GDPR Compliance

Last updated: August 2026

Our commitment to GDPR

Zen Utrecht is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR). This page outlines how we comply with GDPR requirements and how you can exercise your rights.

Data controller

Zen Utrecht acts as the data controller for personal information collected through our services and website. We are responsible for deciding how your personal data is processed and for what purposes.

Contact details:
Zen Utrecht
Oudegracht 287
3511 PD Utrecht
Netherlands
Email: [email protected]

Your GDPR rights

Under GDPR, you have the following rights regarding your personal data:

Right to be informed

You have the right to know how we collect, use, and share your personal data. This information is provided in our Privacy Policy.

Right of access

You have the right to request a copy of the personal data we hold about you. We will provide this information free of charge within one month of your request.

Right to rectification

If you believe any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. We will update your information within one month.

Right to erasure

Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, including:

• The data is no longer necessary for the purpose it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Note that we may need to retain certain information for legal or administrative purposes.

Right to restrict processing

You can request that we limit how we use your personal data in certain situations:

• You contest the accuracy of the data
• Processing is unlawful but you prefer restriction over deletion
• We no longer need the data but you need it for legal claims
• You have objected to processing pending verification

Right to data portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transfer it to another controller when:

• Processing is based on your consent or contract performance
• Processing is carried out by automated means

Right to object

You can object to processing of your personal data when:

• Processing is based on legitimate interests
• Processing is for direct marketing purposes
• Processing is for research or statistical purposes

Rights related to automated decision-making

You have the right not to be subject to decisions based solely on automated processing that produces legal or similarly significant effects. We do not currently use automated decision-making or profiling.

How to exercise your rights

To exercise any of your GDPR rights, please contact us at [email protected] with your request. Please include:

• Your full name and contact details
• Clear description of which right you wish to exercise
• Any relevant details to help us locate your information

We will respond to your request within one month. In complex cases, we may extend this period by two additional months, and we will inform you if this is necessary.

Lawful basis for processing

We only process your personal data when we have a lawful basis to do so:

• Consent: You have explicitly agreed to processing for specific purposes
• Contract: Processing is necessary to fulfill our contract with you
• Legal obligation: We must process your data to comply with the law
• Legitimate interests: Processing is necessary for our legitimate business interests, provided your rights do not override these interests

Data protection measures

We implement appropriate technical and organizational measures to ensure data security, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls limiting who can view personal data
• Staff training on data protection
• Secure disposal of data when no longer needed

Data transfers outside the EEA

If we transfer your personal data outside the European Economic Area, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the European Commission
• Transfers to countries with adequacy decisions
• Binding corporate rules

Data breach notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you without undue delay. We will also report the breach to the relevant supervisory authority within 72 hours of becoming aware of it.

Complaints

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a supervisory authority. In the Netherlands, this is:

Autoriteit Persoonsgegevens
Postbus 93374
2509 AJ Den Haag
Netherlands
Website: autoriteitpersoonsgegevens.nl

Updates to GDPR compliance

We regularly review our GDPR compliance procedures. Any significant changes will be communicated through our website and, where appropriate, directly to you.

Questions

If you have questions about our GDPR compliance or how we process your personal data, please contact us at [email protected]