Privacy policy
Processing and protection of personal data
Romex Stays B.V. (hereinafter referred to as “Romex”, “we”, “us”, or “our”) highly values the protection of your personal data. In this Privacy Statement (hereinafter referred to as the “Privacy Statement”), we provide clear and transparent information about how we carefully process personal data in accordance with the General Data Protection Regulation (GDPR).
When you make a booking to stay at one of our accommodations, we require certain personal data from you. We also process personal data in other situations, as further described in this Privacy Statement. In doing so, we may engage third parties who receive and process certain personal data on behalf of Romex. In the case of a booking, your personal data will, of course, be shared with the accommodation where you will be staying.
Romex is the data controller responsible for the processing of your personal data. If, after reading this Privacy Statement, you have any questions or wish to contact us regarding the processing of your personal data, you can do so using the contact details provided in Section 8 of this Privacy Statement.
Below is an overview of the topics covered in this Privacy Statement:
- Processing of Personal Data: Categories, Purposes and Legal Bases
- Disclosure of Personal Data to Third Parties
- Data Retention Periods
- Security
- Your Rights Regarding Personal Data
- Cookies
- Changes to this Privacy Statement
- Questions and Contact Details
1. Processing of Personal Data: Categories, Purposes and Legal Bases
1.1 Apartment and Hotel Guests
If you have booked a stay at one of our accommodations, Romex processes the following personal data:
- First and last name;
- Gender;
- Place of residence;
- Street name and house number;
- Postal code;
- (Business) telephone number;
- (Business) email address;
- Date of birth; and
- Payment details.
Romex processes this personal data on the following legal basis:
“Processing is necessary for the performance of a contract.”
We process your personal data for the following purposes:
- Registering your booking in our administrative systems;
- Addressing you personally during your stay and in our further communications;
- Sending your booking confirmation and invoice by email;
- Contacting you if we have any questions regarding your booking, or to ask before your arrival or after your stay whether everything is clear and whether your stay met your expectations;
- Recording your payment details in our administration so that payments can be linked to your booking or, where applicable, so that refunds can be processed;
- Verifying that you are at least 18 years of age and therefore legally entitled to make a booking; and
- Determining the amount of tourist tax payable, as this depends on the age of the guests staying at the accommodation.
Guests Staying in Austria
If you have booked a stay at one of our accommodations in Austria, Romex additionally processes the following personal data:
- First and last name;
- Date of birth; and
- Passport or identity card number.
Romex processes this personal data on the following legal basis:
“Processing is necessary for compliance with a legal obligation to which we are subject.”
We process this personal data for the following purposes:
- Providing the required personal data to the local tourism office; and
- Sharing the information with local authorities, such as the police and/or fire brigade, in the event of an emergency.
1.2 Night Register
If you stay at one of our accommodations, Romex processes the following personal data:
- First and last name;
- (Business) telephone number; and
- Dates of birth.
Romex processes this personal data on the following legal basis:
“Processing is necessary for compliance with a legal obligation to which we are subject.”
We process this personal data for the following purpose:
- Recording the personal data of you and your travel companions in the legally required night register on behalf of the relevant municipality, for use in the event of an emergency.
1.3 Marketing, Newsletter Subscribers and Promotional Campaigns
If you subscribe to receive marketing communications, such as special offers or our newsletter, or if you participate in a promotional campaign or competition, Romex processes the following personal data:
- First and/or last name; and
- (Business) email address.
Romex processes this personal data on the following legal basis:
“Consent.”
We process this personal data for the following purposes:
- Sending you information and updates about the activities of Romex;
- Sending you special offers and other marketing communications that may be of interest to you; and
- If you have participated in a promotion or competition, contacting you and informing you if you have won.
If you no longer wish to receive marketing communications, such as our newsletters, you may unsubscribe at any time by clicking the unsubscribe link included in each newsletter.
1.4 Reviews and Guest Surveys
If you leave a review for one of our accommodations or participate in a guest survey, Romex processes the following personal data:
- First and last name;
- Gender;
- Place of residence;
- Street name and house number;
- Postal code;
- (Business) telephone number;
- (Business) email address;
- Date of birth; and
- Payment details.
These are the booking details (as described in Section 1.1) that are linked within our system when we invite you to leave a review or participate in a guest survey. Only your name will be published with a review, unless you choose not to have it displayed.
Romex processes this personal data on the following legal basis:
“Processing is necessary for the purposes of the legitimate interests pursued by Romex.”
We process this personal data for the following purposes:
- Continuously improving our services; and
- Contacting you in response to a completed survey to ask additional questions or to thank you for your valuable feedback.
1.6 CCTV Surveillance
If you are present in the common areas of one of our accommodations, Romex processes the following personal data through CCTV surveillance:
- Video recordings;
- Date and time of the recording; and
- Location of the recording.
Romex processes this personal data on the following legal basis:
“Processing is necessary for the purposes of the legitimate interests pursued by Romex.”
We process this personal data for the following purposes:
- Ensuring the safety and well-being of our guests and employees;
- Protecting our properties against burglary, theft, and vandalism;
- Safeguarding property and information;
- Recording, investigating, and handling (potential) incidents; and
- Handling requests, complaints, and disputes.
The CCTV system is not intended to process special categories of personal data, and the recordings will not be used to infer or distinguish such personal data. Therefore, in general, no special categories of personal data are processed unless this is necessary and permitted by law.
In the event of suspected unlawful conduct, CCTV recordings may be shared with the relevant authorities. In such cases, the recordings may qualify as criminal data, but only where necessary and permitted under applicable law.
1.7 Website Visitors
When you visit our website, Romex processes the following personal data:
- Technical information relating to the device used to access our website, including the IP address of the website visitor; and
- Technical and functional cookies. For more information about cookies, please refer to Section 6 of this Privacy Statement and our cookie banner.
Romex processes this personal data on the following legal basis:
“Processing is necessary for the purposes of the legitimate interests pursued by Romex.”
We process this personal data for the following purposes:
- Ensuring that our website functions properly; and
- Maintaining the security, reliability, and availability of our website.
Whenever Romex processes personal data on the basis of the legal ground of legitimate interests, we carry out a balancing test between our legitimate interests and your privacy rights before the processing takes place.
If you would like more information about this balancing test, please contact us using the contact details provided in Section 8 of this Privacy Statement.
In addition, Romex processes marketing cookies and other non-essential cookies only with your prior consent, as obtained through our cookie banner and cookie preferences.
2. Disclosure of Personal Data to Third Parties
The personal data we collect from you when you make a booking may be shared with the following third parties:
- The accommodation where you will be staying;
- Booking Experts, the company that provides our booking system and supports us with guest surveys and newsletters;
- iClicks, the company responsible for developing and maintaining our website;
- Insurance companies; and
- Competent government authorities or regulatory bodies where required by law.
We do not transfer your personal data outside the European Economic Area (EEA).
Romex has implemented appropriate technical and organisational measures to protect your personal data. We only share your personal data with third parties that apply equivalent technical and organisational safeguards to ensure the security and confidentiality of your information.
3. Data Retention Periods
Romex retains your personal data only for as long as is reasonably necessary to fulfil the purposes for which it was collected. This includes complying with applicable legal, tax, accounting, and reporting obligations.
In certain circumstances, we may retain your personal data for a longer period, for example if a complaint has been submitted or if we reasonably believe that legal proceedings may arise in relation to our relationship with you.
When determining the appropriate retention period, we take into account:
- the amount, nature, and sensitivity of the personal data;
- the potential risk of harm resulting from unauthorised use or disclosure of your personal data;
- the purposes for which we process your personal data and whether those purposes can be achieved through other means; and
- the applicable legal, regulatory, tax, accounting, or other requirements.
For example, Dutch tax legislation requires us to retain certain financial records for a minimum period of seven yearsfollowing the end of the relevant financial year.
CCTV recordings are retained for a maximum of 72 hours, unless an incident has occurred. In such cases, the recordings may be retained for a longer period if necessary for the investigation and handling of the incident.
If you would like more information about the specific retention periods that apply to your personal data, please contact us using the contact details provided in Section 8 of this Privacy Statement.
4. Security
Romex has implemented appropriate technical and organisational measures to protect your personal data against loss, unauthorised access, or any other form of unlawful processing.
Access to your personal data is restricted to those employees and third parties who require the information for legitimate business purposes and who are subject to a duty of confidentiality.
The booking system used by Romex, Booking Experts, is ISO 27001 certified, demonstrating its compliance with internationally recognised information security standards.
5. Your Rights Regarding Your Personal Data
You have various rights regarding your personal data and the way in which it is processed.
You have the right to:
- Obtain confirmation from Romex as to whether or not your personal data is being processed and, if so, access your personal data and receive additional information about the processing;
- Request the correction of your personal data if it is inaccurate or incomplete;
- Request the deletion of your personal data in certain circumstances, for example where the data is no longer necessary for the purposes for which it was collected and processed, where you withdraw your consent (if consent is the legal basis for processing), or where the personal data has been processed unlawfully;
- Request the restriction of the processing of your personal data in certain circumstances, for example if you contest the accuracy of your personal data;
- Receive the personal data you have provided to Romex in a structured, commonly used, and machine-readable format, and to have that data transferred to another data controller where the processing is based on your consent or on the performance of a contract;
- Object to the processing of your personal data where the processing is based on the legitimate interests of Romex. If you object, Romex will cease processing your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or where the processing is necessary for the establishment, exercise, or defence of legal claims;
- Object at any time to the processing of your personal data for direct marketing purposes. If you object, Romex will no longer process your personal data for such purposes;
- Not be subject to a decision based solely on automated processing, including profiling, where such decision produces legal effects concerning you or similarly significantly affects you; and
- Withdraw your consent at any time, where consent is the legal basis for processing. Withdrawal of consent does not affect the lawfulness of any processing carried out before the consent was withdrawn.
Please note that these rights are not absolute. There may be circumstances in which Romex is unable to fully comply with your request. For example, a request to erase personal data cannot be honoured if doing so would conflict with our legal obligations to retain certain information.
If you wish to exercise any of the rights described above, or if you would like to receive more information about the legitimate interest assessment referred to in Section 1, please contact us using the contact details provided in Section 8 of this Privacy Statement.
In principle, the information we provide in response to your request is free of charge. These rights may be exercised at reasonable intervals.
We will respond to your request within one month. If this is not possible due to the complexity of your request or the number of requests received, we will inform you within one month and may extend the response period by a maximum of two additional months.
If your request is granted, Romex will implement the correction, amendment, deletion, and/or transfer of your personal data as soon as reasonably possible.
If you are dissatisfied with the way we process your personal data, the handling of your request, or if you have any other privacy-related complaint, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
For more information, please visit:
https://autoriteitpersoonsgegevens.nl
6. Cookies
Romex and selected third parties, including Google Analytics, use cookies to analyse website usage and improve the performance of our website.
A cookie is a small text file that is stored on your computer or device. It enables us to provide you with a better user experience, both now and in the future. Both Romex and third parties, such as Google, may place cookies on your device.
You can manage, delete, or disable cookies through your browser settings. Please note that disabling cookies may affect the functionality of our website and other websites you visit.
You can opt out of Google Analytics cookies by visiting the Google Analytics Opt-out Page.
If you do not wish advertisers to analyse your browsing behaviour, you can manage your preferences via the Your Online Choices website.
7. Changes to this Privacy Statement
We may update this Privacy Statement from time to time to reflect changes in our services, legal obligations, or the way we process personal data.
The most recent version of this Privacy Statement was last updated on 29 January 2025.
8. Questions and Contact Details
Romex Stays B.V., located at Röntgenlaan 1, 2719 DX Zoetermeer, the Netherlands, is the data controller responsible for the processing of your personal data.
If you have any questions, comments, or requests regarding this Privacy Statement or the processing of your personal data, please do not hesitate to contact us.
Romex Stays B.V.
Röntgenlaan 1
2719 DX Zoetermeer
The Netherlands
E-mail: info@romexstays.com