MyClub

Privacy policy

Demo Club

Last updated: May 20, 2026

1. Data controller

Demo Club is the data controller responsible for the processing of your personal data described in this privacy policy.

2. What personal data do we process?

We process the following categories of personal data of members:

  • Identification: first name, surname, date of birth.
  • Contact details: email address, phone number and — if provided — postal address.
  • Membership data: member-since date, active/inactive status, roles within the association and committee memberships.
  • Profile photo (optional, only if uploaded).
  • Partner data: if you register a partner, we record the same categories of data for them.
  • Chat messages: messages you send via the in-app chat, including timestamp and read status.
  • Event photos: photos you upload at events, including any captions.
  • Dietary requirements: only for events with catering, and only if you provide them yourself.
  • Preferences: language and notification settings.
  • Device tokens for push notifications (only if you use the mobile app and have allowed notifications).
  • Login logs: timestamp and IP address of login attempts, for security purposes.

3. Why we use your data

  • Membership administration and performance of the membership agreement.
  • Organising and communicating about activities and events.
  • Enabling member-to-member communication via the in-app chat.
  • Sending push notifications and activity emails, where you have consented.
  • Platform security and prevention of misuse.
  • Compliance with legal obligations (including the statutory retention period for financial records).

4. Legal basis

We process your data on the following grounds under article 6(1) GDPR:

  • Performance of the membership agreement (b) — for core membership administration and events.
  • Legal obligation (c) — for retention of financial records.
  • Consent (a) — for push notifications, photo uploads and dietary information where applicable.
  • Legitimate interest (f) — for security, fraud prevention and the operational running of the platform.

5. Who we share data with

We do not share your data with third parties for commercial purposes. To operate the platform we rely on one processor and several sub-processors:

Processor

Bart Otto Solutions (sole proprietorship, KvK 69481539, Erasmusweg 2 B, 2202 CC Noordwijk, the Netherlands) operates and maintains the MyClub platform on behalf of the association. A data processing agreement under article 28 GDPR has been concluded with Bart Otto Solutions.

Sub-processors

  • DigitalOcean, LLC — hosting and file storage (Amsterdam, EU).
  • Cloudflare, Inc. — DNS, TLS certificates and email routing.
  • MailerSend, UAB (Lithuania, EU) — delivery of transactional email (password resets, event invitations).
  • Google LLC — Firebase Cloud Messaging, used solely to deliver push notifications to the mobile apps.

Appropriate safeguards are in place with each sub-processor. Any transfer outside the European Economic Area is based on EU Standard Contractual Clauses or another adequate protection mechanism.

6. Retention periods

  • Membership data: during your membership and up to two years after termination, then anonymised or deleted.
  • Financial records: seven years (statutory retention period).
  • Chat messages: two years after the last message in the conversation.
  • Login logs: ninety days.
  • Device tokens: until you log out or remove the app.

7. Your rights

Under the GDPR you have the following rights:

  • Right of access (art. 15)
  • Right to rectification (art. 16)
  • Right to erasure (art. 17)
  • Right to restriction of processing (art. 18)
  • Right to data portability (art. 20)
  • Right to object (art. 21)
  • Right to withdraw consent (art. 7(3))

You can exercise these rights by contacting the association at the board. For technical requests that can only be carried out by the processor, you can write to [email protected]; your request will then be handled in coordination with the association.

8. Security

We take appropriate technical and organisational measures to protect your data, including transport encryption (TLS), role-based access control, secure password storage (bcrypt), regular back-ups and logging of security events.

9. Cookies

We use only functional session cookies that are strictly necessary to keep you logged in and operate the platform. We use no tracking, analytics or advertising cookies. No consent is required for functional cookies (art. 11.7a Dutch Telecommunications Act).

10. Complaints

If you have a complaint about the processing of your personal data, please first contact us using the details above. If we cannot resolve the matter together, you have the right to lodge a complaint with the Dutch Data Protection Authority via autoriteitpersoonsgegevens.nl.

11. Changes

This privacy policy may be updated when our processing or applicable law changes. The most recent version is always available on this page. You will be actively notified of any material changes.

In case of any difference between the Dutch and English text, the Dutch version prevails.

Imprint