Our privacy
statement

This privacy statement explains which personal data Falcon Carwash processes when you wash with us, have a subscription or wash card, wash with us as a business or contact us. It also explains how long we keep data and what rights you have.

The controller is Falcon Carwash B.V., trading as Falcon Carwash, located at Javastraat 12, 3016 CE Rotterdam, the Netherlands, registered with the Chamber of Commerce (KvK) under number 61272809 ("Falcon", "we").

Send questions about privacy or a request about your data to info@falconcarwash.nl or by post to the address above. Falcon does not have a data protection officer.

We only process the data needed for the service you use, for safety at our locations or because the law requires it. We do not process special categories of personal data, such as health data.

Washing and paying at a location
Data: amount, date, time and location of the payment, the type of payment method and part of the card number; with Pay after Use also the reserved amount.
Purpose: processing the payment, releasing the reservation, refunding in the event of a malfunction.
Legal basis: performance of the agreement.

Subscription
Data: name, address, email address, telephone number, licence plate, vehicle height, chosen location and programme, IBAN and mandate details, washes (date, time, location).
Purpose: taking out and performing the subscription, collecting the monthly amount, recognising your vehicle at the roll-over, processing cancellation or withdrawal.
Legal basis: performance of the agreement.

Subscription: fair use
Data: washes per licence plate.
Purpose: checking that the subscription is used as agreed and preventing misuse.
Legal basis: legitimate interest: preventing misuse and fraud.

Wash card and customer portal
Data: name, email address, card number, balance, top-ups, bonus and transactions.
Purpose: managing credit, awarding bonus, blocking the card and transferring the balance in case of loss.
Legal basis: performance of the agreement.

Business washing on account
Data: company name, Chamber of Commerce and VAT number, billing address, name and contact details of the contact person, registered licence plates, washes per licence plate.
Purpose: registering licence plates, invoicing monthly, managing payments.
Legal basis: performance of the agreement; statutory retention obligation.

Licence plate recognition
Data: licence plate, date, time and location.
Purpose: recognising subscribers and business customers and recording their washes (see Licence plate recognition and cameras).
Legal basis: performance of the agreement; for other visitors legitimate interest.

Cameras at the location
Data: footage of the site, car wash and wash bays.
Purpose: safety, preventing misuse and establishing how damage occurred.
Legal basis: legitimate interest: protecting customers, property and evidence in case of damage.

Questions, complaints and damage
Data: name, contact details, licence plate, content of your message or conversation, photos of the damage, details of vehicle and repair.
Purpose: answering your question or complaint, assessing and settling damage, also with our insurer and a damage expert.
Legal basis: performance of the agreement; legitimate interest in settling damage.

Newsletter and offers
Data: name and email address.
Purpose: sending news and offers about our services.
Legal basis: consent; for existing customers legitimate interest for similar services, always with an unsubscribe link.

Website
Data: IP address, browser and device data, cookies, data in forms.
Purpose: making the website work and securing it, measuring use (see Cookies).
Legal basis: legitimate interest; consent for analytical and marketing cookies.

If you have a subscription, wash card or business account, your name, contact details, licence plate and payment details are needed to perform the agreement. Without this data we cannot provide that service.

Licence plate recognition. At the roll-over, a camera reads the licence plate of every vehicle that enters. The system compares that licence plate with the licence plates of subscribers and business customers. We only store a licence plate if you have registered it in our system yourself, for example with a subscription, wash card or business account. Our supplier's system temporarily stores licence plates and photos of vehicles and deletes them after 24 hours. Falcon has no access to that data and does not view it.

• Match: the wash falls under the subscription or business account. We record the licence plate, date, time and location.
• No match: you pay yourself at the terminal. Falcon does not store the licence plate, cannot view it and does nothing with it. The supplier's system deletes it after 24 hours.

We do not use licence plates to track visitors or for marketing. We only give them to others if the law requires it, for example at the request of the police, or if we report misuse of a subscription or another criminal offence.

Cameras. Cameras are installed at our locations; signs at the entrance point this out. We use them for the safety of customers, to prevent vandalism, theft and misuse, and to establish how damage occurred.

We keep footage for a maximum of 2 months; after that it is automatically overwritten. If you report damage or an incident occurs, we keep the footage concerned until the matter has been settled. Only authorised employees can view footage. In case of damage we may share footage with our insurer and a damage expert, and in case of a criminal offence with the police.

If you want to view footage of yourself or your vehicle, send a request within 2 months stating the date, time and location to info@falconcarwash.nl.

How long we keep data

We do not keep data longer than necessary for the purpose for which we collected it, or as long as the law requires. After that we delete or anonymise it.

• Licence plate without a match with a subscription or business account: not stored or viewed by Falcon; the supplier deletes it after 24 hours.
• Camera footage: a maximum of 2 months; in case of an incident or damage report until the matter has been settled (safety and evidence).
• Washes of subscribers (licence plate, date, time, location): 12 months after the wash (checking fair use, answering questions).
• Your subscription data (name, contact details, licence plate): 2 years after the end of the subscription (questions and disputes afterwards).
• Direct debit mandate: 14 months after the last debit (you can reverse a debit for up to 13 months).
• Wash card and account in the customer portal: 2 years after the last top-up or last use, equal to the validity of the credit.
• Data of business contact persons: 2 years after the end of the business account (questions and disputes afterwards).
• Invoices, payments and other records: 7 years (statutory retention obligation).
• Questions and complaints: 2 years after settlement (repeat questions, quality of service).
• Damage files, including photos and secured footage: 5 years after settlement (limitation period for a claim for damages).
• Newsletter: until you unsubscribe.

Who we share data with

We do not sell personal data. We only share it with parties that help us provide the service, or if the law requires us to.

Service providers working on our behalf (processors). We have a data processing agreement with these parties. They may only use your data for the assignment we give them.

• CMPS: customer portal, wash card and payment system at the locations.
• Mach3: website, forms and the subscription application form.
• Supplier of our licence plate recognition and wash installation: recognising licence plates and recording washes.
• Supplier of our camera system: storage and management of camera footage.
• Directklantcontact: telephone and messages for customer service and the emergency number.
• Microsoft: email and documents (Microsoft 365).
• Exact: accounting and invoices (Exact Online).

Parties with their own responsibility. These parties process data under their own responsibility and their own privacy statement:

• Adyen and other payment service providers, for payments by debit card, credit card or contactless.
• Rabobank, for direct debit.
• Our insurer, insurance broker and a damage expert, if you report damage.
• Our accountant and lawyer, if necessary for auditing our records or a dispute.
• A buyer or successor of a location, if we transfer your agreement (article 2.6 of our terms and conditions).
• Police and other government authorities, if the law requires us to provide data or if we report misuse or another criminal offence.

Outside Europe. We keep data within the European Economic Area (EEA) as much as possible. If a service provider processes data outside the EEA, this only happens with appropriate safeguards: an adequacy decision of the European Commission or standard contractual clauses approved by the European Commission.

Cookies, security and automated decisions

Cookies. Our website uses necessary cookies to make the site work. We only place analytical cookies from Google Analytics with your consent. You give or refuse that consent in the cookie notice. You can read more about this in our cookie policy.

Security. We take appropriate technical and organisational measures to protect your data, such as limited access for employees, encrypted connections and agreements with our service providers. We do not store full card numbers; payments are handled by certified payment service providers. If something does go wrong with your data, we report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and, if necessary, to you.

Automated decisions. We do not make decisions based solely on automated processing that significantly affect you. The licence plate camera only determines whether a wash falls under your subscription. A decision about misuse or ending a subscription is always taken by an employee, after you have been able to respond.

Children. Our subscriptions, wash cards and accounts are not intended for children. We do not knowingly collect data from children under 16.

Your rights

You have the following rights regarding your personal data:

• Access: knowing which data we have about you and what we do with it.
• Rectification: having incorrect or incomplete data corrected.
• Erasure: having data deleted if we no longer need it or no longer have a legal basis. Data we are legally required to keep, such as invoices, is only deleted after the retention period.
• Restriction: temporarily stopping the use of your data, for example while we assess an objection.
• Objection: objecting to processing based on our legitimate interest. You can always object to direct marketing; we will then stop immediately.
• Portability: receiving data you have provided to us yourself in a common file format.
• Withdrawing consent: if you have given consent, for example for the newsletter, you can always withdraw it.

Send your request to info@falconcarwash.nl. We respond within one month. To prevent someone else from requesting your data, we may ask you to confirm your identity, for example with your licence plate and the email address of your account.

Complaint. If you do not agree with how we handle your data, please let us know first. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Changes

We may amend this privacy statement, for example if our services or the law change. The current version is always available on falconcarwash.nl. In the event of an important change, we will inform subscribers and business customers by email.

Version October 2026.