Privacy Policy

This Privacy Policy explains how Expat Bubble B.V. ("ExB", "we", "us") collects, uses, stores and shares personal data when you use expatbubble.nl (the "Platform") and related services. It describes your rights under the GDPR and how to exercise them.

We may from time to time update this policy. Please make sure to regularly visit this policy in order to stay up to date.

• Controller: ExB is the controller for Platform operations including registration, booking facilitation, invoicing, payments, messaging storage, marketing and platform safety.
• Professional as controller: the Platform allows professionals to offer their products or services to Clients. Once you, the Client, have entered into contact with a professional, the professional acts as controller for their own communications with the Client. For more information about how the professional processes the Client's personal data as data controller, reference is made to the privacy policy of the respective professional.

We, as data controller, process the following categories of personal data for the purposes listed:

Please see below an overview of the cookies that we use:

You can change your cookie settings in general for all websites you visit via your browser settings. Within your browser you can change your cookie preferences and choose whether you wish to accept cookies or not. It differs per browser which sort of choices you can make, such as denying all third-party cookies. For further information on how you can change your browser settings, please refer to: www.aboutcookies.org/how-to-control-cookies/.

Please note that if you refuse certain cookies, this may reduce the functionality of some parts of our website.

We have the following retention terms in place:

For the provision of our services, we share your personal data on a strictly need-to-know basis with:

If we transfer personal data outside the EEA we will implement appropriate safeguards such as EU Standard Contractual Clauses or rely on an adequacy decision. We document transfer impact assessments where required.

We have implemented appropriate technical and organisational measures including encryption in transit and at rest where feasible, access controls, logging, vulnerability management, secure development practices and incident response procedures. We review measures periodically.

In relation to our processing of your personal data, you have the below privacy rights. For more information on your privacy rights, please be referred to this webpage of the European Commission.

• Right to withdraw consent: In so far as our processing of your personal data is based on your consent (see above), you have the right to withdraw consent at any time.
• Right of access: You have the right to request access to your personal data. This enables you to receive a copy of the personal data we hold about you (but not necessarily the documents themselves). We will then also provide you with further specifics of our processing of your personal data.
• Right to rectification: You have the right to request rectification of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected.
• Right to erasure: You have the right to request erasure of your personal data. This enables you to ask us to delete or remove personal data where: (i) the personal data are no longer necessary, (ii) you have withdrawn your consent, (iii) you have objected to the processing activities, (iv) the personal data have been unlawfully processed, (v) the personal data have to be erased on the basis of a legal requirement, or (vi) where the personal data have been collected in relation to the offer of information society services. We do not have to honour your request to the extent that the processing is necessary: (i) for exercising the right of freedom of expression and information, (ii) for compliance with a legal obligation which requires processing, (iii) for reasons of public interest in the area of public health, (iv) for archiving purposes, or (v) for the establishment, exercise or defence of legal claims.
• Right to object: You have the right to object to processing of your personal data where we are relying on legitimate interests as processing ground (see above). Insofar as the processing of your personal data takes place for direct marketing purposes, we will always honour your request. For processing for other purposes, we will also cease and desist processing, unless we have compelling legitimate grounds for the processing which override your interests, rights and freedoms or that are related to the institution, exercise or substantiation of a legal claim.
• Right to restriction: You have the right to request restriction of processing of your personal data in case: (i) the accuracy of the personal data is contested by you, during the period we verify your request, (ii) the processing is unlawful and restriction is requested by you instead of erasure, (iii) we no longer need the personal data but they are required by you for the establishment, exercise or defence of legal claims, or (iv) in case you have objected to processing, during the period we verify your request. If we have restricted the processing of your personal data, this means that we will only store them and no longer process them in any other way, unless: (i) with your consent, (ii) for the establishment, exercise or defence of legal claims, (iii) for the protection of the rights of another natural or legal person, or (iv) for reasons of important public interest.
• Right to data portability: You have the right to request the transfer of your personal data to you or to a third party of your choice (right to data portability). We will provide to you, or such third party, your personal data in a structured, commonly used, machine-readable format. Please note that this right only applies if it concerns processing that is carried out by us by automated means, and only if our processing ground for such processing is your consent or the performance of a contract to which you are a party (see above).
• Automated decision-making: You have the right not to be subject to a decision based solely on automated processing, which significantly impacts you ("which produces legal effects concerning you or similarly significantly affects you"). In this respect, please be informed that when processing your personal data, we do not make use of automated decision-making.
• Right to complaint: In addition to the above mentioned rights you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or of an alleged infringement of the GDPR at all times. However, we would appreciate the chance to deal with your concerns before you approach the supervisory authority so please contact us beforehand.

The exercise of the abovementioned rights is free of charge and can be carried out by e-mail via the contact details displayed below. If requests are manifestly unfounded or excessive, in particular because of the repetitive character, we will either charge you a reasonable fee or refuse to comply with the request.

We may request specific information from you to help us confirm your identity before we comply with a request from you concerning one of your rights.

We will provide you with information about the follow-up to the request without undue delay and in principle within one month of receipt of the request. Depending on the complexity of the request and on the number of requests, this period can be extended by another two months. We will notify you of such an extension within one month of receipt of the request. The applicable privacy legislation may allow or require us to refuse your request. If we cannot comply with your request, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

We may use automated systems to support platform operations (e.g., fraud detection, ranking). We do not make solely automated decisions that produce legal or similarly significant effects without human review.

The Platform is not intended for children under 16. We do not knowingly collect personal data from children. If we become aware of such data, we will delete it unless required to retain it by law.

We may update this Policy. Material changes will be communicated via the Platform or email.