Privacy Policy
Subterra is the controller for the personal data described in this policy. Questions or requests: info@subterra.space.
1. What we collect and why
Registrations
When you register for an event or class we collect your name and email address. We use these to confirm your registration, check you in at the door, send practical reminders about the event you signed up for, and handle cancellations or refunds.Legal basis: performance of a contract.
Payments
Online payments for registrations are processed by Stripe; rent and studio-related payments by Mollie. In-person card payments at the bar and the vending machine are handled by SumUp and Valinso. We never see or store your card details; each provider processes them under its own privacy policy. We receive confirmation of payment and the details needed for our records.Legal basis: performance of a contract and legal (tax) obligations.
Classes
If you enrol in a class, your name and email address are shared with the teacher so they can run the class. Where a teacher has chosen to share their contact details with participants, we show these only to enrolled participants.Legal basis: performance of a contract.
Newsletter and interest lists
You can sign up to hear from us about events, classes or studio availability. This is always opt-in — we never add you to a mailing list because you registered for something. Every email contains an unsubscribe link. Mailing lists are managed in Brevo.Legal basis: consent, which you can withdraw at any time.
Studio interest and applications
You can join our studio interest list with your email address; when a studio becomes available we email the list and you can apply. You stay on the list until you unsubscribe. If you apply for a studio we collect the details you submit in the application form and use them only to assess your application.Legal basis: consent (interest list) and steps prior to entering into a contract (applications).
Event photography and recordings
Events in De Kern may be photographed, recorded or broadcast (Subterra Radio). We may use this material to document and promote our program. If you appear recognisably in material we've published and want it removed, email info@subterra.space.Legal basis: legitimate interest.
CCTV
Cameras operate in shared areas of the building for the safety of everyone using Subterra and to handle incidents. Footage is stored for a maximum of 4 weeks and only reviewed when there is an incident; footage related to an incident may be kept until the incident is resolved.Legal basis: legitimate interest (safety and security of persons and property).
Emails we send (confirmations, reminders and newsletters) measure opens and link clicks through Brevo. We use this to see which messages are relevant and to keep our lists healthy.Legal basis: legitimate interest.
Website
Our hosting provider (Netlify) keeps standard server logs (IP address, request data) for security and operations. We do not run analytics or tracking on our website.
2. Who we share data with
We use a small number of service providers to run Subterra, each bound by a data processing agreement or equivalent terms: Supabase (database, hosted in the EU), Stripe and Mollie (payments), Brevo (email, EU), and Netlify (website hosting). We do not sell personal data or share it with anyone else, unless required by law.
Some providers may process data outside the EU; where they do, transfers are covered by EU Standard Contractual Clauses or an adequacy decision.
3. How long we keep your data
Registration and payment records are kept for 7 years as required by Dutch tax law. Mailing and interest list data is kept until you unsubscribe. Studio applications are kept for 6 months after the process ends unless you ask us to keep them longer. CCTV footage is deleted after 4 weeks unless needed for an incident. We delete or anonymise everything else once it is no longer needed.
4. Your rights
You can ask us at any time to access, correct, delete or export your personal data, to restrict or object to its processing, or to withdraw consent you previously gave. Email info@subterra.space and we will respond within one month. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
5. Security
We protect personal data with measures appropriate to its sensitivity, including encrypted connections (HTTPS), access controls, and EU-based storage. Access to personal data is limited to those who need it to run Subterra.
6. Cookies
Our website uses only functional cookies that are necessary for it to work (for example, to process payments through Stripe during checkout). We do not use advertising, analytics or tracking cookies, which is why you don't see a cookie banner.
7. Changes
We may update this policy from time to time. The latest version, with its date, is always available on this page. If a change significantly affects how we handle your data, we will let you know.