SearchLog in

Privacy policy

Golfbaanzoeker is the data controller for the personal data processed through this site. Questions or requests about your data can be sent to [email protected].

This policy describes exactly what happens in our database and our code — not generic legal boilerplate, but an honest description of the actual practice.

What data we collect

  • You visit the site without an account: The map view runs entirely on our own server, so nothing is sent to another party there. We do log a click when you press a booking link (see "booking clicks" below).
  • You create an account: We store your email address, your name, a hash of your password and your language preference. When you log in you get a session cookie; the database stores a hash of that session token, how long the session is valid, and your browser’s user agent. If you use features such as favourites, a list of played courses or price alerts, we link that data (which club, which date, which threshold price) to your account.
  • You submit a review: We store your rating, any sub-scores, your text and (optionally) the date you played, linked to your account. Important: the name on your account is shown publicly next to your review — reviews are not anonymous.
  • You submit a club claim: In addition to your account data, we store the business email address you provide, and optionally your role and a note, so we can assess whether you may manage that club.
  • You report incorrect club information: We store your report text and the golf club it concerns. You do not need an account, and we do not store a name, email address or IP address with the report.

Why we use this data

Account data, sessions, reviews, favourites, played rounds, price alerts and club claims are processed to deliver the feature you asked for: without this data, logging in, submitting a review or setting a price alert simply would not work. That is the "performance of a contract" basis.

Booking clicks (which club, which provider, your user id if you are logged in, and the page you came from) are logged on the basis of legitimate interest: we want to know whether referrals to booking partners actually convert, without building an extensive profile of individual visitors.

We process reports about incorrect club information and the security checks around them on the basis of legitimate interest: we want to show reliable information and protect the public form against automated abuse. We do not use tracking or advertising cookies that would require consent.

Cookies

We set two cookies, both functional. Because we do not use tracking or advertising cookies, we do not show a cookie banner.

  • gbz_sessie — keeps you logged in, is valid for 30 days and is only readable by the server (httpOnly), not by scripts on the page.
  • gbz-admin-thema — remembers whether a club manager uses the dark appearance of the admin panel, is valid for 1 year and is only sent on /admin pages.

We do not use Google Analytics or similar trackers.

How long we keep data

For some data the retention period is fixed in code: a session automatically expires after 30 days and a password reset link after 60 minutes; expired sessions and reset links are cleaned up automatically on a schedule.

For the rest — your account data, reviews, favourites, played rounds, price alerts, club claims, correction reports and logged booking clicks — there is currently no fixed retention period. We would rather be honest about that than invent a period with no basis. You can delete reviews, favourites, rounds and price alerts yourself via "My Golfbaanzoeker". To delete your whole account, email us at [email protected]; we currently handle that manually, there is no self-service button for it yet.

Sharing with third parties

  • Mail provider: email (such as a password reset link or a price alert) is sent through an SMTP provider that we configure ourselves. Without a configured provider, the site sends no mail in production; the message stays marked "failed" in our own queue.
  • Hosting: the site and the database run at our hosting provider.
  • Place search: our servers send what you type in the place field to the public PDOK location service from the Dutch Cadastre. Your browser does not share your IP address with PDOK.
  • Map providers: none. The map uses map data we host ourselves (OpenStreetMap data via Protomaps), so your browser does not connect to any other party for it. If you follow the directions link on a course page to Google Maps or Apple Maps, you leave our site and their terms apply.
  • Cloudflare Turnstile: when you use the correction report form, Cloudflare uses limited browser and connection signals to assess whether the submission is likely made by a person. Our server sends the single-use verification token and your IP address to Cloudflare to validate the token. Cloudflare describes this processing in its Turnstile Privacy Addendum.
  • Booking partners: clicking a booking link sends you on to the club, GOLFGO or Greenfee365. We log which club, which provider, your user id (if logged in) and the page you came from, to measure whether that converts. What happens with your visit at the booking partner is covered by their own privacy policy.

Your rights

You have the right to access your data, to have it corrected or deleted, to object to processing based on legitimate interest, and to receive your data in a portable form. Email [email protected] to exercise these rights.

If you disagree with how we handle your data, you can file a complaint with the Dutch data protection authority (Autoriteit Persoonsgegevens). autoriteitpersoonsgegevens.nl.

Security

We never store passwords in readable form: they are hashed with scrypt. For session tokens and password reset links, the database only stores a hash, never the link or code itself — if the database leaks, there is nothing usable in it. Traffic to the site runs over HTTPS.

Last updated: August 5, 2026