1. Introduction

This is the privacy statement of the Cobraspen Group. In this statement, we describe how the Cobraspen Group handles the personal data of customers, clients, website visitors, suppliers, and other parties involved. Cobraspen Groep B.V., as the parent company, is the controller within the meaning of the General Data Protection Regulation (GDPR).

This privacy statement may be amended from time to time. The most recent version will be published on this page and on the website https://www.cobraspen.nl.

The following websites, and the companies concerned, belong to the Cobraspen Group. This privacy statement also applies to the website you are currently visiting:

• Beachhouse.nl

• Htelapartments.com

• Sugarcity.com

• Sugarfactory.nl

• Officehotel.nl

• Cobraspenvastgoed.nl

SugarFactory is part of the Cobraspen Group holding company through its subsidiary SugarCity Investments, which means that this privacy statement also applies to all parties involved with SugarFactory.

1. Contact details of the controller

Cobraspen Groep B.V., Elswoutslaan 20,
2051 AE OVERVEEN +31 (023) 526 49 49 https://www.cobraspen.nl

Mr. J. Deumens is IT Specialist and Data Protection Officer at Cobraspen Groep B.V. If you have any questions or requests, please contact him at privacy@cobraspen.nl.

1. Personal data that we process

Personal data is any data that can provide information about an identifiable natural person. Cobraspen Groep B.V. and its group companies process your personal data because you use our services and/or because you provide this data to us yourself. For example, when renting a property (home, office space, event space, or hotel room).

Below you will find an overview of the personal data we process:

• First and last name
• Gender
• Address
• Email
• Company name
• Phone number (mobile, direct, and/or office),
• Address
• Chamber of Commerce details
• Bank details
• Company website
• Position and department
• Date of birth
• Working days
• Dietary requirements/allergies, illnesses, and physical condition (pregnant, disabled, stressed)

When you stay at one of the Cobraspen Group hotels as a hotel guest, we also collect the following additional information:

• Passport number
• Credit card number + expiration date

1. Objectives and principles

In accordance with privacy legislation, we are required to inform you of the purposes and legal grounds for using your data. We require data from you for the preparation and execution of contractual agreements between you and Cobraspen Groep B.V. or one of its group companies. Without this data, such an agreement cannot be concluded. This applies to:

1. Renting office space
2. Selling and leasing real estate properties
3. Renting a hotel room or apartment
4. Renting event space
5. Use of other catering facilities (restaurant)
6. Purchasing Internet services from our Internet Service Provider during the duration of an event.

In addition, we may use your data if we have a 'legitimate interest' in doing so. That interest is, first and foremost, to be able to provide all our (potential) customers, clients, suppliers, and other parties involved with the best possible and most personalized service. Marketing activities are also a legitimate interest. We always take your privacy into account in this regard. In particular, there is a legitimate interest in the following activities:

1. Reviews & customer satisfaction surveys
2. Visits to (one of) the Cobraspen Group websites*
3. Newsletter & Email
4. Personal advice
5. Promotions
6. Social media
7. Security, Wi-Fi & cameras

*cobraspen.nl; officehotel.nl; sugarcity.com; www.sugarfactory.nl; beachhouse.nl; aquaramabeachclub.nl; htelapartments.com; forestsuites.nl

Finally, we are sometimes legally obliged to process your data, for example for tax purposes. And sometimes you have given us permission to use your data, such as when you sign up for the newsletter. We keep track of this, and you can always unsubscribe.

1. Retention periods

We do not store and use your data for longer than necessary. After that, we delete all data we have about you. Or we anonymize this data for internal analysis and reporting purposes. In that case, the personal data can no longer be traced back to you in any way.

What does this mean in practice? We adhere to certain time limits, after which we delete your data. Namely:

1. We delete inactive customer accounts after 7 years. After that period, we only use your data anonymously for internal reporting.
2. The tax authorities require us to retain our records containing your invoice, payment, and order details for 7 years. After that, we will only use anonymous data for internal reporting purposes. You must also keep the invoices for your agreements in a safe place.
3. If you have subscribed to the newsletter or given permission to receive personalized messages, we will retain that permission in order to demonstrate that you have indicated that you wish to receive the messages during a certain period. Even if you decide at some point that you no longer wish to receive the newsletter or personalized messages, we will retain your withdrawal of consent.
4. We store emails and contact requests for a maximum of 2 years unless you submit a request for their deletion earlier.
5. We do not store camera images of our premises for longer than 4 weeks, unless we see something suspicious that we need to investigate further or the images need to be stored for longer due to an incident.
6. The above does not affect our ability to retain data for longer if this data is necessary for the settlement of possible (legal) disputes.
7. Sharing personal data with third parties

We only pass on your data to other parties if this is really necessary for our services. These parties are: suppliers, payment partners, IT service providers, and parties that collect our reviews. Parties such as data management platforms, media and advertising agencies, and research agencies come into play as soon as we want to give you personal advice or show you targeted advertisements, for example based on your interest in certain products/services. In suspicious situations, we are obliged to share customer data with government agencies.

The parties that we grant access to your data may only use it to provide you with a service on behalf of Cobraspen Groep B.V. or (one of) the group companies. Unless they are themselves responsible for obtaining and protecting your data. Some cookie developers have access to the data that cookies collect on our website. You can read more about this in our cookie statement and the privacy policies of these parties. We never sell your data to third parties.

1. Cookies and similar techniques

A cookie is a small text file that is stored in the browser of your computer, tablet, or smartphone when you first visit a website. The SugarFactory website (and other Cobraspen Group websites as mentioned in point 1) uses functional and analytical cookies. When you first visited one of our websites, we informed you about these cookies and asked for your permission to place them.

Functional cookies:

The so-called functional session cookies are used to provide services or to store your preferred settings.

For example:

• Remembering the preferences you have indicated during your visit to the website;
• Remembering and passing on the information you enter when filling out a contact form on the various web pages, so that you do not have to enter the same information again and again when you return to the site.
• To store your preferences;
• Detecting misuse of our websites.

The basis for processing is: legitimate interest.

Analytical cookies:

These cookies are used to analyze your visit to our websites. For example, we analyze the number of visitors to our websites, the duration of visits, the order in which pages are visited, and whether the pages of a website need to be modified. The information collected helps us to make our websites more user-friendly. These cookies are also used to resolve any technical issues on the websites.

The basis for processing is: legitimate interest

Tracking cookies:

We will only use tracking cookies for commercial purposes if you have given your prior consent. These cookies, often placed by third parties, help us to provide you with personalized offers. This data is shared with these third parties, who can use tracking cookies to track your internet behavior.

The basis for processing is: legitimate interest

Change cookies

You can always change your cookie settings in your browser.

Current cookies

Some cookies (known as third-party cookies) are placed with Cobraspen Group's consent by third parties for the purpose of bringing certain products or services to your attention or giving you direct access to social media: Twitter, LinkedIn, Facebook, Hotjar, Livechat, Google Maps, and Google Adwords.

For information about the cookies placed by these external parties, the information they collect and the purpose for which that information is used, please refer to the privacy statements of these parties on their own websites. These statements are subject to change on a regular basis and Cobraspen Group B.V. has no control over this.

To measure the business use of our website, we use the Leadinfo service from Rotterdam. This service shows us company names and addresses based on the IP addresses of our visitors. The IP address is not recorded.

You can opt out of cookies by setting your internet browser so that it no longer stores cookies. In addition, you can also delete all information previously stored via your browser settings.

For an explanation, see: https://veiliginternetten.nl/themes/situatie/cookies-wat-zijn-het-en-wat-doe-ik-ermee/.

1. View, modify, or delete data

You have the right to view your personal data and to request that we correct or delete it. We will do so if the legal conditions for this are met and there is no exception that requires the data to be retained. In addition, you have the right to withdraw your consent to the data processing, and (under certain circumstances) to object to the processing of your personal data by the Cobraspen Group, to have the processing temporarily restricted, and to the portability of your data. This means that you can submit a request to us to send you the personal data we have about you in a computer file, insofar as this is technically possible and does not infringe on the privacy of others.

You can send a request to view, correct, delete, or transfer your personal data, or a request to withdraw your consent to or object to the processing of your personal data, to privacy@cobraspen.nl.

To ensure that the request has been made by you, we may ask you to provide proof of identity. We will respond to your request as soon as possible, but in any case within one month. If the request is very complex, we may extend this period by two months. We will inform you of this within one month.

1. Complaints procedures

If you have a complaint about compliance with this privacy statement or about a violation of your rights under the law, you can contact the data protection officer, Mr. J. Deumens, at privacy@cobraspen.nl.

You also have the option of submitting a complaint to the national supervisory authority, the Dutch Data Protection Authority. You can do so via the following link: https://autoriteitpersoonsgegevens.nl/nl/contact-met-de-autoriteit-persoonsgegevens/tip-ons.

1. Security
   The Cobraspen Group takes the protection of your data seriously and takes appropriate technical, physical, and organizational measures to prevent misuse, loss, unauthorized access, unwanted disclosure, and unauthorized modification. This is done, among other things, through IT security policy, employee training, and the use of secure storage and connections.

If you feel that your data is not properly secured or if you have indications of misuse, please contact us at privacy@cobraspen.nl.

Overveen, November 2018