PRIVACY POLICY — WORKSHOP BOOKINGS

Last updated: October 2026

Koffie Academie respects your privacy and processes personal data in accordance with the General Data Protection Regulation (GDPR / AVG) and applicable Dutch data protection legislation.

This Privacy Policy explains how personal data is collected, used and protected when you make or manage a workshop booking with Koffie Academie.

1. DATA CONTROLLER

The data controller responsible for the processing of your personal data is:

Koffie Academie
Overtoom 95H
Amsterdam, The Netherlands

Email: workshops@koffie-academie.nl

2. PERSONAL DATA WE COLLECT

When you make a workshop booking, we may collect:

  • your name;
  • your email address;
  • your telephone number, including international country code;
  • the names of other participants included in your booking;
  • workshop date and booking details;
  • number of participants;
  • booking reference;
  • ticket and QR code identifiers;
  • payment status and payment transaction references;
  • cancellation, rescheduling and refund information;
  • communications relating to your booking.

A telephone number is personal data under the GDPR. Autoriteit Persoonsgegevens

Koffie Academie does not store your complete payment card or banking credentials. Payments are processed through Stripe.

3. WHY WE REQUIRE A TELEPHONE NUMBER

A valid telephone number is required when booking a workshop.

We use your telephone number only where reasonably necessary to manage your booking and participation, for example:

  • if there is a problem completing or identifying your booking or payment;
  • if important booking information needs clarification;
  • if we need to contact you regarding a cancellation, rescheduling or operational change;
  • if an urgent issue arises concerning your workshop attendance;
  • where email communication has failed or a timely response is necessary.

Your telephone number is not used for advertising, promotional calls or marketing messages unless you have separately consented to such communications.

The primary legal basis for processing booking-related contact information is the performance of the booking agreement and, where applicable, steps taken at your request before entering into that agreement. Autoriteit Persoonsgegevens

4. PURPOSES OF PROCESSING

We process personal data in order to:

  • process and administer workshop bookings;
  • communicate with customers regarding their reservations;
  • process payments and refunds;
  • issue workshop tickets and QR codes;
  • manage participant capacity and attendance;
  • provide booking and payment support;
  • contact participants where necessary concerning their workshop;
  • manage cancellations and rescheduling requests;
  • prevent fraud, misuse and technical errors;
  • comply with applicable accounting, tax and legal obligations.

Workshop booking data is not automatically added to marketing mailing lists.

5. LEGAL BASIS

Depending on the type of processing, we rely on one or more of the following GDPR legal bases:

Performance of a contract
Processing that is necessary to create, manage and perform your workshop booking, including booking communications and contact details.

Legal obligation
Certain payment and transaction information may need to be retained in order to comply with tax, accounting or other statutory requirements.

Legitimate interests
In limited circumstances, we may process information where necessary for legitimate operational or security purposes, provided that those interests do not override your rights and freedoms.

Consent
Where we wish to use your personal information for a purpose that requires consent, such as optional marketing communications, we will ask for that consent separately.

The GDPR requires organisations to identify an appropriate legal basis before processing personal data. European Data Protection Board

6. PAYMENT PROCESSING

Payments are processed by Stripe.

Stripe processes the payment information necessary to complete transactions in accordance with its own privacy obligations.

Koffie Academie may retain:

  • amount paid;
  • payment status;
  • Stripe transaction or session identifiers;
  • refund status;
  • refund amounts.

We do not receive or store your complete payment card or online banking credentials.

7. BOOKING AND SERVICE COMMUNICATIONS

Your email address and, where necessary, your telephone number may be used for service-related communications concerning your booking.

These may include:

  • booking confirmation;
  • ticket and QR code delivery;
  • payment issues;
  • workshop changes;
  • cancellations;
  • rescheduling;
  • refund information;
  • necessary attendance information.

These are operational communications associated with your booking and are separate from marketing communications.

8. BOOKINGS MADE FOR OTHER PARTICIPANTS

If you make a booking on behalf of another person, please ensure that you are authorised to provide the information necessary to register that participant.

We aim to collect only the information required to manage their participation.

9. DATA SHARING

We may share personal data with service providers where necessary to operate the workshop booking service, including:

  • Stripe and other payment service providers;
  • hosting and website infrastructure providers;
  • email delivery services;
  • IT and security providers;
  • accountants, professional advisers or competent authorities where legally required.

Where third parties process data on our behalf, appropriate data-processing arrangements must be in place where required by the GDPR. Autoriteit Persoonsgegevens

We do not sell personal data.

10. INTERNATIONAL TRANSFERS

Some technology providers may process data outside the European Economic Area.

Where required, appropriate GDPR safeguards are used, such as an adequacy decision or contractual safeguards recognised under EU data-protection law.

11. DATA RETENTION

Personal data is retained only for as long as necessary for the relevant purpose.

Booking contact information is retained for the period reasonably necessary to:

  • complete the workshop;
  • deal with support queries, cancellations or refunds;
  • resolve disputes;
  • comply with applicable legal obligations.

Payment and accounting records may be retained for longer where required by law.

When personal data is no longer required, it will be deleted or anonymised where appropriate.

12. DATA SECURITY

Koffie Academie applies appropriate technical and organisational safeguards designed to protect personal data from:

  • unauthorised access;
  • accidental loss;
  • misuse;
  • alteration;
  • unauthorised disclosure.

Access to booking information is limited to authorised personnel who need it for operational purposes.

13. YOUR GDPR RIGHTS

Subject to the conditions of the GDPR, you may have the right to:

  • access your personal data;
  • correct inaccurate information;
  • request deletion of personal data;
  • request restriction of processing;
  • object to certain processing;
  • receive certain data in a portable format;
  • withdraw consent where processing is based on consent.

Some rights may be limited where Koffie Academie is legally required to retain particular information.

14. EXERCISING YOUR RIGHTS

For questions about your personal data or to exercise a privacy right, contact:

workshops@koffie-academie.nl

We may request sufficient information to verify the identity of the person making the request.

15. COMPLAINTS

If you have concerns regarding the processing of your personal data, you may contact Koffie Academie first so that we can investigate the matter.

You also have the right to lodge a complaint with the Dutch supervisory authority:

Autoriteit Persoonsgegevens

16. AUTOMATED DECISION-MAKING

Workshop booking information is not used for automated decision-making or profiling that produces legal or similarly significant effects.

17. CHANGES TO THIS POLICY

This Privacy Policy may be updated when our services, systems or legal obligations change.

The latest version will be published on our website.