Privacy statement

1. Who we are

Skadea is a service of [BEDRIJFSNAAM B.V.], located at [ADRES], registered with the Dutch Chamber of Commerce (KvK) under number [KVK-NUMMER]. You can reach us at [CONTACT-E-MAILADRES] or via the contact page on this website.

We are the controller for the data of our customers (campsite owners) and of visitors to skadea.com. Data that guests leave via a campsite's widget (reviews and suggestions for outings) is processed by us on behalf of that campsite; the campsite is the controller for that data and we are the processor.

2. What data we process and why

We only process the data needed for the following purposes:

• Sign-up and account (campsite owners): email address, name of the campsite and contact person, website, address and coordinates of the campsite, chosen languages and a one-time verification code for your email address. Purpose: creating your account and setting up the widget for your campsite. Legal basis: performance of the contract.
• Logging in: email address, a securely stored password (we only store a hash), login links (also stored only as a hash) and session cookies. Purpose: keeping your management environment secure. Legal basis: performance of the contract.
• Invoicing and payment: company name, billing address, VAT number, country, subscription, invoices and payment status. Payments are handled by Stripe; we do not receive or store full card or bank account details. Purpose: issuing invoices and processing payments. Legal basis: performance of the contract and legal (tax) obligations.
• Widget content: outings, texts, photos, logo and branding that you enter yourself or have generated. As a rule, this is not personal data.
• Campsite guests: reviews (stars, text and optionally a name) and suggestions for outings (a link, a description and optionally a name). Entering a name is never required. The campsite reviews contributions before they become visible. Legal basis: the campsite's legitimate interest in letting guests share experiences.
• Contact form: name, email address and your message. Purpose: answering your question. Legal basis: legitimate interest.
• Email: we send service emails such as verification codes, login links, confirmations, notifications and invoices. We keep a log of sent emails (recipient, subject, content, type and delivery status) so that we can check delivery. Legal basis: performance of the contract and legitimate interest.
• Security and abuse prevention: your IP address is used briefly to limit the number of requests (rate limiting). The sign-up form uses Google reCAPTCHA to keep out bots. Changes in the management environment are recorded in an audit log (what was changed and by whom). Legal basis: legitimate interest in a secure service.
• Error monitoring: when technical errors occur, we receive error reports with technical data (such as browser, page and IP address). For a small share of visits, a session recording is made so that errors can be reproduced; text and input fields are masked. Legal basis: legitimate interest in a properly functioning service.
• Widget statistics: we anonymously count how often a widget is viewed and how often outings, map links or the share button are clicked. We do not store an IP address, cookie or other identifier; these counts are therefore not personal data.

3. Use of AI and translation services

We use AI to write and translate descriptions of outings (Anthropic, Claude) and to create illustrations (OpenAI). For this, we send the name and location of the campsite and information about the outing. If a guest makes a suggestion, the link and description of that suggestion are sent to Anthropic to analyse the outing. We deliberately do not send names or email addresses. Please do not include personal data in a suggestion.

Texts of outings and service emails may be translated via DeepL. A service email may contain your name or the name of your campsite.

We do not use AI for decisions that produce legal effects concerning you or similarly significantly affect you.

4. Who we share data with

We do not sell your data. We use the following service providers (processors), with whom we have agreements on the security and confidentiality of your data.

• Supabase (database, file storage and login for administrators): all data mentioned above. Servers in [SUPABASE-REGIO]. Supabase Inc. is a US company; transfers outside the EU are therefore possible.
• Vercel (hosting of the website and the widget, server logs): data sent via the website, including IP addresses. Vercel Inc. is based in the United States; data may be processed outside the EU.
• Stripe (payments and subscriptions): name, email address, billing and payment details. Stripe Payments Europe Ltd. is based in Ireland; Stripe may also process data in the United States.
• Anthropic (AI texts and translations): data about the campsite and outings, and the content of guest suggestions. Processing in the United States.
• OpenAI (AI illustrations): name, type and description of outings; no personal data. Processing in the United States.
• DeepL (translations): texts of outings and service emails. DeepL SE is based in Germany (EU).
• Resend (sending email): email address, name and email content. Processing in the United States.
• Upstash (rate limiting): IP addresses, briefly. Servers in [UPSTASH-REGIO].
• Sentry (error monitoring and session recordings): technical data and IP address when errors occur. Servers in [SENTRY-REGIO]; Functional Software Inc. (Sentry) is a US company.
• Google (reCAPTCHA on the sign-up form, address search via Google Maps/Places during sign-up, fonts via Google Fonts): your IP address and browser data; for reCAPTCHA also data about how you use the page. Processing in the United States.
• OpenStreetMap (maps in the widget and looking up locations) and OSRM (calculating travel times): your browser loads map tiles from OpenStreetMap, which makes your IP address known to those servers. For locations and travel times we only send place names and coordinates of outings.

Where data is processed outside the European Economic Area, this is done on the basis of an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, insofar as the party is certified under it) or the European Commission's standard contractual clauses. [PER PARTIJ CONTROLEREN]

Apart from this, we only share data with third parties if we are legally required to do so.

5. How long we keep data

• Account data: as long as your account is active, and thereafter [BEWAARTERMIJN NA OPZEGGING].
• Invoices and accounting records: 7 years, due to the statutory tax retention obligation.
• Sign-ups that do not result in an account: [BEWAARTERMIJN AANMELDINGEN].
• Guest reviews and suggestions: as long as the campsite uses them, or until they are deleted by the campsite or by us.
• Contact messages: [BEWAARTERMIJN CONTACTBERICHTEN].
• Email log: [BEWAARTERMIJN E-MAILLOG].
• Audit log of changes: 2 years; after that it is deleted automatically.
• IP addresses for rate limiting: a few minutes up to a maximum of one hour.
• Error reports and session recordings (Sentry): [BEWAARTERMIJN SENTRY].

6. Cookies and local storage

We do not use advertising or tracking cookies. We only use:

• functional cookies to remember your language choice and to keep you logged in to the management environment;
• local storage in your browser (localStorage) in the widget, to remember your favourite outings and your preference for list or map view. This data stays on your own device and is not sent to us;
• Google reCAPTCHA cookies, only on the sign-up form, to prevent abuse.

7. Security

We protect your data with appropriate technical and organisational measures. For example, all traffic runs over an encrypted connection (HTTPS), we only store passwords and login links as hashes, the database is shielded so that only our server can access it, and we record changes in an audit log.

8. Your rights

You have the right to access, rectify or erase your personal data. You can also ask us to restrict processing, object to processing based on legitimate interest and request your data in a commonly used format (data portability). If you have given consent, you can withdraw it at any time.

Send your request to [CONTACT-E-MAILADRES]. We will respond within one month. We may ask you to verify your identity. If you are a guest of a campsite, please preferably contact that campsite; we will assist the campsite with your request.

If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with the supervisory authority in your own country.

9. Changes

We may amend this privacy statement, for example when our service changes. The current version is always available on this page, with the version number and date at the top. We will inform customers by email of important changes.