Legal

Privacy statement

Which personal data Loculy processes, why, with which suppliers and for how long — and exactly what happens to your location during a route. Version 1.2 of 2 October 2026.

This English version is provided for convenience. In the event of any discrepancy, the Dutch version prevails.

Version 1.2 — 2 October 2026

1. Who is responsible?

The Orange Chameleon is responsible for the processing of personal data via Loculy.

The Orange Chameleon
Registered address: Arendshorst 59, 2317 CS Leiden, the Netherlands
Chamber of Commerce (KvK) number: 72187905
VAT identification number: NL001178266B10
Email for privacy questions: wouter@loculy.com
Telephone: 0646142923

2. Which personal data do we process?

Depending on how you use Loculy, we process:

Visiting the website

your IP address and technical connection data, solely for security and the prevention of misuse (for example, limiting the number of order, voucher or recovery attempts);
technical error and security information from our servers and hosting provider;
functional cookie and session data (see the cookie statement);
visitor statistics via Vercel Web Analytics: the address of the page visited (without access codes, order and game numbers), the website you came from, country, region and city (derived from your IP address), device type, operating system and browser. This happens without cookies; Vercel recognises a visit only by a hash of the request that expires after 24 hours, and the statistics are not linked to your IP address or to you as a person (see section 2 of the cookie statement).

Loculy does not use analytics, advertising or tracking cookies and does not build visitor profiles.

Orders

your email address (a name is not requested when ordering);
order number, product ordered, amount, currency, any voucher and payment status;
the transaction reference of the payment provider (Mollie) and the time of ordering and payment;
data needed to link digital access to your order.

Email

your email address;
the type of transactional email (such as the order confirmation and the activation email), its delivery status and the technical delivery information from our email provider;
limited error and audit data about the sending (never the content of your message to us).

Route use

the moment of activation and the end of your access period;
which stops of a route have been unlocked and when, and which stops you have completed;
encrypted technical session and device characteristics that tie your access to your device (we do not store readable device data);
your location, solely at the moment of an unlock attempt (see section 3).

Contact and customer service

name and contact details, insofar as you provide them yourself;
the content of your question or complaint;
order data needed to help you;
correspondence and an internal support file.

3. Location data

Loculy routes use your device's location to determine whether you are close enough to a route stop to unlock it.
Your browser or operating system asks for location permission for this purpose.
Your location is sent to Loculy's servers only at the moment of an unlock attempt, to calculate the distance to the stop. Loculy does not track your location continuously and does not use the location outside the route process.
Raw GPS coordinates are not stored and not logged by Loculy. After the distance calculation they are not retained; no location history is created.
We only keep a record that a stop has been unlocked and at what moment.
Your location is not shared with Google or other third parties. If you choose to navigate to a stop, you open Google Maps outside Loculy; Google's privacy policy then applies.
We do not sell location data.

4. Why do we process personal data?

We process personal data in order to deliver the website and digital routes, handle orders and payments, grant paid access, enable activation and route use, send transactional emails, provide customer service, prevent fraud and misuse, investigate failures, protect the security of the platform, improve the website with aggregated visitor statistics and comply with legal and tax obligations.

5. Legal bases

Depending on the processing, we rely on one or more of the following GDPR legal bases:

performance of the agreement;
legal obligation;
legitimate interest, for example for security, fraud prevention and visitor statistics without cookies;
consent, where consent is legally required, for example for non-essential cookies or similar third-party technologies.

6. With whom do we share data?

Loculy uses the following specialised suppliers:

Vercel — hosting and serverless infrastructure (run in the EU, Frankfurt region), storage of route and website media and visitor statistics without cookies (Vercel Web Analytics);
Neon — database infrastructure (EU, Frankfurt region);
Mollie — payment processing; the payment takes place in Mollie's payment environment;
Resend — sending of transactional email (EU region);
Google — in two ways:
- Loculy retrieves public place data via the Google Places API, such as business information for listings and the location of cities and route stops. This happens from our servers; no visitor data is passed to Google in the process;
- links to Google that you open yourself: Google Maps (navigation to a route stop or listing, and a listing's reviews) and Google Calendar. If you choose Google Calendar for a saved day plan, your day programme and the link to your saved day are sent to Google;
Microsoft — only if you choose Outlook yourself for a saved day plan: your day programme and the link to your saved day are then sent to Microsoft.

We share data only insofar as this is necessary for the service concerned or where we are legally obliged to do so.

7. Processing outside the EEA

Our hosting, database and email sending run in the European Union. Some suppliers (such as Vercel and Google) are US companies that may process data from or in countries outside the European Economic Area. Where the GDPR requires this, we ensure a valid transfer mechanism and appropriate safeguards.

8. Retention periods

We do not keep personal data longer than necessary for the purpose for which it was collected, unless a statutory retention obligation applies.

basic tax records and sales records (orders, payments): for the statutory tax retention period of seven years;
access, activation and route-use data: for as long as the order is relevant for performance, customer service, fraud prevention and any disputes;
email delivery data: linked to the order, for as long as the order is retained;
server logs of the hosting provider: according to Vercel's standard retention period;
visitor statistics: Vercel recognises a visit for at most 24 hours; Vercel keeps the aggregated totals according to its standard retention period for Web Analytics;
customer service correspondence: for as long as reasonably necessary, subject to legal obligations.

9. Security

Loculy takes appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access and unauthorised alteration. Activation and access codes are stored only in hashed form (the code itself is not kept and cannot be derived from the stored value), connections run over HTTPS and the number of attempts on sensitive functions is limited.

10. Your rights

Insofar as the GDPR allows this in your situation, you have the right of access, rectification, erasure, restriction of processing, objection, data portability and withdrawal of consent where processing is based on consent.

A request can be sent to wouter@loculy.com.

11. Complaint to the supervisory authority

You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

12. Changes

This privacy statement may be updated when our services, suppliers or legislation change. The version date is stated at the top.