Ferry Club loyalty and the Ferry app
Ferry Club (controller) runs a loyalty programme and the Ferry app so we can recognise your payment card, award points, issue rewards, sell and scan tickets, and email you receipts and magic links.
Loyalty account.
If you create an account we process your email, name, and the profile details you give us, plus your points ledger and a summary of visits and spend, to perform the loyalty contract.
Marketing email.
We only send marketing if you tick:
Send me the line-ups, the free drinks and the occasional bit of nonsense by e-mail.
Ticking the box is consent. You can untick it in the app at any time. We do not send a second “confirm subscription” email. Verifying your email with a magic link is not marketing consent.
Customer.io.
We use Customer.io as a processor to hold your profile, send transactional mail (magic links, receipts, tickets, rewards), and — only if you opted in — marketing. Events such as “Logged In” or “Order Placed” are stored there so we can run those messages; they are not themselves marketing consent. Door refusals and other entrance-log details are not sent to Customer.io.
Date of birth.
We ask for it because the door is 18+. That is a legal age obligation, not a marketing field.
Payment cards.
When you pay by PIN we may store a Payment Account Reference (PAR) and the card’s BIN/scheme so the same card earns one points balance whether you tap plastic or a phone. That is a legitimate interest in running the programme; it is not a card number.
At the door.
We keep an entrance log, including if you were refused and the reason, for door safety. That log stays in Ferry; it is not sent to Customer.io.
Free WiFi banner.
If you allow it, the app looks for our venue beacons and the name of the WiFi network on your device only, so we can suggest joining FERRY Free WiFi. We do not log that presence on our servers. The permission the phone asks for is location (on iPhone, beacon ranging and reading the WiFi name both go through Location, not “Bluetooth only”).
App install from a terminal QR.
If you scan a loyalty QR without the app installed we use Branch to try to restore that link after you install. On iPhone that can use device characteristics (a fingerprint). The token is a hint: the app will ask you to confirm the payment before anything is linked. Branch is a processor; that processing is disclosed here because it is not obvious from the QR alone.
Your data.
In the Ferry app, customers can export a copy of their account (including the points ledger and visit/spend summary) and delete the account. Deleting sets the account to deleted, anonymises loyalty data, unlinks cards, and asks Customer.io to suppress the profile. It does not delete invoices, payment records, or door/ticket records we are required or entitled to keep (tax law keeps financial records for seven years). Staff and contractors cannot use that self-service path; ask the venue.
Processors.
Customer.io (US, standard contractual clauses), Branch (US, SCCs), Adyen (payments), PayPal (ticket checkout), Exact Online (bookkeeping), Google Cloud (hosting in the Netherlands, europe-west4).
Contact: privacy@ferryrotterdam.com.