Draft version — under legal review before public launch. Questions: info@dualmicro.com.
The Dutch version of this Privacy Policy is legally binding under Dutch law. This English translation is provided for convenience.
1. Controller
Dualmicro Measurement Technologies B.V., KvK 93553277, VAT NL866446898B01, registered at 1069 RV Amsterdam, is the controller under GDPR for personal data processed via campplek.nl.
Privacy questions: info@dualmicro.com.
2. What data do we collect?
2.1 Directly from you
- Account: email, name, preferred language.
- Profile: avatar, city, optional bio.
- Listings (Hosts): title, description, photos, price, gear location.
- Messages: conversation content between Hosts and Renters.
- Reviews: rating + written comment.
2.2 iDIN identity verification (Hosts only)
- Full name, date of birth, home address (hashed or pseudonymised where possible).
- BSN — only for DAC7 reporting, stored AES-256 encrypted, never shown in the UI.
2.3 Transactional data
- Bookings (dates, amount), payments (via Stripe), payouts, invoices.
- Damage claims and disputes.
2.4 Technical data
- IP address, browser type, device type, language — used for security (fraud detection, rate limiting).
- Session cookies (HttpOnly) for login.
- Audit logs for admin actions (compliance).
3. Why do we process this? (Legal basis, GDPR art. 6)
| Purpose | Basis |
|---|---|
| Delivering the marketplace service | art. 6.1.b (contract) |
| Payment, invoicing, payout | art. 6.1.b + 6.1.c (legal obligation) |
| iDIN verification + BSN for DAC7 | art. 6.1.c (DAC7 directive) |
| Fraud prevention and security | art. 6.1.f (legitimate interest) |
| Transactional emails (booking, invoice) | art. 6.1.b |
| Product updates / marketing | art. 6.1.a (consent, opt-in) |
4. Recipients (sub-processors)
We share data with the following sub-processors, each under a DPA:
- Stripe Payments Europe Ltd. (Ireland) — payment processing and escrow.
- Intuition Machines, Inc. — hCaptcha (USA) — anti-fraud / bot protection on login, contact and abuse-report flows. Processes IP address, user-agent and behavioural signals; we only receive a pass/fail outcome.
- Signicat AS (Norway) — iDIN identity verification.
- SendGrid (Twilio, USA) — transactional email.
- PostNL (Netherlands) — shipping labels for sale orders.
- Hetzner Online GmbH (Germany) — database + application hosting.
We never sell your data nor share it for advertising purposes.
5. International transfers
SendGrid and Intuition Machines (hCaptcha) are based in the United States. Transfers rely on EU Standard Contractual Clauses (SCCs) and, where applicable, the Data Privacy Framework (DPF). All other sub-processors are inside the EU/EEA.
6. Retention periods
- Account data: up to 30 days after account deletion.
- Bookings, invoices, payment data: 7 years (tax retention obligation, art. 52 Awr).
- DAC7 data (BSN, amounts): 5 years after the reporting year.
- Audit logs: 7 years (compliance).
- Marketing consent: until you withdraw it.
- Messages + reviews: 2 years after the related Booking's last activity.
7. Your rights (GDPR art. 15-22)
- Access: download a JSON export of your data via Settings → Export my data.
- Rectification: edit your profile directly via Settings.
- Erasure: delete your account via Settings → Delete account. Transactional data stays retained as legally required.
- Portability: see access (export).
- Objection: email info@dualmicro.com.
- Withdraw consent: marketing emails via the unsubscribe link in every mail.
8. Cookies
See our separate Cookies Policy.
9. Automated decision-making
We do not use automated decision-making with legal effects for you. Fraud detection and risk scoring are advisory; the final decision is made by a human.
10. Minimum age
Campplek is only accessible to persons aged 16 or older. We do not knowingly process data from minors under 16. If you suspect this has happened, contact info@dualmicro.com.
11. Security
We apply industry-standard measures: TLS 1.2/1.3 for traffic, AES-256 for sensitive data (BSN), hashed passwords (actually we use passwordless magic-link login, so we store no passwords at all), least-privilege database accounts and annual pen-tests.
12. Complaints
If you believe we are not processing your data correctly, please reach out at info@dualmicro.com. You also have the right to file a complaint with the Dutch Autoriteit Persoonsgegevens: autoriteitpersoonsgegevens.nl.
13. Changes
Material changes will be announced by email at least 30 days in advance. Minor editorial changes are applied here directly with an updated date at the top.