Privacy statement
Which personal data we process, why, how long we keep it and what rights you have.
This is an English translation for your convenience. The Dutch version is legally binding; in case of any difference, the Dutch text prevails.
1. Who we are
The operator of Noirnights.nl is the controller for the processing of personal data via Noirnights.nl. Questions about privacy: privacy@noirnights.nl.
2. Our principles
- Discretion first. Visitors can view the whole platform without an account. We only use statistics via Google Analytics if you choose to; we never use advertising or profiling cookies and we never sell data.
- As little as possible. We only ask for what is needed. We do not ask for an identity document; for the check, a verification photo that only our team sees is enough.
- Special category data only with your explicit consent. A profile on this platform says something about sexual behaviour. We therefore only publish after you have explicitly agreed to this on first use; you can always withdraw that consent by deleting your profile or account.
3. Which data, for what purpose and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Account data: email address, password (encrypted), display name, phone number, account type, company name (agencies) | Running your account, logging in, contact about your account | Performance of the contract |
| Profile content: working name, age, town, photos, videos, description, services, rates, availability | Publication of your listing. Some of this is special category personal data (sexual behaviour) | Your explicit consent (Art. 9(2)(a) GDPR) |
| Verification data: the verification photo and the stated age | Checking age (21+), authenticity and, where necessary, the right to work and reside | Legal obligation and legitimate interest respectively (preventing abuses) |
| IP addresses: when logging in (last known) and when posting a review | Security and recognising and preventing abuse and fake reviews | Legitimate interest |
| Credits, transactions and invoices | Handling payments and our accounting | Contract and legal (tax) obligation |
| Reports, messages to us and reviews | Handling your report or question; moderation | Legitimate interest; partly legal obligation (DSA) |
| Visitor statistics: aggregated daily totals per page, referral and device type | Insight into how the site is used. These contain no personal data: we do not count people or sessions | Legitimate interest |
| Website usage via Google Analytics, only if you choose it: pages visited, device and browser data and a cookie ID | Insight into how the site is used, in order to improve it | Consent; you can always withdraw it via Cookie settings |
| Real-time visitor counter: a one-off hashed key of IP address and browser (with a random salt that changes daily), without cookies | Seeing how many people are on the site right now. The key cannot be traced back to an IP address or person | Legitimate interest |
4. Retention periods
| Data | Retention period |
|---|---|
| Account and profile data | Up to 28 days after the account is deleted or closed |
| Verification photos | As long as the profile exists, then 28 days |
| IP address with a review | As long as the review exists, at most 12 months |
| Last known login IP | Overwritten at every login; deleted 28 days after the account ends |
| Invoices and transactions | 7 years (tax retention obligation) |
| Reports and moderation log | 12 months after handling |
| Visitor statistics (daily totals, no personal data) | 24 months |
| Google Analytics data (only with consent) | At most 14 months |
| Key of the real-time visitor counter | At most 5 minutes after your last page visit |
5. Who we share data with
We never sell data. We only share with parties needed to make the platform work, under data processing agreements where required:
- Hosting: Vimexx, with servers in the Netherlands (storage and processing within the EEA).
- Email delivery: Resend, for account and service emails.
- Statistics: Google (Google Analytics via Google Tag Manager), only if you give consent. Google may also process this data in the United States.
- Payments: our payment provider pay.nl processes your payment; we do not receive account details, only the status of the transaction.
- Authorities: police and judiciary on the basis of a lawful order and on our own initiative when we have information suggesting that someone's life or safety is in danger (Art. 18 DSA), such as in case of signs of exploitation or minors.
6. Security
We secure the platform with, among other things, encrypted connections (https), encrypted passwords, restricted access to admin functions, logging of admin actions and rate limiting on sensitive forms. Verification material is visible only to administrators and is never shown publicly.
7. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. You can withdraw your consent to publication at any time: pause or delete your profile or close your account via your settings; publication then stops immediately.
You can send requests to privacy@noirnights.nl. We respond within 30 days and may ask you to confirm your request from the email address of your account. If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
8. Changes
If this statement changes materially, we inform account holders in advance by email or when they log in. The date at the top is always the version date.