Privacy policy

This privacy policy sets out which personal data we process, why we do it, how long we keep it and what rights you have. Where we need your consent, we ask for it separately — see chapter four (4).

This privacy policy covers the processing for which Drimbu is itself the controller. That is the data of:

• visitors to drimbu.com
• account holders and the users they create within their account
• users of our web app and mobile app
• people who contact us or sign up for early access.

Data that our customers (accommodation businesses) record in Drimbu about their own guests is not covered here. You can read more about that in chapter five (5).

• Company name: Drimbu B.V.
• Email address for privacy questions: privacy@drimbu.com

We have not appointed a data protection officer (DPO). Do you have a question about privacy or about your data? Send a message to privacy@drimbu.com.

The Category column ties this chapter to the rest of this privacy policy: under that same name you will find the purpose and legal basis in chapter four (4) and the retention period in chapter six (6).

3.1 Website (drimbu.com)

3.2 Web app

The web app is not available yet. Once we release it, we will complete this overview and publish a new version of this privacy policy.

3.3 Mobile app

The mobile app is not available yet. Once we release it, we will complete this overview and publish a new version of this privacy policy.

3.4 Automatically generated data

Our visitor statistics work without cookies: nothing is stored on or read from your device. Our statistics provider turns your IP address and browser data into a code that changes every day, so no profile of you is built.

Where we rely on consent, you can withdraw that consent at any time. Withdrawal takes effect from the moment you tell us; processing carried out before that remains lawful.

Without your name, email address and message we cannot answer your question, and without your email address we cannot put you on the waiting list. Anything marked as optional in chapter three (3) can be left out with no consequences.

Our customers are accommodation businesses. In Drimbu they record data about their own guests: bookings, contact details, payment details, messages and — where the law requires it — data for guest registration with the authorities.

For that data the accommodation business is the controller and we are the processor. That means:

• We process that data solely on the instructions of the accommodation business.
• We have concluded a data processing agreement with every customer setting out those instructions and our obligations.
• We do not use guest data for our own purposes.

Are you a guest of an accommodation business and do you want to see, correct or delete your data? Please contact the accommodation you stayed at or booked with. If we do receive such a request, we pass it on to the accommodation in question and let you know.

In some countries accommodation businesses are legally obliged to pass guest data to the authorities. Drimbu supports that reporting technically. The obligation and the responsibility rest with the accommodation business.

Once a retention period has passed, we delete your personal data or make it anonymous.

Anonymising means removing every characteristic that could trace the data back to you — directly or indirectly, including in combination with other data we hold. What is left is statistics: the number of bookings per month, for instance, with no way to tell who they were about. Anonymous data is no longer personal data and therefore falls outside this privacy policy.

For some processing we pseudonymise data rather than anonymise it. There we replace identifying characteristics with a code, but linking remains possible in theory. Pseudonymised data remains personal data and remains covered by this privacy policy.

Our backups are overwritten on a fixed schedule. Deleted data may therefore still appear briefly in a backup. During that period we do not use it, other than to recover from an incident.

We never sell your personal data to third parties for commercial purposes.

We do engage service providers that help us run the website. They process data on our instructions:

• Hosting and cloud infrastructure — for running drimbu.com.
• Email service — for the confirmation you receive after a message or a sign-up, and for the notification of it to ourselves.
• Statistics service — for measuring how the website is used.
• Error-tracking service — for finding faults.

Once the web app and the mobile app go live, service providers will be added and we will update this list.

We have a data processing agreement with each of these parties, setting out how they handle personal data.

If one of these parties processes data outside the European Economic Area (EEA), we provide appropriate safeguards: the EU-U.S. Data Privacy Framework where the party is certified for it, or the European Commission's standard contractual clauses (SCCs). Where necessary we also assess the risks of that transfer.

We may also disclose data to competent authorities where we are legally obliged to do so.

We use no artificial intelligence on drimbu.com. This website does not process your data with AI, and nothing goes from this site to an AI provider.

The Drimbu platform itself will have AI features. Once those are available, we will complete this chapter and publish a new version of this privacy policy.

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

A cookie is a small text file placed on your device when you visit. Similar techniques do the same thing, such as LocalStorage and SessionStorage in the browser. We treat those techniques the same way as cookies.

There are three kinds:

• Functional — strictly necessary to deliver what you asked for yourself, such as remembering a choice you have just made. No consent is required for these (Article 11.7a(3) of the Dutch Telecommunications Act).
• Analytics — for measuring how a site is used. If that means storing something on your device or reading something from it, consent is required.
• Marketing and tracking — for following you across websites and tailoring advertising to you. Consent is always required for these.

There is one cookie on drimbu.com: it remembers which language you are reading the site in. The site also remembers two things in your browser's storage, both of them to do what you just clicked. They are functional, they disappear when you close your browser, and they do not follow you across websites. The full overview is in chapter eleven (11).

We place no analytics cookies and no marketing or tracking cookies. Our visitor statistics work without storing anything on your device or reading anything from it — see chapter three (3). Because everything we place is functional, you see no cookie screen on this site. Should we ever change that, we will ask for your consent first, and refusing will be as easy as accepting.

11.1 Cookies

This is the only cookie on drimbu.com. There are no third-party cookies.

11.2 Local storage and SDKs

Both live in SessionStorage. We use no LocalStorage, and our statistics and error-tracking services store nothing on your device.

Right now there is one thing we ask your consent for: the email address you sign up for early access with.

• Coming off the waiting list — send a message to privacy@drimbu.com and we will take your email address off the list.
• Clearing the storage in your browser — the cookie and the storage from chapter eleven (11) disappear by themselves when you close your browser. You can also remove them sooner through your browser settings; the site keeps working, it has just forgotten your choice of language.

If you withdraw your consent, we stop the processing concerned immediately. Processing that took place before the withdrawal remains lawful.

You have the following rights:

• Right of access — you may ask which personal data we process about you (Article 15 GDPR).
• Right to rectification — you may have incorrect data corrected and incomplete data completed (Article 16 GDPR).
• Right to erasure — in certain cases you may ask us to delete your data (Article 17 GDPR).
• Right to restriction of processing — you may ask us to put the use of your data on hold, for instance while we assess a correction request (Article 18 GDPR).
• Right to portability — you may receive the data you provided to us in a common file format, or have it forwarded (Article 20 GDPR).
• Right to object — you may object to processing we base on a legitimate interest. You can always object to direct marketing, and we then stop immediately (Article 21 GDPR).
• Right to withdraw consent — where processing rests on your consent, you may withdraw it at any time (Article 7(3) GDPR).
• Right not to be subject to automated decision-making — see chapter nine (9) (Article 22 GDPR).
• Right to lodge a complaint — see chapter seventeen (17).

Requests to access, rectify, erase, restrict or transfer your personal data, to withdraw your consent or to object to the processing of your personal data can be sent to privacy@drimbu.com.

We verify your identity through the email address the request comes from. That is the detail we know you by: everything we hold about you hangs on that address. We do not ask you for a copy of your identity document. Only if we have reasonable doubt about your identity do we ask for further details. We then never ask for more than we need, and we explain why we need it.

We respond as quickly as we can, and at the latest within one (1) month of receiving your request. If your request is complex, or if we receive several requests from you, we can extend that period by two (2) months. We will tell you within one (1) month, with the reason for the extension.

We take appropriate technical and organisational measures to protect personal data against loss, theft and unlawful processing (Article 32 GDPR).

15.1 Technical measures

• Encryption — data travels over the internet encrypted.
• Access security — strong passwords, multi-factor authentication (MFA) and strict access rights, so that only authorised people can reach the data.
• Data minimisation — we collect and keep as little as we can. What we do keep is listed, with a retention period, in chapter six (6).
• Backups — we make regular secure backups, so that data is not lost in a failure or an attack.
• Updates — we keep our software up to date and check it for known vulnerabilities.

15.2 Organisational measures

• Access rights and confidentiality — access to data is limited to those who need it for their work, and our staff are bound to confidentiality.
• Breach procedure — we have a set of steps ready in case a data breach does occur, so that we can report it to the supervisory authority in time.
• Data processing agreements — with service providers that process data on our behalf we conclude a data processing agreement (see chapter eight (8)).

If you suspect something is wrong with your data, or you have found a vulnerability in our systems, report it at privacy@drimbu.com.

Our services are meant for business use and are not aimed at children. We do not knowingly collect personal data from children under sixteen (16). Do you think we have processed a child's data anyway? Contact us at privacy@drimbu.com and we will delete it.

If you have a complaint about the way we handle your data, send it to privacy@drimbu.com. You can also always lodge your complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl (opens in a new tab), or take the matter to court.

We may amend this privacy policy, for example when we launch new features or start working with a new service provider. The version on this page is always the version that applies.

Is it a substantive change? Then we announce it in advance through a notice in the web app, and by email where that is relevant. You can request earlier versions from us at privacy@drimbu.com.

This privacy policy was originally drawn up in Dutch. If this text has been translated into another language and a difference in interpretation or a contradiction arises between the Dutch text and the translation, the Dutch text prevails.