Privacy Statement
Discover Canal Cruises · Discover Leiden · Last updated: 3 November 2026
1. Who we are
Discover Canal Cruises (www.discovercanalcruises.nl) and Discover Leiden (www.discoverleiden.nl) are trade names of one company. That company is responsible for the personal data described in this statement (the "controller" under the GDPR). This statement applies to both websites, to www.discovertours.nl, to our booking system at book.discovertours.nl, and to our tours.
| Company | Visser Advies, Ontwikkeling & Uitvoering (sole proprietorship) |
|---|---|
| Trade names | Discover Canal Cruises, Discover Leiden, Discover Tours |
| Registered address | Troelstraplein 22, 2314 EK Leiden, the Netherlands |
| Chamber of Commerce (KvK) | 73516597 |
| VAT number | NL002016659B06 |
| Main departure point | Beestenmarkt, 2312 CH Leiden (some tours depart from other locations; your confirmation shows yours) |
| Privacy questions | privacy@discovercanalcruises.nl |
| Phone | +31 (0)71 56 90 367 |
We do not have a Data Protection Officer; we are not required to. For any privacy question or request, email privacy@discovercanalcruises.nl.
2. The short version
- We use your data to arrange and run your tour: booking, payment, contact before and on the day, and a review invitation afterwards.
- Our websites use no analytics, advertising or tracking cookies. The only cookies are strictly necessary ones for security and payment.
- We never sell your data and never use it for advertising.
- We share it only with the people and services needed to run your tour, such as the guide or captain, our payment provider and our hosting providers.
- We use photos in which you can be recognised only with your permission.
- You can ask to see, correct or delete your data at any time via privacy@discovercanalcruises.nl.
3. What data we use, why, and on what basis
3.1 Booking directly with us
When you book through our websites or booking pages, or by phone or email, we record: the tour, date, time, number of guests and chosen options; your name, email address and phone number; any remarks you add; payment details (amount, VAT, payment method, the country of your card or payment method, and a Stripe payment reference); and a booking reference. When you book online, we also store your IP address to protect our booking system against abuse, such as mass fake reservations.
We use this to reserve your tour, process your payment, contact you about your tour, and send you service emails: your confirmation with a calendar invite, a payment link if needed, a reminder the day before, and notices about changes, cancellations and refunds.
Legal basis: performance of our contract with you. For the IP address: our legitimate interest in protecting our booking system. We keep the financial part of your booking to meet our legal tax obligations.
Remarks about health or diet. If you tell us about allergies, dietary needs or mobility, we use this only to adapt your tour, and we share it only with the guide, captain or venue who needs it. Please share no more than we need.
3.2 Booking through a partner platform
If you book through GetYourGuide, Viator or Airbnb Experiences, that platform is responsible for the data you give it, under its own privacy statement. We receive from the platform what we need to run your tour: your name, contact details (sometimes a contact address provided by the platform) and booking details. Legal basis: performance of the contract. These platforms also send their own review requests.
3.3 Payment
Online payments are handled by Stripe. Your card or bank details go directly to Stripe; we never see or store them. We pass your name, email address, booking reference and the amount to Stripe. We receive the payment status, the payment method, the country of your card or payment method, and a payment reference. Stripe is itself responsible for some processing, such as fraud prevention and legal checks, under its own privacy policy. Legal basis: performance of the contract; legal obligation for our financial records.
3.4 Contact form
Our contact form asks for your first name, last name, email address, phone number (optional) and message. Our website provider also stores the date and your IP address with each message. We use this to answer your question. Legal basis: our legitimate interest in answering you, or steps before a contract if you are asking about a booking.
3.5 Email, phone and WhatsApp
When you email, call or message us, we use your contact details and what you send us to reply and to arrange your tour. On the day of your tour we may contact you by phone or WhatsApp about practical matters, such as the meeting point or a delay. WhatsApp is a service of WhatsApp Ireland (Meta); messages are end-to-end encrypted. Legal basis: performance of the contract or our legitimate interest in answering you.
3.6 Review invitation
The morning after a tour booked directly with us (online, by phone or by email), we send you one email to thank you and invite you to leave a review on Google or Tripadvisor. It may include a personal note from your guide or captain. We use your name and email address for this. Legal basis: our legitimate interest in receiving feedback.
You can say no when you book, and with one click in the email itself. If you opt out, we keep only a scrambled (hashed) version of your email address, not the address itself, so we never send you a review request again, also after a later booking. The review links are ordinary links: Google and Tripadvisor receive data only if you click them, under their own privacy policies. We send no newsletters or marketing emails.
3.7 Photos during the tour
Our guide may take photos of your group and share them with you afterwards. We use photos in which you can be recognised on our websites and our listings (Tripadvisor, Google, booking platforms) only with your permission. For children, a parent or guardian decides. Legal basis: consent. You can withdraw your consent at any time; we then remove the photos from our websites and listings. We cannot recall copies others have already shared or saved.
3.8 Running your tour with guides, captains and partner companies
Some tours are run by freelance guides or captains, or by a partner company that operates the tour on our behalf. We give them what they need to run your tour: your name, phone number, group size, chosen options and relevant remarks. Legal basis: performance of the contract.
3.9 Staff calendar overview
To plan tours, authorised staff can see confirmed bookings in their own calendar app (for example Google Calendar, Apple Calendar or Outlook) through a private calendar feed. The feed shows the tour, date and time, number of guests, the guest's first name, the booking source, chosen options, remarks and a link to the booking in our system. It does not contain surnames, email addresses or phone numbers; these are visible only after logging in to our booking system. Each staff member has a personal, secret link that can be renewed or switched off. The feed shows only upcoming bookings and those from the last 30 days. Legal basis: our legitimate interest in planning our tours.
To prevent double bookings, we also place anonymous "booked" time blocks in a calendar that other booking platforms can read. These blocks contain only a time and a tour name, no guest data.
3.10 Website security and spam protection
Our websites are protected by Cloudflare. To block attacks and spam (including through Cloudflare Turnstile on our contact form), Cloudflare processes technical data such as your IP address and browser information. Our hosting providers also keep server logs (IP address, date and time, page requested, referring page, browser) for security and troubleshooting. Legal basis: our legitimate interest in keeping our websites and booking system secure.
3.11 Anonymous booking statistics
Our booking system counts how often tour buttons are viewed and how far bookings get, per day, tour, device type (mobile or desktop) and page. These are anonymous totals. We store no IP address, cookie, device ID or anything else that could identify you, so this is not personal data. We mention it for transparency.
3.12 Bookkeeping
Our bookkeeping is done with Kees de Boekhouder. Payment and invoice records needed for our accounts are processed there. Legal basis: legal obligation (Dutch tax law).
4. Who receives your data
We never sell your data. These services process data on our behalf (processors), under agreements that oblige them to protect it:
| Service | What for | Location |
|---|---|---|
| Vimexx | Hosting of our booking system, its database and booking emails | EU |
| TransIP | Our email mailboxes | Netherlands |
| Webflow | Hosting of our websites and contact form messages | USA |
| Cloudflare | Website security and spam protection | USA |
| Kees de Boekhouder | Bookkeeping | Netherlands |
| Google, Apple or Microsoft | Calendar apps used by our staff for the calendar overview (3.9) | USA |
| Freelance guides and captains | Running your tour | Netherlands |
These parties receive data and are responsible for it themselves (independent controllers):
- Stripe, for payments and fraud prevention (Stripe privacy policy (opens in a new tab)).
- GetYourGuide, Viator and Airbnb, if you booked through them, under their own privacy statements.
- WhatsApp (Meta), if you contact us through WhatsApp.
- Partner companies that operate a tour on our behalf, for running that tour.
- Authorities, such as the Dutch Tax Administration, when the law requires it.
Google and Tripadvisor appear on our websites only as links. They receive no data from us unless you click through to their sites.
5. Transfers outside the EU
Our booking system, booking data and mailboxes are stored within the EU. Some services we use are based in the United States: Webflow, Cloudflare, Stripe, Google, Apple, Microsoft and Meta (WhatsApp). Data may be transferred to the US when they process it.
These transfers are protected by the EU-US Data Privacy Framework, under which the European Commission has decided that certified US companies protect personal data adequately. Where a company is not certified, the transfer is covered by the European Commission's Standard Contractual Clauses.
6. How long we keep your data
We keep data no longer than needed. We delete old data in a cleanup at least once a year, so the periods below are maximums.
| Data | How long |
|---|---|
| Bookings and payment records | 7 years after the end of the year of the booking (Dutch tax law) |
| IP address stored with an online booking | 7 days after the booking is made (the booking itself stays) |
| Reservations that were never paid (expired reservations, unpaid payment requests) | 30 days after they were made |
| Contact form messages, emails and WhatsApp messages (if no booking followed) | Up to 2 years after our last contact |
| Opt-out from review emails (hashed email address only) | As long as needed to respect your opt-out |
| Photos used with your permission | Until you withdraw your permission, or we stop using them |
| Staff calendar feed | Bookings drop out of the feed 30 days after the tour |
| Server logs | Only as long as needed for security and troubleshooting; our hosting providers delete them automatically (log rotation) |
| Backups of our booking system | Up to 60 days; deleted data can remain in a backup that long before it is overwritten |
| Anonymous booking statistics | No limit (not personal data) |
Data held by partner platforms, Stripe and WhatsApp is kept according to their own policies.
7. Cookies
Our websites use only strictly necessary cookies and no analytics, advertising or tracking cookies. Under Dutch law (Telecommunicatiewet, article 11.7a), strictly necessary cookies need no consent, which is why we do not show a cookie banner.
| Cookie or technology | Set by | Purpose | When |
|---|---|---|---|
Security cookie (_cfuvid) | Cloudflare | Protects our websites against attacks and abuse | Every page; deleted when you close your browser |
| Cloudflare Turnstile | Cloudflare | Checks that contact form messages come from a person, not a bot | Pages with the contact form |
| Stripe cookies | Stripe | Secure payment and fraud prevention | Only at the payment step of a booking |
Cloudflare and Stripe describe their cookies in their own cookie policies. The staff dashboard of our booking system uses one session cookie for logged-in staff; it is never set for visitors.
Our websites and booking system store nothing in your browser's local storage or session storage. Our fonts are hosted on our own website, and maps and review badges are plain links, so no data goes to Google or Tripadvisor while you browse.
You can delete or block cookies in your browser settings. Blocking these cookies may stop the contact form or payment from working.
8. Security
We protect your data with measures that fit a small company:
- All our websites and our booking system use encrypted connections (HTTPS).
- Our booking system is accessible only to authorised staff, each with a personal account secured by a password and a one-time code, and with limits on login attempts.
- Card and bank details are handled by Stripe; we never store them.
- Contact details are not included in the staff calendar feed.
- Our hosting provider makes regular backups.
If a data breach occurs that risks your rights, we will report it to the Dutch Data Protection Authority and inform you where the law requires.
9. Your rights
You have the right to:
- access the personal data we hold about you;
- have incorrect data corrected;
- have your data deleted, unless we must keep it by law (such as booking records for tax purposes);
- restrict how we use your data;
- receive your data in a usable format (portability);
- object to our use of your data based on legitimate interest, such as the review invitation;
- withdraw your consent at any time, for example for photos. This does not affect what we did before.
To use any of these rights, email privacy@discovercanalcruises.nl. We reply within one month. We may ask you to confirm your identity, for example by replying from the email address you booked with. We will not ask for a copy of your passport or ID card.
Complaints. If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (opens in a new tab), or to the authority in the EU country where you live.
10. Children
Bookings are made by adults. If children join a tour, we receive only what the booking adult tells us, such as the number of guests. We use photos of children only with permission from a parent or guardian.
11. Changes to this statement
We update this statement when our services or the law change. The date at the top shows the latest version. If a change significantly affects you, we will let you know if we can.
