Who is responsible?
Rainbow Road B.V., trading as Playhood, is the controller for the processing described in this policy. We are registered with the Dutch Chamber of Commerce under number 89333004. Our VAT number is NL864950433B01 and our registered address is Stettineiland 26, 1014 ZE Amsterdam, the Netherlands.
For privacy questions or a request about your data, email hello@playhood.nl.
Which data do we process?
The data we process depends on how you use Playhood. We only ask for information relevant to the service concerned.
- Booking and payment data, such as name, email address, phone number, selected location, date, time slot, group size, ticket type, payment status and transaction details. We do not receive full card details.
- Contact and enquiry data from email, contact requests, events, group bookings, parties, schools, childcare, venue hire and complaints.
- Account and membership data, including names, household composition, members' dates of birth, visits, benefits and booking history.
- Photos taken during a first membership visit to verify family members. These photos are not intended for facial recognition.
- Newsletter details and preferences if you subscribe and newsletters are enabled.
- Technical and usage data, such as IP address, device, browser, pages visited, referring source, cookie IDs and choices made in the consent banner.
- Images from events or locations when you separately consent to promotional photography or another valid legal basis applies.
Why do we use data?
We only process data where we have a legal basis under the GDPR. Our main purposes and legal bases are set out below.
- Performance of a contract: processing bookings, granting access, handling payments, sending confirmations, managing memberships and answering questions about a booking.
- Legitimate interests: protecting and improving our services and website, preventing fraud and misuse, running our business administration and sending relevant service messages. We balance these interests against your rights.
- Legal obligation: financial records, tax retention duties and responding to valid requests from authorities.
- Consent: non-essential cookies, newsletters when enabled, promotional photography and other situations where we expressly ask.
- Vital interests: only in an exceptional emergency where information is needed to protect someone's safety.
Children's and family data
Playhood is for families. Bookings and online enquiries should be made by a parent, carer or other authorised adult. We do not knowingly ask children to independently provide personal data to us online.
For memberships, we may process dates of birth to check age, access and benefits. During the first visit, and with the responsible adult's permission, we may take a family verification photo. We only use that image to check who belongs to the membership, not for advertising or automated facial recognition.
If you believe a child gave us data without appropriate permission, email us so we can investigate and delete it where required.
Providers, payments and transfers
We use providers that process data for us or have their own legal role. We put appropriate processor arrangements in place and share no more than necessary.
- Vercel for hosting, security and technical delivery of the website.
- ROLLER for ticket sales, bookings, accounts, memberships and operational communications.
- Payment providers processing payments through ROLLER or our sales channels. They may be independent controllers for payment and fraud prevention tasks.
- Google Tag Manager, Google Analytics 4, Meta, TikTok, Pinterest and Klaviyo when the relevant features are enabled and you have given valid consent.
- Google Maps when you activate or view a map.
- Professional advisers, IT providers and competent authorities where necessary or legally required.
Outside the European Economic Area
Some providers may process data outside the European Economic Area, including in the United States. Where no adequacy decision applies, we use appropriate safeguards when required, such as the European Commission's standard contractual clauses and supplementary measures. You can ask us for information about the relevant safeguards.
Photography and promotional images
Visitors may take their own photos if they respect other people's privacy and mainly point the camera at their own group.
For identifiable promotional images, we ask for clear permission in advance where required. Consent is voluntary and can be withdrawn for future use. Withdrawal does not make earlier lawful use unlawful. Once published, copies may already have been shared or stored beyond our direct control. Where reasonably possible, we will stop new use and remove the material from channels we control.
How long do we keep data?
We do not keep data longer than necessary for its purpose unless a statutory retention period applies. The exact period depends on the type of data and any dispute.
- We generally retain financial records for seven years after the end of the relevant financial year.
- We keep booking, contact and complaint data for as long as needed for performance, service, evidence and potential claims, after which we delete or anonymise it.
- We keep newsletter details until you unsubscribe, plus a limited record needed to respect your opt-out.
- We retain consent records for as long as needed to evidence the choice, followed by an appropriate evidential period.
- We keep family verification photos no longer than the membership and a short administrative closing period, unless a dispute requires longer retention.
- We review promotional images periodically and remove them when the purpose ends or valid consent for future use is withdrawn.
Your privacy rights
Depending on the circumstances, you have rights of access, correction, erasure, restriction, portability and objection. You may withdraw consent at any time. You can always object to direct marketing.
Email your request to hello@playhood.nl. We may ask for additional information to securely verify your identity. We generally respond within one month. If you are not satisfied, you can complain to the Dutch Data Protection Authority or your local supervisory authority.
Security and data breaches
We use technical and organisational measures appropriate to the nature and risks of processing. No system is completely secure. If a breach is likely to create a high risk for affected people, we notify those people and the regulator as required by law.
Changes and contact
We may update this policy when our services, providers or the law change. The date above shows when it was last updated. We will communicate significant changes in an appropriate way.
Send privacy questions, requests and complaints to Rainbow Road B.V., trading as Playhood, at hello@playhood.nl or by post to Stettineiland 26, 1014 ZE Amsterdam, the Netherlands.
Question about this information? Get in touch
Back to top