Privacy Policy

‍CRUISE WITH US B.V.

Version October 6, 2026 — applies to www.cruisewithus.nl, www.msdejordaan.nl, and all our cruises

Download the privacy policy as a PDF

‍

In a nutshell

• Cruise With Us B.V. is responsible for your personal information, even if you book through MS de Jordaan or one of our other ships.
• We use your information to process your reservation, to ensure safety on board, for our records, and—only if you choose—for newsletters and marketing.
• We use information about allergies and disabilities solely to ensure your safety and provide you with the best possible care, and only with your consent.
• We will only use recognizable photos or videos of you for marketing purposes if you give your prior consent.
• We never sell your information.
• You can always ask what information we have about you and have it corrected or deleted: info@cruisewithus.nl.

‍

1. Who We Are

Cruise With Us B.V., Danzigerkade 40, 1013 AP Amsterdam, Chamber of Commerce No. 55826326, is the data controller for the personal data described in this privacy policy. MS de Jordaan is a brand of Cruise With Us; we operate the ships Prins van Oranje, MS De Jordaan, Soeverein, and Valentijn.

Questions and requests regarding privacy: info@cruisewithus.nl or 020 774 27 64. We do not have a data protection officer.

‍

2. What data we process, for what purposes, and on what legal basis

2.1 Reservations, Tickets, and Gift Certificates

• Data: name, email address, phone number, billing address, booking details (cruise, date, number of people, price), payment details (payment status and payment method—no full card numbers), and for business customers, the company name, Chamber of Commerce number, VAT number, and contact person. For gift cards, also the recipient’s name, if you provide it.
• Purpose: to finalize and process your reservation, send you a confirmation and practical information, and handle payments, cancellations, rebookings, and withdrawals.
• Legal basis: performance of the contract (Article 6(1)(b) of the GDPR).

2.2 Fellow Passengers

If you are booking for a group, we may process the names and number of your guests to the extent necessary for the cruise and safety. Legal basis: performance of the contract and our legitimate interest in ensuring a safe cruise (Article 6(1)(b) and (f) of the GDPR). You must inform your guests about this privacy policy (Article 14.2 of our Terms and Conditions).

2.3 Allergies, Dietary Preferences, and Restrictions

• Information: allergies, food intolerances, and any information regarding a disability or mobility issue that you provide to us.
• Purpose: To serve safe and appropriate meals and to welcome you and your guests aboard.
• Legal Basis: This information constitutes health data. We process it only with your explicit consent (Article 9(2)(a) of the GDPR), which you provide by sharing it with us. We use it only for the specific cruise, share it only with the kitchen staff and crew who need it, and delete it no later than 30 days after the cruise.

If, as the primary booker, you provide information about your guests’ allergies or disabilities, you are responsible for ensuring that they consent to this. Please provide this information anonymously whenever possible (for example, “2 people with a nut allergy”); we will only need a name if it is absolutely necessary for safety or seating arrangements. We treat dietary preferences without a medical basis (such as vegetarian) as standard booking information.

2.4 Quotes and Contact

• Information: what you enter in a contact or quote form, or what you email or tell us.
• Purpose: to answer your question, prepare a quote, and follow up.
• Legal basis: actions taken at your request prior to entering into a contract (Art. 6(1)(b) of the GDPR), or our legitimate interest in answering questions (subparagraph (f)).

2.5 Cancellation and Complaints

• Information: what you enter on the cancellation form or in a complaint, plus the date and time of receipt.
• Purpose: to process your cancellation or complaint and to be able to demonstrate that we received it and when.
• Legal basis: legal obligation (Art. 6(1)(c) of the GDPR) and performance of the contract (subparagraph (b)).

2.6 Newsletter and Marketing

• Data: name, email address, your preferences, and whether and when you open an email or click on a link.
• Purpose: To keep you informed about cruises, events, and special offers.
• Legal basis: your consent (Art. 6(1)(a) of the GDPR). If you are already a customer, we may also email you about similar cruises we offer without separate consent, based on our legitimate interest (subparagraph (f) and Art. 11.7 of the Telecommunications Act). If you do not wish to receive these emails, you can indicate this when booking; you can also unsubscribe from each email with a single click.

2.7 Photos and Videos on Board

• We create and use atmospheric images in which individuals are not individually recognizable based on our legitimate interest (Article 6(1)(f) of the GDPR).
• We use recognizable images for marketing purposes (website, social media, printed materials) only if you provide separate and explicit consent in advance (Art. 6(1)(a) of the GDPR). For children under the age of 16, we request consent from a parent or legal guardian. You can withdraw your consent at any time by emailing info@cruisewithus.nl or by speaking with the crew; we will then remove the images from our own channels and will not use them again. Withholding consent will not affect your participation.

2.8 Onboard Cameras

All of our ships are equipped with cameras, both inside and outside.

• Purpose: to ensure the safety of passengers and crew, and to prevent and document damage, theft, and incidents.
• Legal basis: our legitimate interest (Article 6(1)(f) of the GDPR). We have determined that this interest outweighs the infringement on your privacy, because the cameras are directed only at the ship itself and are never installed in restrooms or other areas where you may expect a special degree of privacy. The outdoor cameras are directed at the deck, the boarding and disembarking areas, and the section of the pier immediately adjacent to the ship where passengers board and disembark. We do not point them into public areas any further than is necessary for that purpose.
• You'll recognize this: Cameras on board are marked with signs.
• Retention: Footage is automatically deleted or overwritten after a maximum of 4 weeks, unless we need it to resolve an incident; in that case, we retain it until the matter is resolved.
• Provider: The camera system is provided and managed by Verisure, which acts as our data processor. When an alarm is triggered, Verisure’s monitoring center can view the footage related to that alarm.
• Access: Only our operations team can view the footage. In the event of an incident, we may share the footage with the police or an insurance company.

2.9 Website Visits and Cookies

We use cookies and similar technologies on our websites. We always set functional cookies; we set analytical and marketing cookies only with your consent, which we request and record via CookieFirst. With your consent, we use services from Google and Meta to measure how our websites are used and to improve and better tailor our advertisements. In doing so, Google and Meta may process data in the United States; both are certified under the EU-U.S. Data Privacy Framework. You can always withdraw or modify your consent via the cookie settings at the bottom of the website. You can read more about this in our cookie policy.

2.10 Job Applications

• Information: what you send us when you apply for a job, such as your resume, cover letter, and contact information.
• Purpose: to review your application.
• Legal basis: steps taken at your request prior to a potential employment contract (Art. 6(1)(b) of the GDPR). We retain your data for up to 4 weeks after the conclusion of the process, or for 1 year if you give your consent.

2.11 Administration

We retain invoices, payments, and the data required for these purposes because tax law requires us to do so (Art. 6(1)(c) of the GDPR).

‍

3. Who We Share Data With

We do not sell your data. We only share it with parties that help us provide our services, and only to the extent necessary. We enter into a data processing agreement with data processors.

• FareHarbor (FareHarbor B.V.) — Booking system, tickets, gift cards — U.S. (Amazon Web Services), data transfer based on standard contractual clauses
• Stripe — Payments and Refunds — EU and U.S., data transfers based on the EU-U.S. Data Privacy Framework
• Gifty (Gifty B.V.) — Sale of MS de Jordaan gift cards — Netherlands
• Exact Online — Accounting and Billing — Netherlands/EU
• n8n — Integration between the booking system and accounting — EU
• MailBlue (ActiveCampaign) — Newsletters and Email — EU
• Jotform — Cancellation and Other Web Forms — EU (Germany)
• Webflow — Hosting for our websites — U.S.
• CookieFirst — Recording Cookie Consent — Netherlands
• Microsoft 365 — Email and Office Software — EU (EU Data Boundary)
• Verisure — Video Surveillance and Video Storage — Netherlands

In addition, we may share information with:

• Our sister companies that own the ships, to the extent necessary for the operation of the shipping service. They do not use the data for their own purposes.
• Partners that you engage through us or that are part of a package, such as a performer or a caterer, will only receive the information they need to fulfill their part of the agreement.
• Sales platforms and intermediaries through which you make your reservations. They are responsible for their own processing.
• Government and police, if required by law or in the event of an incident on board.

‍

4. Data Outside the European Economic Area

Some suppliers store data in the United States or transfer it there. This applies to our booking system, FareHarbor (which runs on Amazon Web Services servers in the U.S.), to payment processing by Stripe, and to the hosting of our websites by Webflow. We only transfer data if appropriate safeguards are in place: the recipient is certified under the EU-U.S. Data Privacy Framework, such as Stripe, or Standard Contractual Clauses from the European Commission have been agreed upon, as is the case with FareHarbor. Upon request, we will inform you which safeguard applies.

‍

5. How Long We Retain Data

• Reservation data — 2 years after the cruise, after which it is deleted or anonymized; data that is part of the financial records: 7 years
• Invoices and financial records — 7 years (tax retention requirement)
• Allergies and Information About Disabilities — 30 days after the cruise
• Quotes that do not result in a booking — 1 year after the last contact date
• Cancellations — 1 year in our forms system; we retain the acknowledgment of receipt and the processing details for 2 years in our records
• Complaints — 2 years after resolution
• Newsletter — Until you unsubscribe
• Camera footage — Up to 4 weeks, except in the event of an incident
• Recognizable photos and videos for marketing — Until you withdraw your consent
• Job Applications — 4 weeks after the process, or 1 year with consent

‍

6. Security

We take appropriate technical and organizational measures to protect your data against loss and unauthorized use. These include secure connections, access limited to employees who need the data, and strong passwords with two-factor authentication. If a data breach does occur, we will report it to the Dutch Data Protection Authority within 72 hours, if required, and notify you if necessary.

‍

7. Your Rights

You have the right to:

• view your information;
• to have incorrect information corrected;
• to have your data deleted, unless we are required to retain it, for example, for tax purposes;
• to have the processing restricted;
• to object to processing based on our legitimate interest, and always to direct marketing;
• to receive your data in a commonly used file format or to have it transferred to another party;
• to withdraw your consent; this takes effect immediately and is not retroactive.

Please send your request to info@cruisewithus.nl. We will respond within one month. To prevent us from disclosing information to the wrong person, we may ask you to verify your identity; we will only request a copy of your ID if there is no other option.

If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (www.autoriteitpersoonsgegevens.nl). We would prefer to hear from you first so that we can resolve the issue.

‍

8. Automated Decision-Making

We do not make decisions about you that are based solely on automated processing and that significantly affect you.

‍

9. Changes

We may update this privacy policy, for example, in response to new legislation or if we begin using a new service or supplier. The current version, dated, is always available at www.cruisewithus.nl and www.msdejordaan.nl. We will notify you of any significant changes.

‍

10. Contact

Cruise With Us B.V.

Danzigerkade 40, 1013 AP Amsterdam

info@cruisewithus.nl · 020 774 27 64

‍