Privacy Policy

This Privacy Policy explains how Expat Bubble B.V. ("ExB", "we", "us") stores and shares personal data when you use expatbubble.nl (the "Platform") and related services. It describes your rights under the GDPR and how to exercise them.

We may from time to time update this policy. Please make sure to regularly visit this policy in order to stay up to date.

Controller: ExB is the controller for Platform operations including registration, booking facilitation, invoicing, payments, messaging storage, marketing and platform safety.

Professional as controller: the Platform allows professionals to offer their products or services to Clients. Once you, the Client, have entered into contact with a professional, the professional acts as controller for their own communications with the Client. For that professional's role as data controller, reference is made to the privacy policy of the respective professional.

We, as data controller, process the following categories of personal data for the purposes listed:

Please see below an overview of the cookies that we use:

You can change your cookie settings in general for all websites you visit via your browser settings. Within your browser you can change your cookie preferences and choose whether you wish to accept cookies or not. It differs per browser which sort of choices you can make, such as denying all third-party cookies. For further information on how you can change your browser settings, please refer to: www.aboutcookies.org/how-to-control-cookies/.

Please note that if you refuse certain cookies, this may reduce the functionality of some parts of our website.

We have the following retention terms in place:

For the provision of our services, we share your personal data on a strictly need-to-know basis with:

If we transfer personal data outside the EEA we will implement appropriate safeguards such as EU Standard Contractual Clauses or rely on an adequacy decision. We document transfer impact assessments where required.

We have implemented appropriate technical and organisational measures including encryption in transit and at rest where feasible, access controls, logging, vulnerability management, secure development practices and incident response procedures. We review measures periodically.

In relation to our processing of your personal data, you have the following privacy rights. For more information, please refer to the European Commission's webpage on data subject rights.

• Right to withdraw consent: In so far as our processing of your personal data is based on your consent, you have the right to withdraw consent at any time.
• Right of access: You have the right to request access to your personal data. This enables you to receive a copy of the personal data we hold about you (but not necessarily the documents themselves). We will also provide you with further specifics of our processing of your personal data.
• Right to rectification: You have the right to request rectification of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected.
• Right to erasure: You have the right to request erasure of your personal data where: (i) the personal data are no longer necessary; (ii) you have withdrawn your consent; (iii) you have objected to the processing; (iv) the personal data have been unlawfully processed; (v) erasure is required by law; or (vi) data collected in relation to information society services. Exceptions apply where processing is necessary for freedom of expression, legal compliance, public health, archiving, or legal claims.
• Right to object: You have the right to object to processing based on legitimate interests. For direct marketing purposes, we will always honour your request. For other purposes, we will cease processing unless we have compelling legitimate grounds overriding your interests or related to legal claims.
• Right to restriction: You have the right to request restriction of processing in case: (i) accuracy is contested during verification; (ii) processing is unlawful and you request restriction instead of erasure; (iii) we no longer need the data but you need it for legal claims; or (iv) you have objected to processing during verification.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format, or to have it transferred to a third party of your choice. This applies where processing is based on consent or a contract and is carried out by automated means.
• Automated decision-making: You have the right not to be subject to a decision based solely on automated processing. We do not make use of automated decision-making that produces legal or similarly significant effects without human review.
• Right to complaint: You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of an alleged infringement of the GDPR. Please refer to this webpage for an overview of supervisory authorities. We would appreciate the opportunity to deal with your concerns before you approach the supervisory authority.

The exercise of the above-mentioned rights is free of charge and can be carried out by email via the contact details displayed below. If requests are manifestly unfounded or excessive, we will either charge a reasonable fee or refuse to comply.

We may request specific information to confirm your identity before complying. We will respond without undue delay and in principle within one month of receipt, extendable by a further two months in complex cases.

We may use automated systems to support platform operations (e.g., fraud detection, ranking). We do not make solely automated decisions that produce legal or similarly significant effects without human review.

The Platform is not intended for children under 16. We do not knowingly collect personal data from children. If we become aware of such data, we will delete it unless required to retain it by law.

We may update this Policy. Material changes will be communicated via the Platform or email.