Tickets
Home / Legal & Privacy / Privacy Statement
GDPR & Dutch AVG Compliant

Privacy Statement

We want your visit to Efteling to be a wondrous escape from everyday life. Treating your personal data with utmost security, transparency, and care is integral to our hospitality.

Data Protection Officer privacy@efteling.com

1 Who Are We?

We are Efteling B.V., the largest theme park destination in the Netherlands, located at Europalaan 1, 5171 KW Kaatsheuvel, registered with the Dutch Chamber of Commerce (KvK) under number 18034444. Efteling B.V. acts as the Data Controller under the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Dutch Implementation Act (UAVG).

2 What Personal Data Do We Collect & Why?

Theme Park Tickets & Annual Passes

Name, email, date of birth, photo (for Annual Pass subscription cards), and transaction records to deliver valid scannable turnstile barcodes and fulfill purchase contracts.

Hotel & Holiday Village Accommodations

Guest contact information, party size, dietary requirements for dining packages, vehicle registration for automated boom barrier entry, and legal tourist tax night register compliance.

Official Efteling Mobile App & Boarding Passes

Real-time GPS coordinates while inside park boundaries (only with explicit device location permissions) to show live distance to attractions and enable Boarding Pass virtual queue call-outs. Location data is never stored permanently on our servers.

On-Ride Photography & CCTV Security

Automatic high-speed photos taken during roller coaster drops (Baron 1898, Python, Joris en de Draak). Unpurchased ride photos are permanently deleted within 48 hours. CCTV cameras monitor security perimeters, crowd safety, and lost children; footage is retained for a maximum of 30 days unless required for police investigation.

3 Legal Grounds for Processing

We process your data strictly under the lawful bases defined in Article 6 of the GDPR:

  • Performance of a Contract (Art. 6(1)(b)): Issuing tickets, fulfilling hotel stays, processing restaurant reservations.
  • Legal Obligation (Art. 6(1)(c)): Municipal night register reporting, tax and invoicing records.
  • Legitimate Interest (Art. 6(1)(f)): Park security, fraud prevention, IT systems safety, queue analytics.
  • Consent (Art. 6(1)(a)): Newsletter subscriptions, analytical and marketing cookies.

4 Your Rights as a Guest

Under the GDPR, you possess full sovereignty over your personal records:

Right to Access (Art. 15) Request a complete copy of all data Efteling holds regarding your profile.
Right to Rectification (Art. 16) Correct any outdated or inaccurate address or email details.
Right to Erasure (Art. 17) Request complete deletion of your Efteling Account and marketing history.
Right to Portability (Art. 20) Receive your visit records and wishlist in machine-readable JSON format.

To exercise any of these rights, contact our Data Protection Officer at privacy@efteling.com. We respond within 30 days without charge.

5 Coordinated Vulnerability Disclosure

At Efteling, the security of our digital systems is paramount. If you discover a vulnerability or security flaw in any of our web services or mobile APIs, we warmly invite you to report it to cert@efteling.com under our responsible disclosure guidelines. We pledge not to initiate legal action against ethical researchers who respect user privacy and allow reasonable time for remediation.