Privacy & Personal data Policy

Last updated: 1.08.2026

1. General

This Privacy and Personal Data Policy explains what personal data we collect, for what purposes and on what legal grounds we use it, who we may share it with, how long we keep it, and what rights you have.

This Policy applies when you:

  • visit art-unlocked.com and its pages;
  • choose and book an Experience;
  • pay for, change, or cancel a booking;
  • buy or use a gift card or voucher;
  • contact our customer support;
  • subscribe to newsletters or promotional messages;
  • submit reviews, photos, or other materials;
  • are photographed or filmed during certain Experiences, and in the subsequent use of such materials;
  • interact with us by email, WhatsApp, social media, or other channels.

It applies regardless of the device you use.

Terms used in this Policy are interpreted in line with the EU General Data Protection Regulation 2016/679 (“GDPR”), applicable Dutch law including the GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming), and applicable rules on cookies and electronic communications.

2. Who is responsible for your data

The controller of your personal data for the website, the booking platform, customer support, marketing communications, and the other activities described in this Policy is:

VERVVEY B.V.
Jane Addamslaan 46
1187 DA Amstelveen
The Netherlands

KvK number: 86164503
VAT number: NL863881658B01

Email for data protection matters: welcome@art-unlocked.com

When contacting us about privacy, please put “Privacy request” in the subject line.

We have not appointed a dedicated Data Protection Officer. Data protection requests are handled by responsible staff at VERVVEY B.V.

3. The role of our guides (Artmates)

ART UNLOCKED creates and sells curated art experiences. When you book, your contract is with us, and we are responsible to you for the Experience.

Our Experiences are led on location by independent professional (“Artmates”), who deliver the Experience on our behalf. To make this possible, we share with the Artmate leading your walk only the information they need to:

  • identify your booking;
  • contact you if needed;
  • organise the meeting;
  • know the number of participants;
  • accommodate any special requests you’ve told us about;
  • run the Experience;
  • handle changes, cancellations, and any issues.

4. What data we process

4.1. Data you provide when booking

We may process: your first and last name; email address; phone number; the city and Experience chosen; date and time; number of adult participants; number of children and their age group; any promo, gift-card, or voucher code; comments and special requests; details of changes or cancellations; your booking code and voucher details; and the history of your contacts about a specific booking.

If you book for other participants, please provide only the necessary data and, where required, inform them that you’re sharing it with us.

4.2. Payment and transaction data

We may process: the amount and currency; date and time of payment; payment status; transaction ID; the payment method chosen; refund details; limited information about your payment instrument provided by the payment processor; and the results of technical payment and fraud-prevention checks.

Your full card number, expiry date, and security code are entered on the payment processor’s side and do not reach our systems.

4.3. Gift cards and vouchers

When you buy or use a gift card, we may process: the buyer’s name; the buyer’s or recipient’s email; the value and number of cards; the unique card number; expiry date; available and used balance; payment details; details of Experiences paid for with the card; and correspondence about delivery or recovery of the card.

For corporate gift cards, we may also process the organisation’s name, the representative’s name and contact details, and payment/accounting details.

4.4. Contact and customer support

When you contact us by email, phone, WhatsApp, social media, or otherwise, we may process: your name; email and phone number; social-media username; the content of your message; booking number; documents or images you attach; correspondence history; and information needed to handle a complaint or claim.

Please don’t include bank details, ID copies, medical data, or other sensitive information in free-text fields unless it’s needed to handle a specific request.

4.5. Newsletter subscription

When you subscribe, we may process: your name; email; language; city or destinations of interest; the date, time, source, and wording version of your consent; information about opens and link clicks if you’ve allowed those technologies; and unsubscribe details.

4.6. Reviews, images, and other materials

If you submit a review, photo, or other material, we may process: your name or chosen pseudonym; the review text; rating; Experience details and date; photo and video materials; the source of the review; and your consent to publish.

Before publishing, we may check whether a review relates to a real booking and remove any contact, payment, or excessive personal data from it.

Separately from materials you submit yourself, during certain Experiences the Artmate or a photographer we work with may create photos and video in which participants may be recognisable. In that case we may process: your image, appearance, and voice; the date, city, Experience, and circumstances of filming; original and edited files; and any request not to be filmed, to remove material, or to crop or blur an image.

If a person cannot be identified—directly or indirectly, including after reliable blurring or other irreversible de-identification—the material is not treated as their personal data.

4.7. Technical data

When you visit the site, our servers and connected services may receive: IP address; date and time of the request; the page opened; the referring source; device type; browser type and version; operating system; language; approximate region from the IP address; technical identifiers; cookie data and similar technologies; your cookie consent or refusal; site errors; security and suspicious-activity data; and information about your actions on the site if you’ve allowed analytics or marketing technologies.

4.8. Data from third parties

We may receive data from: the Artmate leading your walk; photographers or video editors we work with (including consent/refusal information); the payment processor, bank, or payment system; a partner through whom you reached our site; a platform where a review was posted; social media, if you contact us through it; a gift-card provider; and public sources, courts, authorities, or professional advisers where the law provides for it.

5. Purposes and legal bases

5.1. Running and securing the website

We process technical data to display pages, save your order contents, run forms, prevent attacks/abuse/spam/fraud, diagnose errors, protect users and partners, and keep technical logs.

Legal basis: necessity to perform the function you requested; our legitimate interests in a secure, stable site (Art. 6(1)(f) GDPR); and our data-security obligations.

5.2. Making and fulfilling bookings

We use data to create and confirm your order, check availability, send your voucher and instructions, coordinate with the Art Mate, change or cancel orders, issue refunds, keep you informed, and handle booking-related requests.

Legal basis: performance of the contract for the Experience concluded between you and VERVVEY B.V. when you accept our Terms and confirm your order (Art. 6(1)(b) GDPR).

Providing your name, contact details, and basic order information is necessary to book. Without it, we can’t confirm your order or arrange the Experience.

5.3. Delivery of the Experience by the Artmate

We share the necessary data with the Artmate delivering your Experience on our behalf, so your booking can be fulfilled (GDPR).

5.4. Processing payments and refunds

We use transaction data to take payment, confirm the transaction, process refunds, investigate disputed payments, keep financial records, and prevent fraud.

Legal bases: performance of the contract ; legal and tax obligations ; legitimate interest in fraud prevention and protecting our and users’ rights .

5.5. Gift cards

We use data to process the purchase, deliver the card, track validity and balance, apply it to an order, recover a card, prevent misuse, and meet accounting obligations.

Legal bases: performance of the contract; legal obligation; legitimate interest in preventing abuse.

5.6. Support, complaints, and claims

We process your messages to answer questions, change or cancel orders, handle complaints, resolve disputes, monitor service quality, and defend or bring legal claims.

Legal bases: performance of the contract ; legal obligation ; legitimate interest in supporting users and protecting rights .

5.7. Newsletters and promotional messages

We send news, offers, and promotional messages only where we have a valid basis. For people who’ve subscribed, the basis is consent .

Consent to the newsletter is not a condition of booking, is given separately, can be withdrawn at any time, and does not automatically extend to analytics or marketing cookies. You can unsubscribe via the link in any email or by writing to welcome@art-unlocked.com. After you unsubscribe, we may keep a minimal record of your email on a suppression list so we don’t message you again.

5.8. Analytics and improving the site

With your consent, we may analyse site use to understand which pages and Experiences are popular, spot technical issues, assess the interface, improve search and booking, and measure advertising effectiveness.

Legal basis: your consent . We use Google Analytics for this.

5.9. Marketing and advertising technologies

With your consent, we may use marketing technologies to evaluate campaigns, attribute bookings, cap ad frequency, build advertising audiences, show ads on other sites and platforms, and run partner/affiliate programmes.

Legal basis: your consent . We use the Meta Pixel for this. Refusing marketing cookies doesn’t affect your ability to browse, book, or pay.

5.10. Publishing reviews, photos, and video

We may publish a review, name or pseudonym, photo, and Experience details where you’ve submitted the material for publication and were informed beforehand that it would be public.

Our Experiences are social, group events, and we (or people working with us) often take photos and video during them to capture the atmosphere. We may use this content on our website, in our social-media accounts, and in materials about ART UNLOCKED and our Experiences.

Legal basis: our legitimate interest in showing what our Experiences are like and promoting them . By taking part, you understand you may appear in such photos or video.

We always respect our guests. If you’d prefer not to be featured, let the Artmate know on the day, and if you later see content featuring you that you’d like removed, email welcome@art-unlocked.com and we’ll take it down from our own channels. You can ask us to stop using material featuring you at any time; we’ll stop further use and remove it from channels we control, so far as is technically and legally possible. Withdrawal doesn’t affect use that was lawful before then.

Removing material from our site or accounts doesn’t always mean it immediately disappears from search engines, caches, archives, reposts, third-party posts, or previously produced printed materials. We can’t guarantee removal of copies made independently by third parties, but where we’re obliged to, we take reasonable steps to notify known recipients of a removal request.

For any close-up or promotional use built around an identifiable individual, we rely on that person’s specific consent  rather than legitimate interest.

5.11. Accounting and tax

We process data in invoices, payment documents, refunds, and accounting records to comply with tax, accounting, and corporate law .

5.12. Protecting rights and preventing violations

We may process data to prevent fraud, establish breaches of our terms, protect users’ rights, protect our intellectual property, bring or defend legal claims, and deal with courts, law-enforcement, and regulators.

Legal bases: legitimate interest ; legal obligation .

6. Special categories of data

We don’t ask you to provide data on health, disability, religion, political views, biometrics, or other special categories.

If you voluntarily tell us about health, mobility, or other circumstances so we can check whether a route is accessible or arrange safe participation, we process only what’s necessary. Where Art. 9 GDPR requires it, the basis is your explicit consent or another applicable exception. Such information is shared with the Artmate only to the extent needed.

An ordinary photo or video of a recognisable person is personal data, but doesn’t become special-category biometric data merely because a face is visible. It’s biometric data under Art. 9 only if processed by specific technical means for unique identification. We don’t use Experience materials for facial recognition, biometric templates, or automated unique identification.

7. Children’s data

Our services are intended for adults who can enter into a contract themselves.

Recognisable photos or video of children are published only with a parent’s or guardian’s separate consent. We try not to publish a child’s full name, contact details, or other information that would unnecessarily ease identification, and we take a child’s own objection into account where they can understand the situation.

8. Who we share data with

Depending on the purpose, your data may be available to: the Artmates delivering Experiences; photographers, video editors, and media-storage providers, only as needed; payment processors, banks, and payment systems (including Stripe); hosting, infrastructure, backup, and content-delivery providers; website developers and technical support; email, CRM, and support-tool providers; form-processing services; security and fraud-prevention providers; analytics and advertising providers, only within your consent (Google, Meta); distribution and booking partners such as GetYourGuide, where you book through them; social networks and publishing platforms, where you’ve allowed publication; affiliate/referral partners, within your consent; accountants, auditors, tax advisers, lawyers, and insurers; government, judicial, law-enforcement, and regulatory bodies where required; and a buyer, investor, or adviser in a business sale or reorganisation, subject to confidentiality.

We don’t sell users’ personal-data sets.

Providers processing data solely on our instructions are bound to maintain confidentiality and security and to meet Art. 28 GDPR. Some recipients—payment providers, social networks, distribution partners—may act as independent controllers under their own privacy policies.

9. Transfers outside the EEA

We work with Experiences and partners in different countries, so data may be transferred to recipients outside the European Economic Area (EEA)—for example, when a technical provider (such as Google, Meta, or Stripe) uses infrastructure or staff outside the EEA, or when material is published publicly online and becomes accessible internationally..

10. Cookies and similar technologies

The site uses cookies, local storage, pixels, and similar technologies, falling into these categories: strictly necessary,  analytics, marketing.

Strictly necessary technologies run the site, keep it secure, store your order contents, and remember your privacy settings. Optional analytics and marketing technologies run only after you consent, unless a specific technology may lawfully run without consent. Before you consent, optional providers don’t receive data from your device.

You can accept, reject, or configure categories via the cookie panel, and change your choice any time through “Cookie Policy” in the site footer.

11. Automated checks

To protect payments and bookings, we or our payment processor may run automated technical checks—considering, for example, unusual numbers of payment attempts, mismatched technical parameters, signs of automated tools, previously identified fraud, or an unusual device, location, or interaction. A check may lead to additional verification, delay, or refusal of a payment.

If a decision based solely on automated processing produces legal or similarly significant effects for you, you can ask for human involvement, express your view, and contest the decision.

12. Retention periods

We don’t keep data longer than needed for the stated purposes, legal obligations, and protection of rights. Indicative periods:

  • Incomplete bookings: up to 30 days, unless longer is needed to investigate a technical error or fraud, or at your request.
  • Completed bookings: core booking data and correspondence about changes, cancellations, and claims, up to 5 years after the Experience or final resolution of a dispute.
  • Financial and accounting data: at least 7 years, or longer where the law requires.
  • Gift cards: operational data for the card’s validity and a necessary period after last use; payment/accounting records for the legal period.
  • Support requests: ordinary requests up to 3 years after closure; dispute-related ones up to 5 years after final resolution, or longer where required.
  • Newsletter: contact data until you withdraw consent; a record of consent and withdrawal up to 5 years after withdrawal; a minimal suppression-list record to prevent repeat messaging.
  • Cookie consents: records of your choice, notice version, date, and consent ID for the duration of the choice and up to 5 years after change or withdrawal.
  • Analytics: optional web-analytics data generally no more than 14 months.
  • Technical logs: ordinary logs up to 12 months; incident-related data until the investigation and any subsequent limitation period ends.
  • Reviews, photos, and video: published reviews kept while relevant and until you ask for removal; published photos/video used on the basis of legitimate interest or consent kept until you object or withdraw, or the purpose ends, with necessity reviewed periodically; unused originals deleted or anonymised within a reasonable time; records of consent and its scope up to 5 years after use ends where needed to show compliance.

Data may be kept longer if the law requires, a dispute or investigation is ongoing, a legal claim needs protecting, or the data is anonymised so it no longer identifies anyone.

13. Security

We apply reasonable technical and organisational measures appropriate to the data and risks, including: encrypted connections; access control and user-role separation; backups; software updates; protection of admin accounts; activity logging; limiting staff and contractor access; restricting access to original photo/video files; recording consents, permitted channels, and removal requests; cropping, blurring, or otherwise de-identifying images where publishing a recognisable person isn’t needed; confidentiality obligations; incident-response procedures; data minimisation; and deletion or anonymisation after retention periods.

No system can guarantee absolute security. If an incident occurs, we act to limit its effects and meet our obligations to notify the supervisory authority and affected individuals where the law requires.

14. Your rights

To the extent applicable law provides, you have the right to: information about how your data is used; access to a copy of your data; rectification of inaccurate or incomplete data; erasure where data is no longer needed, consent is withdrawn, processing is unlawful, or another legal basis applies (this can be limited where data is needed for a legal obligation, a contract, or legal claims); restriction of processing in the cases GDPR provides; portability of data you provided, in a structured, commonly used, machine-readable format, where Art. 20 conditions apply; objection to processing based on legitimate interests (we’ll stop unless we show compelling grounds or need the data for legal claims; for direct marketing, we always stop); withdrawal of consent at any time (not affecting prior lawful processing—and for photos/video, you can withdraw fully or for specific purposes or channels); human review of a solely automated decision where applicable; and to lodge a complaint with a supervisory authority.

Our lead authority is:

Autoriteit Persoonsgegevens
Postbus 93374
2509 AJ Den Haag
The Netherlands

Before complaining, you’re welcome to contact us so we can try to resolve the issue.

15. How to exercise your rights

Send your request to welcome@art-unlocked.com, including where possible: your name; contact email or phone; booking number (if relevant); the nature of the request; the data it concerns; and, for a photo/video request, a link or description of the material and the date or city, so we can find it without using facial recognition.

We may ask for information reasonably needed to verify your identity, and won’t ask for more than necessary. We normally respond within one month; for complex or numerous requests we may extend by up to two further months, telling you within the first month. Requests are free, though for clearly unfounded or excessive repeat requests we may charge a reasonable fee or decline, as GDPR allows.

If a request concerns data held by an independent controller—such as a payment processor or a distribution partner—we may direct you to them or help pass the request on.

16. Third-party links and services

The site may link to payment pages, maps and video services, social networks, messengers, partner sites, Google Forms, external partner sites, and review platforms. When you go to an external site, that organisation may collect and process data on its own account. This Policy doesn’t govern processing a third party carries out as an independent controller—please review their privacy policy first.

If a photo or video is published, with consent, on a social network or other external platform, that platform may process it and your technical data independently. Removing a post from our account doesn’t automatically remove reposts, cached copies, or material saved by others. External content able to send data to third parties directly from our pages loads only where the necessary consent or other legal basis exists.

17. Changes to this Policy

We may update this Policy when our processes, providers, purposes, data categories, the law, our site, or our services change. The current version is published here with its update date. If a change materially affects processing purposes, your rights, or consent-based processing, we’ll give additional notice and, where needed, ask for fresh consent. Continuing to use the site isn’t, by itself, consent to new processing that legally requires separate active consent.

18. Contact

For any questions about this Policy, our processing, or your rights:

VERVVEY B.V.
Jane Addamslaan 46
1187 DA Amstelveen
The Netherlands

KvK: 86164503
VAT:NL863881658B01

Email: welcome@art-unlocked.com