AVG/GDPR-compliant privacy notice for guests and customers — required under articles 13/14 AVG (the Dutch implementation of the GDPR) for essentially any business processing personal data (bookings, orders, Wi-Fi, CCTV, loyalty programmes).
⚠️ This is a blank template, not legal advice: check the wording with a lawyer and adapt it to your jurisdiction and your case.
This template has no optional clauses: the text is the same for everyone. Field placeholders are shown as labels — on the site the template is read-only, values are entered inside the system.
PRIVACY NOTICE (PRIVACYVERKLARING)
Business name (data controller) (Business address, KvK KvK (trade register) number) Effective date: Effective date
This notice explains how Business name (data controller) (the "Company", the data controller) collects, uses and protects your personal data, in accordance with the Algemene Verordening Gegevensbescherming ("AVG" — the Dutch name for the GDPR) and the Uitvoeringswet AVG.
1. DATA CONTROLLER 1.1. Business name (data controller) is the data controller for the processing described in this notice.
2. WHAT DATA WE COLLECT AND WHY 2.1. What data is collected and why
3. LEGAL BASIS FOR PROCESSING 3.1. Purposes & legal basis (art. 6 AVG)
4. PROCESSORS AND THIRD PARTIES 4.1. Processors & third parties 4.2. Where a third party processes personal data on our behalf, we have a verwerkersovereenkomst (processing agreement, art. 28 AVG) with that party.
5. RETENTION 5.1. Retention period
6. YOUR RIGHTS 6.1. Data subject rights 6.2. You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, at autoriteitpersoonsgegevens.nl, if you believe your data has been mishandled.
7. CONTACT US 7.1. Questions about this notice, or requests to exercise your rights, may be sent to Privacy contact email.
⚠️ If CCTV, guest Wi-Fi logging, or staff monitoring is used, keep a corresponding entry in the verwerkingsregister (register of processing activities, art. 30 AVG) and post visible signage where cameras are in use.
— — — ⚠️ This is a boilerplate template, not legal advice. Dutch employment, consumer-protection, data-protection, and health & safety law (Burgerlijk Wetboek Boek 7, Arbowet, AVG/GDPR) is detailed and actively changing through 2026–2028 (Wet meer zekerheid flexwerkers, modernisering van het concurrentiebeding, renewal of CAO Horeca after 31 December 2026) — have this document reviewed and adapted by a Dutch employment/legal advisor (jurist/advocaat) before use. Where a Dutch-language version of this document is also used, the Dutch-language version prevails in case of any conflict.
Fields that belong to a switched-off clause are dimmed — they are not asked for.
e.g. bookings, orders, CCTV footage, guest Wi-Fi logs, loyalty/marketing data
e.g. contract performance, legitimate interest, consent — for each purpose listed above
Payment providers, booking/reservation platforms, marketing tools, and any transfer outside the EEA
Access, rectification, erasure, restriction, objection, portability, and the right to complain to the Autoriteit Persoonsgegevens
2 of 10 fields are taken from the company, employee or counterparty record, the questionnaire can be dictated to the AI, and the finished document comes with a number, a PDF and an acknowledgement record.