Privacy Policy

What we know about you, and what we do with it.

Last updated: 24 August 2026

// Survivor Briefing, the short version

We only collect what we need to run the event safely.
No cookies, no tracking pixels, no ads, and we never sell your data.
Consent form data is deleted 90 days after the event.
You can ask us to delete your data at any time: hello@survivethez.com
We use GDPR-compliant analytics that collects zero personal data.
Your data stays in the EU where possible, and EU-approved safeguards cover the rest.

// CLASSIFIED, this policy has not been reviewed by legal counsel. We've drafted it to comply with the GDPR and Dutch UAVG. For binding legal advice, consult a qualified professional.

1. Who's Running This Operation

In short: We're a Dutch company. Here's how to reach us.

Survive the Z B.V.
Tweede van Swindenstraat 7-G
1093 VE Amsterdam, Netherlands
KvK: 96292245 • BTW-id: NL867548952B01
hello@survivethez.com

We are the data controller. No Data Protection Officer has been appointed (not required given our scale).

2. What Intel We Collect

In short: Only what we need. The details per form are below.

Parental Consent Forms

Data	Guardian name, email, phone, relationship; child's name, DOB, ticket number; digital signature
Why	Verify parental consent for participants aged 16–17
Legal basis	Legal obligation (Art. 6(1)(c)) + consent (Art. 6(1)(a))
Kept for	90 days after the event the form was signed for, then deleted
Stored in	Cloudflare D1 (EU)

Ticket Buyers

Data	Name, email, city, ticket type, order reference, check-in scan time
Why	Sell you a ticket, admit you on the night, and contact you about the event you bought
Legal basis	Performance of a contract (Art. 6(1)(b))
Kept for	Seven years, as Dutch tax law requires for sales records
Stored in	WeTicket, our ticketing provider, who process it on our behalf

Email Subscribers

Data	Email address, signup source, quiz result (if taken)
Why	Send event updates and announcements
Legal basis	Consent (Art. 6(1)(a)): you signed up voluntarily
Kept for	Until you unsubscribe (hello@survivethez.com)
Stored in	Cloudflare D1 (EU)

Volunteer Signups

Data	Name, email, phone, age, health conditions, allergies, emergency contact, skills, availability
Why	Manage volunteer registration, role assignment, and on-site safety
Legal basis	Contract performance (Art. 6(1)(b)): volunteer agreement
Kept for	Duration of engagement + 90 days
Stored in	Cloudflare D1 (EU), mirrored to Google Sheets (via Google Apps Script)

Analytics

We use Umami Cloud for analytics. It sets no cookies, stores no IP addresses and collects nothing that identifies you, so it's GDPR-compliant and this site needs no consent banner.

Legal basis	Legitimate interest (Art. 6(1)(f)): understanding how the site is used

3. Cookies & Tracking

In short: None. This site doesn't use cookies or tracking pixels.

No cookies, no fingerprinting, no third-party advertising scripts, no retargeting.

4. Who Else Sees Your Data

In short: Our hosting provider, our email service and WeTicket for ticketing. We never sell data.

Cloudflare: hosting, database, file storage. Their policy
Google: volunteer data mirrored to Sheets/Apps Script. Their policy
Resend: transactional email delivery. Their policy
Umami: anonymous analytics. Their policy

5. International Transfers

In short: Data stays in the EU where possible. When it leaves, it's protected by EU-approved safeguards.

Some processors (Cloudflare, Google, Resend) operate in the US. Transfers are protected by the EU-US Data Privacy Framework and/or Standard Contractual Clauses (GDPR Chapter V).

6. How We Protect Your Data

In short: Encrypted, access-controlled, and auto-deleted after the event.

HTTPS everywhere, on all pages and API endpoints
Password-protected admin access to consent records
Limited access: only event organizers can view submissions
Consent data deleted within 90 days of the event it was collected for

7. Children's Data

In short: under-16s attend with an adult who consents for them. 16 and 17 year olds use our consent form.

Dutch law (UAVG) sets the age of digital consent at 16, so participants aged 13, 14 and 15 fall below it. Those participants attend with an accompanying adult aged 18 or over, who books their ticket and gives that consent on their behalf. Participants aged 16 and 17 attend on a guardian's signed consent form, which needs a guardian's digital signature.

8. Your Rights

In short: It's your data. You can access, correct, delete, or export it anytime.

Under the GDPR, you can:

Access your data (Art. 15)
Correct inaccurate data (Art. 16)
Delete your data (Art. 17)
Restrict processing (Art. 18)
Export your data in a portable format (Art. 20)
Object to processing (Art. 21)
Withdraw consent at any time (Art. 7(3))

Email hello@survivethez.com. We respond within 30 days.

Not satisfied? File a complaint with the Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl.

9. Changes

We may update this policy. The date at the top changes when we do. For significant changes, we'll notify subscribers by email.

10. Contact

Survive the Z B.V.
Tweede van Swindenstraat 7-G
1093 VE Amsterdam, Netherlands
hello@survivethez.com • +31 (0)6 3562 8606