Your data.
Clear agreements.

Who is responsible for processing?

UrbexNow, part of Global Adventure Factory, is responsible for processing personal data as described in this policy.

Which personal data do we process?

Depending on how you use UrbexNow, we may process, among other things:

• name, email address and, where applicable, telephone number;
• billing details and other information entered with an order;
• order number, purchased products, order status and payment status;
• the UrbexNow account and account details needed to provide digital access;
• messages, questions and correspondence with customer service;
• location names, map links, coordinates, photo or file links and explanations that you submit through forms;
• newsletter preferences when you subscribe;
• IP address, device, browser, session and usage data;
• cookie preferences and data collected using permitted cookies or similar technologies;
• data required for security, fraud prevention and the investigation of misuse.

Full payment card details are generally processed by the payment provider and are not stored directly by UrbexNow.

How do we obtain personal data?

We receive data directly from you when you:

• place an order or request digital access;
• contact us or complete a support form;
• submit a location update, new spot or trade request;
• subscribe to email updates;
• set cookie preferences or use the website.

We also receive limited data from service providers required for payments, orders, security, delivery and website functionality.

Purposes and legal bases

Which data is required?

Data marked as required in checkout or a form is needed to process the order, delivery or request. Without a correct email address, payment confirmation or required access details, we may be unable to deliver a digital order.

You do not have to complete optional fields. They may help us assess a question, location update or trade request more effectively.

With whom may data be shared?

We share personal data only when necessary for one of the stated purposes. This may involve the following categories of recipients:

• Shopify and parties providing technical support for the webshop;
• payment service providers, banks and fraud prevention services;
• email, hosting, storage and digital delivery services;
• analytics, cookie and marketing services that are actually activated in the webshop;
• accountants, administrative service providers and professional advisers;
• government authorities or regulators when we are legally required to provide data.

Service providers may process personal data only for their agreed task and must apply appropriate security and privacy safeguards.

Transfers outside the European Economic Area

Some service providers or their subprocessors may process personal data outside the European Economic Area. Where this occurs, a legally permitted transfer mechanism is used, such as an adequacy decision, approved standard contractual clauses or another appropriate safeguard.

How long do we retain data?

We do not retain personal data longer than necessary for the purpose for which it was collected, except where a statutory retention obligation or an ongoing dispute requires a longer period.

• basic order, invoice and administrative data is generally retained for 7 years;
• for data covered by a special tax scheme, such as certain OSS records, a period of 10 years may apply;
• support messages, location updates and trade requests are deleted or anonymised when they are no longer needed for handling, evidence or improving the database;
• newsletter data is retained until you unsubscribe or the processing must stop for another reason;
• cookie and analytics data is retained in accordance with the configured duration of the relevant cookie or service;
• data relating to security incidents may be retained for longer where necessary for an investigation or legal claim.

Cookies and similar technologies

The webshop uses necessary cookies for functions such as the shopping cart, checkout, security and privacy preferences.

Analytics, personalisation or marketing cookies are used only insofar as they are activated and the required consent or another valid legal basis exists. You can manage your choices through the cookie banner or the privacy settings shown by the webshop.

Which privacy rights do you have?

Depending on the situation, you may request:

• access to the personal data we process about you;
• correction or completion of incorrect data;
• deletion of personal data;
• restriction of processing;
• objection to processing based on a legitimate interest;
• transfer of data where the right to data portability applies;
• withdrawal of consent, without invalidating earlier lawful processing;
• objection to direct marketing; when you object, we stop that processing.

Send your request to info@urbexnow.com. We normally respond within one month. If we have doubts about your identity, we may request additional information to prevent data being provided to the wrong person.

Security and data breaches

We take appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration or disclosure. These include secure platform and payment environments, access restrictions and appropriate agreements with service providers.

If a data breach occurs, we assess whether reporting it to the Dutch Data Protection Authority and informing the persons concerned is legally required.

Minors, complaints and changes

The webshop is not specifically aimed at children. We do not knowingly collect personal data from children where valid consent from a parent or legal representative is required.

Do you have a complaint about the processing of your personal data? Please contact us first. You also have the right to lodge a complaint with the Dutch Data Protection Authority.

We may amend this privacy policy when our services, systems used or legislation changes. The current version and amendment date are shown on this page.