Privacy Statement and Cookie Policy

Effective from 24 March 2025 · Van Gogh Exhibition B.V. (Vincent Hall) · KvK 94140332

This privacy statement sets out how Van Gogh Exhibition BV (hereinafter referred to as “Vincent Hall” and “we”) uses and protects any personal information that you give to us. This privacy statement is being issued in accordance with the European General Data Protection Regulation (“GDPR”). Vincent Hall is committed to ensuring that your privacy is protected. Therefore Vincent Hall is as transparent as possible in how it deals with personal data, and we aim to achieve this by means of this privacy statement.

Van Gogh Exhibition BV is domiciled in the Netherlands, with tax ID: NL866651044B01, registered at Amsterdam, 1092AD Mauritskade 55A, and we operate the Websites frida.amsterdam and vincenthall.nl and all of the webpages, subdomains, country level domain variants and subparts of those Websites (collectively, our "Websites").

This privacy statement sets out to whom the personal data belongs, what it is and why we collect & store it. You can also read about the legal basis for collecting personal data, who we can share it with and how we protect it. Finally, we set out what your rights are in respect of that data.

Should we ask you to provide certain information by which you can be identified, then you can be assured that it will only be used in accordance with this privacy statement.

This privacy statement is effective from 24 March 2025. The most recent version can always be found on the website of Vincent Hall. We would, therefore, advise you to check our websites regularly for new versions and to read the privacy statement.

Vincent Hall’s Privacy Policy is not applicable to other websites. Vincent Hall advises you to always read the privacy statements of those other websites for more detailed information, also in case of affiliated parties.

If you have any questions or need any help in relation to this Privacy Notice or how Vincent Hall processes your Personal Data, please contact our Support at go@vincenthall.nl.

General

Vincent Hall limits processing personal data to an absolute minimum. However, we will always require certain personal data, such as for the provision of all products and services offered by the museum. For example, the online ticket shop requests an email address in order to supply the ordered exhibition or event ticket and the receipt of your order. Personal data and other data are used for issuing tickets and tax reports.

Whoever supplies her/his/their data to us is – and remains – the owner of this data. This means that the owner of this data has given permission for the personal data to be processed. It also means that the owner can revoke this permission and request that her/his/their data is deleted.

Children’s Privacy

Our services are not intended for use by individuals under the age of 16. We do not knowingly collect or process personal data from children under 16 without obtaining verifiable consent from a parent or legal guardian, as required under the General Data Protection Regulation (GDPR).

If we become aware that we have collected personal data from a child without proper consent, we will take steps to delete such information promptly.

We encourage parents and guardians to monitor their children's online activities and to contact us if they believe that a child has provided us with personal information without appropriate consent.

If you are a parent or guardian and believe we have collected personal data from your child, please contact us at go@vincenthall.nl.

When we require your data

Necessary to fulfil a contract or agreement that we have with you

• Provision of our Services, account administration and informing about changes to our Services;
• Processing your ticket transactions and payments (payment process handled by third-party payment service providers that comply with Payment Card Industry Data Security Standards);
• Provision of user support services and responses to your enquiries and requests. We may record and monitor any communications between you and Vincent Hall, to maintain appropriate records, check your instructions, analyse, assess and improve our services, and for training, monitoring and quality control purposes;
• Provision of personalised recommendations and content within the Services by collecting data about you in order to build a profile of your preferences based on your activity when you use the Services. The Services cannot be provided to you without this profiling. If you wish to object to this profiling, we will not be able to provide the Services to you and you should not use or access the Services.

Legitimate interests

• Detect and prevent fraud;
• Keep our Services and IT systems secure, as well as ensuring that Vincent Hall processes, procedures and systems run as efficient and effective as possible (including troubleshooting, data analysis, testing, research, statistical and survey purposes);
• Suggest events or experiences similar to those previously purchased that may be of interest to you under the scope of our Services and personalise your in-app experience and marketing messages about our Services to make them more relevant and interesting to you. This may include analysing how you use our Services and your ticketing transactions;
• Ask your opinion about our Services through specific surveys;
• Analyse and enhance the information that we collect, your use of the Services to improve them or develop new ones, including but not limited to our content, features, scheduling, technology and events;
• Determine the effectiveness of our promotional campaigns and advertising;
• Use your IP addresses and device location to identify the location of users and block any unauthorised users;
• Keep records of your marketing communications preferences;
• We collect anonymised statistical datasets and details about visitors to our website and about our users' transactions patterns for the purposes of aggregate statistics, data analytics, dashboards and insights, reporting purposes and to understand how our users use our Services. These datasets may be shared internally or externally with others, including our partners. However, no single individual will be identifiable from the anonymised details we have collected for these purposes.

Consent

• Photography and video recording at events and experiences to use your image for promotional purposes or for future marketing campaigns. This can include also user generated content;
• Where you have given us your express consent for other specific data processing actions, we will use your data for such actions.

If we rely on your consent for us to process your Personal Data in a particular way, but you later change your mind, you may withdraw your consent at any moment by updating your preferences or by contacting our Support at go@vincenthall.nl.

Legal Obligations

• Where we must comply with our legal obligations or to help detect or prevent a crime, we may share your Personal Data with other organisations (example: law enforcement authorities, tax authorities, fraud prevention agencies, etc.);
• Response to data subject requests, complaints or handle legal claims/disputes;
• Any ancillary processing activity in the event it is necessary to meet our legal or regulatory obligations;

Marketing Purposes

We use your Personal Data to personalise marketing communications about our Services so they are more relevant and interesting to you (where allowed by law). This may include analysing how you use our Services and your ticket transactions.

We want to provide you with choices regarding certain Personal Data uses, particularly around marketing and advertising (including the sending of marketing messages). You can update your choices at any time by logging into the Platform and checking or unchecking relevant boxes or sliders to adjust your marketing preferences. For such purpose, we have developed a preferences centre where you can view and make certain decisions about your Personal Data use. Additionally, you can exercise control over your Personal Data by following the opt-out links on any marketing communications sent to you or by contacting us at any time, or by emailing our Support at go@vincenthall.nl.

Where you opt out of receiving these marketing communications, please note that this will not apply to Personal Data we collect and its necessary for the proper provision of our Services. Therefore, you will continue to receive service communications related to the functionality and/or administration of our Services. For instance, as mentioned above, you may receive notifications about updates to our Services or changes in our legal terms.

We aim to ensure that our advertising and marketing remain relevant and interesting to you. To achieve this, we use third-party advertising and technology companies as data processors to serve ads and/or provide aggregated data to assist in ad delivery when you visit or use our Services. This includes third-party technology companies that collect data about you to create a profile of your preferences based on your interactions when you use our Services. These companies also automatically collect data when you use our Services to assist us identify the ads that are served to you and what you do after seeing those ads. In addition, we also share data with providers of web analytics tools, such as Google Analytics, which we use to analyse your use of the Services.

These third-party advertising companies collect, store and use data by integrating cookies and other tracking technologies on our Services.

In some cases, these third parties may also use the data that they collect for their own purposes. For instance they may aggregate your data with other information they hold and use it to inform advertising-related services provided to other clients or collaborate with other advertising companies and share your Personal Data as part of the process.

Please see our Cookie Notice for more information on the third-party advertising companies which collect, use and store data about you, and the use of cookies and other tracking technologies implemented on our Services. From our Cookie Notice, you can also learn how to exercise control over this data collection and usage. If you choose to restrict or prevent tracking for these purposes, the advertising you see when you visit or use our Services will no longer be tailored to your preferences.

We may also share your data with social media or similar platforms so that you and other people can see relevant content on those platforms. For example, we may use the Facebook Custom Audiences service and share your email address in a protected format with Facebook. This allows us to include you in a custom audience to serve you relevant advertising content on Facebook or create an audience of other Facebook users based on the information in your Facebook profile. You can opt-out by emailing go@vincenthall.nl.

Who we share your Personal Data with

Third-party service providers. We may share your Personal Data with third-party service providers, acting as our data processors, in order to facilitate or provide certain services on behalf of us. By way of example and not limitation, it may include:

• Analytics and user research providers that help us improve our Platform;
• Communications and survey services providers to help us provide our Services to you and help us send you emails, push notifications and text messages; and
• Other third-party service providers, for the purpose of providing our Services or tracking our users' use of the Services (including but not limited to payment service providers).

These providers are authorised to process your Personal Data only as necessary to provide these Services to us.

Mergers & Acquisitions. When we need to transfer Personal Data about you if we are acquired by or merged with another company. If we are involved in a merger, acquisition, or sale of all or a portion of its assets, you will be notified afterwards via email and/or a prominent notice on our Services of any change in ownership or uses of your Personal Data, as well as any choices you may have regarding your Personal Data.

Social media and advertising partners. When we use social media for marketing purposes, your Personal Data (limited to only your name and email address) may be shared with the social media platforms so that they can check if you also hold an account with them. If you do, we may ask the advertising company or social media provider to:

• use your Personal Data to sent our ads to you, because we think that you might be interested in new Our products or services;
• not send you our ads, because the marketing related to a service that you already use;
• send our ads to people who have a similar profile to you (lookalike audiences) and custom audiences. Please note that your Personal Data is hashed before we send it to the advertising partner and they are only allowed to use it in the ways described above.

Experience or Event organisers. When you purchase tickets, sign up for, or donate to an experience or event through our Platform, we may share your Personal Data with the entity organising that experience or event. Sometimes, these organisers might have others help them set up the event. We call these helpers "Third-Party Organizers." For example, a concert venue might let a promoter use our Platform to create an event at their venue. In these cases, we might share your Personal Data with both the venue and the promoter for logistical or operational purposes due to it being necessary for the proper execution of the contract with you. Remember, we're not responsible for how these experience or event organisers or Third-Party Organisers process your Personal Data or if they comply with applicable data protection laws.

International data transfers

As a general rule, if you are a user resident in the European Economic Area (EEA), please note that Vincent Hall aims to store your Personal Data in the EEA territory.

When transferring Personal Data outside the EEA to other countries that do not offer a standard of data protection equivalent to the EEA, we will make sure that your Personal Data is sufficiently protected and make sure that a contract with strict data protection safeguards and clauses are in place before we transfer your Personal Data.

Please also note that when you are purchasing tickets or enrolling into an event, such event may be organised by another entity located outside the EEA. By enrolling in such event or purchasing the relevant tickets you acknowledge the necessity of transferring your Personal Data to the organiser for the purpose of managing your participation in the relevant event or experience.

If you are a European resident, you can find out further information about the rules on data transfers outside the EEA, including the mechanisms that we rely upon, on the European Commission website.

Tax authorities. When you purchase tickets, we transfer your receipt or invoice information to the Dutch Tax Authority (Belastingdienst).

Bank acquiring. When you purchase your tickets, we redirect you to the Stripe payment system that acquires card payment information for providing the payment and emails you the confirmation of your payment with the receipt or invoice.

Mailing agent. After placing an order successfully, the emailing agent Mailtrap sends you out your ticket at the indicated email box.

Cookie Policy

In addition, we collect personal data when you make use of our websites and/or social media channels, such as your IP address and the browser that you are using.

We use cookies to analyse how you use our Services. In addition, pixels, web beacons, tags and scripts may be used by us and our partners, affiliates, analytics or service providers. These technologies are used for measuring performance of our email campaigns, analysing trends, administering the Services, analytics and tracking users’ behaviours regarding the Services and to gather demographic information about our user base as a whole. We receive reports and build internal dashboards based on the use of these technologies on an individual as well as aggregated basis.

We use cookies, for example, to remember users’ settings (e.g. language preference). Users can control the use of cookies at the individual browser level. If you reject cookies, you may still use our Services, but your ability to use some features or areas of our Services may be limited.

Categories of personal data:

• The date and time you last accessed our Websites,
• The pages or content you engaged with during your initial visit to our Websites,
• The language setting you prefer to use by default,
• Details about your device, such as the type and model, the operating system and its version, the type of browser and its configuration, your IP address or another unique identifier for your device, and a unique token for your device,
• Information categorizing you as a user, which might include your behavior, likes and dislikes, or purchasing history.

If you consent to the activation of personalization cookies, we may integrate your personal information with other data to create a profile of your interests and activities.

When you first visit our Websites, a cookie banner will pop up to inform you about our use of cookies as described in this Cookie Notice. This banner will enable you to provide informed consent from the onset for the use of cookies, by agreeing to the specific installation of particular types of cookies. In this case, you can always adjust your preferences or withdraw your consent at any time, both for our first-party cookies and those set by third parties.

In order to use certain Services and functionalities that we offer through Vincent Hall, it is necessary for you to have cookies enabled in your Internet browser. Specifically, by means of these technical cookies, we will be able to identify you as a registered user each time you access the Websites and Apps, thus allowing you to access and use such services and functionalities.

• Managing cookie preferences: You can modify your settings directly via the cookie banner or through the Settings Panel. Open cookie settings
• Disabling cookies: If you wish to disable cookies, you can do so using the settings in your web browser. For guidance on how to manage cookies in your specific browser, please refer to the following instructions:
  • Google Chrome;
  • Safari;
  • Microsoft Edge;
  • Firefox;
  • Opera.

Cookies on weloveplaymobil.nl

Vincent Hall places cookies and similar technologies (such as local storage, pixels and tags) on weloveplaymobil.nl in accordance with Article 11.7a of the Dutch Telecommunications Act (Telecommunicatiewet) and the GDPR. Strictly necessary technologies are used without consent, as permitted by Article 11.7a(3) of the Telecommunications Act. Analytics and marketing cookies are only placed after you have given your consent via the cookie banner (Article 6(1)(a) GDPR). Until you accept, no analytics or marketing cookies are placed; Google may receive limited, cookieless signals (such as a page view and your consent status) without identifiers, which are used only for aggregated statistics.

You can change or withdraw your consent at any time via “Cookie settings” at the bottom of every page; withdrawing consent does not affect the lawfulness of processing before the withdrawal. Google and Meta may process data in the United States; such transfers take place under the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

Your rights regarding the use of cookies

Under current data protection laws, you have the right to manage your personal data. This includes the rights to access, rectify, erase, restrict its processing, object, as well as your right to data portability, and the right not to be exclusively subject to a decision based solely on automated processing. You can also withdraw consent for data processing at any time, as was described above.

Security

Your personal data is handled with the utmost care. In principle, this data will not be supplied to third parties, unless this is necessary for the service in question, or if we are legally obliged to do so. We do our utmost to ensure that this data is secured to the best of our ability.

Whilst we take appropriate technical and organisational measures to safeguard the Personal Data that you provide to us, no transmission over the Internet can ever be guaranteed 100% secure. Consequently, please note that we cannot guarantee the security of any Personal Data that you transfer over the Internet to us.

We are committed to protecting your Personal Data using appropriate technical and operational security measures such as access controls that restrict and manage the ways in which your Personal Data is stored and handled, in order to maintain the confidentiality, availability and integrity of your Personal Data.

Personal data will be stored for the shortest possible length of time, taking into account legal retention periods.

Your rights and how to exercise these rights

You have certain rights in relation to your Personal Data. If you would like further information in relation to these or would like to exercise any of them, please contact our support at go@vincenthall.nl.

In short, you have the right to:

• Be told and obtain information regarding how we use your Personal Data.
• Ask for a copy of your Personal Data. Please note that we may not be able to provide you any Personal Data about other people or linked to an ongoing crime or fraud investigation. In addition, we won’t provide you with any communication we’ve had with our legal advisers or internal notes about our procedures/protocols).
• Ask us to correct your Personal Data if you think it’s wrong, inaccurate or incomplete. In that case, we may need to verify the accuracy of it.
• Ask us to delete your Personal Data. As informed above, there may be circumstances where we may not be able to agree to your deletion request due to we have a legal obligation or there is an applicable data retention period.
• Object (opt-out) the processing of your Personal Data for marketing purposes (including profiling) or other processing activities based on legitimate interests. Please note that we may not be able to accept it in the event we need to process your Personal Data for the proper provision of our Services or even need to close your account as we won’t be able to provide our Services.
• Restrict the way that we process your Personal Data and ask us to suspend using your Personal Data. This may be possible if your Personal Data it’s not accurate or there is an ongoing legal claim.
• Ask us to transfer all your Personal Data to another company. Please note that we may do it if a regulatory requirement enables it, providing your Personal Data in a structured, commonly used and machine-readable format.
• Withdraw your consent or update your permissions. You’re in control of your Personal Data and therefore you can change your privacy settings and preferences by sending an email to go@vincenthall.nl.

We will consider all such rights requests and provide our response within a reasonable period (and in any event within any time period required by applicable data protection laws). Please note, however, that certain Personal Data may be exempt from such requests in specific circumstances. If an exception applies, we will tell you this when responding to your request. We may request you provide us with information necessary to confirm your identity before responding to any request you make.

If we delete any Personal Data which we are holding about you, this deletion may only relate to the Services and not any other service provided by us in other jurisdictions. You should make requests for each account that you may have set up to access the Services or any other service provided by us.

In case of a consultation needed with the Supervisory Authority in the Netherlands, you should contact Dutch Data Protection Authority (Postbus 93374. 2509 AJ DEN HAAG).