Privacy notice

Last updated 31 October 2026

This notice explains what we collect when you book an evening, join a waitlist, choose who you’d like to see again, leave your email or contact us as a partner. It covers why we collect it, who else handles it, how long we keep it and what you can ask us.

Activity-based dating is run by NNMC. NNMC is responsible for your personal data (the “controller” under the GDPR).

NNMC
[address to be added]
KvK [number to be added]
Email: [contact email to be added]

When you book an evening: your first and last name, email address, phone number, age, the side you book (for mixed evenings: women or men), what you eat, and which contact details a mutual match may receive (email, phone and, if you add it, your Instagram name). We also record when you booked, the status of your seat and your payment.

Allergies: if you tell us about an allergy, that is information about your health. We only use it with your explicit consent, which you give with a separate tick box, and only to prepare your food.

After the evening: whether you attended, the seat you had, and who you ticked as someone you’d like to see again.

If you bought your ticket on another platform: the platform and your order number.

To stop fake sign-ups: a scrambled code made from your network (IP) address, not the address itself. The code changes every day.

When you leave your email for future evenings: your email, and if you fill them in, your city and the activities you’re interested in.

When you contact us as a partner: your name, organisation, contact details and message.

Payments: Mollie handles payments. We see whether a payment succeeded and its reference, never your card or bank details.

When you visit the site: our hosting provider keeps short-lived technical logs, including your IP address, to deliver the site and protect it against abuse. We don’t use analytics, advertising or tracking cookies.

  • To run the evening you booked: holding your seat, the waitlist, planning the room, practical messages such as your confirmation, and afterwards the link to choose who you’d like to see again. Basis: performing our agreement with you (GDPR article 6(1)(b)).
  • To share your chosen contact details with a mutual match, only when you both said yes. This is the service you book. Basis: performing our agreement with you (article 6(1)(b)).
  • To use your allergy details to prepare your food. Basis: your explicit consent (articles 6(1)(a) and 9(2)(a)). You can withdraw it at any time; we then can’t take the allergy into account.
  • To keep your profile for future evenings, only if you ticked that box. Basis: your consent (article 6(1)(a)).
  • To email you about new evenings, if you asked for that. Basis: your consent (article 6(1)(a)).
  • To keep financial records of payments. Basis: legal obligation (article 6(1)(c)).
  • To keep the site secure and prevent fake sign-ups. Basis: our legitimate interest in a working, safe booking process (article 6(1)(f)).
  • To reply to partners who contact us. Basis: our legitimate interest in answering business enquiries (article 6(1)(f)).

We don’t match people on paper or use automated decisions about you. Everyone at an evening meets everyone on the other side.

Some editions may be for a specific community, for example LGBTQ+ evenings. Booking one can reveal your sexual orientation. For those editions we ask for your explicit consent first.

Only our organisers. The person preparing the food sees your food choice and allergy details for that evening. While choosing after the evening, the people you met see your first name, the initial of your last name and the round you met in. The contact details you chose go to another guest only when you both said yes. We never sell your details or share them for marketing.

We use these service providers, who process data on our behalf under a data processing agreement:

  • Vercel – hosts the website.
  • Supabase – stores bookings. Our database is in the EU.
  • Resend – sends emails, from the EU.
  • Mollie – handles payments (Netherlands).

Vercel, Supabase and Resend are US companies. Where they can access data from outside the European Economic Area, this happens under the EU–US Data Privacy Framework or the EU Standard Contractual Clauses.

If you bought your ticket on another platform, that platform’s own privacy notice covers what you gave them.

  • Allergy details: until 7 days after the evening.
  • Who you ticked, and your matches: until 30 days after matches are sent.
  • Booking details: until 90 days after the evening, unless you asked us to keep your profile for future evenings. Then we keep it until you withdraw that consent.
  • Email for future evenings: until you unsubscribe or ask us to delete it.
  • Partner messages: until two years after our last contact.
  • Payment records: seven years, because the law requires it for financial records.

You can ask us to see, correct or delete your details, to limit how we use them, or to give you a copy to take elsewhere. You can object to use based on our legitimate interest, and withdraw any consent at any time. Withdrawing doesn’t affect what we did before. Email [contact email to be added] and we reply within one month.

If you think we handle your details wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens. We’d appreciate the chance to sort it out with you first.

The public site sets no cookies. The only cookie is a login cookie for the organisers’ admin page.

If we change this notice, we update the date at the top. If a change affects what you agreed to, we tell you by email.