Privacy Statement

Atelier Jumé is a sole proprietorship, located at Heilige Geeststraat 25, 5611 HN Eindhoven. Atelier Jumé operates the online platform Shortaway via www.shortaway.com. For the personal data processing described in this privacy statement, Atelier Jumé is in principle the data controller.

This privacy statement applies for example when you:

• visit or use our website;
• create or use an account on Shortaway;
• as a host, place, manage, modify or delete a listing;
• as a concierge, view listings or respond to them;
• communicate or make contact with other users via the platform;
• take out, pay for or cancel a subscription;
• contact us for any reason; or
• provide products or services to us or otherwise collaborate with us in a business capacity.

This privacy statement only applies to processing for which we act as data controller under the General Data Protection Regulation (GDPR).

We determine the purposes and means of the personal data processing necessary to offer and secure the platform. This includes, for example, account registration, phone number verification, hosting and display of listings, response functionalities, subscriptions, billing, support, security and enforcement of the terms of service.

We are not automatically responsible for all personal data processing that hosts and concierges subsequently carry out in their own business operations, in their mutual agreement or in communications outside the platform. For those own processes, hosts and concierges may themselves be data controllers.

We currently only verify the phone number provided by a user. We therefore do not carry out a full identity, reliability or suitability check.

When you visit or use our website, we may process the following categories of personal data:

• Technical connection and log data: IP address, date and time of visit, requested URLs, error messages, browser type, device type, operating system, language settings and referring URLs.
• Cookie and similar identifiers: Cookie IDs, session IDs, preference settings, consent status and analytical identifiers.
• Contact or form data you have filled in: Name, email address, phone number, company name and the content of a message or form.

This data is processed to keep the website running safely and properly, to remember your cookie preferences, and to respond to questions or requests you send us via the website. The legal basis is legitimate interest, necessity for requested functionality or your consent for non-necessary cookies.

When you register as a host or use a host account, we may process the following categories of personal data:

• Contact details: Name, business email address, phone number and correspondence details.
• Business and account data: Company name, user role, account data, login and session data, account status and any Chamber of Commerce or VAT number.
• Verification data: The phone number provided, verification code or token, verification status and verification moment.
• Profile data: Profile information you have filled in, business description, profile photo or logo and preferences.

This data is processed for creating and managing your account, phone number verification, displaying profile information to concierges, service messages and enforcement of the terms of service. The legal basis is performance of the contract and legitimate interest.

The phone number verification is limited. We therefore do not carry out a full background or reliability check of a user.

When you register as a concierge or use a concierge account, we may process the following categories of personal data:

• Contact details: Name, business email address, phone number, job title and correspondence details.
• Business and account data: Company name, user role, account data, login and session data, account status and any Chamber of Commerce or VAT number.
• Verification data: The phone number provided, verification code or token, verification status and verification moment.
• Profile and preference data: Profile information, area of operation, expertise and a profile photo.

This data is processed for creating and managing your account, phone number verification, viewing listings and displaying profile information to hosts, service messages and enforcement of the terms of service. The legal basis is performance of the contract and legitimate interest.

If you place, view, respond to a listing or have contact with another user via the platform, we may process the following data, among others:

• Listing data: Data about the accommodation or listing, description, characteristics, location, availability information.
• Uploaded content and profile or listing content: Texts, photos, images, videos, logos, documents and other content that users upload or share via the platform.
• Response and match data: Responses to listings, expressions of interest, the status of a match between host and concierge and the associated timestamps.
• Messages and other communications between users: The content of messages, contact requests, attachments and other communications exchanged via the platform.
• Metadata, notification and enforcement data: Data about who had contact with whom, timestamps, account IDs, log data, reports of unlawful use and measures taken.

This data is processed for publishing and managing listings, facilitating responses and matches, content moderation and enforcement, and protecting the rights of Shortaway and third parties.

When you take out a paid subscription or when we process your use of the platform administratively, we may process the following data:

• Invoice and business data: Company name, invoice address, contact person, email address, VAT number and other administrative business data.
• Subscription and transaction data: Type of subscription, linked listings, subscription duration, start and end date, invoice number, amount, payment status and internal customer or relationship data.
• Payment data: Payment references, transaction IDs and information made available by the payment provider; Shortaway in principle does not receive more payment data than necessary.
• Administrative correspondence: Reminders, cancellations, complaints, credit notes and other communications about invoices or payments.

This data is processed for entering into and managing subscriptions, payment processing, accounts receivable management, and compliance with financial and tax statutory obligations.

When you contact us, we may process: your name, email address, phone number, company name, job title, the content of your message and data about the handling of your request. The legal basis is the legitimate interest of Shortaway to respond to messages, or necessity for the performance of a contract.

When you provide products or services to Shortaway as a supplier, advisor or other business service provider, we may process: contact details, contract and business data, financial and administrative data, and communication and performance data. The legal basis is performance of the contract, statutory obligations and legitimate interest.

When you visit or use our website, we may use cookies and similar techniques. Cookies are small text files stored on your device. We may also use similar techniques, such as local storage, pixels, scripts or other online identifiers.

We use functional cookies where necessary to keep the website technically functioning properly, to remember preferences and to make login or security functions available.

In addition, we may use analytical cookies or similar techniques to better understand how the website is used and to improve the website and the platform. If these cookies fall within the statutory exceptions, we may use them without consent. In other cases, we ask for consent in advance.

If we use marketing, advertising or other tracking cookies, we always ask for your prior consent. You can manage your cookie preferences via the cookie banner or via your browser settings.

We do not sell your personal data to third parties. We only share personal data where necessary for providing the platform, for our business operations or because we are legally obliged to do so. Depending on the situation, we may share personal data with:

• other users of the platform, insofar as necessary to make listings visible, facilitate responses and enable contact or a match between hosts and concierges;
• external IT, hosting, cloud, support, communication and verification service providers who provide services for the platform on our behalf;
• payment providers and providers of billing or administration services, insofar as necessary for subscriptions, invoices and payments;
• professional advisors, such as lawyers, accountants and insurers, insofar as reasonably necessary;
• competent authorities, regulators or law enforcement agencies where the law requires us to do so or as necessary to protect rights; and
• parties involved in a merger, acquisition, financing, restructuring or transfer of part of our business.

If a third party processes personal data on our behalf, we will enter into a data processing agreement where necessary or make other appropriate contractual arrangements.

We strive to have personal data processed as much as possible within the European Economic Area (EEA). However, it may occur that service providers engaged by us process or have access to personal data from a country outside the EEA.

If we transfer personal data to a country outside the EEA, we only do so if there is a valid legal basis, such as an adequacy decision by the European Commission or the standard contractual clauses of the European Commission. If a recipient is established in the United States, a transfer may take place on the basis of participation in the EU-U.S. Data Privacy Framework or another appropriate transfer mechanism.

We take appropriate technical and organizational measures to secure your personal data, such as access restrictions, authentication measures, logging, backups, secure connections, update and monitoring processes and contractual arrangements with service providers regarding appropriate security.

No system is completely secure. Do you suspect that unauthorized parties have gained access to your account or your login credentials? Please let us know as soon as possible so that we can take appropriate measures.

We do not retain your personal data longer than necessary for the purposes for which we process it. In principle, we apply the following guidelines:

• Website and security log data: maximum 12 months, unless longer is needed for incident investigation or misuse.
• Account, verification and profile data: for as long as the account is active; after termination for a maximum of 12 months for settlement, support and enforcement.
• Listing data, response data, match data and communications: for as long as needed for the platform; after deletion or termination for a maximum of 24 months for settlement, enforcement and disputes.
• Invoice, transaction and administrative data: at least 7 years, pursuant to statutory retention obligation.
• Data of persons who contact us without an account: maximum 12 months after handling the request.
• Data of suppliers and business service providers: during the term of the collaboration and afterwards for as long as necessary for administration and compliance.

After the applicable retention period has expired, we delete your personal data or anonymize it, unless we are permitted or required to retain it longer under the law or another valid legal basis.

You may ask us for access to your personal data (including a copy), rectification or deletion of your personal data, restriction of processing, objection to processing based on our legitimate interest and, in certain cases, portability of your personal data. Is processing based on your consent? Then you can withdraw that consent at any time.

We will handle your request carefully. We may ask you to verify your identity. In some cases, we are permitted or required to reject a request in whole or in part, for example if necessary to comply with a statutory obligation or to protect the rights of others.

You also always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or with the supervisory authority of the country where you live or work.

Do you have questions or requests about the protection of your personal data at Shortaway or about this privacy statement? Please contact us:

• Email: [email protected]
• Post: Atelier Jumé, Heilige Geeststraat 25, 5611 HN Eindhoven
• Website: www.shortaway.com