Everyone is welcome at the Van Gogh Museum, to be inspired by Vincent van Gogh and his contemporaries. In some cases, we require information about you linked to your upcoming visit. For example, if you order a ticket online, book a guided tour or order an item in our webstore. It goes without saying that we handle your personal data with the greatest possible care. After all, this concerns your privacy. Read on for more information about our privacy policy and how we use your data.
The Van Gogh Museum
This privacy statement applies to:
Van Gogh Museum Foundation formerly Rijksmuseum Vincent van Gogh/Rijksmuseum H.W. Mesdag;
In all instances where ‘Van Gogh Museum’, 'the museum' or 'we' is mentioned, the information applies to this party.
The Van Gogh Museum limits processing personal data to an absolute minimum. However, it will always require certain personal data, such as for the provision of all products and services offered by the museum. For example, the webstore and online ticket shop request certain personal data: this data is required in order to supply the ordered products or services correctly. There are also other instances when we require your personal data. Such as when you book a guided tour or online event, subscribe to our email communication, apply for a job at the museum or when you want to support us by making a donation.
Your personal data is handled with the utmost care. In principle, this data will not be supplied to third parties, unless this is necessary for the service in question, or if we are legally obliged to do so. We do our utmost to ensure that this data is secured to the best of our ability and also impose this obligation on all our processors.
Personal data will be stored for the shortest possible length of time (see article 7). We take legal retention periods that apply to certain data into consideration.
We only process personal is we have a have a legitimate interest or a legal obligation to do so or if you yourself have given permission (directly or indirectly). As the owner of your personal data, you can also withdraw this permission and have your personal data erased (see article 15).
The Kiefer exhibition is a joint production of the Stedelijk Museum Amsterdam and the Van Gogh Museum. The personal data of visitors to this exhibition are processed and shared jointly by the Stedelijk Museum Amsterdam and the Van Gogh Museum. Both museums are joint controllers and therefore both responsible for your personal data. This applies both to visitors who visit one of the exhibition locations and visitors who visit both locations.
Therefore, both the Privacy Statement of the Stedelijk Museum Amsterdam and the Privacy Statement of the Van Gogh Museum. The museums have jointly determined their responsibilities in conformity with applicable privacy regulations. In both privacy statements, you can read more on how both museums process personal data and how they keep data safe. If you have any questions about the processing of your personal data collected in relation to this exhibition, please contact Stedelijk Museum or contact Van Gogh Museum.
Personal data is understood to be: All data concerning an identified or identifiable natural person. This means that information directly relates to someone or can be traced to this person. Data relating to the deceased or organisations is not considered to be personal data.
Processing is understood to mean all actions carried out with regard to personal data, both digital and on paper. For example, collecting, recording, categorising, storing, editing, amending, requesting, consulting, using, forwarding, distributing, combining, linking, protecting, erasing and destroying personal data, as well as making it available.
We may process the following personal data:
Museum visit
- CCTV recordings are made inside and outside the museum for security purposes. These recordings are used to help us safeguard the safety and security of visitors, staff and the artworks to the best of our ability.
- During events such as Vincent on Friday, the opening of a new exhibition, the purchase of a new artwork, etc. we make photographs or videos. These images are being used to report and give an impression of these events. We will not ask your consent for these images, because these images are made in the context of the freedom of press. As mentioned in the Dutch Uitvoeringswet AVG (UAVG) in case of freedom of press consent is not necessary. In case you don’t want to be photographed, please inform the photographer, so he/she can take this in account. If we take pictures of a minor or a incapacitated person, we will always ask consent of a legal designated representative.
- We will ask consent for all other images we make inside or outside of the museum.
Website visit
Various services are offered on our website. Visitors to the website can purchase an admission ticket for the museum or an online event or Van Gogh merchandise. You can also book a guided tour, audio tour or workshop. You can use the website to support our museum, subscribe to our email communication or ask us to look into whether you are the owner of a work by Van Gogh. We ask you to provide personal data in all of these cases, in order to handle your purchase, request or question as best we can.
Counting cameras are used in the museum. These cameras convert images directly into numbers. We do this to be able to spread visitors throughout the museum and for the safety of visitors and employees. No images are saved.
We use cookies, analytics and other technologies on our websites and in our apps. These all help us to ensure that the websites and apps work properly and to collect data that helps us to improve the websites. This data is anonymised whenever possible and is not supplied to third parties. This concerns the websites vangoghmuseum.nl, tickets.vangoghmuseum.nl, vangoghmuseumshop.com, demesdagcollectie.nl, unravel.vangogh.com and ontrafel.vangogh.nl. More information about cookies and how we use them is available in our cookie policy.
On our websites, we request the following personal data:
Webstore, online tickets, email communication, application and contact forms
If you use our services, shop online in our webstore, would like to stay up to date on our activities or to follow us via social media, and have entered certain relevant personal data, we can process the following personal data supplied by you:
- first and last name;
- address information (for the webstore);
- domicile;
- first and last name;
- date of birth (only for online tickets);
- address information (for the webstore and online tickets);
- country information;
- telephone number (for the webstore and online tickets);
- mobile phone number (if you pay with a credit card);
- email address;
- language preference (for email communications);
- other information voluntarily provided by the visitor to the website and/or for which the visitor has given explicit permission for it to be processed, e.g. as part of research or to stay up to date on activities in and around the museum;
- IP address, when you complete and sent an application or contact forms.
Credit card payments
If you pay with your credit card, your mobile phone number will be requested so we can send you a verification code. Providing your mobile telephone number and this additional verification is intended to prevent payment fraud, entrance ticket scams and money laundering through the resale of entrance tickets. We do not store this telephone number neither does the processor (the payment provider).
Personal data ‘country’ and ‘residence’
The personal data ‘country’ and ‘residence’ of museum visitors will also be anonymized and then further processed for analysis purposes.
Online programmes or activities
- first and last name;
- email address;
- nickname;
- your image (if you have your camera on during an interactive session);
- your voice or comments (if you participate in a discussion or ask questions during the event).
With regard to your image, voice or comments, this information is only used in the privacy of the group and classrooms and will not be shared with third parties.
We may use online platforms such as YouTube, that may process your personal data. In that case the rules of the relevant platform apply to the processing of your personal data.
Benefactors
Sunflower Circle, Theo van Gogh Circle, Yellow House Circle If you are a member of one of these circles, we process the following personal data about you:
‐ first and last name; ‐ address data; ‐ residence; ‐ country; ‐ telephone number; ‐ bank account number; ‐ e-mail address; ‐ date of birth (not mandatory); ‐ if applicable: information required to deduct your donation in your income tax return; ‐ the relevant circle of which you are a member.
More information about privacy and the donation processed via Adyen can be found in the Circle members privacy statement, which is part of the Van Gogh Museum Circle Members General Terms and Conditions.
Sponsors
With regard to sponsors of the Van Gogh Museum, the following personal data is processed:
- first and last name of contact;
- email address of contact;
- telephone number of contact.
Authentication requests
Do you own a painting, drawing, letter or print that you think might be the work of Vincent van Gogh? Then you could submit an authentication request via an authorized person.
In order to process this application, we need a number of personal details from both the applicant (the owner) and the authorized representative (the person who submits the request on behalf of the applicant).
This is why the following personal data can be processed:
- sex (applicant + authorized representative);
- function (authorized representative);
- first and last name (applicant + authorized representative);
- address information (applicant);
- country information (applicant);
- email address (applicant + authorized representative);
- signature (applicant + authorized representative);
- language preference (applicant + authorized representative);
- date of birth (applicant);
- place of birth (applicant);
- country of birth (applicant).
More information about privacy and authentication can be found in the Terms and Conditions for Authentication and the Terms and Conditions for Registration as a authorized representative and Acting as a authorized representative for Authentication.
Guided tour, workshop or other museum activities
With regard to visitors who book a guided tour or other museum activity (by telephone, email or via the website), the following personal data can be processed:
- first and last name of the person booking the activity or who is acting as the contact;
- address information; telephone number;
- email address;
- language preference;
- country information (only for workshops);
- in the case of children, in addition to the data relating to the parent/carer, the first name and age of the child(ren) is also requested;
- other information supplied voluntarily;
- your IP address that is automatically added when you complete and submit a form on the website.
Requesting images for commercial usage
If natural persons request images, this privacy statement applies. In order to be able to assess and handle image requests, including payment, the following personal data is processed:
- sex;
- language preference;
- first and last name;
- address information;
- country information;
- telephone number;
- email address;
- VAT number.
Events and venue hire for companies
If you want to organize an exclusive guided tour after closing hours or organize an exclusive dinner, buffet of reception surrounded by Van Gogh’s masterpieces, we can process the following personal data:
- first and last name of contact;
- email address of contact;
- telephone number of contact.
Contact
When you submit an enquiry via a contact form or submit a request for a call back, we can process (besides the company data) the following personal data:
- first and last name (of contact);
- email address (of contact);
- some cases sex;
- telephone number (if you requested telephone contact);
- your question, complaint or request;
- other details you give us.
Research
We regularly conduct research in order to help us improve the quality of our websites and apps. This research is usually conducted anonymously. In the case of research requiring the processing of personal data, we do not request more personal data than is strictly necessary. We also ask for explicit permission to process this data.
Van Gogh at School
This part of our website features free digital lessons for primary and secondary schools. These lessons can be stored and edited in LessonUp. If you choose to store a lesson, you are redirected to a screen where you can register for LessonUp by entering your name and email address. The LessonUp privacy statement applies to this data.
Collection information
For research purposes we register the owners of the collection of Vincent van Gogh. We keep this record in order to make transparent who the owners are of artwork of Vincent van Gogh. For this purpose the following personal data is processed:
- first and last name;
- telephone number;
- email address;
- address information, including postal code and country; date of birth;
- date of death (if applicable).
Apply for a job at the museum
If you apply for a job at the museum, we can process the following personal data supplied by you:
- first and last name;
- address information;
- telephone number;
- email address;
- CV;
- motivation.
Competitions
In order to participate in one of the competitions via one of our websites or the web shop and to receive your prize as a winner, personal data is processed. We do this on the basis of permission. What personal data this is, how long it will be kept and what it will be used for can be read in the terms and conditions of the relevant competition.
Other relations
Personal data of other relations are registered in one of our relationship management or registration systems, in our visitor information system, in our billing system or in our contract registration and may contain various personal data. We keep in contact with these relations by sending them information about our museum and our activities, invite them for events, have contact about art borrowing or lending, the cooperation or purchased services, payments, visits to our museum or office location and other contact moments.
The following personal data can be processed:
- first and last name;
- function;
- (private or business) address information;
- (private or business) telephone number;
- (private or business) email address;
- in some cases a passport photo (if you have given consent);
- in some cases date of birth (if you have given consent);
- in some cases information you provide us in a conversation;
- time of visit to the museum or our office;
- payment or claim;
- bank details;
- agreements.
Interest Profiles
For every visitor who purchases a ticket for the museum or an online activity, makes a purchase in the webshop, makes a donation, subscribes to a newsletter, or establishes any other form of relationship with the museum, an interest profile is automatically created and stored. This profile is stored in a separate environment by a processor with whom the museum has entered into a data processing agreement.
The interest profile may contain the following personal data:
- identification number
- first and last name
- address (webshop customers)
- city
- country
- email address
- language preference
- date of museum visit
- newsletter opt-in
- click behavior in the museum's newsletters
- other information you have voluntarily provided
The Van Gogh Museum has a legitimate interest in processing this data. It is used to create anonymized overviews for analysis purposes:
- to improve our products and services;
- to better understand our visitors and relationships;
- to send information and/or offers to our visitors and relationships that match their interests.
For the personal data for which you have given consent and for the personal data regarding city, country, and language preference: this personal data will be retained until you withdraw your consent. You can withdraw your consent via the link in the newsletter or by emailing: info@vangoghmuseum.nl.
For the other personal data in these profiles: personal data of Dutch visitors is retained for 26 months, and of foreign visitors for 12 months. After these periods, the personal data will be deleted from the profiles, and empty profiles will be discarded.
Personal data is only processed if:
- it is required in order to fulfil an agreement;
- the owner has given explicit, unequivocal permission for us to do so;
- there is a justified interest for the Van Gogh Museum (e.g. analytical purposes, security or direct marketing);
- processing the data is necessary in order to comply with a legal obligation.
The Van Gogh Museum processes personal data:
- to help us to carry out your order, authentication request or visual material request, or deal with your request for a workshop, venue hire, guided tour or other (online) museum activity;
- so that we can get in touch with you if issues are encountered/questions arise regarding the implementation of the agreement;
- so that we can get in touch with you in the case that there are urgent changes that impact the date or time upon which you have booked your museum visit, guided tour or workshop;
- to help us ensure that your visit to the museum is as enjoyable as possible;
- to provide you with the service that is important to us, such as sending you information or a welcome message before you visit our museum
- to help us safeguard the safety and security of visitors, staff and our artworks;
- so that we can offer the guided tour, workshop or other service in the desired language;
- so that we can properly tailor the content of children’s workshops to the participating children, we ask for the age of the children;
- if you would like to offer the museum a donation;
- so that we can request payment for the museum activity provided or so that we can accept the donation/gift;
- so we are able to organize exhibitions in the museum (in collaboration with or with the help of other parties);
- so that we can address you in your preferred language;
- so that we can deal with your job application;
- if you have requested information from us;
- so that we can invite you to events;
- so we can answer your questions or deal with your complaint, through social media, email, by regular mail of by telephone;
- so Sharingbox will be able to sent you the picture you made with the photo booth;
- so that you can participate in a giveaway and win a prize;
- to congratulate you on your birthday;
- to have insight of all our relations and our complete network in order to improve our fundraising, which is important for the continued existence of our museum;
- for purposes of analysis that will help us to improve the service we offer, in which case the data will be anonymised wherever possible;
- if you have given permission for your data to be processed. For example, if you would like to be kept up to date on our events and developments at our museum, for research purposes or to help us improve our services.
- to be able to analyze the origin of visitors with anonymized reports and thus, together with the city of Amsterdam, to better regulate tourism flows within the city;
- to be able to test, on the basis of anonymized reports, whether the objectives in the field of inclusivity and sustainability are being achieved by the museum;
- to provide the Ministry of Education, Culture and Science (in Dutch “OCW”) at their request with anonymized reports about visitors and their origin.
We supply third parties with personal data if this is required for technical reasons (e.g. in the case that we do not have the required technology in-house), or due to (legal) obligations.
In such cases, we employ the services of a specialised third party to carry out the agreed activities or to fulfil an agreement or sales contract. This third party also processes the personal data. Examples include providing the delivery service with address information so that they are able to deliver items ordered in the webstore to the correct address, or a specialised party that ensures that your admission ticket is delivered to your inbox.
In such cases, we will employ the services of a third party who satisfies our safety norms and privacy guidelines. We make clear agreements with this party regarding handling personal data with care. The Van Gogh Museum is, and remains (also in such a case), responsible for the processing of the data.
We may also be required to make a declaration or report a crime, e.g. in the case of fraud. The police, judiciary, watchdogs and/or the Tax Office may request data from us on legal grounds. A judge also has the power to oblige us to provide data. In all of these cases, we are required to supply the necessary personal data to third parties.
Personal data will not be stored for longer than is strictly required in order to realise the purpose for which the data was collected. In some cases, we are bound by a legal retention period. In case your personal data cannot be deleted for technical reasons, your data will be anonymized whenever possible.
Job applicants’ data is deleted or destroyed 4 weeks after a recruitment procedure is completed or stopped, unless it has been agreed with the applicant that their data will be kept on file. In the case of the latter, we will store the data for a maximum of 1 additional year.
With regard to the booking of tickets, guided tours or other live events in the museum, all personal data required for these bookings will be stored for a maximum of one year after you made the booking.
With regard to online events or activities that are organized by the museum, all data necessary for bookings of these events will be stored for a maximum of one year after you made booking. The personal data processed during the event itself will be stored for a maximum period of two years. For online events we use third parties such as You Tube. The retention period of these parties concerning the personal data they process can be found in their privacy statement.
If you contact us, via the contact form on our website, by e-mail (info@vangoghmuseum.nl) or by telephone, we will process your personal data in our CRM system, in order to handle your question, complaint or request as good as possible. This data will be anonymised after a maximum of one year.
Personal data of our benefactors or sponsors will be kept their for a maximum of three years after the agreement has ended or has been cancellation or after the last donation, unless the law obliges us to keep the data for longer. When a donation is cancelled, we will ask whether the personal data should be deleted or whether the person in question would like to stay up to date on the museum’s activities (whether they would like to remain on our records as a museum relation), of course, with the exception of the personal data that we are legally obliged to keep.
For private circle members, we keep their personal data for a maximum of three (3) years after the expiry of the (periodic) agreement or a separate donation, unless the law requires us to keep the data for longer.
In the case of an authentication request, we store the personal data indefinitely. This is because this data is used for scientific and/or historical research. The Van Gogh Museum determines when this data is no longer required, at which time it will be deleted.
If you have subscribed to receive our email communication (such as newsletters) or have indicated that you would like to be added to our records as a museum relation, we process your data until such time as you indicate that you would no longer like to receive our email communication or would like to be deleted from our records. To unsubscribe from our newsletter, you can also click ‘Unsubscribe’ in the header or footer of our newsletter. All data collected in relation to the provision of our products and/or services will be deleted as soon as possible after the transaction has been completed in full, unless it is necessary to keep it longer due to a legal obligation. For customers who have created a profile in our web shop, they can manage this themselves and delete the personal data themselves, this data is not automatically deleted by us.
We store personal data from relations that visit our museum regularly, such as schools, until they ask us to delete these personal data.
In case of events that are not booked via the tickets page on our website we store personal data with a maximum of four weeks after the event. Images made during events are stored in our digital archive and is, for press purposes, stored and used for an indefinite period of time.
All visual material that is made during specific events, such as “Vincent op Vrijdag”, the opening of a new exhibition, the announcement of new purchases, etc., and that has news value for us, is stored indefinitely in our digital image archive and will be used for an indefinite period of time. Reason for this is that processing of these personal data falls under the legal exception of the journalistic exception.
Personal data is only shared with third parties if this is required to fulfil an agreement or contract entered into with you, to comply with legal obligations or to cooperate with investigations being conducted by the police or other authorities. See also article 6.
Your personal data will be processed and stored within the European Union as much as possible.
In some cases it is necessary for us to transfer personal data outside of the European Economic Area (EEA), to countries that guarantee an adequate level of protection and are on the list of the Dutch Data Protection Authority (AP). Very sporadically, if there really is no other option, we transfer personal data to a country that is not on this list. In that case, we perform a transfer impact analysis on this country and take extra measures to protect the personal data, such as but not limited to encryption.
For purposes of security, the museum uses CCTV surveillance both inside and outside of the museum. It goes without saying that we handle the recordings with care. They are not shared with third parties unless the police or other authorities request them. Recordings are stored for a maximum of 4 weeks, unless this data is required as part of investigations being conducted by the police or other authorities.
For purposes of security, the museum also uses CCTV surveillance both inside and outside of our office building and our personnel entrance of the museum. Recordings are stored for a maximum of 4 weeks and are not shared with third parties unless the police or other authorities request them.
At the museum you can use our free Wi-Fi service. As a result of offering the Wi-Fi service, we may receive information that could be used to identify you or the device you are using. For example, your MAC address or unique means of identification, such as a name or number assigned to a device. This data is not stored or shared with third parties.
The Van Gogh Museum makes extensive use of social media to inspire you with our artworks, to keep you up to date on our activities, to share news about the museum with you, to offer online activities or events and to give you a glimpse behind the scenes. We also use social media to respond to your questions and comments. You can follow us on Facebook, Twitter, Instagram, YouTube, Pinterest and LinkedIn. If you use these social media platforms, you have agreed to the terms & conditions of the social media platform in question.
We place advertisements for our exhibitions and other activities on social media. We show you advertisements based on the data that the social media platform collects with your permission, e.g. that you follow us, your age, where you live or that you are interested in art.
The Van Gogh Museum does not have any influence on the personal data that the different social media platforms collect about you. They are themselves responsible for complying with the law. More information about how the platform handles your data can often be found in the terms & conditions of the social media platform you use or in their privacy statement. You can also often manage these privacy preferences in the settings in your social media profile.
The Van Gogh Museum uses Google Analytics to gain insight into how visitors use their websites. We use the information to help us improve the websites.
The data cannot be traced back to individual people. Read more about the Google privacy policy.
We have taken the following measures to protect your privacy:
-
We have signed a data processing agreement with Google.
-
We have turned off the ‘share data with Google’ option.
-
Google Analytics cookies are not used in combination with other Google services.
-
The last three numbers of your IP address have been deleted, meaning it is anonymised.
On our websites we use cookies to ensure that the websites work properly, to analyse how the websites are used and to show you advertisements tailored to your interests and how you use the internet. More information is available in our cookie policy.
- If you have subscribed to our newsletter and would like to cancel your subscription, you can do so by clicking on the ‘Unsubscribe’ hyperlink in the footer of the email communication. Alternatively, email your request to newsletter@vangoghmuseum.nl.
- If you are under the impression that we process your personal data unlawful or improper, you can request a restriction on the processing of your personal data by the Van Gogh Museum.
- You have the right to request what personal data we process about you. If your personal data we hold is incorrect, you have the right to request to have any inaccuracies corrected.
- You can withdraw your consent at any time for future processing by us of your personal data. In case of images we need to know at what date the images is made, at what event and we need a clear description of the image. If possible attach the image to your request. If we grant your request the image will not be used for future processing. Because of the legal journalistic exception this option does not apply to visual material that falls under this exception.
- You have the right to request to transfer your personal data to another company. We will grant this request to the extent that this (data portability) is technically possible.
- You have the right to object to the processing of your personal data. If you do so, we will stop processing your personal data, unless our urgent justified grounds outweigh your interests. In that case we will inform you about it.
- You have the right to be forgotten. After you request, your personal data will be deleted as soon as possible, unless we are not able to do so because of legislation. Due to technical reasons it is not always possible to delete personal data. In that case we will anonymize your personal data whenever possible.
Any request about your personal data must be made in writing to:
Van Gogh Museum
Privacy Officer
P.O Box 75366
1070 AJ Amsterdam
The Netherlands
Or sent by email to info@vangoghmuseum.nl.
We will respond to your request as soon as possible, and within 4 weeks at the latest.
If we are not possible to grant your request we will let you know with reasons. In order to prevent abuse, we might ask you for identification, by sending us a copy of your identification.
If you believe that we do not handle your personal data with care or responded to your request seriously, you have the right to file a complaint with the supervisory authority Autoriteit Persoonsgegevens (Dutch DPA).
The Van Gogh Museum will always do its utmost to secure your personal data optimal and according to the latest technology and expects the same from its processors. Our aim is to prevent misuse or loss of data, as well as unauthorised access, unwanted publication or unlawful adjustments. Our websites use a secure SSL Certificate, to ensure that your personal data does not fall into the wrong hands.
If you nevertheless get the impression that your data is not properly secured or that there are signs of misuse, or if you would like to receive more information about how your personal data is secured, contact us by sending an email to info@vangoghmuseum.nl.
The Van Gogh Museum reserves the right to make changes, additions or adjustments to its privacy statement.
This privacy policy is adjusted on 19 December 2024.
Have you managed to discover a vulnerability in one of the systems of the Van Gogh Museum? If so, please inform us per e-mail at CVD@vangoghmuseum.nl. Submitting this type of report is known as Coordinated Vulnerability Disclosure (CVD).