English
Privacy Notice
De Tuinkamer | Stay & Retreat
Last updated: 22 September 2026
1 Who is responsible for your data
De Tuinkamer | Stay & Retreat, referred to below as De Tuinkamer, we, us or our, with its registered address at Rechteind 1, 9746 RV Groningen, the Netherlands, registered with the Dutch Chamber of Commerce under number 72135131 and VAT number NL001422458B11, is the controller of the personal data described in this notice.
You can contact us at Rechteind 1, 9746 RV Groningen, the Netherlands, by telephone on +31 6 29432591 or by email at [email protected].
This privacy notice applies to our bed and breakfast, the websites https://de-tuinkamer-stay-retreat.nl and https://de-tuinkamer-stay-retreat.online, the booking and contact functions connected to those websites or provided through Lodgify, direct enquiries and bookings, bookings made through external booking platforms, and our contact with guests before, during and after a stay.
External booking and communication platforms also process personal data for their own services. They are independent controllers for those processing activities.
2 From whom and where we receive data
We usually receive personal data directly from you. We may also receive limited data from the lead guest or a fellow traveller, from Lodgify, from the platform through which you book, such as Airbnb, Booking.com, Vrbo or Expedia, or from a communication channel you choose to use, such as WhatsApp or Facebook.
If a lead guest provides data about fellow guests, we ask the lead guest to share this privacy notice with them.
3 Personal data we process
Depending on how you contact us or make a booking, we may process the following data:
Identity and contact data, such as first and last name, address, place and country of residence, email address and telephone number.
Booking and stay data, such as arrival and departure dates, number of guests, composition of the party, ages where relevant to occupancy, price or tax, the accommodation selected, price, preferences and practical details for the stay.
Data for the legally required guest register. Article 438 of the Dutch Criminal Code requires at least the guest's name, place of residence, arrival and departure dates and the type of identity document shown. Article 2:42 of the 2021 Groningen General Municipal By-law also lists address, date and place of birth, and occupation or capacity. We record these data only to the extent that the rules applicable to our accommodation require them.
Payment and accounting data, such as payment status, amount, invoice details, transaction reference, tourist tax and, for a direct bank transfer, the account number visible on the payment.
Correspondence, such as emails, messages sent through Lodgify, a booking platform, WhatsApp or social media, telephone notes, questions, complaints and information you provide voluntarily.
Ordinary dietary preferences and, only after explicit consent, information about allergies or food intolerances.
Technical website data, such as IP address, browser and device type, pages visited, referring page, date, time and duration of the visit, cookie choices and technical log data.
Reviews and feedback shared through a booking platform or directly with us.
We do not record a Dutch citizen service number, known as a BSN. We do not copy, scan or retain your identity document. We may ask you to show a valid identity document on arrival. We record only the details required by law for the guest register, including the type of document shown.
4 Why we process data and our legal bases
Enquiries and bookings. We use the necessary data to answer questions, determine availability and price, record a reservation, and take steps before entering into and performing the accommodation contract. The legal basis is Article 6(1)(b) GDPR.
Your stay. We use the necessary data for check-in, communication, breakfast, service, safety, damage handling and performance of the stay. The legal basis is the contract. For fraud prevention, safety and the protection of our rights, we may rely on our legitimate interests under Article 6(1)(f) GDPR after balancing the interests involved.
Dietary requirements and allergies. We process ordinary dietary preferences to perform the stay. Information about an allergy or food intolerance may be health data. We record such information only after you have given explicit consent under Article 9(2)(a) GDPR. You may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
Payment and accounting. We process data to receive payments, verify platform payouts, maintain invoices and accounts and answer payment questions. The legal bases are performance of the contract and compliance with our legal accounting obligations under Article 6(1)(b) and (c) GDPR.
Guest register and tourist tax. We process the data needed to comply with Article 438 of the Dutch Criminal Code, the Groningen General Municipal By-law, the rules on tourist tax and other applicable legal duties. The legal basis is Article 6(1)(c) GDPR.
Contact, complaints and disputes. We use correspondence to assist you, handle complaints, establish agreements and bring, exercise or support legal claims. The legal basis is the contract or our legitimate interest in providing good service and protecting our legal position.
Website operation and security. We process technical data to operate the websites, contact forms and booking module, prevent failures, spam and misuse and monitor security. This includes the use of reCAPTCHA on the contact form at https://de-tuinkamer-stay-retreat.online. The legal basis is our legitimate interest in reliable and secure websites. Strictly necessary storage on your device is covered by the applicable exception under the Dutch Telecommunications Act.
Statistics and non-essential technologies. We use limited analytics without consent only when configured to have little impact on your privacy. We ask for prior consent for other analytics, social media and marketing technologies. Where personal data are processed, the legal basis is then Article 6(1)(a) GDPR.
Feedback and reviews. We may use feedback to improve our service on the basis of our legitimate interests. We publish an identifiable review outside the platform on which you posted it only with your consent.
Newsletters and offers. We do not automatically use booking or contact data for newsletters or personalised offers. We do so only if you have given separate consent. You can unsubscribe easily at any time.
5 Direct bookings and bookings through a platform
At https://de-tuinkamer-stay-retreat.nl, we use a Lodgify booking module. The website https://de-tuinkamer-stay-retreat.online is hosted through Lodgify and also contains Lodgify booking and contact functions. When you check availability, submit an enquiry, contact us or book directly, Lodgify processes booking, contact and technical data on our behalf. We are the controller of guests' personal data and Lodgify is our processor.
If you book through Airbnb, Booking.com, Vrbo or Expedia, or another external platform, that platform processes data to provide its account, search and booking service, communications, payments, security and other purposes of its own. The platform is an independent controller for those purposes. Once the platform provides us with the data required for your booking, we process them for the purposes described in this notice.
Please also read the privacy notice of Lodgify and of the booking or communication platform you use.
6 Cookies and similar technologies
Our websites use cookies, local browser storage, scripts and similar technologies. The exact technologies differ between the websites. Strictly necessary technologies support core functions, security, caching, your cookie choices and the operation of contact and booking functions. They do not require consent. If you make a cookie choice, it is stored in your browser until you change it, the configured retention period expires or you delete your browser data.
At https://de-tuinkamer-stay-retreat.nl, we use Phoenix Analytics for visitor statistics. If this service is configured solely as limited, privacy-friendly analytics, it may be used without consent. We request prior consent for any configuration that involves more extensive processing of personal data or storage of or access to information on your device that is not strictly necessary.
At https://de-tuinkamer-stay-retreat.online, the contact form is protected by Google reCAPTCHA. If you visit the form page or use the form, Google may receive technical and interaction data, such as your IP address, browser and device information and data about your interactions. We use reCAPTCHA to distinguish legitimate use from spam and misuse. Google's privacy policy also applies to Google's processing. Where reCAPTCHA or another service stores or accesses information on your device that is not strictly necessary, we request prior consent.
Social media features and marketing code, including Meta or Facebook code, are loaded only after you have given marketing consent. Without that consent, only an ordinary link to an external social media platform should be available. If you choose to click such a link, the privacy notice of that platform applies.
The available cookie settings identify the provider, purpose, category and retention period of each service. You may reject non-essential technologies without losing the websites' core functions. At https://de-tuinkamer-stay-retreat.nl, you can change or withdraw your choice just as easily later by using the Cookies button. Where a technology at https://de-tuinkamer-stay-retreat.online requires consent, the relevant choice is offered through the Lodgify cookie settings displayed there. You can also delete cookies and local storage through your browser.
The web servers may temporarily process IP addresses and technical log data for administration and security. We do not use these data to follow you outside our websites.
7 With whom we share personal data
We do not sell your personal data. Where necessary, we may share data with:
Phoenix or IMU and other providers of website hosting, forms, email, security and IT services for https://de-tuinkamer-stay-retreat.nl;
Lodgify, which hosts https://de-tuinkamer-stay-retreat.online and supplies our booking, reservation and contact functions;
Google, for reCAPTCHA on the contact form at https://de-tuinkamer-stay-retreat.online;
the booking platform through which you book or communicate;
banks, payment providers and accounting or administration service providers;
providers of the communication channels you choose, such as your email provider or WhatsApp and Meta;
the Municipality of Groningen, Noordelijk Belastingkantoor, the Dutch Tax and Customs Administration, the police or other competent authorities where required by law;
legal and other professional advisers where needed for advice, a complaint, a dispute or a legal duty.
Where a party processes personal data only on our instructions, we enter into a data processing agreement where required. A party that determines its own purposes and means is an independent controller for that processing.
8 Transfers outside the European Economic Area
Some suppliers and platforms may process personal data outside the European Economic Area. For processors we engage, we use only a transfer mechanism permitted by the GDPR. This may be an adequacy decision by the European Commission, participation by a US recipient in the EU-US Data Privacy Framework, or the European Commission's Standard Contractual Clauses, with supplementary measures where necessary.
Independent booking and communication platforms are responsible for their own international transfers. Please consult their privacy notices for details. You may ask us which transfer mechanism applies to a processor engaged by us and how to obtain a copy or description of the relevant safeguards.
9 How long we retain data
We do not retain personal data for longer than necessary for the purpose for which we use them. The following periods apply in principle:
An enquiry that does not lead to a booking and other completed contact messages: no more than 6 months after the last substantive contact.
Booking and stay communications: no more than 2 years after departure. We retain data that form part of the contract, payment records or tax records for longer where a statutory retention duty requires this.
Invoices, payments, platform payouts and other core tax records: generally 7 years under Dutch tax retention rules. A different statutory period may apply to some records.
Guest register data: for as long as required for the statutory registration duty and inspection by a competent authority. Where those data also form part of the relevant tax records, the 7-year tax retention period generally applies. We delete data earlier when they are no longer needed for either purpose.
Ordinary dietary preferences and allergies or food intolerances provided with consent: no later than 4 weeks after departure. If consent is withdrawn, we delete health data sooner unless they are still needed to deal with an incident or legal claim.
Technical security and server logs: no more than 6 months, unless a security incident requires investigation and longer retention.
Identifiable or pseudonymous analytics data: no more than 14 months. Truly anonymous, aggregated statistics may be retained for longer.
Complaints, incidents and disputes: for as long as needed to deal with them and then for the applicable statutory limitation period.
A review published on our own channels with consent: until you withdraw consent or the publication is no longer needed, unless a statutory exception applies.
Data retained by an external platform for its own purposes are subject to that platform's retention policy.
10 Data you are required to provide
Data needed for an enquiry or booking are required so that we can take steps before entering into and perform the accommodation contract. Without those data, we may be unable to process your enquiry or booking.
Guest register and tourist tax data are legally required where the relevant rules apply to your stay. If you do not provide those data or do not show a valid identity document where the law requires it, we may be unable to complete check-in or provide the stay.
Sharing dietary preferences, allergies and food intolerances is voluntary. Without that information, we cannot take them into account when providing breakfast. Consent to non-essential cookies and marketing is also voluntary. Refusal does not affect the websites' core operation or your ability to make an enquiry about a stay.
11 Children's data
Our websites and booking facility are not directed at children booking accommodation independently. A booking for a minor is made by a parent, guardian or another authorised adult. We process only the data about minor guests that are needed for occupancy, price, safety or a legal duty.
12 Automated decision-making
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
13 Security
We take appropriate technical and organisational measures to protect personal data against loss, unauthorised access, unlawful use, alteration and disclosure. We limit access to people and service providers who need the data and use encrypted connections, strong account security and up-to-date equipment and software where appropriate.
No digital system is entirely risk-free. If a possible personal data breach occurs, we investigate it, limit its effects and comply with the applicable recording, notification and information duties.
14 Your privacy rights and complaints
Depending on the circumstances, you have the right to:
obtain access to the personal data we process about you;
have inaccurate or incomplete data corrected;
have data erased where no statutory exception applies;
restrict processing;
object to processing based on a legitimate interest;
object to direct marketing;
receive data you provided in a structured, commonly used and machine-readable format or have them transmitted, where processing is automated and based on consent or a contract;
withdraw consent at any time.
You can send a request to [email protected]. If we have reasonable doubts about your identity, we may request additional information. We use an appropriate and minimally intrusive verification method and do not routinely request a copy of your identity document.
We respond without undue delay and in principle within one month. For a complex request or several requests, this period may be extended by no more than two months. We will tell you within the first month why more time is needed.
If you have a question or complaint about how we handle your data, you may contact us. You may also lodge a complaint directly with the Dutch Data Protection Authority at https://www.autoriteitpersoonsgegevens.nl/een-tip-of-klacht-indienen-bij-de-ap.
15 Third-party links and services
Our websites contain links to and components from external services. If you follow an external link or use a third-party service, that third party's privacy and cookie notices apply to its own processing. We recommend reading those notices before providing personal data.
16 Changes to this privacy notice
We amend this privacy notice when our services, websites, suppliers or the law change. The current version is published on our websites. The last-updated date appears at the top. We will inform affected individuals appropriately of material changes.