Privacy statement

Responsible entity and scope

Nostium B.V., Bogert 1, 5612 LX Eindhoven, the Netherlands, is responsible for processing for which it determines the purposes and means. This statement applies to the public website and, where Nostium is responsible, Nostium accounts, booking environments, portals, integrations, support and business services. Use dataprotection@nostium.com for privacy questions or requests; general questions can be sent to support@nostium.com or +31 (0)40 8200 194.

Roles with connected organisations

When you book with an organisation that uses Nostium, that organisation is generally responsible for its service, the substance of the booking and its own customer communications. Nostium processes data as a processor when acting solely on that organisation’s instructions, as an independent controller for its own purposes such as platform security and administration, or as a joint controller where the parties actually determine purposes and means together. The applicable agreement records the allocation of roles; you may exercise your rights with any relevant party.

Data categories and sources

Depending on the service, Nostium may process your name, address, date of birth, email address, telephone number, organisation or venue relationship, account and authorisation data, booking details, participants, preferences or comments, payment and invoice status, correspondence, support information and technical logs. Data comes from you, your employer or organisation, the venue with which you book, a connected ticket, voucher, payment or sales platform, or is generated technically during use. We do not request more data than reasonably necessary for the relevant purpose.

Website visits and technical data

For necessary operations, an IP address, device and browser information, language setting, date and time, requested route, referring page and error or security data may be processed to keep the service available and secure. After your separate consent, Google Analytics and Microsoft Clarity may additionally process an online identifier, approximate region, session and campaign data, page views and interactions such as clicks, scrolling and rendering behaviour. Clarity may create masked session recordings and heatmaps from this; input fields and sensitive content are masked. After marketing consent, Tracklution may process campaign parameters and conversion events. These optional processing activities do not take place without consent.

Contact, demo and partnership requests

When you submit a form, Nostium processes the necessary contact, company and message data you enter to register, allocate, answer and follow up your contact, demo or partnership request. Company is optional for a contact question, and surname and telephone number are optional for a demo; omit free text that is not needed for your request. Every request is first stored in the Nostium CMS. After the relevant processing is approved and activated, contact and demo requests may be emailed to the responsible team, sent to Nostium Hub and, when enabled, submitted to the existing HubSpot form. Partnership requests may be emailed after mail processing is approved. The CMS erases open requests no later than 24 months after receipt and completed or archived requests no later than 12 months after closure. An erasure request is also passed to recipients where required. This processing takes place to act on your request and for our legitimate interest in orderly relationship and request administration.

Bookings, participants and payments

A booking may involve identification and contact data, date, time, activity, venue, number or names of participants, special requests, amount, payment method, payment status and transaction identifiers. Purposes include creating and changing bookings, payments, access control, capacity and planning, confirmations, reminders, refunds, support, fraud prevention and compliance with tax or other legal duties. The connected organisation remains the primary contact for the substance of its offering and service.

Accounts and user administration

For personal or business accounts, Nostium processes information including name, email address, encrypted authentication data, two-factor settings, organisation and venue relationships, roles, permissions, login and audit data, and settings. This is necessary for account creation, authentication, authorisation, support, security and performance of the agreement. Never share credentials; an organisation’s administrators are also responsible for correct user permissions within their environment.

Customers, contracts and administration

For business customers, suppliers and partners, we process contact details, role, correspondence, arrangements, quotations, invoices, payment status and support history to prepare and perform agreements, provide service, manage relationships, establish rights and meet administrative duties. Required information is identified as such; without necessary contact, booking, account or payment data, the relevant service may not be available.

Nostium newsletter and marketing

After a voluntary subscription, Nostium processes your email address, language, consent time, policy version and subscription status to send relevant product updates or information. Name and company are optional. Marketing that requires consent is based solely on consent. The subscription and consent evidence remain active for no more than 24 months after the latest affirmative confirmation; after that we stop sending or request renewed consent. You can withdraw earlier through the unsubscribe facility or dataprotection@nostium.com; withdrawal does not affect earlier lawful processing. On withdrawal, the website CMS erases pending local mail copies, blocks ordinary follow-up and bulk export, and erases the archived request no later than 12 months afterwards. Any newsletter service in use must also apply the opt-out immediately and may retain only a minimal suppression entry for as long as needed to respect it.

Communications from connected organisations

A connected organisation may use Nostium to send necessary booking communications such as confirmations, reminders, changes, cancellations or service messages. That organisation is responsible for the content and legal basis of its own marketing; Nostium facilitates technical delivery under the applicable privacy and processing arrangements. You may also direct questions or objections about such marketing to the sender.

Cookies and consent

The public website uses necessary technologies for session security, form protection and remembering your choice. Google Tag Manager, Google Analytics and the analytics functions of Microsoft Clarity stay off until you allow Analytics; Tracklution and advertising-related Microsoft storage stay off until you allow Marketing. Nostium uses strict opt-in and sends no cookieless measurement requests after refusal. Current categories, technologies, retention periods and rules for the Netherlands, EU and Germany are set out in the cookie policy. Consent can be withdrawn through the permanent Cookie settings control just as easily as it was given; loaded suppliers then receive the refusal, accessible optional first-party storage is erased and the page restarts without the withdrawn scripts.

Legal bases

Nostium processes personal data where necessary for a contract or steps at your request, to comply with a legal obligation, on the basis of your consent, or for a legitimate interest such as security, continuity, fraud prevention, support and careful relationship management. For a legitimate interest, we balance that interest against your rights and expectations. Special-category data is processed only where an appropriate GDPR exception applies; do not provide it unless the service or venue expressly requests it.

Recipients, processors and Cherry B.V.

Access is limited to authorised staff, the connected organisation and service providers needed for hosting, email, support, security, payments, forms, CRM or integrations. Contact and demo forms may be transferred to Nostium Hub and HubSpot as described above. After the corresponding consent, Google Ireland Limited, Microsoft Ireland Operations Limited and Tracklution Oy may receive the data needed for the described measurement; Tracklution may send consented events to advertising destinations inventoried in advance. Nostium may share necessary data with parent company Cherry B.V., Galvanistraat 23A, 3861 NJ Nijkerk, for internal operations, support, security, audit, compliance and administration. An external processor is activated only after its role, instructions, security, subprocessors, deletion and audit rights have been contractually recorded; where parties jointly determine purposes and means, responsibilities are recorded under Article 26 GDPR.

Transfers outside the EEA

Tracklution primarily processes at AWS in Stockholm. Google, Microsoft, their subprocessors and advertising destinations inventoried in advance may also process data from or outside the EEA, including in the United States. Before activation, Nostium records for each transfer the country, recipient, applicable adequacy decision or European Commission Standard Contractual Clauses, transfer assessment and supplementary technical and organisational measures. A current list of relevant subprocessors and safeguards is available on request from dataprotection@nostium.com.

Retention periods

Personal data is kept no longer than needed for the purpose, legal duties and potential disputes. Open website requests are retained in the CMS for no more than 24 months after receipt; completed or archived requests for no more than 12 months after closure. Newsletter consent remains active for no more than 24 months after the latest affirmative confirmation. The application erases expired CMS records daily, failed queue jobs containing form data after no more than seven days, and CMS audits after one year. Temporary page autosaves older than 24 hours are erased hourly. Page and catalog revisions are erased after no more than one year and limited to the newest twenty snapshots per record; when the count limit is exceeded sooner, the oldest snapshots expire. Temporary CMS edit locks expire after 90 seconds and are removed from the database no later than five minutes afterwards. Security rate limits for forms and CMS sign-in expire after one minute; expired database-cache and cache-lock records are physically erased no later than five minutes afterwards, and custom CMS sign-in keys contain no readable email address or IP address. The CMS provides no persistent sign-in: legacy remember tokens are invalidated and a remaining recaller cookie is removed on the login screen. A separate CMS-activity timestamp is renewed only by CMS requests; after two hours without CMS activity, the user is logged out even while visiting the public website. Ordinary website browsing therefore cannot extend the CMS limit. When a website request is permanently erased, the application also immediately erases its remaining local queued jobs and failed queue copies. During a valid processing restriction, the CMS marks the request for storage and privacy handling, erases remaining local queue copies, blocks ordinary follow-up and bulk export, and schedules a review within 30 days. Automatic erasure is paused only while the restriction requires preservation and resumes after the restriction is lawfully lifted. Website CMS sessions are valid for no more than two hours and password-reset tokens for no more than one hour; expired records are erased within fifteen minutes and local application logs are retained for no more than fourteen days. Disabled CMS staff accounts can be permanently erased with authentication residue and identifying audit copies once no longer needed and where retention is not required. A public CMS upload remains available while needed for website publication; after it is moved to trash, the file, media metadata and related audit copies are permanently erased within 30 days. Other account and customer data generally remains during the relationship and is then erased, anonymised or access-restricted; booking, transaction and invoice records may generally be retained for seven years for Dutch administration. Google Analytics cookies may remain for up to two years by default; Nostium configures Google Analytics event-data retention to two months. Clarity recordings are retained for 30 days and labelled recordings and heatmap/click data for up to nine months. Tracklution event data is retained for up to twelve months. Exact browser-storage periods are listed in the cookie inventory. An incident, legal claim or retention duty may require a longer period; access is restricted and the reason documented in that case.

Security and incidents

Nostium uses appropriate technical and organisational measures, including encrypted connections, roles and permissions, strong authentication where appropriate, network and environment separation, logging, backups, updates, access reviews and development and incident-response procedures. Images uploaded through the website CMS are re-encoded before publication so embedded location, device, author and comment metadata is not made public. Access is limited to people who need data for their duties and who are bound by confidentiality. Security incidents are investigated and documented and, where the GDPR requires it, notified to the authority within 72 hours and to affected people where there is a high risk.

Your privacy rights

Subject to the GDPR conditions, you may request access and a copy, rectification, erasure, restriction or portability of your data. You may object to processing based on a legitimate interest and always object to direct marketing. Where processing relies on consent, you may withdraw it for the future. You may also request information about recipients, sources, retention periods and relevant safeguards for international transfers.

Requests and complaints

Send requests to dataprotection@nostium.com and include enough context to locate the relevant data. To prevent misuse, we may verify your identity proportionately. For a valid erasure, we also erase identifiable local queue copies. For rectification, erasure or restriction, we notify other recipients where Article 19 GDPR requires it; before lifting a restriction, we notify you. Nostium normally responds within one month; for a complex or extensive request, the GDPR allows an extension of two months and we will notify you within the first month. You may complain to the Dutch Data Protection Authority or the authority in the EU country where you live, work or where the alleged infringement occurred.

Children

Nostium services are not intended to collect children’s data without appropriate involvement of a parent, guardian or connected organisation. An activity or venue may need participant data for a booking; that organisation determines what is necessary and its legal basis. If you believe a minor’s data was processed incorrectly or without an appropriate basis, contact us so the situation can be investigated and data erased where required.

Automated decisions and profiling

Under the current policy, Nostium does not make decisions with legal or similarly significant effects based solely on automated processing. Operational rules, availability calculations, fraud alerts and reporting may support processes, but do not produce such an individual decision without appropriate human involvement. If this changes, we will provide the required information about logic, significance, consequences and your rights in advance.

Public team profiles and customer reviews

Nostium may display a team member’s first name, role, initials and, where appropriate, a photo and voluntarily shared professional-profile link to make clear who delivers our services. We minimise the data, review publication when a role changes and at least annually, and remove or amend a profile after a valid objection or when publication is no longer needed. Nostium also displays a limited selection of customer reviews posted publicly on Google, including the name or pseudonym used there, date, rating and review text. This material is served directly by Nostium without a Google widget, profile image or advance request to Google. These publications rely on our legitimate interest in recognisable, trustworthy information and promotion, balanced against the affected interests. You may object for reasons relating to your particular situation or request removal through dataprotection@nostium.com. The more-reviews button opens Google only after you activate it.

Changes and contact

We update this statement when services, suppliers, roles or laws change. For material changes, we inform affected people through the website, account or email where appropriate. The latest version replaces earlier versions for future processing. Privacy questions and requests: dataprotection@nostium.com. Post: Nostium B.V., Bogert 1, 5612 LX Eindhoven, the Netherlands. Last updated: 25 August 2026.

Disabled CMS accounts

When CMS access is disabled, Nostium immediately terminates the related sessions and password-reset capability. No later than 30 days afterwards, an administrator must review whether the name, business email address and remaining account or audit data are still needed for security, a dispute or a legal retention duty. Without a recorded need, the account, authentication residue and identifying audit copies are permanently erased; when retention is necessary, the reason and a new review date are recorded in the restricted register.

Recipient-release records

For new website requests, the CMS records which approved delivery channels were queued for that request, using only the recipient category, purpose, channel and time. The record does not copy a name, email address, telephone number, message or other submitted content and follows the same retention period as the request. A queue record does not prove that an external recipient processed the data; for a privacy request, Nostium therefore verifies and records receipt, rectification, restriction or erasure separately with every applicable recipient.