ZoppaBox attaches great importance to the protection of personal data. In this privacy statement we explain the role ZoppaBox plays in the processing of personal data and how such data are handled.
1 – Who is ZoppaBox?
ZoppaBox is a Dutch online platform for music associations and other musical organisations.
For questions about privacy, please contact us at info@zoppabox.com.
2 – What role does ZoppaBox play?
ZoppaBox as controller
ZoppaBox processes certain personal data for its own business operations, for example for:
- subscriptions and agreements;
- customer administration;
- invoicing and payments;
- account management;
- communication;
- support;
- security;
- technical management.
For this processing, ZoppaBox itself determines the purposes and means.
ZoppaBox as processor
Associations use ZoppaBox for their own association activities.
For personal data that an Association records in ZoppaBox for this purpose, the Association determines why these data are processed and who has access.
In that case, the Association is in principle the controller and ZoppaBox the processor.
The arrangements for this are set out in the ZoppaBox Data Processing Agreement.
3 – Which personal data may be processed via ZoppaBox?
Depending on use, the following may be processed, among others:
- name;
- address and place of residence;
- telephone number;
- email address;
- date of birth;
- profile photo;
- membership details;
- attendance data;
- instrument, group or section;
- positions and roles;
- lesson and scheduling data;
- details of parents/guardians;
- contact and donor data;
- documents;
- photos and media;
- messages and comments;
- event and ticket data;
- data in custom fields;
- account and authorisation data;
- technical and security data.
4 – Special categories of personal data
Free text fields, documents, photos, messages, custom fields and other Content may in certain cases contain special categories of personal data.
The Association concerned determines whether it is necessary and lawful to process this information and who has access.
ZoppaBox processes such data on behalf of the Association and does not use them for its own advertising or marketing purposes.
5 – Which data does ZoppaBox process for itself?
For its own business operations, ZoppaBox may process, among other things:
- names and contact details of contact persons;
- organisation details;
- account details;
- subscription and invoice details;
- payment details where necessary;
- correspondence and support requests;
- technical and security data.
6 – Why do we process these data?
Depending on the situation, ZoppaBox processes personal data for:
- performance of agreements;
- access to the Service;
- subscription management;
- payments;
- support;
- necessary communication;
- security;
- fraud prevention;
- technical management;
- legal obligations.
The legal basis may be the performance of a contract, a legal obligation, legitimate interest or consent where required.
7 – Data of Associations
The Association itself determines which personal data it processes within the available options of ZoppaBox.
ZoppaBox processes these data on behalf of the Association in accordance with the Data Processing Agreement.
ZoppaBox does not sell personal data of Associations or their members.
Personal data that ZoppaBox receives solely as processor are not used for its own advertising or marketing purposes.
8 – Minors
ZoppaBox may be used for the administration of youth members and pupils.
As a result, personal data of minors and their parents or guardians may be processed.
The Association concerned is responsible for the lawfulness of this processing and for obtaining consent where required by law.
9 – Access by ZoppaBox
Authorised persons within ZoppaBox may have access to customer data where necessary for:
- technical support;
- troubleshooting;
- maintenance;
- security;
- development;
- quality improvement.
Access is limited to situations where it is necessary and takes place under confidentiality.
Where reasonably possible, anonymised or pseudonymised data are used for development and analysis.
10 – Service providers and sub-processors
ZoppaBox uses third-party service providers for, among other things:
- cloud hosting;
- data storage;
- authentication;
- email;
- push notifications;
- payments;
- technical infrastructure;
- monitoring and security.
Where these parties process personal data on behalf of ZoppaBox, appropriate arrangements are made regarding privacy and security.
An up-to-date list of relevant sub-processors is available via zoppabox.com.
11 – Transfers outside the EEA
Where personal data are processed outside the European Economic Area, ZoppaBox ensures, where required, a valid transfer mechanism in accordance with the GDPR.
12 – Security
ZoppaBox takes appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration and unlawful disclosure.
Where appropriate, measures are applied in the areas of encryption, authentication, authorisations, access management, monitoring and recovery.
No digital system can guarantee absolute security.
13 – Retention periods
ZoppaBox does not keep personal data longer than necessary for the purpose for which they are processed or for as long as required by law.
Administrative and invoice data are kept for the applicable statutory retention period.
Data processed solely on behalf of an Association are handled after termination in accordance with the Data Processing Agreement.
After deletion from the active environment, data may remain in technical backups for a maximum of 30 days, until they are deleted or overwritten according to the regular retention cycle.
14 – Security incidents and data breaches
ZoppaBox has procedures for assessing and handling security incidents.
When an incident concerns personal data processed on behalf of an Association, ZoppaBox informs the Association concerned without undue delay in accordance with the Data Processing Agreement.
15 – Data subject rights
Where ZoppaBox is itself the controller, a data subject may, depending on the situation, request:
- access;
- rectification;
- erasure;
- restriction of processing;
- objection;
- data portability;
- withdrawal of consent.
Where a request concerns personal data that an Association processes via ZoppaBox, that Association is in principle responsible for the request. ZoppaBox assists the Association where necessary.
16 – Cookies and similar technologies
The ZoppaBox website uses the following cookies and similar technologies:
- Functional cookie (
zoppabox_cookie_consent): remembers the choice you made in the cookie notice so that the notice does not keep reappearing. This cookie is kept for a maximum of 1 year. - Google Analytics analytics cookies (
_gaand_ga_*): these allow us to measure how visitors use the website, for example which pages are viewed and how visitors arrive at the website. These cookies are only placed if you give consent via "Accept all" in the cookie notice. Google Analytics is a Google service. Device and browser data, an approximate location and page visit data, among other things, are sent to Google; these data may also be processed outside the European Economic Area. These cookies are kept for a maximum of 2 years. - Technically necessary storage in the ZoppaBox app: the app uses technically necessary storage in your browser or on your device, for example to keep you logged in and to make the app work properly and securely.
You can change your choice at any time via the cookie settings. If you withdraw your consent, the Google Analytics cookies are deleted. You can also always delete or block cookies via your browser settings.
17 – Complaints
For questions or complaints about privacy, please contact ZoppaBox.
In addition, every data subject has the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
18 – Changes
This privacy statement may be amended when the Service, technologies used, suppliers or legislation change.
The most recent version is published on zoppabox.com.
19 – Contact
For privacy questions, please contact us at info@zoppabox.com.
Back to the homepage