Privacy Policy
How Vincent Hall handles your personal data, including cookies. Version of 22 October 2026.
1. Who is responsible
The controller of your personal data is Van Gogh Exhibition B.V., trading as Vincent Hall, Mauritskade 55A, 1092 AD Amsterdam, the Netherlands, Chamber of Commerce (KvK) 94140332 (“Vincent Hall”, “we”). This policy applies to www.vincenthall.nl, to the exhibition websites we run (such as weloveplaymobil.nl and frida.amsterdam), to our ticket shop and to visits to our premises. Questions and requests: go@vincenthall.nl.
2. What we process, why, and on which legal basis
| Purpose | Data | Legal basis (GDPR art. 6) | Kept for |
|---|---|---|---|
| Selling and delivering tickets, admission, customer service, rebooking and refunds where these terms allow | E-mail address, order (date, time slot, tickets, price, promotion code), payment status and reference, ticket codes and scans | Performance of the contract (b) | 7 years (Dutch tax retention duty), ticket codes until 3 months after the visit |
| Payment | Handled by Stripe; we receive the payment status and reference, not your card details | Performance of the contract (b) | 7 years |
| Bookkeeping and tax | Order and invoice data | Legal obligation (c) | 7 years |
| Answering e-mails, group bookings, venue rental and complaints | Name, contact details, content of your message | Contract (b) or legitimate interest in answering you (f) | 2 years after the last contact, longer for agreements and claims |
| Statistics about ticket orders | Order date, time slot, tickets, amount, how you reached the website (campaign tags, referring website, type of ad click). No name or e-mail | Legitimate interest in understanding which channels work (f) | 3 years |
| Website analytics and advertising measurement (only with your consent) | Cookie identifiers, pages visited, device and browser data, approximate location, interactions | Consent (a), see Cookies | See Cookies |
| Security of visitors, staff and the exhibition (camera surveillance, indicated by signs) | Camera images | Legitimate interest in safety and preventing theft and damage (f) | Up to 4 weeks, longer only to investigate an incident |
| Photos and videos in the halls for our website, social media and promotion (announced at the entrance) | Images in which you may be visible | Consent (a), which you can refuse or withdraw at any time | Until you object, at most 5 years |
| Newsletter (only if you sign up) | E-mail address, sign-up date | Consent (a) | Until you unsubscribe |
| Running and protecting the website | IP address, technical logs | Legitimate interest in a secure website (f) | At most 30 days |
We do not sell your personal data and do not use automated decision-making that has legal or similarly significant effects for you. Our services are not aimed at children under 16; tickets for children are bought by an adult.
3. Who receives your data
We use service providers (processors) who process data only on our instructions and under a data processing agreement:
- our ticket shop and customer system (tickets.vincenthall.nl) and its hosting provider;
- Stripe Payments Europe Ltd. (Ireland) for payments; Stripe is an independent controller for the payment itself and its fraud checks;
- Mailtrap for sending tickets and order e-mails;
- Cloudflare for hosting and protecting the website;
- Google (Workspace) for e-mail and documents;
- analytics and advertising providers, only with your consent (see Cookies).
We share data with the organiser of an event you buy a ticket for if that is not Vincent Hall, with the Dutch Tax Authority where required, with the police or other authorities where the law requires or allows this, and with our advisers (accountants, lawyers) where needed.
4. Transfers outside the European Economic Area
Some providers (for example Google, Meta, Cloudflare and Stripe group companies) may process data in the United States or other countries outside the EEA. For our service providers we use appropriate safeguards: an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework for certified companies) or the European Commission’s standard contractual clauses. Analytics services you accept in the cookie settings may also process data in countries without an adequacy decision; if you do not want this, do not accept analytics cookies. You can ask us for more information.
5. Security
We take appropriate technical and organisational measures to protect your data, such as encrypted connections, access controls and limited retention. If a data breach occurs that is likely to affect you, we inform you and the Dutch Data Protection Authority where the law requires this.
6. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict processing, to data portability, and to object to processing based on legitimate interest. Where processing is based on consent, you can withdraw your consent at any time (for cookies via the cookie settings in Cookies); this does not affect processing before the withdrawal. Send your request to go@vincenthall.nl. We answer within one month and may ask you to confirm your identity. Some data we must keep by law (for example order data for tax purposes).
If you are not satisfied with how we handle your data, please contact us first. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your EU country of residence.
7. Cookies
Cookies are small files a website stores in your browser; similar technologies (local storage, pixels, scripts) work the same way. We use:
- Necessary cookies — always on: they run the website and the ticket shop, protect against misuse (Cloudflare) and remember your cookie choice (12 months; if you decline, we ask again after 6 months). The payment page of Stripe uses its own necessary cookies.
- Analytics cookies — only with your consent: Google Analytics and similar analytics services, to see how the website is used (for example _ga, up to 2 years).
- Advertising cookies — only with your consent: Meta Pixel and Google advertising signals, to measure our ads and show relevant ads on social media (for example _fbp, 90 days).
- Maps and videos — the Google map on pages with our address is shown directly (Google may place its own cookies and receives your IP address, under the Google Privacy Policy); YouTube videos load only when you click them.
On your first visit we ask for your consent; rejecting is as easy as accepting and the website works fully without optional cookies. You can change your choice at any time: . You can also delete cookies in your browser settings.
8. Changes
We may update this policy, for example when we use new services. The current version is always on this page, with the date at the top. If changes are significant, we will make this clearly visible on the website.