Privacy Statement Stichting Kunsthal Rotterdam
Version May 2022
This privacy statement applies to the processing of personal data by Stichting Kunsthal Rotterdam, located in the Museum Park, at Westzeedijk 341, 3015 AA Rotterdam and listed in the Dutch Commercial Register of the Chamber of Commerce under number: 41132613 (hereinafter: "Kunsthal", "we" or "us"). The content of this privacy statement should be interpreted in accordance with the General Data Protection Regulation (GDPR).
We process your personal data in the context of offering our products and/or services. This includes visiting our websites www.kunsthal.nl and www.kunsthalshop.nl. Kunsthal makes efforts to treat your personal data with due care and to protect your personal data in accordance with the requirements imposed by legislation and regulations, including the GDPR. We advise you to read this privacy statement carefully, so that you will be aware of your rights and obligations with regard to the processing of personal data by Kunsthal.
At our website you can always find the most current version of this privacy statement. Questions about the processing of personal data or this privacy statement can be directed to email@example.com.
2. Processing Personal Data
We process personal data from:
- Customers and visitors (incl. “Vrienden van de Kunsthal”);
- Other relationships, such as suppliers; and
- Website visitors.
We may process the following personal data, among others:
- Contact details, such as your name, address, city, zip code, (mobile) phone number and email address;
- Personal information, such as your gender and date of birth;
- Financial information, such as your bank details and information relating to your income (e.g. in the context of donations to Kunsthal);
- Video images captured by our security cameras; and
In principle, we will only retain your personal data for as long as necessary for the purposes listed below (insofar as applicable), or to comply with our legal (retention) obligations (such as tax obligations). In some cases we may keep personal data longer, for example when we have a legitimate interest that outweighs privacy interests.
3. How we obtain your personal data
We may obtain personal data because you provide it to us, for example when you purchase tickets for or buy products from Kunsthal, when you register as a Vriend van de Kunsthal, when you subscribe to the newsletter or when you contact us (for example by e-mail or telephone).
In principle, providing personal data to us is not mandatory. However, in order to carry out certain activities (such as, for example, issuing entrance tickets or to communicate with you) we need certain personal data. Some activities we cannot perform if you refuse to provide your personal data. To the extent that the input of personal data is necessary for you to purchase any of our products or services, it is indicated which personal data is necessary and which personal data may be provided optionally.
If you are under the age of 16, you may only provide personal information to us with the consent of your parent(s) or your legal representative who has read this privacy statement.
4. Grounds for and purposes of processing your personal data
We may use your personal data for the following purposes in particular:
- Offering and performing our services and offering products (e.g. providing information about exhibitions, ticket sales or sales through our webshop);
- Maintaining contact with you (e.g., answering questions you submit to us);
- Receiving donations and corresponding with Vrienden van de Kunsthal;
- For sending (electronic) commercial messages with information about our products and services and about products and services of parties affiliated with us (e.g. newsletters). If required by law, we will ask your permission for this;
- To establish relationships and execute agreements with our suppliers;
- To optimize and secure our website;
- To send you service messages, such as push notifications;
- To secure our premises, property, visitors and employees and to handle incidents;
- To comply with our legal obligations (including tax obligations).
5. Purposes of Processing
We can process your Personal Data for the following purposes:
- the entering and execution of an agreement in respect of the products and/or services we deliver (such as the online sale of tickets);
- to offer products and/or services from us and to adapt them to your needs and wishes;
- to be able to contact you;
- if you have given your unambiguous consent: to send you (electronic) commercial messages (newsletters) with information about our products and services, as well as products and services from affiliated parties;
- to send you user information and service messages, such as push notifications;
- to analyze, maintain, secure and optimize our Website and associated technologies;
- for compiling user statistics;
- to comply with relevant laws and regulations.
Your Personal Data will not be used for purposes other than the ones mentioned above. We can use service providers to process your Personal Data, which as processors will only act on our instructions.
We may engage third parties in the execution and/or delivery of our products and services. These third parties may process your personal data for the aforementioned purposes. When engaging (so-called) processors (or other third parties), we will ensure that appropriate safeguards are agreed and that the required technical and organizational measures are taken to protect your personal data. When we have to provide data to third parties, such as supervisors, authorities and investigative bodies, on the basis of a legal obligation, we always consider how we can respect your right to privacy as much as possible.
In principle, we process your personal data only within the European Economic Area (EEA). However, under certain circumstances it may happen that your data is transferred to countries outside the EEA, for example because a data center or our supplier is located there. Where this occurs, we will only do so under the conditions set by privacy law (including making efforts to ensure that an adequate level of protection exists and providing the necessary contractual, technical and organizational safeguards, for example, through implementing a contract to which the EU Standard Contractual Clauses apply and implementing any additional measures where required by legislation). If we are not assured of an adequate level of protection, we will inform you and seek your consent to the transfer of your personal data.
We provide appropriate security measures in the processing of your personal data to prevent unauthorized access, modification, disclosure or loss of personal data. If, despite these measures, there is a security incident (data breach) that is likely to have a high risk (adverse impact) on your privacy, we will inform you of the incident as soon as possible.
In the unlikely event that you find a security breach or suspect that the security of your personal data is not properly ensured, please contact us immediately.
7. Links to other people's websites
Our website may contain hyperlinks or other references to third party websites. We are not responsible for the content of these websites. We advise you to read the privacy statements of (and other relevant information relating to) third party websites carefully, so that you are aware of the processing of personal data by that website.
8. Your rights
You have the following rights with regard to the processing of your personal data:
- You may request information about and access to your personal data we process. This means that you can request what personal data has been registered about you and for what purposes that personal data is used;
- You can object to the processing of your personal data, for example, if you believe that the use of your personal data is not necessary for the performance of our activities or to comply with a legal obligation;
- If your personal data changes, you can have this personal data corrected. You may also ask us to restrict the processing of your personal data, also for the period of time we need to assess your requests or objections;
- You can also ask us to remove your personal data from our systems or to arrange for your personal data to be transferred to another party.
Requests and other communications regarding the exercise of your rights may be submitted in writing using the contact information at the top of this privacy statement. We may ask you to explain your request in more detail and/or to further identify yourself. In principle, you will receive a response within one month after receipt of your request.
We will comply with your request unless we have a compelling legitimate interest in not doing so, which outweighs your privacy interest or where complying with your request is not required by law and we would then no longer be able to perform the contract with you. We may also refuse to comply with the above requests if they are made unreasonably often, require unreasonable technical effort, or have unreasonable technical consequences for our systems or jeopardize the privacy of others. If we have deleted your personal data, we may not be able to immediately remove all copies of the personal data from our systems and backup systems for technical reasons. If Kunsthal has complied with a request to correct or delete personal data, we will notify third parties to whom such personal data has been disclosed of the changes made.
If you are not satisfied with the way in which we have dealt with your request or objection, or otherwise with the processing of your personal data by us, you can also lodge a complaint about the use of your personal data with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
This privacy statement may be changed by us at any time and without notice. Changes are effective from the time they are displayed on our website. We therefore advise you to regularly read this privacy statement for any changes. If these changes are of significant importance to you, we will endeavour to inform you about them.
10. Language and inconsistencies
This privacy statement was originally drafted in Dutch. If any inconsistency exists between this version and the Dutch version, the Dutch text will prevail over the English text.