Privacy Policy and Personal Information

Sometimes we ask you to provide some personal data. What information might we collect about you? How do we manage the data? Please read our privacy policy for more information.

Everyone is welcome at the Van Gogh Museum, to be inspired by Vincent van Gogh and his contemporaries. In some cases, we require information about you linked to your upcoming visit. For example, if you order a ticket online, book a guided tour or order an item in our webstore. It goes without saying that we handle your personal data with the greatest possible care. After all, this concerns your privacy. Read on for more information about our privacy policy and how we use your data.

The Van Gogh Museum

This privacy statement applies to:

Van Gogh Museum Foundation (formerly Rijksmuseum Vincent van Gogh/Rijksmuseum H.W. Mesdag);
Van Gogh Museum Enterprises B.V.;
Meet Vincent van Gogh Experience B.V.

In this privacy statement, these three parties are referred to by a single name, i.e. the Van Gogh Museum. In all instances where ‘Van Gogh Museum’, 'the museum' or 'we' is mentioned, the information applies to all of these parties.

How does the Van Gogh Museum handle your personal data?

The Van Gogh Museum limits processing personal data to an absolute minimum. However, it will always require certain personal data, such as for the provision of all products and services offered by the museum. For example, the webstore and online ticket shop request certain personal data: this data is required in order to supply the ordered products or services correctly. There are also other instances when we require your personal data. Such as when you book a guided tour, subscribe to our email communication, apply for a job at the museum or when you want to support us by making a donation.

Your personal data is handled with the utmost care. In principle, this data will not be supplied to third parties, unless this is necessary for the service in question, or if we are legally obliged to do so. We do our utmost to ensure that this data is secured to the best of our ability.

Personal data will be stored for the shortest possible length of time (see article 7). We take legal retention periods that apply to certain data into consideration.

Whoever supplies his or her data to us is – and remains – the owner of this data. This means that the owner of this data has given permission for the personal data to be processed. It also means that the owner can revoke this permission and request that his or her data is deleted (see article 15).

1. What is personal data?

Personal data is understood to be: All data concerning an identified or identifiable natural person. This means that information directly relates to someone or can be traced to this person. Data relating to the deceased or organisations is not considered to be personal data.

2. What is processing personal data?

Processing is understood to mean all actions carried out with regard to personal data, both digital and on paper. For example, collecting, recording, categorising, storing, editing, amending, requesting, consulting, using, forwarding, distributing, combining, linking, protecting, erasing and destroying personal data, as well as making it available.

3. What personal data do we process?

Museum visit

CCTV recordings are made inside and outside the museum for security purposes. These recordings are used to help us safeguard the safety and security of visitors, staff and the artworks to the best of our ability.
During events such as Vincent on Friday, the opening of a new exhibition, the purchase of a new artwork, etc. we make photographs or videos. These images are being used to report and give an impression of these events. We will not ask your consent for these images, because these images are made in the context of the freedom of press. As mentioned in the Uitvoeringswet AVG in case of freedom of press consent is not necessary. In case you don’t want to be photographed, please inform the photographer, so he/she can take this in account. If we take pictures of a minor or a incapacitated person, we will always ask consent of a legal designated representative.
We will ask consent for all other images we make inside or outside of the museum.

Website visit
Various services are offered on our website. Visitors to the website can purchase an admission ticket or Van Gogh merchandise. You can also book a guided tour, multimedia guide or workshop. You can use the website to support our museum, subscribe to our email communication or ask us to look into whether you are the owner of a work by Van Gogh. We ask you to provide personal data in all of these cases, in order to handle your purchase, request or question as best we can.

We use cookies, analytics and other technologies on our websites and in our apps. These all help us to ensure that the websites and apps work properly and to collect data that helps us to improve the websites. This data is anonymised whenever possible and is not supplied to third parties. This concerns the websites vangoghmuseum.nl, tickets.vangoghmuseum.nl, vangoghmuseumshop.com, demesdagcollectie.nl, unravel.vangogh.com and ontrafel.vangogh.nl. More information about cookies and how we use them is available in our cookie policy.

Read our cookie policy

On our websites, we request the following personal data:

Webstore, online tickets, email communication, application and contact forms

If you use our services, shop online in our webstore, would like to stay up to date on our activities or to follow us via social media, and have entered certain relevant personal data, we can process the following personal data supplied by you:

sex (only for online tickets);
first and last name;
date of birth (only for online tickets);
address information (for the webstore and online tickets);
country information;
telephone number (for the webstore and online tickets);
email address;
language preference (for email communications);
other information voluntarily provided by the visitor to the website and/or for which the visitor has given explicit permission for it to be processed, e.g. as part of research or to stay up to date on activities in and around the museum;
IP address, when you complete and sent an application or contact forms.

Benefactors

With regard to benefactors of the Van Gogh Museum, the following personal data is processed:

first and last name;
address information;
telephone number;
bank account number;
email address;
if applicable: information required to allow you to deduct your gift from your income tax return.

Sponsors
With regard to sponsors of the Van Gogh Museum, the following personal data is processed:

first and last name of contact;
email address of contact;
telephone number of contact.

Authentication requests
Do you own a painting, drawing, letter or print that you think might be the work of Vincent van Gogh? Then you could submit an authentication request.

An authentication request can be submitted by a natural person, a legal person or a partnership. This privacy statement is only applicable in the case of authentication requests submitted by natural persons, not in the other cases.

In order to conduct authenticity research when requested, we also require personal data concerning the (previous) owner(s) of the artwork(s). This is why the following personal data can be processed:

sex;
first and last name;
address information;
country information;
telephone number;
email address.

Guided tour, workshop or other museum activity
With regard to visitors who book a guided tour or other museum activity (by telephone, email or via the website), the following personal data can be processed:

first and last name of the person booking the activity or who is acting as the contact;
address information;
telephone number;
email address;
language preference;
country information (only for workshops);
in the case of children, in addition to the data relating to the parent/carer, the first name and age of the child(ren) is also requested;
other information supplied voluntarily;
your IP address that is automatically added when you complete and submit a form on the website.

Requesting images for commercial usage
If natural persons request images, this privacy statement applies. In order to be able to assess and handle image requests, including payment, the following personal data is processed:

sex;
language preference;
first and last name;
address information;
country information;
telephone number;
email address;
VAT number.

Photo booth
You can find the photo booth in our museum. With this booth you can take a fun picture of yourself and have it sent to you by email. In order to make this possible you have to give your email address. Sharingbox (the processor) retains your picture and email address for a period of one year. After this period these data will be deleted. You can find more information about this subject in the privacy policy of Sharingbox.

We do not receive your photograph from Sharingbox. They only sent us the email addresses. We only keep your email address if you opt in for our email communication. We delete all other email addresses.

Donation terminal
There are two donation terminals in the museum. With these terminals you can make a donation to the Van Gogh Museum. For the digital payment we use Adyen. If you provide your email address you will receive a receipt of your donation by email. We do not store these email addresses. We only receive your email address if you opt in for our email communication.

Events and venue hire for companies
If you want to organize an exclusive guided tour after closing hours or organize an exclusive dinner, buffet of reception surrounded by Van Gogh’s masterpieces, we can process the following personal data:

first and last name of contact;
email address of contact;
telephone number of contact.

Contact
When you submit an enquiry via a contact form or submit a request for a call back, we can process (besides the company data) the following personal data:

first and last name (of contact);
email address (of contact);
some cases sex;
telephone number (if you requested telephone contact);
other details you give us.

Research
We regularly conduct research in order to help us improve the quality of our websites and apps. This research is usually conducted anonymously. In the case of research requiring the processing of personal data, we do not request more personal data than is strictly necessary. We also ask for explicit permission to process this data.

Van Gogh at School
This part of our website features free digital lessons for primary and secondary schools. These lessons can be stored and edited in LessonUp. If you choose to store a lesson, you are redirected to a screen where you can register for LessonUp by entering your name and email address. The LessonUp privacy statement applies to this data.

Other relations
Personal data of other relations are recorded in our CRM-system. We keep in contact with these relations by sending them information about our museum and our activities or invite them for events.

The following personal data can be processed:

first and last name;
(private) address information;
(private) telephone number;
(private) email address;
in some cases a passport photo;
in some cases date of birth;
in some cases information you provide us in a conversation.

When you visit our office or visit our museum for business purpose we record your first and last name and in some cases your (business) telephone number in our visitors-system.

Collection information
For research purposes we register the owners of the collection of Vincent van Gogh. We keep this record in order to make transparent who the owners are of artwork of Vincent van Gogh. For this purpose the following personal data is processed:

first and last name;
telephone number;
email address;
address information, including postal code and country;
date of birth;
date of death (if applicable).

Apply for a job at the museum
If you apply for a job at the museum, we can process the following personal data supplied by you:

first and last name;
address information;
telephone number;
email address;
CV;
motivation.

Facebook Messenger Chatbot
Via Facebook Messenger you can chat with us via a chatbot. The Van Gogh Museum Chatbot is enabled by Microsoft Bot Framework. This is a set of web-services that enable intelligent services and connections using conversation channels you authorize. As a service provider, Microsoft will transmit content you provide to our bot/service in order to enable the service. For more information see the Microsoft privacy policy.

In addition, your interactions with this bot/service are also subject to Facebook's applicable terms of use, privacy and data collection policies. To report abuse when using a bot that uses the Microsoft Bot Framework, please visit the Microsoft support page.

The following data can be processed:

The account ID (a random generated ID). For more info, visit the Microsoft website.

The Microsoft Bot Framework application insights collects the following data:

the messages that were sent and received;
timestamps of messages and conversations;
the user’s location data ;
the (random generated) user ID;
time and ID of conversations in order to merge single messages into a transcript;
the user’s language settings;
the measured sentiment of messages.

We use these data to gain insight into the use of the chatbot and to improve our service.

4. When do we process personal data?

Personal data is only processed if:

it is required in order to fulfil an agreement;
the owner has given explicit, unequivocal permission for us to do so;
there is a justified interest for the Van Gogh Museum (e.g. analytical purposes or direct marketing);
processing the data is necessary in order to comply with a legal obligation.

5. Why do we process this data?

The Van Gogh Museum processes personal data:

to help us to carry out your order, authentication request or visual material request, or deal with your request for a workshop, venue hire, guided tour or other museum activity;
so that we can get in touch with you if issues are encountered/questions arise regarding the implementation of the agreement;
so that we can get in touch with you in the case that there are urgent changes that impact the date or time upon which you have booked your museum visit, guided tour or workshop;
to help us ensure that your visit to the museum is as enjoyable as possible;
to provide you with the service that is important to us, such as sending you information or a welcome message before you visit our museum
to help us safeguard the safety and security of visitors, staff and our artworks;
so that we can offer the guided tour, workshop or other service in the desired language;
so that we can properly tailor the content of children’s workshops to the participating children, we ask for the age of the children;
if you would like to offer the museum a donation;
so that we can request payment for the museum activity provided or so that we can accept the donation/gift;
so that we can address you in your preferred language;
so that we can deal with your job application;
if you have requested information from us;
so that we can invite you to events;
so we can answer your questions or deal with your complaint, through social media, email, by regular mail of by telephone;
so Sharingbox will be able to sent you the picture you made with the photo booth;
to have insight of all our relations and our complete network in order to improve our fundraising, which is important for the continued existence of our museum;
for purposes of analysis that will help us to improve the service we offer, in which case the data will be anonymised wherever possible;
if you have given permission for your data to be processed. For example, if you would like to be kept up to date on our events and developments at our museum, for research purposes or to help us improve our services.

6. Processing by third parties

We supply third parties with personal data if this is required for technical reasons (e.g. in the case that we do not have the required technology in-house), or due to (legal) obligations.

In such cases, we employ the services of a specialised third party to carry out the agreed activities or to fulfil an agreement or sales contract. This third party also processes the personal data. Examples include providing the delivery service with address information so that they are able to deliver items ordered in the webstore to the correct address, or a specialised party that ensures that your admission ticket is delivered to your inbox.

In such cases, we will employ the services of a third party who satisfies our safety norms and privacy guidelines. We make clear agreements with this party regarding handling personal data with care. The Van Gogh Museum is, and remains (also in such a case), responsible for the processing of the data.

We may also be required to make a declaration or report a crime, e.g. in the case of fraud. The police, judiciary, watchdogs and/or the Tax Office may request data from us on legal grounds. A judge also has the power to oblige us to provide data. In all of these cases, we are required to supply the necessary personal data to third parties.

7. For how long do we store your data?

Personal data will not be stored for longer than is strictly required in order to realise the purpose for which the data was collected. In some cases, we are bound by a legal retention period. In case your personal data cannot be deleted for technical reasons, your data will be anonymized whenever possible.

Job applicants’ data is deleted or destroyed 4 weeks after a recruitment procedure is completed or stopped, unless it has been agreed with the applicant that their data will be kept on file. In the case of the latter, we will store the data for a maximum of 1 additional year.

With regard to benefactors or sponsors, when a donation is cancelled, we ask whether the personal data should be deleted or whether the person in question would like to stay up to date on the museum’s activities (whether they would like to remain on our records as a museum relation).

In the case of an authentication request, we store the personal data indefinitely. This is because this data is used for scientific and/or historical research. The Van Gogh Museum determines when this data is no longer required, at which time it will be deleted.

If you have subscribed to receive our email communication (such as newsletters) or have indicated that you would like to be added to our records as a museum relation, we process your data until such time as you indicate that you would no longer like to receive our email communication or would like to be deleted from our records. To unsubscribe from our newsletter, you can also click ‘Unsubscribe’ in the header or footer of our newsletter.

All data collected in relation to the provision of our products and/or services will be deleted as soon as possible after the transaction has been completed in full.

We store personal data from relations that visit our museum regularly, such as schools, until they ask us to delete these personal data.

In case of events we store personal data with a maximum of four weeks after the event. Images made during events are stored in our digital archive and is, for press purposes, stored and used for an indefinite period of time.

8. Do we share personal data with third parties?

Personal data is only shared with third parties if this is required to fulfil an agreement or contract entered into with you, to comply with legal obligations or to cooperate with investigations being conducted by the police or other authorities. See also article 6.

9. The transfer of personal data to third countries

Your personal data will be processed and stored within the European Union as much as possible. Our processors might store or process your personal data outside of the European Economic Area (EEA).

Transfer of personal data to a country outside of the EEA will only take place when that country ensures they take appropriate precautions to protect personal data.

10. CCTV surveillance

For purposes of security, the museum uses CCTV surveillance both inside and outside of the museum. It goes without saying that we handle the recordings with care. They are not shared with third parties unless the police or other authorities request them. Recordings are stored for a maximum of 4 weeks, unless this data is required as part of investigations being conducted by the police or other authorities.

For purposes of security, the museum also uses CCTV surveillance both inside and outside of our office building and our personnel entrance of the museum. Recordings are stored for a maximum of 4 weeks and are not shared with third parties unless the police or other authorities request them.

11. Wi-Fi network

At the museum you can use our free Wi-Fi service. As a result of offering the Wi-Fi service, we may receive information that could be used to identify you or the device you are using. For example, your MAC address or unique means of identification, such as a name or number assigned to a device. This data is not stored or shared with third parties.

12. Social media

The Van Gogh Museum makes extensive use of social media to inspire you with our artworks, to keep you up to date on our activities and to offer you glimpses behind the scenes. We also use social media to respond to your questions and comments. You can follow us on Facebook, Twitter, Instagram, YouTube, Pinterest and LinkedIn. If you use these social media platforms, you agree to the terms & conditions of the social media platform in question.

We place advertisements for our exhibitions and other activities on social media. We show you advertisements based on the data that the social media platform collects with your permission, e.g. that you follow us, your age, where you live or that you are interested in art.

The Van Gogh Museum does not have any influence on the data that the social media platforms collect about you. To find out more, check the terms & conditions of the social media platform you use. You can also often manage these privacy preferences in the settings in your social media profile.

13. Google Analytics

The Van Gogh Museum uses Google Analytics to gain insight into how visitors use their websites. We use the information to help us improve the websites.

The data cannot be traced back to individual people. Read more about the Google privacy policy.

The Van Gogh Museum has taken the following measures to protect your privacy:

We have signed a data processing agreement with Google.
We have turned off the ‘share data with Google’ option.
Google Analytics cookies are not used in combination with other Google services.
The last three numbers of your IP address have been deleted, meaning it is anonymised.

14. Cookies

On the websites of the Van Gogh Museum, we use cookies to ensure that the websites work properly, to analyse how the websites are used and to show you advertisements tailored to your interests and how you use the internet. More information is available in our cookie policy.

Read our cookie policy

15. What rights do you have?

If you have subscribed to our newsletter and would like to cancel your subscription, you can do so by clicking on the ‘Unsubscribe’ hyperlink in the footer of the email communication. Alternatively, email your request to newsletter@vangoghmuseum.nl .
If you are under the impression that we process your personal data unlawful or improper, you can request a restriction on the processing of your personal data by the Van Gogh Museum.
You have the right to request what personal data we process about you.
If your personal data we hold is incorrect, you have the right to request to have any inaccuracies corrected.
You can withdraw your consent at any time for future processing by us of your personal data. In case of images we need to know at what date the images is made, at what event and we need a clear description of the image. If possible attach the image to your request. If we grant your request the image will not be used for future processing.
You have the right to request to transfer your personal data to another company. We will grant this request to the extent that this (data portability) is technically possible.
You have the right to object to the processing of your personal data. If you do so, we will stop processing your personal data, unless our urgent justified grounds outweigh your interests. In that case we will inform you about it.
You have the right to be forgotten. After you request, your personal data will be deleted as soon as possible, unless we are not able to do so because of legislation. Due to technical reasons it is not always possible to delete personal data. In that case we will anonymize your personal data whenever possible.

Any request about your personal data must be made in writing to:

Van Gogh Museum
Privacy Officer
P.O Box 75366
1070 AJ Amsterdam
The Netherlands

Or sent by email to privacy@vangoghmuseum.nl.

We will respond to your request as soon as possible, and within 4 weeks at the latest.

If we are not possible to grant your request we will let you know with reasons. In order to prevent abuse, we might ask you for identification, by sending us a copy of your identification.

16. The right to file a complaint

If you believe that we do not handle your personal data with care or responded to your request seriously, you have the right to file a complaint with the supervisory authority Autoriteit Persoonsgegevens (Dutch DPA).

17. Personal data security

The Van Gogh Museum will always do its utmost to secure your personal data. Our aim is to prevent misuse or loss of data, as well as unauthorised access, unwanted publication or unlawful adjustments. Our websites use a secure SSL Certificate, to ensure that your personal data does not fall into the wrong hands.

If you nevertheless get the impression that your data is not properly secured or that there are signs of misuse, or if you would like to receive more information about how your personal data is secured, contact us by sending an email to privacy@vangoghmuseum.nl.

18. Amendments

The Van Gogh Museum reserves the right to make changes, additions or adjustments to its privacy statement.

This privacy policy is adjusted on 20 May 2019.

Contents: