis
- Performance of the contract (Art. 6(1)(b) GDPR)
You buy a passe-partout or ticket
- Data
- Name, email address, phone number, date of birth, ticket details and QR code, payment status
- Purpose
- Delivering the ticket and checking that you are 18 or over
- Legal basis
- Performance of the contract
You book a programme item
- Data
- Name, email address, number of places
- Purpose
- Carrying out the reservation
- Legal basis
- Performance of the contract
You consent to news from a hotel or spot
- Data
- Name, the contact detail you consented for, the text of the checkbox, date and time
- Purpose
- Recording your consent and passing it on to that hotel or spot
- Legal basis
- Consent (Art. 6(1)(a) GDPR); you can withdraw it at any time
Your ticket is scanned at the door
- Data
- Barcode, the result valid or invalid, scan time and, if shown on the ticket, your name, ticket type and ticket details
- Purpose
- Checking access
- Legal basis
- Performance of the contract
You subscribe to our newsletter
- Data
- Email address and, if you provide it, your name; whether you open the newsletter and which links you click
- Purpose
- Keeping you informed about Mastercard Hotelnacht and improving the newsletter
- Legal basis
- Consent; you can unsubscribe via any newsletter
You contact us
- Data
- Name, contact details, content of your message
- Purpose
- Answering your question
- Legal basis
- Legitimate interest (Art. 6(1)(f) GDPR)
You are a contact person at a hotel, spot or partner
- Data
- Name, job title, email address, phone number, company details
- Purpose
- Carrying out the participation or cooperation
- Legal basis
- Performance of the contract with your organisation and legitimate interest
You attend the event
- Data
- Photos and video recordings in which you may appear
- Purpose
- Reporting on and promoting Mastercard Hotelnacht
- Legal basis
- Legitimate interest; see section 4
You visit our website or app
- Data
- Technical data such as IP address and browser type; visitor numbers without cookies
- Purpose
- Operating and securing the website and app and keeping track of visitor numbers
- Legal basis
- Legitimate interest; see section 9
We use your date of birth only to check that you are 18 or over. We do not pass it on to hotels or spots.
Photos and videos at the event
During Mastercard Hotelnacht, we and photographers engaged by us take photos and videos. We use them to report on and promote Mastercard Hotelnacht, for example on our website, in the app, on social media, in the newsletter and in press releases. We do not select images in which you are recognisable in an unfavourable situation. Do you not want to be recognisable in recordings, or would you like a photo of you to be removed? Tell the photographer or email info@hotel-night.com.
Data outside the European Economic Area
Some service providers, such as Vercel, Cloudflare, Mailchimp and Google, are US companies and may (also) process data outside the European Economic Area. We only allow this where there is a valid legal basis under the GDPR. For these providers, that is the EU-U.S. Data Privacy Framework, with the European Commission’s Standard Contractual Clauses as an additional safeguard. Data you enter in our forms is stored in the EU. Would you like to know which safeguards we use? Email us.
How long we keep data
We do not keep data longer than necessary:
- booking, ticket and reservation data, including your date of birth: up to 12 months after the end of the edition you booked for;
- data we must keep for our accounts, such as payments and invoices: 7 years, as required by law;
- consent for news and the newsletter: for as long as your consent applies; proof of consent and your unsubscription no longer than needed to demonstrate this;
- scan data: CM.com keeps a record of each scan for 30 days, with your personal data masked;
- contact messages: up to 12 months after your question has been dealt with;
- data of contact persons at hotels, spots and partners: for as long as we work with your organisation or can reasonably expect to work together again. We update or delete it when we learn that you no longer work there, or when you ask us to. Registrations, agreements and invoices are part of our accounts and are kept for 7 years;
- photos and videos: for as long as they are relevant for reporting and promotion, or until you object.
Security
We take appropriate measures to protect your data. Only staff who need your data for their work have access to it, using a personal account. Data is sent over secure connections and stored in secure systems. We have made agreements with hotels and spots on security, retention periods and reporting data breaches.
Cookies
Our website and app do not use analytical cookies or marketing or tracking cookies. We only use functional cookies that are necessary for the website to work; no consent is required for these.
We see how many people visit our website and app through the statistics of our hosting providers (Vercel and Cloudflare) and our content management system. These work without cookies and only show totals, such as the number of visits per page, not who you are.
You can delete cookies at any time in your browser settings.
Your rights
You have the right to:
- know what data we hold about you and receive a copy;
- have incorrect data corrected;
- have data deleted, if we no longer need to keep it;
- have the processing restricted;
- object to processing based on legitimate interest, such as photos and the data of business contact persons;
- withdraw your consent, without affecting processing that took place before;
- receive data you provided to us in a common format, or have it transferred.
Email your request to info@hotel-night.com. We will respond within one month. We may ask you to confirm your identity, but we will not ask for a copy of your ID if that is not necessary. If your request concerns what a hotel or spot does with your data, please also contact that hotel or spot.
Complaints
Not satisfied with how we handle your data? Let us know. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).
Changes
We may update this policy, for example when our way of working or the law changes. The date at the top shows when the policy was last updated. We will also announce important changes in another way.
Contact
HBMEO B.V.
Mastercard Hotelnacht
Reguliersgracht 56, 1017 LT Amsterdam, the Netherlands
info@hotel-night.com
Chamber of Commerce 27188914