We are an independent ticket reseller and booking intermediary for selected Amsterdam experiences.
We are not the official venue operator unless explicitly stated.
Prices may be higher than the official venue price because they can include booking and service fees.
Availability is not guaranteed until your booking voucher has been issued by email.
Privacy Policy
Amsterdam Museum Tours | ZOYO Travel B.V.
Last updated: 23 March 2026
ZOYO Travel B.V. (“we”, “us”, “our”), operating Amsterdam Museum Tours, is committed to protecting your privacy and handling your personal data in full compliance with the General Data Protection Regulation (GDPR) and applicable Dutch law.
This Privacy Policy explains what personal data we collect when you visit www.amsmuseumtours.com, submit a booking request, or interact with our advertising, and how we use, store, and protect that data.
By using our Website or submitting a booking request you acknowledge that you have read and understood this Policy.
The data controller responsible for your personal data is:
ZOYO Travel B.V.
Herengracht 584, 1017 CJ, Amsterdam, The Netherlands
KVK: 89633741
Email: [email protected]
Phone: +31 20 700 83 00
3.1 Data You Provide Directly
When you submit a booking request or contact us we collect:
• Full name
• Email address
• Phone number (optional)
• Tour preferences, date, and number of participants
• Any additional information you provide in the message field (e.g. accessibility needs)
3.2 Data Collected Automatically
When you visit our Website our systems and third-party tools automatically collect:
• IP address and approximate geographic location
• Browser type and version
• Operating system
• Pages visited, time spent, and referral source
• Device type and screen resolution
• Cookies and similar tracking technologies (see Section 6)
3.3 Data from Advertising Platforms
If you arrive at our Website via a Google Ads advertisement, Google may share aggregated and anonymised conversion data with us. We do not receive your name or email address from Google as a result of clicking an ad.
We process your personal data for the following purposes and on the following legal bases:
Purpose | Legal Basis
• Processing and managing your booking request — Performance of a contract (Art. 6(1)(b) GDPR)
• Responding to enquiries and providing customer support — Legitimate interest (Art. 6(1)(f) GDPR)
• Sending a payment link and issuing booking confirmation vouchers — Performance of a contract (Art. 6(1)(b) GDPR)
• Sending transactional emails related to your booking (changes, cancellations, reminders) — Performance of a contract (Art. 6(1)(b) GDPR)
• Sending promotional communications and newsletters — Your consent (Art. 6(1)(a) GDPR) — you may unsubscribe at any time
• Analysing Website usage to improve our services and user experience — Legitimate interest (Art. 6(1)(f) GDPR)
• Measuring the effectiveness of our Google Ads campaigns — Legitimate interest / Consent via cookie banner
• Complying with legal obligations (e.g. tax records) — Legal obligation (Art. 6(1)(c) GDPR)
We do not sell, rent, or trade your personal data. We share your data only in the following circumstances:
5.1 Service Providers
We use carefully selected third-party processors who act on our instructions and are bound by data processing agreements:
• Payment processor — to securely transmit your payment link and process transactions (we never receive or store your full card details)
• Email delivery provider — to send booking confirmations and transactional emails
• Website hosting provider — to operate and maintain the Website
• Google LLC — for website analytics (Google Analytics) and advertising measurement (Google Ads); see Section 6
5.2 Tour Operators and Venues
Where your booking involves a third-party venue or tour operator (e.g. a museum or canal cruise provider), we will share the minimum data necessary (name, group size, date) to fulfil your booking.
5.3 Legal Requirements
We may disclose your data when required by law, court order, or regulatory authority, or to protect the rights, property, or safety of ZOYO Travel B.V., our customers, or the public.
5.4 International Transfers
Some of our service providers (including Google) operate outside the European Economic Area (EEA). Where data is transferred outside the EEA we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission or equivalent mechanisms under GDPR Chapter V.
6.1 What Are Cookies?
Cookies are small text files stored on your device when you visit a website. We use cookies and similar technologies (pixel tags, web beacons) to operate our Website, analyse usage, and deliver relevant advertising.
6.2 Cookies We Use
Strictly Necessary Cookies
These cookies are essential for the Website to function. They cannot be disabled.
• Session cookies for login/authentication functionality
• Security cookies to prevent cross-site request forgery
Analytics Cookies
We use Google Analytics to understand how visitors interact with our Website. Google Analytics collects data such as pages visited, session duration, and traffic sources. This data is aggregated and anonymised. We have enabled IP anonymisation.
• Cookie: _ga, _gid, _gat (Google Analytics)
Advertising and Remarketing Cookies
We use Google Ads (including Google Tag Manager and the Google Ads conversion tracking tag) to measure the effectiveness of our advertising campaigns and to show relevant ads to users who have previously visited our Website (remarketing).
• Cookie: _gcl_au (Google Ads conversion linker)
• Cookie: IDE, DSID (DoubleClick/Google Display Network)
These cookies may collect information about your browsing behaviour across websites to provide you with personalised advertisements. You can opt out of personalised advertising via the Google Ads Settings page (see Section 6.4).
Preference Cookies
These cookies remember your preferences such as language and currency selection to improve your experience.
6.3 Managing Cookies
When you first visit our Website you will be presented with a cookie consent banner. You may accept or decline non-essential cookies at any time. You can also manage or delete cookies through your browser settings; please refer to your browser’s help documentation for instructions.
Please note that disabling certain cookies may affect the functionality of our Website.
6.4 Opting Out of Personalised Advertising
You can opt out of Google’s personalised advertising at any time using the following resources:
Google Ads Settings — myaccount.google.com/data-and-privacy
Google Analytics Opt-out Browser Add-on
Your Online Choices (EU) — youronlinechoices.eu
We retain your personal data only for as long as necessary for the purposes described in this Policy:
• Booking and transaction records — 7 years (Dutch statutory accounting requirement)
• Customer enquiry correspondence — 2 years after the last interaction
• Marketing consent records — until you withdraw consent, plus 1 year
• Analytics data — 26 months (Google Analytics default, configured by us)
After the applicable retention period your data is securely deleted or anonymised.
As a data subject you have the following rights. To exercise any of them, please contact us at [email protected].
• Right of access — you may request a copy of the personal data we hold about you
• Right to rectification — you may ask us to correct inaccurate or incomplete data
• Right to erasure — you may ask us to delete your data where there is no legitimate reason for continued processing
• Right to restrict processing — you may ask us to suspend processing of your data in certain circumstances
• Right to data portability — you may request your data in a structured, machine-readable format
• Right to object — you may object to processing based on legitimate interest, including for direct marketing purposes
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):
autoriteitpersoonsgegevens.nl
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration, including:
• SSL/TLS encryption for all data transmitted between your browser and our Website
• PCI DSS-compliant payment processing — we never store full card numbers
• Access controls limiting who within our organisation can access personal data
• Regular security reviews and staff training
Although we take all reasonable steps to protect your data, no internet transmission is completely secure. If you have concerns about a data breach, please contact us immediately.
Our Website may contain links to third-party websites (for example, official museum websites or payment providers). This Privacy Policy applies only to our Website. We are not responsible for the privacy practices of third-party sites and encourage you to review their policies before providing any personal data.
Our services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by posting the updated Policy on this page with a revised “Last Updated” date. We encourage you to review this page periodically.
Your continued use of our Website following any changes constitutes acceptance of the updated Policy.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
ZOYO Travel B.V.
Herengracht 584, 1017 CJ, Amsterdam, The Netherlands
Email: [email protected]
Phone: +31 20 700 83 00
Business Hours: Monday–Friday, 09:00–17:00
Saturday 10:00 — 16:00
We aim to respond to all privacy-related enquiries within 30 days.
© 2026 ZOYO Travel B.V. All rights reserved.
