July 2026 

Introduction 

90+1 B.V. handles personal data with care. This privacy statement explains which personal data is processed, why this is done, with whom data may be shared, and which rights customers, travellers and website visitors have. 

Controller 

90+1 B.V. is responsible for the processing of personal data as described in this privacy statement. For questions about this processing of personal data, 90+1 B.V. can be contacted. 

Which personal data does 90+1 B.V. process? 

90+1 B.V. processes personal data that is necessary for contact, enquiries, bookings, payments and the performance of trips and ticket-related services. 

This may include: 

– name; 
– address details; 
– e-mail address; 
– telephone number; 
– date of birth; 
– nationality; 
– gender, where required for tickets, travel or local conditions; 
– details of fellow travellers; 
– travel and booking details; 
– ticket, match and product details; 
– payment status and payment method; 
– invoice and administration details; 
– communication by e-mail, telephone, WhatsApp or contact form; 
– any preferences or special details relevant to the trip; 
– identity or travel document details, only where necessary for a specific trip, supplier, accommodation, carrier or local obligation; 
– IP address, cookie data and data relating to website use. 

90+1 B.V. does not process more personal data than necessary. 

Why does 90+1 B.V. process personal data? 

90+1 B.V. processes personal data for: 

– answering questions and enquiries; 
– preparing and sending offers; 
– processing and confirming bookings; 
– organising and carrying out trips and ticket-related services; 
– arranging tickets, accommodation, transport and additional travel or tourist services; 
– processing payments; 
– sending practical travel information; 
– contact before, during and after the trip; 
– customer service, complaints handling and aftercare; 
– administration, invoicing and legal obligations; 
– safety, fraud prevention and website security; 
– improving the website and services; 
– marketing, newsletters or offers, only where consent has been given or where this is legally permitted. 

Legal bases for processing 

90+1 B.V. only processes personal data where there is a valid legal basis for doing so. Depending on the situation, this may be: 

– performance of an agreement or steps prior to entering into an agreement; 
– legal obligations, such as tax administration; 
– legitimate interest, for example for customer service, security, internal administration and improvement of services; 
– consent, for example for newsletters or marketing cookies; 
– protection of vital interests, for example where assistance is required during a trip. 

With whom does 90+1 B.V. share personal data? 

90+1 B.V. only shares personal data where this is necessary for the provision of services, the performance of an agreement or compliance with legal obligations. 

Data may be shared with, for example: 

– clubs, stadiums, ticket platforms or event organisers; 
– hotels, accommodation providers and other places of stay; 
– carriers and local service providers; 
– STO Garant and Stichting Derdengelden Certo Escrow, where the guarantee scheme applies; 
– payment providers; 
– bookkeepers, accountants or administrative service providers; 
– IT, hosting, e-mail and website providers; 
– government authorities or regulators, where legally required. 

90+1 B.V. does not sell personal data to third parties. 

Transfers outside the EEA 

For some trips or services, it may be necessary to share personal data with parties outside the European Economic Area, for example with an accommodation provider, club, carrier or local service provider outside the EU. 

This only takes place where necessary for the performance of the booking or trip, or where another valid legal basis exists. Where required, appropriate safeguards are put in place. 

Retention periods 

90+1 B.V. does not retain personal data for longer than necessary. 

The following principles apply in any event: 

– administrative and tax data is retained for as long as legally required; 
– booking and travel data is retained for as long as necessary for performance, aftercare, complaints handling and administration; 
– contact details relating to enquiries are retained for as long as necessary to handle the enquiry properly; 
– data for newsletters or marketing is retained until consent is withdrawn or the person unsubscribes; 
– technical data and log data are not retained for longer than necessary for the security and functioning of the website. 

Security 

90+1 B.V. takes appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access and unwanted disclosure. 

Only persons or parties that need the data for their work are given access to personal data. 

Cookies 

The website of 90+1 B.V. may use cookies and similar technologies. 

This may include: 

– functional cookies, which are necessary for the website to work properly; 
– analytical cookies, which are used to measure and improve website use; 
– marketing or tracking cookies, only where consent has been given. 

Cookies can be refused or deleted through browser settings or the cookie banner. Tracking cookies are only placed where consent has been given. 

Third-party websites 

The website of 90+1 B.V. may contain links to third-party websites, such as clubs, stadiums, ticket platforms, accommodation providers, carriers or other partners. 

90+1 B.V. is not responsible for the way in which these third parties handle personal data. The privacy policies of those parties apply. 

Rights 

Everyone whose personal data is processed by 90+1 B.V. has certain rights under the GDPR. These include the right to: 

– access personal data; 
– have personal data corrected; 
– have personal data deleted; 
– object to processing; 
– restrict processing; 
– transfer data; 
– withdraw previously given consent. 

A request can be submitted via contact. 

90+1 B.V. will respond as soon as possible, and in any event within one month. If a request is complex, this period may be extended in accordance with the GDPR. 

Filing a complaint 

Anyone who believes that 90+1 B.V. does not handle personal data properly may contact 90+1 B.V. 

In addition, there is a right to lodge a complaint with the Dutch Data Protection Authority. 

Changes 

90+1 B.V. may amend this privacy statement. The most recent version will always be available on the website.