Privacy statement

Bernardus Privacy Statement

Bernardus attaches great importance to the protection of your personal data. In this Privacy Statement we aim to provide clear and transparent information about how we handle personal data.

Bernardus records the personal data of all members, employees and our suppliers. We also use a website, social media, including LinkedIn, Facebook, Instagram and Twitter and a newsletter program named Spotler.

We safeguard your privacy and handle your personal data with care. Bernardus complies in all cases with the applicable laws and regulations, including the General Data Protection Regulation. This includes the following:

• We will ask your prior consent to process your personal information, unless the data is necessary for the creation of a contract, we are legally obliged to do so, or if we have a legitimate interest in doing so.

• We process personal data in accordance with the purpose for which they were provided or obtained, or a purpose compatible therewith. These purposes and types of personal data are described in this Privacy Statement.

• Processing of personal data is limited to the data that are necessary for the purposes for which they are processed.

• We do not retain personal data longer than necessary for the purpose for which they were collected, unless there is a legal obligation to retain them;

• We have taken appropriate technical and organizational measures to ensure the security of personal data;

• We only pass on personal data to other parties if this is necessary for the purposes for which the data were provided;

• We are aware of the rights regarding personal data, want to point them out to you and respect them.

As Bernardus, we are responsible for the processing of personal data. For we qualify as a controller. If, after reviewing our Privacy Statement, or in a more general sense, you have any questions about this or wish to contact us, you can do so via the contact details at the bottom of this document.

Processing of personal data of members, customers or suppliers

We process personal data for the following purposes:

• Keeping and maintaining the required membership records in the Golf Management System;

• Classification into the right membership category (Corporate Member, Private Member, Business Member and Day Member);
• Processing competition data and results and keeping the handicap registration in Golf Genius;

• Providing information about the start time;

• Exchanging data with the Netherlands Golf Federation (NGF) for the purpose of membership of the NGF;

• Inclusion in the financial administration, including the accounting program Exact;

• Providing information about and sending invitations to matches and/or other club activities and sending invoices;

• Our newsletter intended to provide information, but every now and then with a commercial angle;

• Executing a (membership) agreement and the services provided by Bernardus, such as hotel accommodation, the organization of business and other events and the use of gym/massage facilities
• Maintaining member statistics on golf performance and for optimal course distribution;

• Providing access to partners and/or children of the members;

• Complying with statutory obligations such as injunctions for the detection and prosecution of criminal offences. Bernardus may also transfer personal data to authorities in order to protect its rights and property.

For the above purposes Bernardus may request the following (personal) data:

• First name and initials, prefix and surname;

• Maiden name;

• Address;

• Town/city;

• Date of birth;

• (Business) telephone number(s), landline and mobile;

• (Business) email address;
• Gender;

• Date and place of birth;

• NGF number;

• Nationality;

• WHS-handicap;

• Passport photo;

• Company name;

• Name of partner and children (under 24);

• Credit card or bank details;

The basis for the processing of these personal data is the execution of a (membership) agreement, consent or a legitimate interest. For the processing of these data Bernardus uses the Golf Management System.

It is possible that Bernardus will make photographs and videos during training, events, matches and tournaments, in which members may be recognisable. This processing will be based on your consent, or on a legitimate interest of Bernardus, such as to report on these events and to advertise new events. You always have the right to object to these processing operations.

In order to guarantee the safety of Bernardus' visitors, Bernardus uses camera images. To this end, there is a legitimate interest of Bernardus because of the purpose described above. So you may be filmed when you visit Bernardus. This is clearly indicated on the course. These camera images are saved for a maximum of four weeks after the recording in question was made, unless there is an incident. In this case, the relevant images are kept until the incident is settled.

In order to offer members an optimal playing experience, Bernardus uses Tagmarshal (www.tagmarshal.com), a renowned system used on leading golf courses. Members can use a "Tagmarshal device", which provides insight into where members are located on the golf course so Bernardus can find out where a member who has placed an order is and deliver the order directly to the right person. Also, in the long run, the flow in the course can be improved to avoid unnecessary waiting. With the non-anonymized statistics we collect, we can improve our services for the benefit of our members. The collected data can be permanently stored and analysed under a pseudonym. The basis for the processing of these personal data is the consent of the data subject and a legitimate interest of Bernardus. You always have the right to object to this. For this we refer to the heading "Data rights"

Provision of data to third parties

We may provide the information you provide to us to third parties if this is necessary for the purposes described above.

For example, we use a third party for:

• The exchange of the required (handicap) data with the NGF;

• Communication to members and tournament participants via text message and Social Media, such as Facebook, Instagram and Twitter;

• Reservations at Noble Kitchen and the (gym/massage) facilities at Bernardus;

• Reservations at Bernardus Lodge;

• The use of the Tagmarshal system;

• The use of cloud services for all data via Golf Genius.

If these third parties only process personal data on our instructions, we will conclude a processing agreement with these processors. Of course, we make the necessary arrangements to guarantee the security of personal data.

Furthermore, we will not provide the information you provide to other parties, unless required by law. An example of this is that the police request personal or other data from us as part of an investigation. In such a case, we must cooperate and are therefore obliged to provide these data. We may also share personal data with third parties if you give us your written consent, this is necessary for the execution of an agreement or we have a legitimate interest in this.

If some parties are located outside the European Union, the transfer of personal data is based on an adequacy decision of the European Commission, appropriate or suitable guarantees have been put in place with these parties, or the transfer fulfils one of the conditions set out in Article 49 of the General Data Protection Regulation. You can access these guarantees at any time by sending us an email to that effect.

Retention period

Bernardus will not retain personal data longer than necessary for the purpose for which they were provided, or as required by law. For example, we will delete the data of former members two years after they cancel their membership.

Security

We have taken appropriate technical and organizational measures to protect personal data against unlawful processing, for example the following measures:

• All persons who can read the data on behalf of Bernardus are bound by the obligation of confidentiality and have been informed about the importance of the protection of personal data.

• We have a user name and password policy on all our systems;

• We pseudonymise and encrypt personal data if necessary;

• We make backups of the personal data in order to be able to restore them in the event of physical or technical incidents;

• We regularly test and evaluate our measures;

• Bernardus employees have been informed about the importance of protecting your personal data.

Cookies

When you use the website, certain information, such as IP address, browser type and operating system, may passively be collected and stored on our server logs or those of our service providers. We also use cookies and navigation data such as Uniform Resource Locators (URL) to collect information about the date and time of your visit and the solutions and information you were looking for and viewed. This type of information is collected to increase the usefulness of our services and to better tailor the website to your specific interests and wishes.

In this context, we place various cookies from the Google Analytics service of Google to view certain information about your visit to the website. For example, visitor numbers, popular pages and topics. It is also possible that these cookies link a unique ID to your visit. In this way Bernardus can better tailor the communication of the website to the needs of the website visitors. More specifically, Bernardus places the following analytical or tracking cookies:

Bernardus will request the necessary permission to read these cookies prior to the placement of these cookies by means of a cookie banner.

You can at any time, through the settings of your browser, automatically refuse or delete cookies.

Data rights

You have the right to request access to the personal data processed by or on behalf of Bernardus. You also have the right to request correction and, under certain circumstances, deletion of your data.

As a member you have access to your personal data via a personal login code. You can ensure the accuracy of your data yourself.

You can also object to the processing of personal data (or a part thereof) by us, or by one of our processors. You also have the right to have us transfer the data provided by you to you or, on your instructions, directly to another party. We may ask you to identify yourself before we can comply with the above requests.

If we are allowed to process personal data on the basis of consent given by you, you always have the right to withdraw this consent.

We will respond to your request within one month at the latest. Depending on the number of requests and their complexity, we may extend this period by another two months, about which we will also inform you. If we reject your request for whatever reason, we will inform you of these reasons.

Complaints

If you have a complaint about the processing of personal data, please contact us directly. We will, of course, regret it if we cannot find a solution together. You always have the right to lodge a complaint with the Dutch Data Protection Authority, which is the supervisory authority in the field of privacy protection.

Questions

If you have any questions or comments about our Privacy Statement, please contact us.

Contact details:

Bernardus Golf
Deutersestraat 39D
5266 AW Cromvoirt
+31 (0)73 203 41 41
info@bernardus.com