Privacy Policy

1. Who we are

This Privacy Policy explains how Grachtlicht Media B.V. ("we", "us", "the Company"), a private limited company registered in the Netherlands under Company No. 78412096 with its registered office at Keizersgracht 412, 1016 GC Amsterdam, Netherlands, collects, uses, stores, shares and protects personal data in connection with the website cleverpocketscoutshelves.lol (the "Site"). The Company acts as the data controller for all personal data processed through the Site unless expressly stated otherwise.

The Site is an independent editorial publication about five luxury hotels located along the Amsterdam canals. We are not a travel agency, tour operator, reservation platform or payment processor. We do not take bookings, we do not hold hotel inventory, and we never collect payment card data.

2. Data we collect

We deliberately collect as little personal data as possible. The categories below describe everything that can reach us through normal use of the Site.

2.1 Information you give us voluntarily

• Contact form submissions: first name, last name, email address, optional telephone number, optional hotel of interest, optional approximate travel date, subject line, message content, enquiry category and your consent confirmation.
• Direct email correspondence: any information you choose to include when writing to hello@, press@ or [email protected], including message headers and attachments.
• Corrections and editorial tips: where you identify yourself as a hotel representative or industry source, we may record your name, role and organisation for verification purposes.

2.2 Information collected automatically

• Server log data: truncated IP address, user-agent string, requested URL, referring URL, response status, timestamp and approximate country. Logs are used for security, abuse prevention and diagnostics.
• Consent state: a record of whether you accepted all cookies, rejected non-essential cookies, or saved custom preferences, stored in your browser's local storage under the key cookieConsent and related preference keys.
• Analytics events, only with consent: anonymised or pseudonymised page views, article scroll depth, outbound link clicks and device class.

2.3 Information we never collect

We do not collect payment card details, passport or identity document numbers, precise geolocation, biometric data, or special category data such as health, religious belief, political opinion, trade union membership or sexual orientation. Please do not include such information in messages to us.

3. Legal bases for processing

Under Article 6 of the EU General Data Protection Regulation we rely on the following legal bases:

• Consent (Art. 6(1)(a)) — for analytics and functional cookies, and for handling voluntary enquiries submitted through the contact form.
• Legitimate interests (Art. 6(1)(f)) — for maintaining the security and integrity of the Site, preventing fraud and abuse, keeping short-lived server logs, and defending legal claims. We have balanced these interests against your rights and freedoms and consider the impact minimal.
• Legal obligation (Art. 6(1)(c)) — where retention or disclosure is required by Dutch or EU law, for example in response to a lawful order.

4. Cookies and similar tracking technologies

The Site uses a small number of first-party technologies. Essential storage keeps your consent choice and protects form submissions; it cannot be disabled because the Site would not function correctly without it. Analytics and functional cookies are loaded only after you provide consent through the banner, and you may withdraw that consent at any time using the "Cookie preferences" control in the footer of every page.

A full, itemised breakdown of each cookie and storage key — including purpose, type, provider and duration — together with browser-level opt-out instructions, is provided in our Cookie Policy.

5. Third-party processors and recipients

We use a deliberately short list of service providers. Each is bound by a written data processing agreement that restricts them to processing personal data only on our documented instructions.

We do not sell personal data, we do not share it with data brokers, and we operate no advertising exchange or retargeting pixels. Outbound links to hotel websites, the MICHELIN Guide, museums and transport operators lead to independent third parties whose own privacy policies govern your visit once you leave the Site.

6. International data transfers

Our primary infrastructure is located within the European Economic Area. Where a limited transfer outside the EEA occurs — for example when your browser requests a map tile or a font file — we rely on the European Commission's Standard Contractual Clauses, adequacy decisions where applicable, and supplementary technical measures. You can avoid the map transfer entirely by not opening the embedded map on the contact page.

7. Data retention periods

• Contact form and email correspondence: 24 months from the date of last contact, then deleted, unless an ongoing editorial or legal matter requires longer retention.
• Server access logs: 30 days in identifiable form, then aggregated or deleted.
• Analytics data: 14 months in aggregate form; no individual-level profiles are retained.
• Consent records: stored locally in your browser until you clear site data, and logged on our side for up to 24 months as evidence of consent.
• Accounting and statutory records: retained for seven years where required by Dutch tax law.

8. Your rights under the GDPR

If you are located in the European Economic Area, the United Kingdom or Switzerland, you have the right to: request access to the personal data we hold about you; request rectification of inaccurate data; request erasure ("right to be forgotten"); request restriction of processing; object to processing based on legitimate interests; receive your data in a portable, machine-readable format; and withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any right, write to [email protected]. We respond within 30 calendar days and may ask a limited question to verify that the request comes from you. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive. You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the supervisory authority in your country of residence.

9. California privacy rights (CCPA/CPRA)

California residents have the right to know what categories of personal information we collect, the purposes for collection, and the categories of third parties with whom it is shared; the right to request deletion; the right to correct inaccurate information; the right to limit the use of sensitive personal information; and the right not to be discriminated against for exercising these rights. We do not "sell" or "share" personal information for cross-context behavioural advertising as those terms are defined under the CPRA, and we have not done so in the preceding twelve months. Requests may be submitted to the same privacy address above and will be verified using the email address associated with your enquiry. Authorised agents may submit requests with written proof of authorisation.

10. Security measures

The Site is served exclusively over HTTPS with modern TLS. Administrative access requires multi-factor authentication and is limited to named editorial staff on a least-privilege basis. Form submissions are transmitted encrypted, stored in access-controlled mailboxes and reviewed manually. We maintain backup copies for disaster recovery and carry out periodic dependency and configuration reviews. No system is perfectly secure; if a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens within 72 hours and inform affected individuals without undue delay.

11. Children's privacy

The Site is intended for adults planning travel and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has submitted information to us, contact the privacy address and we will delete it promptly.

12. Changes to this Policy

We may update this Policy to reflect changes in law, technology or our editorial operations. The "Last updated" date at the top of this page always indicates the current version. Material changes affecting how we use personal data will be announced by a notice on the Site homepage for at least 30 days. Continued use of the Site after a change takes effect constitutes acknowledgement of the revised Policy.

13. Contact and Data Protection Officer

For any privacy matter, including access requests, objections, complaints or questions about this Policy, our appointed Data Protection Officer can be reached as follows:

Supervisory authority: Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, Netherlands.