Privacy Policy

Pickorabuzzpocket B.V. ("Pickorabuzzpocket," "we," "our," or "us"), registered at Keizersgracht 482, 1016 EG Amsterdam, Netherlands, is committed to safeguarding the privacy and fundamental data protection rights of our clients, website visitors, and charter passengers. This comprehensive Privacy Notice details how we collect, process, store, transfer, and protect your personal data pursuant to the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming), and the Dutch Telecommunications Act (Telecommunicatiewet).

1. Data Controller Identification

The legal data controller responsible for the processing of personal data across our digital domain (pickorabuzzpocket.homes) and physical passenger booking channels is:

• Legal Entity: Pickorabuzzpocket B.V.
• Chamber of Commerce (KVK): 84920194
• Registered Seat: Keizersgracht 482, 1016 EG Amsterdam, Netherlands
• Data Protection Officer (DPO): [email protected]
• Direct Inquiries: [email protected]

2. Categories of Personal Data Collected

We only process personal information necessary for the execution of our commercial transport agreements, municipal passenger logs, and website functionality:

• Identification & Contact Data: Full legal name, residential or business billing address, email address, mobile telephone number, and passport/ID details where mandated for international airport customs manifests.
• Reservation & Route Details: Preferred pickup point, canal itinerary selections, hospitality choices, passenger headcount, celebration milestones, and scheduled drop-off destinations.
• Financial & Payment Transaction Data: Encrypted credit/debit card tokens, Dutch iDEAL transaction numbers, SEPA corporate bank transfer details, and VAT identification numbers. We never store raw payment card CVV codes on our servers.
• Technical & WebGL Device Telemetry: IP address, device viewport resolution, browser software version, operating system, approximate geographic locale (city-level), WebGL GPU rendering performance metrics (for 3D canal visualization), and interaction durations.

3. Legal Bases for Data Processing

We operate strictly under the lawful grounds established in Article 6(1) of the GDPR:

• Contractual Performance (Art. 6(1)(b)): Necessary to generate quotes, confirm charter schedules, dispatch party coaches, and furnish catering amenities.
• Legal Obligation Compliance (Art. 6(1)(c)): Fulfilling Dutch commercial ledger retention obligations (Belastingdienst 7-year statutory financial rules) and Municipal Transport Authority passenger capacity regulations.
• Legitimate Interests (Art. 6(1)(f)): Protecting on-board passengers, fleet asset security, fraud prevention, network security, and refining our 3D spatial web application.
• Freely Given Consent (Art. 6(1)(a)): For non-essential analytics tracking, marketing updates, and specific photographic permissions during event tours.

4. Third-Party Data Processors & Subcontractors

Pickorabuzzpocket B.V. does not sell, rent, or trade your personal data. We disclose information solely to vetted processors bound by strict Data Processing Agreements (DPAs):

• Cloud Infrastructure & Hosting: Amazon Web Services EMEA SARL (Frankfurt & Dublin EU regions).
• Payment Gateways: Mollie B.V. (Amsterdam, Netherlands) and Stripe Technology Europe Ltd. for PCI-DSS Tier 1 compliant transactions.
• Fleet Telematics & Dispatch: TomTom Telematics B.V. for live route optimization, avoiding low-clearance canal bridges, and GPS municipal reporting.

5. Data Retention Periods

Personal data is preserved only as long as necessary to achieve the designated purpose. Booking records, financial invoices, and contractual agreements are retained for seven (7) statutory years in compliance with the Dutch State Tax Administration. Web server access logs and telemetry data are erased or anonymized after thirty (30) calendar days.

6. Your GDPR Data Subject Rights

Under Chapter III of the GDPR, European and international clients maintain the following statutory entitlements:

• Right of Access (Art. 15): Obtain confirmation regarding whether personal data is processed and request certified copies.
• Right to Rectification (Art. 16): Rectify inaccurate or incomplete contact or reservation records.
• Right to Erasure ("Right to Be Forgotten", Art. 17): Request deletion of personal records where legal retention requirements no longer apply.
• Right to Restriction (Art. 18): Restrict processing under contested circumstances.
• Right to Data Portability (Art. 20): Receive your structured personal data in machine-readable JSON or CSV format.
• Right to Object (Art. 21): Object at any moment to processing justified by legitimate interest.

To exercise your rights, contact our Data Protection Officer at [email protected]. We respond to verified requests within thirty (30) calendar days without fee. You also retain the right to lodge a formal complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.