Privacy Policy

What we know about you, and what we do with it.

Last updated: 2 April 2026

// Survivor Briefing — the short version

We only collect what we need to run the event safely.
No cookies. No tracking pixels. No ads. No selling your data. Ever.
Consent form data is deleted 90 days after the event.
You can ask us to delete your data at any time: info@survivethez.com
We use GDPR-compliant analytics that collects zero personal data.
Your data stays in the EU where possible. When it doesn't, it's protected.

// CLASSIFIED — These terms have not been reviewed by legal counsel. We've drafted them to comply with the GDPR and Dutch UAVG. For binding legal advice, consult a qualified professional.

1. Who's Running This Operation

In short: We're a Dutch company. Here's how to reach us.

Survive the Z B.V.
[registered address]
KvK: [KvK number] • BTW-id: [BTW-id]
info@survivethez.com

We are the data controller. No Data Protection Officer has been appointed (not required given our scale).

2. What Intel We Collect

In short: Only what we need. Nothing more. The details per form are below.

Parental Consent Forms

Data	Guardian name, email, phone, relationship; child's name, DOB, ticket number; digital signature
Why	Verify parental consent for participants aged 13–17
Legal basis	Legal obligation (Art. 6(1)(c)) + consent (Art. 6(1)(a))
Kept for	90 days after 13 June 2026, then permanently deleted
Stored in	Cloudflare D1 (EU)

Email Subscribers

Data	Email address, signup source, quiz result (if taken)
Why	Send event updates and announcements
Legal basis	Consent (Art. 6(1)(a)) — you signed up voluntarily
Kept for	Until you unsubscribe (info@survivethez.com)
Stored in	Cloudflare D1 (EU)

Volunteer Signups

Data	Name, email, phone, age, health conditions, allergies, emergency contact, skills, availability
Why	Manage volunteer registration, role assignment, and on-site safety
Legal basis	Contract performance (Art. 6(1)(b)) — volunteer agreement
Kept for	Duration of engagement + 90 days
Stored in	Google Sheets (via Google Apps Script)

Analytics

We use Umami Cloud for analytics. It collects no personal data, sets no cookies, stores no IP addresses, and uses no tracking pixels. It's GDPR-compliant by design. No consent banner needed because there's nothing to consent to.

Legal basis	Legitimate interest (Art. 6(1)(f)) — understanding how the site is used

3. Cookies & Tracking

In short: None. Zero. This site doesn't use cookies or tracking pixels.

No cookies. No fingerprinting. No third-party advertising scripts. No retargeting. The zombies track you. We don't.

4. Who Else Sees Your Data

In short: Our hosting providers and email service. Nobody else. We never sell data.

Cloudflare — hosting, database, file storage. Their policy
Google — volunteer data via Sheets/Apps Script. Their policy
Resend — transactional email delivery. Their policy
Umami — anonymous analytics. Their policy

5. International Transfers

In short: Data stays in the EU where possible. When it leaves, it's protected by EU-approved safeguards.

Some processors (Cloudflare, Google, Resend) operate in the US. Transfers are protected by the EU-US Data Privacy Framework and/or Standard Contractual Clauses (GDPR Chapter V).

6. How We Protect Your Data

In short: Encrypted, access-controlled, and auto-deleted after the event.

HTTPS everywhere — all pages and API endpoints
Password-protected admin access to consent records
Limited access — only event organizers can view submissions
Automatic deletion of consent data 90 days post-event

7. Children's Data

In short: Under-16s need parental consent. Our consent form handles this.

Dutch law (UAVG) sets the age of digital consent at 16. All our participants aged 13–17 fall below this threshold. We collect their data only with verifiable parental consent via our consent form, which requires a guardian's digital signature.

8. Your Rights

In short: It's your data. You can access, correct, delete, or export it anytime.

Under the GDPR, you can:

Access your data (Art. 15)
Correct inaccurate data (Art. 16)
Delete your data (Art. 17)
Restrict processing (Art. 18)
Export your data in a portable format (Art. 20)
Object to processing (Art. 21)
Withdraw consent at any time (Art. 7(3))

Email info@survivethez.com. We respond within 30 days.

Not satisfied? File a complaint with the Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl.

9. Changes

We may update this policy. The date at the top changes when we do. For significant changes, we'll notify subscribers by email.

10. Contact

Survive the Z B.V.
[registered address]
info@survivethez.com • +31 (0)6 3562 8606