Privacy statement: the Mauritshuis
This privacy statement outlines what information we may request from you and explain how we will protect your data. We also want to tell you about your rights and options for managing your personal information and protecting your privacy.
Privacy Statement
Stichting Koninklijk Kabinet van Schilderijen Mauritshuis (Mauritshuis Royal Picture Gallery Foundation), The Hague
1. About this privacy statement
At the Mauritshuis, you will find the finest examples of Dutch painting from the era of Rembrandt and Vermeer. We want to share our knowledge and the stories behind our collection – with you and with many others, both within the museum and beyond. In order to share our stories, we may need to process your personal data.
In this privacy statement, we explain the type of personal data we collect and process, the purposes for doing so, how long we retain this data, the parties we share it with, and what rights you have. We process personal data in accordance with the General Data Protection Regulation and other applicable privacy legislation.
2. Who we are
Stichting Koninklijk Kabinet van Schilderijen Mauritshuis – Mauritshuis Royal Picture Gallery Foundation – (hereinafter: the Mauritshuis) is the data controller responsible for processing your personal data as described in this privacy statement. Our contact details are: Mauritshuis, PO Box 536, 2501 CM The Hague, email: [email protected].
3. The purposes and legal basis for processing your personal data
The Mauritshuis processes data, including personal details that you have provided to us in the course of our services as well as data obtained from other sources, such as CCTV footage on-site and cookies on the website.
In some cases, the provision of personal data is required to execute an agreement with you, for example, when you make a booking or place an order. If you do not provide the necessary data, we may not be able to provide the service in question (in full) or process your request.
Why we process your data, the corresponding categories of data, objectives, legal bases and retention periods, are shown in the table below:
|
Purposes for processing personal data |
Personal data |
Purpose (legal basis) |
Retention period |
|
Ticket sales, processing orders and booking details. |
Name, email address, order and booking details, transaction details. |
Execution of the agreement. |
Up to 2 years after processing, unless longer retention is necessary for disputes or evidence. |
|
Maintaining tax and financial records. |
Invoice details, payment details, transaction details, administrative records. |
Compliance with the statutory obligation to maintain tax records. |
7 years after the end of the financial year in which they were obtained. |
|
Sending newsletters. |
Name, email address, preferences, opt-in status, unsubscribe status, interaction data. |
Consent. |
As long as the data subject remains subscribed. |
|
Responding to enquiries, handling complaints and providing customer service. |
Contact details, emails, contact forms, content of enquiries and complaints. |
Our legitimate interest in being able to answer and fulfil enquiries. |
Up to 2 years after processing, unless longer retention is necessary for disputes or legal proceedings. |
|
Safeguarding visitors, staff, artworks and the building by means of CCTV surveillance. |
CCTV footage. |
Our legitimate interest, namely protecting visitors, staff, artworks and buildings, supporting incident handling and ensuring safety. |
Maximum 72 hours, unless longer retention is necessary in the event of incidents, police reports or claims. |
|
Providing, managing and securing our Wi-Fi network. |
MAC address, IP address, connection times, session logs, technical identification data. |
Legitimate interest or performance of the service. |
Maximum 72 hours, unless longer retention is necessary for incident investigation or abuse detection.
See our Wi-Fi terms and conditions. |
|
Performing technical management, security and optimisation of the website and apps. |
IP address, browser data, device data, date and time, pages visited, referrer URL. |
Our legitimate interest in being able to manage and optimise website visits and server logs. |
14 to 90 days, depending on the type of log and security necessary. |
|
Measuring and improving website and app usage by means of analytical cookies. |
Cookie ID, usage data, session data, statistical information, device and browser data. |
For analytical cookies that affect your privacy: consent. For analytical cookies with no or negligible impact on your privacy: our legitimate interest in analysing the performance of our website and app. |
See our Cookie Policy. |
|
Cookies and consent registration. |
Cookie IDs, consent status, preferences and technical identifiers. |
For marketing cookies: consent. For strictly necessary cookies: our legitimate interest in ensuring the proper functioning of our website. See our Cookie Policy for more information. |
See our Cookie Policy. |
|
Conducting research, evaluations, audience insights and statistics. |
Survey responses, interview data, contact details if provided, segment information. |
Consent provided by the visitor. |
No longer than 5 years. |
|
Conducting audience research, policy analyses and segmentation. |
Postcode, house number, derived target group or segment data. |
The legitimate interest of us and of The Hague & Partners in conducting research and policy analyses relating to our visitors. |
No longer than 3 years after completion of a research report based on the Target Groups Model. |
|
Social media interactions. |
Account name, messages, reactions, contact details where shared |
Our legitimate interest in engaging in public interactions and customer communication. |
As long as necessary for processing; own recorded contact history, preferably no longer than 2 years. |
|
Relationship management, agreement execution performance and procurement from supplier and business contacts. |
Name, job title, business contact details, correspondence. |
Execution of the agreement or compliance with the statutory tax record-keeping obligations. |
During and up to 2 years after the end of the contractual relationship; mandatory administrative records are kept for 7 years if legally required. |
4. With whom we share personal data
Our service providers
We share personal data with third parties when necessary for the performance of our services. This may include providers of hosting, ticketing, payment processing, analysis and communication services, Wi-Fi or security services and other support service providers. These parties receive only the personal data necessary for the provision of their services.
Social networks
Our website and apps may, in certain situations, offer you plug-ins from various social networks. If you choose to interact with a social network, such as Facebook or TikTok, your activities on our website or via our apps will also be made available on that social network. If you are logged in to one of these social networks during your visit to our website or one of our apps, or if you interact via one of the social plug-ins, the social network may – depending on your privacy settings – add this data to your profile on that network. If you wish to prevent your data from being shared in this way, you should log out of your social network before using one of our websites or apps. Where possible, you can also change the privacy settings of the app. Please read the privacy policies of these social networks to learn about how they collect and transfer personal data, what rights you have, and how you can adjust the privacy settings to suit your preferences.
Legal advisers, supervisory authorities and law enforcement agencies
We share personal data with law enforcement agencies where required to by law or legal proceedings, for the purpose of the administration of justice, to protect your interests, with supervisory authorities for the purposes of law enforcement and with our legal advisers to protect and defend our property and legal rights, to ensure the personal safety of users of the Mauritshuis website or (mobile) apps, or when a valid order is issued by a court or law enforcement agency.
The Hague & Partners
For certain audience and policy analyses, we work in partnership with The Hague & Partners. In this context, the postcode and the house number plus any additional details are shared with The Hague & Partners via a special secure environment (File Transfer Protocol). A Data Processing Agreement is in place with The Hague & Partners (the data controller).
The postcode and house number plus street name are used for visitor research. The cultural target groups segmentation model is applied to the data to gain statistical insights into which cultural target groups visit the museum. Research is conducted into the demographic, socio-economic and cultural behaviour of visitors to the municipality of The Hague. Het Publieksonderzoek Cultuursector (the Cultural Sector Audience Survey), which centres on the cultural target groups model, is carried out by The Hague and Partners on behalf of the municipality of The Hague.
The Hague and Partners (data controller) will retain the data for the purposes of the project for no longer than necessary, but in any event for no longer than 3 years after it has concluded its survey report based on the Target Groups Model.
Museum Monitor
The Museum Monitor is distributed via the ‘after-visit email’. It is only received by people who bought a ticket online, and they can decide whether or not to complete it. On completion, all respondents will be assigned an anonymous respondent ID.
In the survey, respondents can provide their age (but are expressly not asked for their date of birth) and/or postcode and house number, plus any additional details. These are not compulsory fields. The information gathered by the Museum Monitor survey is processed by Enalyzer. A data processing agreement has been entered into with Enalyzer (the data controller).
The data from the survey, such as age and/or postcode and house number, is used for visitor research to gain a better understanding of the composition of the audience. This allows for comparisons to be made with other museums affiliated with the Museum Monitor.
Enalyzer (the data controller) will retain the data for the purposes of the Museum Monitor for no longer than is necessary, but in any event for no longer than 5 years.
5. Your rights and contact details
Subject to the limits set by applicable legislation, you have the right to access, rectify and/or erase your personal data, restrict processing, object to processing and request data portability. Below, we describe your rights in more detail and provide information on how you can exercise them.
Access: You have the right to ask us whether we are processing your personal data and, if so, you may request access to your personal data and verify whether we are processing it lawfully. If necessary, you may obtain a copy of the personal data we hold about you. If your request is manifestly unfounded or excessive, we reserve the right to charge a reasonable fee in such circumstances or to refuse your request.
Rectification: You have the right to request us to correct your personal data in the event that these are factually incorrect, incomplete or inaccurate.
Erasure: You have the right to request the erasure or deletion of your personal data. In certain circumstances, we may refuse a request for erasure, for example, where the personal data is necessary for compliance with legal obligations, or in connection with legal claims.
Restriction: You have the right to request us to suspend the processing of certain personal data, for example, if you want us to verify its accuracy or the grounds for its processing.
Data portability: You have the right to request us to transfer personal data processed by technical means, on the basis of consent or the execution of the agreement with us, to you or another party in an easily readable format where this is technically possible.
Objection: You have the right to object to the processing of your personal data where we do so on the basis of our own legitimate interests or those of third parties. However, where there are compelling legitimate grounds that override your interests, rights or freedoms, we may continue to process your personal data. You may always object to processing carried out for the purposes of direct marketing.
Filing a complaint with the supervisory authority: You have the right to file a complaint with the supervisory authority of the country where you live, work or where an alleged infringement has taken place. Here you will find a list of supervisory authorities categorised by EU member state.
If the processing is based on consent, you may withdraw that consent at any time.
To exercise your rights, please contact us at [email protected]. We may ask you for further information to verify your identity. In principle, we will respond to your request within one month; in complex cases, this period may be extended in accordance with the law. If we consider that a request cannot be granted, either in whole or in part, we will explain the reasons to you. Unless otherwise stated in this privacy notice, we do not make any decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
6. Photography and filming
The Mauritshuis regularly commissions photographic and video shoots in the Museum. This material may be used for publicity purposes on the website, in leaflets, etc. By entering the Museum, Visitors agree to the publication of this material. If a Visitor objects to the publication of visual material in which they are recognisable, they may notify the Mauritshuis to this effect. The Mauritshuis will then make every effort to prevent the publication of such material.
7. Cookies, website and Wi-Fi usage
In addition to personal data, the Mauritshuis processes technical data from various sources.
Visiting the website
When you visit our website, we may process technical data such as your IP address, browser details, device information, pages visited and cookies or similar identifiers. For non-essential cookies and similar technologies, we will ask for your consent in advance where required by law. In our cookie policy, we explain, by category, which cookies we use, for what purpose, how long they remain active and how you can adjust your preferences.
When using the guest Wi-Fi network
When you use our guest Wi-Fi network, we may process technical identification and log data as set out in the table above. Please see our website for the full terms and conditions governing the use of our Wi-Fi network.
8. Changes
We may update this privacy statement from time to time. The most recent version will be published on our website, and we will always state the date of the last update.
If a change has a significant impact on the way in which we process your personal data, we will inform you of this in an appropriate manner.
© Mauritshuis, The Hague, September 2026. Subject to modifications.
