Privacy
Privacy policy
Below you can read which data Bubble & Bloom B.V. processes, why we do so, who receives it and how long we keep it.
Last updated 31 August 2026
Who processes your data
Bubble & Bloom B.V. is the controller for the personal data processed through this website and around your stay.
We have not appointed a data protection officer. Privacy questions arrive at the email address below and we handle them ourselves.
- Registered name
- Bubble & Bloom B.V.
- Registered office
- Unescolaan 28, 1462 SC Middenbeemster
- Chamber of Commerce number
- 42127777
- VAT number
- NL869849827B01
- Phone
- +31 6 52 38 46 89
This is our registered office, not the address of the accommodation. You receive that only after you have booked.
Which data we process, and what for
For each purpose, you can see which data we process, on which legal basis, and how long we keep it.
Your booking and your stay
Bookings run through Lodgify, our booking system. You enter your details in the Lodgify checkout; we then see them in our booking overview. We use them to confirm your stay, send you the arrival information and your access code, and settle the payment. The payment itself runs through Stripe, the payment provider connected to Lodgify.
Data
- Your name
- Your email address
- Your phone number
- The address details you enter when booking
- Arrival and departure dates and the number of guests
- Any add-ons you book and the notes you add yourself
- The payment status and the invoice details for your stay
Legal basis
Performance of the contract. For invoice and payment data there is also a legal obligation.
Retention period
We keep invoices and payment data for seven years, as Dutch tax law requires. The remaining booking data we keep until two years after your stay.
Contact by email, phone or WhatsApp
If you send us a message, we read and keep it so we can answer your question. WhatsApp messages travel through WhatsApp itself, so the terms and privacy policy of WhatsApp apply to that channel as well.
Data
- Your name
- Your email address or phone number
- The content of your message and our reply
Legal basis
Legitimate interest: we want to be able to answer questions. If your message concerns a booking, the basis is performance of the contract.
Retention period
Until your question is settled, and for at most twelve months after that.
Newsletter and the welcome guide by emailnot live yet
If you sign up, we add your email address to our list at Mailchimp. The newsletter goes out once a quarter, and every email carries an unsubscribe link at the foot. If you only ask for the welcome guide, we send you that and no marketing.
Data
- Your email address
- The language you were viewing the site in
- What you ticked, and when
- Whether you signed up through the welcome guide or through the website
Legal basis
Consent. You give it by ticking a box yourself, and you can withdraw it at any time using the unsubscribe link at the foot of every email.
Retention period
Until you unsubscribe. After that we keep only the fact that you unsubscribed, so you do not accidentally start receiving mail again.
Statistics on how the website is used
We measure how the site is used with Google Analytics 4, measurement ID G-9H2WPZQK8G. This only happens if you consent in the cookie notice. If you decline, no cookies are set and Google receives only an anonymous signal in which you cannot be identified. The measurement is never used for advertising: Google's advertising settings are permanently off.
Data
- Which pages you view and for how long
- How you reached the site, for example through a search engine
- Your device, browser and screen size
- Your approximate location, at city or region level
- Clicks on buttons such as Book now
- Your IP address, which is processed in shortened form
Legal basis
Consent. You can withdraw it at any time.
Retention period
Fourteen months at most. That period is set inside Google Analytics itself; after it, Google deletes the underlying data.
Remembering your cookie choice
We store your choice from the cookie notice in your own browser, under the key bb-toestemming. That way you do not see the notice again on every visit. No cookie is set for this and the choice never leaves your device.
Data
- Whether you accepted or declined the analytics cookies
Legal basis
Necessary to respect your choice and to be able to demonstrate it.
Retention period
Until you clear the stored site data in your browser.
Guest reviews on the site
The site shows reviews guests wrote on Airbnb. We reproduce them word for word, with the first name and the month of the stay as the guest gave them on Airbnb. If you would rather your review was not on the site, let us know and we will take it down.
Data
- The guest's first name
- The month and year of the stay
- The text of the review
Legal basis
Legitimate interest: showing future guests what previous guests thought of their stay.
Retention period
For as long as the review is on the site. We remove it on request.
The gift cardnot live yet
The online gift card is still being built. Once it exists, payment will run through Stripe. We will see who buys the card, who it is meant for and what it is worth. We never see your full card or account number; that stays with Stripe. This paragraph describes the plan and will be replaced once the gift card actually works. If you want to give a gift card today, it goes through a message to us, and those details fall under “Contact by email, phone or WhatsApp” above.
Data
- Name and email address of the buyer
- Name of the recipient and any personal message
- The amount, the balance and the status of the card
- The payment details Stripe shares with us, such as the transaction number and the payment method
Legal basis
Performance of the contract. For the bookkeeping there is also a legal obligation.
Retention period
Invoices and payment data for seven years, as Dutch tax law requires. A gift card is valid for 24 months; we keep the details of an unredeemed card for as long as it is valid. After that we keep only what that retention obligation requires of us.
Who we share your data with
We do not sell your data and we do not pass it on for advertising. We do rely on a few parties that are needed to make the booking, the site and the bookkeeping work.
Lodgify
Role
Booking system and payment for your stay
What is shared
Your booking and contact details and the payment for your stay. Lodgify is the only place where our calendar and our bookings are kept.
Role
Statistics on website use (Google Analytics 4)
What is shared
Only the statistical data listed above, and only if you have given consent.
Mailchimp
Role
Our newsletter and the welcome guide by email
What is shared
Only your email address and what you ticked, and only if you signed up. Mailchimp is a US service, so your data is processed outside the European Union.
Vercel
Role
Hosting of the website
What is shared
Technical data from server logs, such as the address requested, the time and the IP address the request came from.
Stripe
Role
Payment provider. Today for the payment of your stay through Lodgify, later for the gift card as well.
What is shared
Name, email address and the payment details needed to complete the payment. Full card numbers stay with Stripe and never reach us.
Our accountant
Role
Bookkeeping and tax returns
What is shared
Invoices and payment data, as far as the bookkeeping requires.
Every party that processes data on our behalf should be covered by a data processing agreement. Which ones are already in place, and which still need signing, will be checked before launch.
Data outside the European Union
Some of the parties above may also process data outside the European Union. The GDPR sets requirements for that.
Which safeguards apply per party has not been established yet. That will be done before the site goes live and stated here.
How we protect your data
The website runs entirely over a secure connection. Keys and passwords for connected systems are not in the site's code but in protected environment variables.
The payment for your stay runs through Lodgify, with Stripe as the payment provider; the gift card will run through Stripe directly. Full card numbers never reach us and are stored nowhere on our side.
Access to the booking overview is limited to the people who need it to arrange your stay.
No automated decision-making
We make no decisions about you based on automated processing, and we build no profiles to target you.
Changes to this privacy policy
If the way we handle data changes, we update this text. The date of the current version is stated at the top.
This page will in any case be updated once the policy has been checked by a lawyer and once the gift card goes live.
Your rights
You have a number of rights over your own data. You can exercise them by emailing us. We respond within a month.
- Access
- You may ask which data we hold about you and what we do with it.
- Rectification
- If your data is wrong, we correct it.
- Erasure
- You may ask us to erase your data. What we are legally required to keep, such as invoices, we cannot remove.
- Restriction
- You can ask us to pause the processing, for example while we assess a correction.
- Objection
- You may object to processing based on legitimate interest.
- Portability
- You can request your data in a common file format to take it elsewhere.
- Withdrawing consent
- Consent you gave, for example for the analytics cookies, can be withdrawn at any time. What was measured before that remains lawful.
To avoid handing data to the wrong person, we may ask you for extra information showing that you are who you say you are.
If you disagree with how we handle your data, you can lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch data protection authority.
Questions about your data
A question about this privacy policy or about your own data? Email or call us. We reply as soon as we can.