Privacy statement Hotel Arnhem

We consider your privacy very important. We therefore process your personal data carefully and in accordance with the applicable laws and regulations, including the General Data Protection Regulation (GDPR). In this privacy statement we explain which personal data we process, why we do so and with whom we share your data.

Who is responsible for your data?

Hotel Arnhem, Van der Valk Hotel Arnhem is the controller for the processing of personal data in the context of reservations, stay and service provision. The hotel makes use of systems and services supplied by Van der Valk Diensten Centrum B.V. (VDC). These support the hotel in the processing of personal data. For specific central processing operations (such as marketing, accounts or platforms), VDC may be the independent controller. In that case we refer to the privacy statement of VDC.

When do we process your data?

We process your personal data when, for example, you:

make or change a reservation;
stay in our hotel;
make use of our other services;
make a payment;
contact us.

Our processing operations

Booking an overnight stay

Purpose
Processing and recording your reservation.

We process your data as soon as you make a booking via our website or via other channels.

Data: Booking details (arrival, stay, reservation details)
Legal basis: Performance of a contract
Retention period: 7 years after the end of the calendar year
Party involved: Amadeus, ActiveCampaign, Shiji

Data: Business details
Legal basis: Performance of a contract
Retention period: 7 years
Party involved: Amadeus, ActiveCampaign, Shiji

3.
Data: Contact details
Legal basis: Performance of a contract
Retention period: 7 years
Party involved: Amadeus, ActiveCampaign, Shiji

Data: Invoice details
Legal basis: Performance of a contract
Retention period: 7 years
Party involved: Amadeus, ActiveCampaign, Shiji

Data: Gender, comments, preferred language, name
Legal basis: Performance of a contract
Retention period: 7 years
Party involved: Amadeus, ActiveCampaign, Shiji

Data: Postcode
Legal basis: Legitimate interests
Retention period: As short as possible
Party involved: Postcode.nl

2. Emails concerning your stay

Purpose
Sending information and offers relating to your stay.

We process your data if you have a reservation and we inform you about your stay and possible offers in that respect.

Data: Booking details
Legal basis: Performance of a contract
Retention period: 4 weeks + 2 days
Party involved: ActiveCampaign

Data: Postcode
Legal basis: Performance of a contract
Retention period: 4 weeks + 2 days
Party involved: ActiveCampaign

3. Check-in

Purpose
Processing and registering your arrival and stay.

We process your data at the moment you check in at our hotel.

Data: Arrival and departure details
Legal basis: Performance of the contract
Retention period: 7 years
Parties involved: Amadeus, New Story, Shiji

2.
Data: Booking (details)
Legal basis: Performance of the contract
Retention period: 4 weeks + 2 days
Party involved: ActiveCampaign

Data: Date of birth and place of birth
Legal basis: Performance of the contract
Retention period: 7 years
Party involved: Amadeus, New Story, Shiji

4. Credit card authorisation/verification

Purpose
Processing and registering a credit card authorisation or verification.

We process your data when we have to verify a credit card or have to reserve an amount as security for a reservation, stay, payment or deposit.

Data: Credit card details (limited)
Legal basis: Legitimate interest
Retention period: 7 years
Party involved: Amadeus

Data: Name
Legal basis: Legitimate interest
Retention period: 7 years
Party involved: Amadeus

5. Payment link

Purpose
Processing and sending a payment request.

We process your data when we send you a payment request, for example for a down payment, deposit or outstanding amount.

Data: Contact details and name
Legal basis: Performance of the contract
Retention period: 4 weeks + 2 days
Party involved: ActiveCampaign

Data: Country, language of communication
Legal basis: Performance of the contract
Retention period: 4 weeks + 2 days
Party involved: ActiveCampaign

3.
Data: Outstanding balance
Legal basis: Performance of the contract
Retention period: 4 weeks + 2 days
Party involved: ActiveCampaign

6. Online payment

Purpose
Processing and registering an online payment.

We process your data when you make a payment via our online payment environment.

Data: Reservation number, e-mail, amount, invoice address
Legal basis: Performance of the contract
Retention period: Is passed on
Party involved: Adyen

7. Business bookings

Purpose
Processing and registering a business booking.

We process your data when you make a booking via a business account or on the basis of a business relationship with our hotel.

1.
Data: Company data, contact details, name
Legal basis: Performance of the contract
Retention period: Until the end of the relationship
Party involved: New Story

Data: Login details
Legal basis: Performance of the contract
Retention period: Until the end of the relationship
Party involved: New Story

Data: Financial data
Legal basis: Performance of the contract
Retention period: 7 years
Party involved: New Story

Recipients of personal data

In the sections above you have been able to read that we make use of external parties for certain processing operations. We refer to these parties as ‘recipients’. This overview includes only those recipients that are engaged by us in the context of the processing operations for which we are ourselves the controller.

We make arrangements with recipients that process personal data on our instructions in order to process your data carefully and securely. In that case these parties act as processor. Some parties process personal data (in part) for their own purposes and are therefore the independent controller.

Sometimes your personal data are processed outside the European Economic Area (EEA). This is only permitted if appropriate safeguards are provided, such as the use of Standard Contractual Clauses (SCCs) approved by the European Commission. Where this is applicable, we have put these safeguards in place.

Overview of recipients

Recipient:
Adyen
Description:
Payment service provider
Recipient details:
Simon Carmiggeltstraat 6-501011 DJ, Amsterdam, The Netherlands
Recipient:
New Story B.V.
Description:
Booking engine support
Recipient details:
Erasmusweg 192202 CA, Noordwijk, Netherlands
Recipient:
Postcode.nl B.V.
Description:
Matching postcodes to addresses
Recipient details:
Haarlemmerweg 317-H1051 LG, Amsterdam, Netherlands
Recipient:
Amadeus Hospitality Netherlands B.V.
Description:
PMS system provider
Recipient details:
Catharinastraat 164811 XD, Breda, Netherlands
Recipient:
ActiveCampaign LLC
Description:
Email service provider
Recipient details:
1 N Dearborn St, 5th Floor60602, Chicago, IL, United States. Outside the EEA. Safeguards: Standard Contractual Clauses (United States of America)
Recipient:
Shiji Deutschland GmbH
Description:
Property management system
Recipient details:
Tempelhofer Ufer 110961, Berlin, Germany

Changes to this privacy statement

We may amend this privacy statement if developments within our organisation or changes in laws and regulations give cause to do so. If changes have consequences for the manner in which we process your personal data, we will inform you about this via our website or other appropriate channels. At the top of this privacy statement you will always find the most recent version and the effective date.

Your rights

If we process your personal data, you have various rights under the General Data Protection Regulation (GDPR). Would you like to exercise your rights? If so, please contact us via [e-mail address] or the contact details at the bottom of this privacy statement. Please clearly indicate which right is involved.

In order to be able to handle your request properly, we may ask you to confirm your identity. We will in principle respond to your request within 1 month. If that is not possible, we will inform you in good time of the reason and the possible extension.

You have the following rights:

Right of access
You can request which personal data we process about you. Please indicate as specifically as possible which data you wish to access.
Right to rectification
You can ask us to correct or supplement your data if these are inaccurate or incomplete.
Right to erasure
You can request us to delete your personal data. We assess for each request whether we can comply with it (for example because of statutory retention obligations).
Right to data portability
You can ask us to receive or have transferred certain personal data in a structured, commonly used and machine-readable format, insofar as this right is applicable.
Right to restriction of processing
In certain cases you can ask us to temporarily restrict the use of your personal data.
Right to object
You can object to the processing of your personal data, for example in the case of use for direct marketing or because of your specific situation.
Right to withdraw consent
If we process your personal data on the basis of your consent, you can withdraw that consent at any time.

You can find more information about your rights on the website of the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Security

VDC takes appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access.

These measures are aimed, among other things, at:

• securing systems and networks;

• restricting access to personal data to authorised persons;

• safeguarding the confidentiality and integrity of data.

Complaints

Do you have a complaint? Please contact us via [e-mail address] or the contact details below. You can also submit a complaint to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Contact

Hotel Arnhem
6816VK, Amsterdamseweg, 505, Arnhem
+31 26 482 11 00

arnhem@valk.com