Privacy
Policy

Section 01

About Us & This Policy

This Privacy Policy is issued by Eindhoven Play Hall ("we", "us", "our"), a physical entertainment and gaming venue located in Eindhoven, the Netherlands. We operate as a data controller under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Dutch Implementation Act (Uitvoeringswet AVG).

This policy applies to personal data collected through this website (the "Site") and, where relevant, during your visit to our physical premises. It does not apply to third-party websites linked from the Site.

By using the Site, you acknowledge that you have read and understood this policy. If you have questions, please use the contact details in Section 13.

Section 02

Data We Collect

We collect only the data necessary for the purposes described in this policy:

We do not collect sensitive categories of personal data through this Site and do not process real-money payments on this website.

Section 03

Legal Basis for Processing

Under GDPR, we rely on the following legal bases:

• Consent (Art. 6(1)(a)) — for non-essential cookies and marketing analytics, where you have provided consent via our cookie banner.
• Contract (Art. 6(1)(b)) — to respond to your enquiries or process a reservation request.
• Legal obligation (Art. 6(1)(c)) — to comply with Dutch gaming law, anti-money-laundering regulations, and applicable tax obligations.
• Legitimate interests (Art. 6(1)(f)) — to operate and secure our website, prevent fraud, and improve our services.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. See Section 9 for how to exercise your rights.

Section 04

How We Use Your Data

• To operate the Site — serving pages, ensuring security, diagnosing technical issues.
• Analytics — understanding how visitors navigate the Site so we can improve content and performance.
• Responding to enquiries — processing messages submitted via the contact form or email.
• Venue compliance — verifying guest age and identity at entry as required by Dutch law (Wet op de kansspelen) and our operating licence.
• Legal compliance — meeting obligations under Dutch and EU law, including anti-money-laundering (Wwft) requirements.
• Marketing — where you have consented, measuring the effectiveness of promotional campaigns.

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

Section 05

Cookies

Cookies are small text files placed on your device. We use the following categories:

Section 06

Data Sharing

We do not sell your personal data. We may share limited data with trusted third-party service providers who assist us in operating the Site and venue, strictly under confidentiality agreements and data processing contracts as required by GDPR Art. 28. Categories of recipients include:

• Hosting & infrastructure providers — to store and serve the Site;
• Analytics providers — to measure Site performance (only where you have consented);
• Email and communication tools — to handle contact form submissions;
• Regulatory authorities — when required by Dutch law (e.g. Kansspelautoriteit, tax authorities, or law enforcement).

Section 07

International Transfers

Some service providers may process data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission or transfers to countries recognised as providing adequate protection.

You may request a copy of the relevant safeguards by contacting us at the details in Section 13.

Section 08

Retention

We retain personal data only for as long as necessary to fulfil the purposes set out in this policy:

• Contact enquiries — up to 2 years from last contact, unless you request earlier deletion.
• Analytics data — aggregated or anonymised within 26 months.
• Cookie consent records — up to 12 months, aligned with the cookie lifespan.
• Venue compliance records — as required by Dutch gaming and anti-money-laundering law (typically 5 years).

After the applicable retention period, data is securely deleted or anonymised.

Section 09

Your Rights

Under GDPR, you have the following rights. We will respond to verified requests within 30 days.

To exercise any of these rights, please contact us using the details in Section 13. We may need to verify your identity before processing your request.

Section 10

Children

Our Site and venue are directed exclusively at adults aged 18 and over. We do not knowingly collect or process personal data from anyone under 18. If you believe we have inadvertently received data from a minor, please contact us immediately and we will delete it without undue delay.

Section 11

Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures are reviewed and updated regularly.

While we take reasonable precautions, no method of transmission over the internet is completely secure. If you suspect any unauthorised access to your data, please notify us immediately.

Section 12

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our operations. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will make reasonable efforts to notify you via a prominent notice on the Site.

Section 13

Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise your rights, or would like to make a complaint, please reach out:

We aim to respond to all data subject requests within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Dutch Data Protection Authority.