Privacy · Dutchbeard

How I process and protect personal data within the Dutchbeard services.

In this statement, "Dutchbeard services" means: this account portal (account.dutchbeard.nl), the associated apps (including RailBox and Dienstkaartje.nl) and all other websites and applications that I offer under the name Dutchbeard. Your Dutchbeard ID works centrally for all these services: one login, one wallet, one set of personal data.

1. Controller

The Dutchbeard services are operated by me, Dutchbeard, established in the Netherlands. Within the meaning of the General Data Protection Regulation (GDPR) I am the controller for the processing described in this statement. For questions or requests you can reach me at brievenbus@dutchbeard.nl.

2. Which data I process

When you use the Dutchbeard services, I may process the following data:

Account data. Email address, name, display name, optional profile picture and the time at which your email address was confirmed.
Login and security data. Password hash, status of two-factor authentication (2FA), any recovery codes and information about active sessions (device, browser, IP address, time of last activity).
Wallet and credit data. Balance, transactions and the associated metadata. See also section 5 (Payments) of the Terms and Conditions for the payment flow.
Donation data. Amount, optional message, whether your name may be visible on the supporter page and the time of the donation.
Push tokens. If you have enabled notifications in a Dutchbeard app, I register the associated push token (FCM) so that I can send notifications to the right device. The content of the token itself is not readable by me other than for sending notifications.
App-specific data. For some apps I process additional data specific to that app, such as an API key for treinposities.nl, privacy settings for dienstkaartje.nl or files you have uploaded for server-intensive tasks. Per-app processing is, insofar as it is additional, explained in the app itself.
Payment data. For topping up credits and making donations I only process a transaction ID, the amount paid, the time of payment and your email address. Card or bank account details are entered directly with the payment provider (Stripe) and are not stored by me.
Technical data and logging. IP address, user agent, language preference and technical error messages that are needed to keep the Dutchbeard services functioning and secure and to be able to analyse problems.
Contact form. If you use the public contact form, I process your name, email address, subject and message. You do not need a Dutchbeard account for this. I also record which version of this privacy statement was shown when you submitted. The IP address is not stored with the contact message. Do not send any special-category or other personal data through the free-text field that is not needed for your question.

3. Why I process data and on what legal basis

I process your data for the following purposes, each time on the basis of the grounds set out in the GDPR:

Performance of the contract (art. 6(1)(b) GDPR). Creating and managing your Dutchbeard ID, logging in to the Dutchbeard services, carrying out server-intensive tasks for which you use credits, handling payments and maintaining your wallet and donation history.
Legal obligation (art. 6(1)(c) GDPR). Complying with tax and accounting retention obligations for payment data.
Legitimate interest (art. 6(1)(f) GDPR). Security, fraud prevention, countering abuse (such as detecting unusual login attempts), analysing technical errors, keeping anonymous visitor statistics (see section 7, Cookies and tracking) and generally improving the stability and quality of the Dutchbeard services.
Consent (art. 6(1)(a) GDPR). Sending push notifications and, where applicable, displaying your name and optional message on the public supporter page. You can withdraw this consent at any time via the portal or the relevant app.
Handling contact requests (art. 6(1)(f) GDPR). I process the data from the contact form on the basis of my legitimate interest in being able to receive, assess, administratively handle and answer questions, comments and other contact requests. In doing so I process only the data needed for that purpose.

I do not use your data for advertising purposes or for personalised profiling.

4. Retention periods

I do not keep your data longer than is necessary for the purposes described above. In concrete terms this means:

Account and profile data is kept for as long as your Dutchbeard ID is active. After deletion of your Dutchbeard ID, this data is deleted or anonymised within a reasonable period, except for data that I am required to keep longer under a legal obligation.
Payment and donation data is kept in the accounts until the end of the statutory tax retention period (in the Netherlands generally seven years).
Session and security data is kept for as long as the session is active and briefly thereafter for security and fraud purposes.
Technical logging is kept for as long as is necessary to resolve malfunctions and detect abuse, and is subsequently deleted or aggregated automatically.
Uploads for server-intensive tasks are kept no longer than necessary to carry out the requested task; see section 6 (Uploads and user content) of the Terms and Conditions.
Contact messages are kept for a maximum of 6 months after the last substantive handling. After that I delete the message, unless longer retention is necessary due to a legal obligation or for the establishment, exercise or defence of a legal claim.

Unverified accounts

When you create a Dutchbeard ID, you must verify your email address to activate your account. If you do not verify your email address, you will receive a reminder after 3 days. If the account has still not been verified after that, you will receive a final reminder 24 hours before the account is deleted.

Unverified accounts are automatically removed from the active systems 7 days after creation. Personal data processed solely for the creation and management of this registration is deleted at the same time, unless there is a legal obligation or another valid basis to keep certain data longer.

Data from a deleted account may still appear temporarily in secured backups after deletion. Backups are kept for a maximum of 6 days on a fixed rotation and are then automatically overwritten or deleted. Backups are used solely for recovery and continuity purposes and not to actively process deleted accounts again.

I only share your data with third parties if this is necessary for the provision of the Dutchbeard services or if I am legally obliged to do so. The main categories of processors I work with:

Payment provider: Stripe Payments Europe Ltd. (Ireland) processes payments for credits and donations. See section 5 (Payments) of the Terms and Conditions.
Hosting and CDN: parties that supply the servers and the content delivery network on which the Dutchbeard services run (including Bunny CDN for static assets).
Push notifications: Google (Firebase Cloud Messaging) provides the push infrastructure with which notifications are delivered to your device if you have enabled them.
Email delivery: a transactional email provider for sending verification and security emails (for example a password reset).

I do not sell your data and I do not share it for third-party marketing or advertising purposes.

6. Transfers outside the European Economic Area

Some processors (in particular Google in the context of push notifications) may process data on servers outside the European Economic Area (EEA). In that case I base that transfer on the Standard Contractual Clauses adopted by the European Commission or another appropriate transfer mechanism under the GDPR. Where possible I choose processors with an entity established in the EEA.

7. Cookies and tracking

The Dutchbeard services only use necessary cookies and local storage for the functioning of the services (for example to remember your login session and your theme preference). I use no third-party advertising or tracking cookies on any Dutchbeard domain.

In order to see how heavily the Dutchbeard services are used, I keep an anonymous count of page views and general visitor statistics on a self-hosted server. No personal data that can be traced back to you is recorded in the process and no profile of you is built. These measurements are not shared with third parties and are not linked to your Dutchbeard ID. Under Dutch cookie law, privacy-friendly statistics of this kind fall under the exemption for analytics, and no consent is required for them.

See the cookie statement for the full overview.

8. Security

I take appropriate technical and organisational measures to protect your data against misuse, loss, unauthorised access and unwanted disclosure. Among other things:

Traffic between your device and the Dutchbeard services runs over an encrypted connection (HTTPS).
Passwords are stored exclusively as a hash (derived value) and never as readable text.
Sessions are set up in such a way that the part of the login credentials representing long-lived access is not accessible to scripts in your browser.
Two-factor authentication (2FA) is available for additional protection of your Dutchbeard ID.
Access to production environments is limited to the people who need it technically.
Suspicious activity is detected automatically and, where necessary, rate limits and blocks apply.

No security is one hundred percent watertight; should a data breach occur despite these measures, I will handle it in accordance with the GDPR and, where required, report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and the users concerned.

9. Minors

The Dutchbeard services are not specifically aimed at children under sixteen years of age. If you are under sixteen, you may only create a Dutchbeard ID or use paid features (such as credits) with the consent of a parent or guardian. Do you suspect that I am unintentionally processing data of a minor without that consent? Please contact me so that I can delete this data.

10. Automated decision-making

I use no automated decision-making or profiling that produces legal effects concerning you or significantly affects you. Automatic security measures (such as rate limits or temporarily blocking suspicious login attempts) are purely aimed at the safety of the Dutchbeard services.

11. Your rights

Under the GDPR you have, among others, the following rights in respect of your personal data:

Access: requesting an overview of which data I process about you.
Rectification: having incorrect or incomplete data corrected.
Erasure: requesting deletion of your data ("right to be forgotten"), insofar as no statutory retention obligation or other overriding interest applies. In addition, you can delete your Dutchbeard ID yourself directly via Profile in the portal; you confirm this with a code that I send to your email address, after which the deletion is final. Your outstanding balance lapses in the process and your donations are anonymised.
Restriction: requesting temporary restriction of the processing.
Portability: receiving or having transferred a structured, machine-readable copy of certain data you have provided.
Objection: objecting to processing based on a legitimate interest.
Withdrawal of consent: withdrawing consent for processing that rests on that basis (such as push notifications) at any time, without this having retroactive effect on processing that has already taken place.
Complaint to the supervisory authority: lodging a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if you believe that I am not processing your data correctly.

To exercise these rights you can contact me at the address mentioned in section 13 (Contact). I may ask you for additional information with which I can establish that the request actually comes from you.

12. Changes to this statement

I may amend this privacy statement from time to time, for example because I introduce new features or because regulations change. The date at the top of this document indicates when the statement was last amended. In the event of material changes, I will inform registered users reasonably in advance, for example by email or via a notification in the portal.

13. Contact

Do you have questions about this privacy statement or would you like to exercise your rights? You can reach me in the following ways:

Contact form: via the contact form on the website.
Email: brievenbus@dutchbeard.nl.

I aim to respond within a reasonable period, but I cannot guarantee fixed response times.

Language

This English text is a translation provided for convenience. The Dutch version of this document is the legally binding one; in the event of any discrepancy between the two versions, the Dutch version prevails.