Privacy Statement Bajes
Last updated: September 7, 2026
Bajes is a venue in the former Bijlmerbajes prison in Amsterdam Zuidoost. To run that place we process personal data: from people who sign up for our mail, buy a ticket, visit the building, or rent space from us. This statement explains which data that is, why we use it, how long we keep it, and what you can do about it.
We write this in plain language. Where we use a legal term, we explain it.
1. Who is responsible
Bajes Events B.V. HJE Wenckebachweg 48, 1096 AN Amsterdam, the Netherlands Chamber of Commerce (KvK): 99851121 VAT: NL869159495B01 E-mail for privacy questions: info@bajes.amsterdam
Bajes Events B.V. is the data controller. That means we decide which data is processed and for what purpose, and that you can come to us with questions and requests.
We do not have a data protection officer. An organisation of our size is not required to appoint one. Your privacy questions arrive at the address above and are handled within one month.
2. What this statement covers
Our website, our mailing list, our ticket sales, your visit to our venue, and rentals and business contacts.
If you attend an event at our venue that someone else organises, that organiser processes its own visitor data under its own privacy statement. We remain responsible for what happens in and around the building, such as camera surveillance.
3. What we process, why, and for how long
3.1 Our mailing list
What: your e-mail address, and your name if you fill it in. Plus the moment you signed up and the proof of your confirmation, and whether you open our mails and what you click.
Why: to tell you what is happening at Bajes, and to see whether our mails get read so we can send fewer and better ones.
Legal basis: your consent. You sign up yourself and confirm through a mail we send you (double opt-in). Without that confirmation we do not add you.
How long: until you unsubscribe. After that we only keep your e-mail address on a suppression list, so we do not accidentally mail you again, and the proof of your original sign-up for as long as we need it to demonstrate that you consented.
Unsubscribing: there is a link at the bottom of every mail. One click, no questions, no reason needed.
Who sees it: Mailchimp, our mail provider. See section 4.
3.2 Our website
What: your IP address, which device and browser you use, which pages you view, how long you stay, and which link brought you here.
Why: to make the site work and keep it secure, and to see what people look at so we can improve it.
Legal basis: for the data needed to run and secure the site: our legitimate interest. For statistics and advertising cookies: your consent, which you give through the cookie notice.
Cookies: we use three kinds.
Necessary. Make the site work and keep it safe. Always on, no consent required.
Statistics. Google Analytics, which we use to measure visitor numbers and behaviour. Off until you consent.
Advertising. The Meta pixel, which lets us see whether our ads on Instagram and Facebook work and lets us reach people who already visited our site. Off until you consent.
You can change or withdraw your choice at any time through the cookie settings at the bottom of every page. If you refuse, the site works normally and we measure nothing.
How long: Google Analytics retains the data for fourteen months. Our own cookies and the Google Analytics cookie expire after at most six months. The Meta pixel cookie has a lifetime set by Meta. The cookie table lists the exact lifetime per cookie.
3.3 Tickets
What: your name, e-mail address, order details and payment details. For events with an age limit, your date of birth as well.
Why: to deliver your ticket, to reach you if an event changes or is cancelled, to keep our books, and to prevent fraud and resale.
Legal basis: performance of the contract you enter into with us or with the ticketing partner. For our administration: our legal obligation.
Who sees it: our ticketing partner Celebratix B.V. in Amsterdam handles the sale on our behalf. For events by external organisers, ticket sales may run through their own partner.
How long: data that belongs to our administration is kept for seven years, because Dutch tax law requires it. Data that does not belong there is deleted sooner, at the latest 24 months after the event.
3.4 Your visit to the building
Camera surveillance. There are cameras in and around the building, in the places where they are needed for the safety of visitors and staff and to prevent damage and theft. Signs indicate where we film.
Legal basis: our legitimate interest in the safety of everyone in the building. We have assessed that no less intrusive means is available to us, and we do not film more than necessary.
How long: seven days. In the event of an incident we keep the relevant footage longer, until the matter is settled.
Who sees it: our security staff and the responsible employees. In the event of an incident or a crime we may share footage with the police.
We do not use facial recognition.
Age checks. At the door we look at your ID if that is required for the age limit or for selling alcohol. We only look. We do not copy, scan or record anything.
Legal basis: our legal obligation under the Dutch Alcohol Act and the conditions of our licence.
Refusal of entry. If someone seriously breaches the house rules, we can refuse them entry and record that, so our security staff can act on the decision.
What we record: your name, the date, the reason in one line and how long the ban lasts. Nothing more.
Legal basis: our legitimate interest in safety inside the building. Without this record our security staff cannot act on the decision, and no less intrusive means is available to us.
What we do not do: we do not record criminal-law data, and we do not share the record with other venues, clubs or a collective hospitality ban scheme. It is an internal list.
How long: for as long as the ban lasts, and no longer than one year. After that we delete the record.
What you can do: we will tell you that it has been recorded. You can request the record and object to it at info@bajes.amsterdam.
Photos and video. Photos and video are taken at our events, for our own archive and for our own channels and advertising. We do not go looking for close-ups of people who would rather not be filmed.
Legal basis: our legitimate interest in showing what happens at our venue.
Objecting: if you are in an image and would rather not be, mail us and we will take it down. You can also tell the photographer on site straight away.
3.5 Rentals and business contacts
What: your name, company, role, phone number and e-mail address, and whatever you tell us about your request.
Why: to answer your request, to arrange a meeting or a contract, and to keep our books.
Legal basis: performance of the contract, or our legitimate interest in business contact where no contract came about.
How long: if it becomes a booking, seven years because of the statutory bookkeeping obligation. If nothing comes of it, we delete your request after 24 months.
3.6 Working at Bajes
What: whatever you send us when you apply or register as a member of staff: your details, your CV and your motivation.
Why: to handle your application.
Legal basis: your consent, and the preparation of an employment contract.
How long: until four weeks after the procedure closes. If we would like to keep your details longer in case something comes up later, we ask you separately, and then it is a maximum of one year.
4. Who else sees your data
We do not sell your data. We only pass it to parties that need it to do something for us, or where we are legally required to.
The parties that work for us:
Party
What for
Branch
Mailchimp (Intuit)
Our mailing list
United States
Google Analytics
Website statistics
United States, with EU institutions
Meta (Instagram, Facebook)
Our advertisements
United States
Celebratix B.V.
Ticket sales
Netherlands
Sanity
Our content system, which hosts the site
European Union (Frankfurt)
Vercel
Website hosting
Servers in the European Union (Frankfurt), worldwide content network
Our security guard and our accountant
Safety and administration
Netherlands
We have a data processing agreement with all of these parties, stating that they may only use your data on our behalf.
Data outside Europe. Mailchimp, Google, Meta and Vercel are American companies. Where they process data in the United States, this takes place on the basis of the European Commission's adequacy decision for the United States, the EU-US Data Privacy Framework, for parties certified under it. Where a party is not certified, we use the European Commission's standard contractual clauses. The same rule applies if a supplier processes data elsewhere outside the European Economic Area.
5. How we secure your data
We take the measures you may expect from us. Only the people who need data for their work have access to it. Connections to our site are encrypted. Our accounts are protected with two-factor authentication. Camera footage is accessible only to security staff and the responsible employees.
If something goes wrong anyway and you are at risk because of it, we will tell you, and we will report it to the Dutch Data Protection Authority.
6. What you can do
You have the following rights. Mail us at info@bajes.amsterdam and you will hear from us within one month.
Access. You may ask which data we hold about you.
Correction. If something is wrong, we will fix it.
Deletion. You may ask us to erase your data. Sometimes we are not allowed to, for instance for records Dutch tax law requires us to keep for seven years. In that case we say so, with the reason.
Restriction. You may ask us to pause the use of your data, for example while we look into a correction.
Objection. Where we process on the basis of our legitimate interest, such as camera surveillance, refusal of entry or photos of an event, you may object.
Portability. Data you gave us yourself, you can receive from us in a common file format.
Withdrawing consent. If you gave consent, you may withdraw it at any time. That works forward, not backward.
To avoid handing data to the wrong person, we may ask you to send your request from the e-mail address we have on file.
Complaints. If you are unhappy with how we handle your data or your request, tell us and we will sort it out. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.
7. Changes
Bajes is a place under development and this statement develops with it. The date at the top says when we last changed it. If something material changes in what we do with your data, we will say so by mail or on the site.