Stichting Pluk de Nacht, located at Wibautstraat 150 BP1.68, 1091 GR Amsterdam, is responsible for processing personal data as described in this privacy statement.
You can contact us at info@plukdenacht.nl or +31 85 004 1645. Our contact person for privacy matters is J.P. Esmeijer, who can be reached at jurriaan@plukdenacht.nl.
Personal data we process
We may process the following personal data:
- First and last name;
- Email address;
- Postal code;
- Order details and payment status;
- Limited payment information provided by our payment service provider, such as the last four digits of your IBAN and your bank code;
- If you choose to receive a digital receipt at the festival venue: your email address or telephone number;
- Information about your visit to our website, including browser and cookie data.
How we use your personal data
We use your personal data for:
- Processing and delivering your order, including your tickets;
- Processing your payment;
- Service communications concerning your order, such as ticket changes or information about changes to screening times;
- Sending our newsletter, if you have subscribed to it;
- Audience research;
- Improving and securing our website and systems;
- Complying with legal obligations, including our accounting and tax obligations.
Postal codes and audience research
Since 2025, we have asked customers to provide their postal code when placing an order. Your postal code is required to process your order through our ticketing system.
We also use postal codes to analyse, at group level, the areas our visitors come from. This helps us improve our festival and communications. Once the annual audience survey has been completed, we remove the link to individual orders and retain only sufficiently aggregated results that cannot be traced back to individual people.
Legal bases for processing
We process your personal data on the following legal bases:
- Performance of our contract with you, for ticket sales, payment, delivery and service communications;
- Your consent, for the newsletter and non-essential cookies;
- Our legitimate interests, for audience research and for securing and improving our website and systems;
- Our legal obligations, including our accounting and tax obligations.
When we process data on the basis of a legitimate interest, we balance our interest against your privacy interests.
Payments
Payments are processed by external payment service providers: Mollie and Stripe for our online shop, and Zettle, part of PayPal, for payments made at the festival venue.
We do not have access to your full credit card or bank details and cannot use this information to make payments. Our ticketing system contains your order details, payment status and certain limited payment information provided by the payment service provider, such as the last four digits of your IBAN and your bank code. We use this information only to assist you with questions about your order or a refund.
If you choose to receive a digital receipt at the festival venue, your email address or telephone number will be used solely to send you that receipt.
How long we retain your data
We do not retain personal data for longer than necessary for the purpose for which it was collected.
- Data that forms part of our tax records is retained for the applicable statutory retention period, which is generally seven years;
- We retain your email address for the newsletter until you unsubscribe;
- We remove the link between postal codes and individual orders after completing the annual audience survey. We then retain only aggregated results that cannot be traced back to individuals;
- We delete other customer data no later than two years after your most recent order, unless we need to retain it for longer due to a legal obligation or legal dispute;
- Details provided for a digital receipt are used solely to send the receipt and are not subsequently used by us for other purposes.
Sharing personal data with third parties
We do not sell your personal data.
We share personal data only with parties that are necessary to provide our services, such as our hosting provider, website developer, ticketing system, payment service providers, newsletter service and providers of website and cookie services.
Where these parties process personal data on our behalf, we enter into a data processing agreement with them. Some parties may act as independent data controllers for certain processing activities. In those cases, their own privacy statements also apply.
Cookies
Our website uses cookies and similar technologies. When you first visit our website, we use our Cookiebot-powered cookie banner to ask for your consent to place non-essential cookies.
We distinguish between the following categories:
- Essential cookies, including cookies used for the shopping cart and order processing;
- Preference cookies;
- Statistics cookies, including Google Analytics cookies used to measure how the website is used;
- Marketing cookies, including cookies from embedded videos and social media services.
An up-to-date overview of the cookies we use, including their purposes, providers and retention periods, is available in the cookie statement on our website. This overview is updated automatically.
You can change your choices at any time through the cookie settings on our website. You can also reject or delete cookies through your browser settings. Withdrawing your consent does not affect the lawfulness of cookies used before your consent was withdrawn.
Security
We take appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, unwanted disclosure and unauthorised alteration.
Our website and ticketing system are hosted by a Dutch hosting provider, are protected and are continuously updated under a service agreement with our developer. Access to systems containing personal data is restricted to the core team and secured using two-factor authentication.
If you believe that your personal data is not adequately protected or have reason to suspect misuse, please contact us at info@plukdenacht.nl.
Automated decision-making
We do not make decisions based solely on automated processing that produce legal effects concerning you or otherwise significantly affect you.
Your rights
To the extent provided for by the GDPR, you have the right to:
- Access your personal data;
- Have inaccurate or incomplete data corrected;
- Have your personal data erased;
- Restrict the processing of your personal data;
- Object to the processing of your personal data;
- Receive the personal data you have provided to us in a machine-readable format or have it transferred to another organisation;
- Withdraw previously given consent.
Send your request to info@plukdenacht.nl. We will generally respond within one month. If your request is complex or we receive a large number of requests, we may extend this period by up to two months. If we do so, we will notify you within the first month.
If we have doubts about your identity, we may request additional information to verify it. We will not request more information than necessary. Please do not send us a copy of your identity document unless we ask you to do so.
Withdrawing your consent does not affect the lawfulness of processing carried out before your consent was withdrawn.
If you are dissatisfied with how we handle your personal data, you can submit a complaint to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.
