Privacy Policy

What we know about you, and what we do with it.

Last updated: 24 August 2026

// Survivor Briefing — the short version

We only collect what we need to run the event safely.
No cookies. No tracking pixels. No ads. No selling your data. Ever.
Consent form data is deleted 90 days after the event.
You can ask us to delete your data at any time: info@survivethez.com
We use GDPR-compliant analytics that collects zero personal data.
Your data stays in the EU where possible. When it doesn't, it's protected.

// CLASSIFIED — These terms have not been reviewed by legal counsel. We've drafted them to comply with the GDPR and Dutch UAVG. For binding legal advice, consult a qualified professional.

1. Who's Running This Operation

In short: We're a Dutch company. Here's how to reach us.

Survive the Z B.V.
Tweede van Swindenstraat 7-G
1093 VE Amsterdam, Netherlands
KvK: 96292245 • BTW-id: NL867548952B01
info@survivethez.com

We are the data controller. No Data Protection Officer has been appointed (not required given our scale).

2. What Intel We Collect

In short: Only what we need. Nothing more. The details per form are below.

Parental Consent Forms

Data	Guardian name, email, phone, relationship; child's name, DOB, ticket number; digital signature
Why	Verify parental consent for participants aged 13–17
Legal basis	Legal obligation (Art. 6(1)(c)) + consent (Art. 6(1)(a))
Kept for	90 days after the event the form was signed for, then deleted
Stored in	Cloudflare D1 (EU)

Ticket Buyers

Data	Name, email, city, ticket type, order reference, check-in scan time
Why	Sell you a ticket, admit you on the night, and contact you about the event you bought
Legal basis	Performance of a contract (Art. 6(1)(b))
Kept for	Seven years, as Dutch tax law requires for sales records
Stored in	WeTicket, our ticketing provider, who process it on our behalf

Email Subscribers

Data	Email address, signup source, quiz result (if taken)
Why	Send event updates and announcements
Legal basis	Consent (Art. 6(1)(a)) — you signed up voluntarily
Kept for	Until you unsubscribe (info@survivethez.com)
Stored in	Cloudflare D1 (EU)

Volunteer Signups

Data	Name, email, phone, age, health conditions, allergies, emergency contact, skills, availability
Why	Manage volunteer registration, role assignment, and on-site safety
Legal basis	Contract performance (Art. 6(1)(b)) — volunteer agreement
Kept for	Duration of engagement + 90 days
Stored in	Google Sheets (via Google Apps Script)

Analytics

We use Umami Cloud for analytics. It collects no personal data, sets no cookies, stores no IP addresses, and uses no tracking pixels. It's GDPR-compliant by design. No consent banner needed because there's nothing to consent to.

Legal basis	Legitimate interest (Art. 6(1)(f)) — understanding how the site is used

3. Cookies & Tracking

In short: None. Zero. This site doesn't use cookies or tracking pixels.

No cookies. No fingerprinting. No third-party advertising scripts. No retargeting. The zombies track you. We don't.

4. Who Else Sees Your Data

In short: Our hosting provider, our email service and WeTicket for ticketing. Nobody else. We never sell data.

Cloudflare — hosting, database, file storage. Their policy
Google — volunteer data via Sheets/Apps Script. Their policy
Resend — transactional email delivery. Their policy
Umami — anonymous analytics. Their policy

5. International Transfers

In short: Data stays in the EU where possible. When it leaves, it's protected by EU-approved safeguards.

Some processors (Cloudflare, Google, Resend) operate in the US. Transfers are protected by the EU-US Data Privacy Framework and/or Standard Contractual Clauses (GDPR Chapter V).

6. How We Protect Your Data

In short: Encrypted, access-controlled, and auto-deleted after the event.

HTTPS everywhere — all pages and API endpoints
Password-protected admin access to consent records
Limited access — only event organizers can view submissions
Consent data deleted within 90 days of the event it was collected for

7. Children's Data

In short: Under-16s need parental consent. Our consent form handles this.

Dutch law (UAVG) sets the age of digital consent at 16, so participants aged 13, 14 and 15 fall below it. We require a guardian's verifiable consent for everyone under 18 regardless, via our consent form, which needs a guardian's digital signature.

8. Your Rights

In short: It's your data. You can access, correct, delete, or export it anytime.

Under the GDPR, you can:

Access your data (Art. 15)
Correct inaccurate data (Art. 16)
Delete your data (Art. 17)
Restrict processing (Art. 18)
Export your data in a portable format (Art. 20)
Object to processing (Art. 21)
Withdraw consent at any time (Art. 7(3))

Email info@survivethez.com. We respond within 30 days.

Not satisfied? File a complaint with the Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl.

9. Changes

We may update this policy. The date at the top changes when we do. For significant changes, we'll notify subscribers by email.

10. Contact

Survive the Z B.V.
Tweede van Swindenstraat 7-G
1093 VE Amsterdam, Netherlands
info@survivethez.com • +31 (0)6 3562 8606