Privacy statement

If this translation differs from the Dutch text, the Dutch text prevails. The Dutch version is the authoritative one.

Provided by Noren (demoversie, geen echt bedrijf), Voorbeeldstraat 1, 1000 AA, Amsterdam, Dutch Chamber of Commerce (KvK) 00000000, VAT NL000000000B00.

This statement is about guests who book with an accommodation through our system, about hosts who use the system to let their property, and about everyone who visits this website.

If you are a guest

You book with an accommodation, not with us. They decide what happens to your data; we run the technology underneath. If you want to know something or have something changed, the accommodation is your point of contact; if you ask us, we will refer you to them.

What we record: your name, email address and phone number, the dates of your stay, the room, the number of people, the amount and whether it has been paid, and whatever you write in the comments field yourself.

For a stay in Spain: the law (Real Decreto 933/2021) requires every accommodation to pass on the details of all guests to the Spanish Ministry of the Interior within 24 hours of arrival. For that purpose we ask for your date of birth, nationality and document number, and possibly a photo of your document. We delete that photo as soon as the report has been accepted. We keep the document number encrypted for three years, because the law requires it.

Mail from the accommodation: when you book, and on the check-in form, there is a box you can tick to say that you would like to receive news from the accommodation now and then. That box is never ticked in advance: if you leave it, you receive nothing. If you tick it, we record when you did so and where (the booking module or the form); without that record, the accommodation cannot show that you gave your consent. You can unsubscribe with the link at the bottom of every message: no login, no account, one click. Your booking confirmations and the practical emails about your stay will keep coming after that; they belong to the booking, not to the mailings.

What we do not do: sell your data, track you across websites, or send you mail on behalf of anyone other than the accommodation you booked with.

Cookies: the booking module does not set any tracking cookies. One strictly necessary key is stored in your browser, so that you can find your half-completed booking when you come back. It disappears as soon as you close the tab.

If you are a host

We record your name, email address, role and actions in the system, plus the details that belong on your invoice. We do this to perform the agreement and to be able to reconstruct afterwards what happened: for example, when your price agreement changed, by whom and for what reason. We are required to record that reason, also when it was our own decision. How long we keep what is set out under How long, and the two kinds of records are not kept for the same period.

When you sign up and accept our terms and the data processing agreement, we record: your name, email address, the time, the version of the text, your IP address and your browser. The same applies to your statement that you are 18 or older and may sign on behalf of the business. We do this to be able to show that we concluded an agreement (our legitimate interest). We keep this until five years after your subscription ends.

If someone on our side looks into your account to provide support, this is done with a recorded reason. You can request that log.

If you visit this website

The website sets one cookie: NEXT_LOCALE. It remembers the language in which you read the site, so that you arrive in the same language next time. It is a functional cookie: it says nothing about who you are and is not shared with anyone. There are no trackers on the site, no advertising pixels, and no scripts or fonts from other parties. Nor do we record your visit: no session recordings, no heatmaps, and nothing of what you type or where your mouse goes. The same applies to the dashboard, the booking page and the booking module.

To know how many people visit the site and what they read, every page sends a small measurement to our own server. That measurement does not set a cookie. We record which page you viewed, in which language, which website you came from (only the name of that website), the campaign code in the link if there was one, which buttons you clicked and how fast the page loaded. While your tab is open, your browser remembers which website you came from, so that a sign-up can be attributed to that source; when you close the tab, that is gone.

On five screens we also measure how quickly they appear: Today, the calendar, the reservations and the messages in the dashboard, and the booking page. We only record which screen it was, how many milliseconds it took and how that was measured; not the address of the page, not the name of the property and not who you are. That measurement sets no cookie either. The 95th percentile is shown on the status page.

If you search on the questions page, we store your search term (at most 40 characters, and not if it looks like it contains an email address or a number) and how many answers there were. If you sign up, we only count how many sign-ups came from which website and with which campaign code each month; we do not store that with your account.

As a visitor of the site, we do not store your IP address, except for an encrypted derivative against abuse of the sign-up form, which we keep for at most one day. If you sign up, we do record your IP address with your acceptance; see If you are a host. To count visitors without recognising them, we turn your IP address and your browser into a hash with a secret that changes every day and is not stored anywhere. Tomorrow, you are someone else to us. We do this on the basis of our legitimate interest in improving the site.

If you would like to receive the changes by email, we store your email address and your language, and we only send anything after you have confirmed. You can unsubscribe with the link in every email; your address then remains marked as unsubscribed, so that we do not email you again.

Where it is stored

In data centres in Frankfurt (Germany), within the European Economic Area: the website and the system run at Vercel, and the database is at Supabase. Our suppliers are listed by name in the data processing agreement, together with what it means that Vercel and Supabase are American companies, and with the suppliers that will join later.

How long

Data	Period
Reservations and invoices	7 years (statutory tax retention)
Guest registration	3 years (Spanish law)
Photos of documents	until the report has been accepted
Log of who looked at what	1 year
Log of what changed in an agreement	for as long as the agreement runs, plus 7 years
Acceptances at sign-up (with IP address)	until five years after your subscription ends
Consent to mailings, and its withdrawal	until you withdraw it, and then 3 years as proof
Measurements of the website	13 months
List for the changes	until you unsubscribe

The two logs are not the same, which is why they are listed separately. A record of who looked at something is worth nothing after a year. What changed in your price or your terms, when and why, should remain traceable for as long as you are a customer and after that for as long as the tax authorities can request our records. Otherwise an agreement from three years ago can no longer be checked.

Your rights

Access, rectification, erasure, restriction, objection and portability. For guests, this goes through the accommodation; for hosts and visitors of this website, through hallo@norenrooms.com. We respond within thirty days. If we cannot resolve it together, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

---

This text was drafted for this product and has not yet been reviewed by a lawyer.