GDPR Information

Last updated: August 14, 2026

Your Data Protection Rights

Under the General Data Protection Regulation, you have specific rights regarding your personal data. Het Theehuis is committed to facilitating the exercise of these rights.

Right to Access

You have the right to request access to the personal data we hold about you. This includes:

• Confirmation of whether we process your personal data
• Access to your personal data
• Information about the purposes of processing
• Categories of personal data concerned
• Recipients or categories of recipients
• Retention period or criteria used to determine it

We will provide this information free of charge within one month of your request.

Right to Rectification

If you believe any personal data we hold about you is inaccurate or incomplete, you have the right to request correction or completion of that data. We will respond to such requests within one month.

Right to Erasure

Also known as the "right to be forgotten," you may request deletion of your personal data under certain circumstances:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent on which processing is based
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Erasure is required for compliance with legal obligations

This right is not absolute and may be limited by our legal obligations to retain certain information.

Right to Restriction of Processing

You have the right to request restriction of processing in the following situations:

• You contest the accuracy of the data during verification
• Processing is unlawful but you oppose erasure
• We no longer need the data but you require it for legal claims
• You have objected to processing pending verification of legitimate grounds

Right to Data Portability

Where processing is based on consent or contract performance and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format. You also have the right to request direct transmission of this data to another controller where technically feasible.

Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes. Upon receiving an objection, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

How to Exercise Your Rights

To exercise any of these rights, please contact us at:

Email: info@garnet-nebula.cyou
Subject line: "GDPR Request"

We will verify your identity before processing your request and respond within one month. In complex cases, this period may be extended by two additional months with notification.

Right to Lodge a Complaint

If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with the relevant supervisory authority:

Autoriteit Persoonsgegevens
Bezuidenhoutseweg 30
2594 AV Den Haag
Netherlands
Website: autoriteitpersoonsgegevens.nl

Data Controller Information

The data controller responsible for your personal data is:

Het Theehuis
Keizersgracht 482
1017 EG Amsterdam
Netherlands
Email: info@garnet-nebula.cyou

International Data Transfers

We do not transfer your personal data outside the European Economic Area. Should this become necessary in the future, we will ensure appropriate safeguards are in place and inform you accordingly.

Data Breach Notification

In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, providing information about the nature of the breach, likely consequences, and measures taken or proposed to address it.