Privacy and cookie statement

Verpact considers it important to handle your personal data with care. Personal data is information that relates directly to you or can be traced back to you, such as your name, email address or IP address. In this Privacy and Cookie Statement, we explain which personal data we process, why we process it, with whom we share data, how long we retain data and what rights you have. We process personal data in accordance with the General Data Protection Regulation (GDPR) as the data controller.

Identity and contact details

Stichting Verpact (Verpact), located at Henri Faasdreef 312, 2492 JP The Hague, the Netherlands.

Personal data and purposes of processing

Verpact only processes your personal data if there is a lawful basis for doing so under the GDPR. This may, for example, be because you have given your consent, because processing is necessary for the performance of a contract with you, because Verpact must comply with a legal obligation or because Verpact has a legitimate interest.

Packtool & Waste Management Contribution

Verpact processes personal data for reporting and declaring the Waste Management Contribution for Packaging. To do so, you register for a Packtool account on behalf of your company via Verpact's website (www.verpact.nl). You can use this account to submit reports and declarations for the Waste Management Contribution.

For registration, declarations, payments and related communications, Verpact may process the following personal data: your first and last name, gender, telephone number and email address.

Verpact processes this personal data because this is necessary for the performance of the Packaging Waste Management Contribution Agreement and to comply with legal obligations.

Contact & customer service

You can contact us via the website, by email or by telephone. If you ask a question or contact us, we may process personal data that is necessary to assist you. This may include your name, email address, telephone number and the content of your message. We may also process data relating to our communications with you, such as the date of your message and our response.

In some emails, we use a tracking pixel. This is a small, invisible image embedded in the email. It allows us to receive technical information, such as:

• whether and when an email has been opened;
• the type of device or email application used to open the email;
• whether links in the email have been clicked.

We use this information to assess whether our communications are working effectively and to improve them. You can limit tracking pixels by disabling the automatic loading of images in your email application.

Newsletter

You can subscribe to our newsletter using your email address. If you subscribe, we process your name and email address. We may also process technical data relating to the sending and opening of the newsletter, for example whether the newsletter was delivered or opened.

We process this data on the basis of your consent. You can withdraw your consent at any time by unsubscribing via the link at the bottom of the newsletter.

Website and cookies

When you visit our website, we may process technical data. This may include your IP address, the type of device you use, your operating system, your internet browser and the pages you visit. We use cookies for this purpose. Cookies are small text files that are placed on your computer, tablet or phone when you visit our website.

We use functional cookies and limited analytical cookies. These cookies are necessary to ensure that the website works properly, remains secure and can be improved. They also help us resolve technical issues and understand how the website is used. These cookies have little or no impact on your privacy. We therefore do not require your consent for these cookies.

We may also use other cookies, but only if you give your consent. These include:

• Preference cookies. These cookies remember your choices so that the website can better reflect your preferences;
• Reporting cookies. These cookies provide us with insight into the general use of our website, allowing us to improve it;
• Marketing and advertising cookies. These cookies help us measure the effectiveness of advertisements and advertise in a more targeted way. We never share customer data with third parties.

When you visit Verpact's website, you can use the cookie banner to select your cookie preferences and disable optional cookies. You may also be able to change your browser settings to manage cookies. Please note that deleting or disabling certain cookies may affect your user experience. As a result, some parts of the website may no longer function fully.

Deposit Return app

When you use our Deposit Return app, Verpact and Statiegeld Nederland may process your personal data. For the app and its features, including participation in games of chance via the app, Verpact and Statiegeld Nederland jointly determine why and how this personal data is used. They are therefore joint controllers. Verpact and Statiegeld Nederland have made arrangements between themselves regarding this. You can exercise your privacy rights with both Verpact and Statiegeld Nederland. The personal data that is processed depends on the features you use and the choices you make, such as whether you provide consent. We explain this in more detail below.

You can also use the app without an account and without logging in. In that case, Verpact and Statiegeld Nederland do not process account details or contact details relating to you, such as your name, email address or telephone number. Technical data may still be processed, as explained below. Some features of the app are not available without an account.

You may choose to log in using Face ID, fingerprint recognition or a similar feature on your device. These are also referred to as biometric data. This data remains on your own device. Verpact and Statiegeld Nederland do not receive or process this data.

If you want to use the wallet in the app, an identity check is required. This check is carried out by a specialised service provider on behalf of Verpact and Statiegeld Nederland. Data from your identity document is processed for this purpose, such as your name, gender, nationality and date of birth. The check is necessary to comply with legal obligations relating to the wallet and the payment of deposits, and to prevent fraud and misuse. The data required for your wallet is stored in the wallet. Data that is only required to verify the authenticity of your identity document, such as your Dutch citizen service number (BSN), is not stored.

If you want your deposit to be paid out via the wallet, your name and bank account number (IBAN) will be processed. This data is required to verify that the bank account belongs to you and to pay the deposit to you. Data about the bottles or cans you have returned may also be processed, such as the deposit amount and a unique return code. This data is used to link the correct amount to your wallet. The verification of the bank account and the payment are carried out by a payment service provider.

When you use the app, technical data may also be processed. This data is required to ensure that the app works properly, remains secure and can be improved. This may include:

• technical and usage data, such as opening the app, screens viewed, technical error messages and information about your device. We use this data to manage the app, resolve issues and improve the app;
• location data, but only if you give permission through your device settings. We use this data to show return points near you;
• technical codes, such as an app installation ID. These allow us to analyse the use of the app at an aggregate level;
• data relating to push notifications, if you give permission for these. You can disable push notifications at any time through your device settings.

We process technical data insofar as this is necessary for our legitimate interest in providing and improving a properly functioning, secure and user-friendly app. Where consent is required, such as for location data and push notifications, we only process this data if you have given your consent.

Games of chance

Verpact and Statiegeld Nederland process personal data to enable participation in De Groene Jackpot and the Scan je statiegeldbon & win! promotion via the Deposit Return app. The personal data we process and the purposes for which we process it vary depending on the game of chance. We explain this for each game of chance below.

Participation in De Groene Jackpot and the Scan je statiegeldbon & win! promotion is voluntary. We process personal data that is necessary to perform the participation agreement with you. We also process data to comply with legal obligations, for example in relation to age checks and our administration. For fraud prevention, security and customer service purposes, we may process data because we have a legitimate interest in doing so. Below, we explain which personal data we process for each game of chance and why.

For the operation of the games of chance, Verpact and Statiegeld Nederland also use specialised service providers, for example for identity checks, payment services and the technical operation of the lottery. More general information about access to your data can be found under ‘Who has access to your data?’

De Groene Jackpot

If you are aged 18 or over, you can participate in De Groene Jackpot through the Deposit Return app. When you participate, personal data required for your participation is processed. When registering, this includes your name, email address, date of birth and a unique participant number. Your date of birth is used to verify that you are aged 18 or over. You cannot participate without this verification.

When purchasing lottery tickets and participating in draws, data may be processed relating to your tickets, the deposit amount used, your participation history and the outcome of draws. This data is processed to register your purchase and participation, link your tickets to the correct draw, determine the result and verify any entitlement to a prize. If you win, data required to enable payment of the prize may also be processed, such as your name, email address, unique participant number, information about the winning ticket and the draw, and, where necessary for payment, your bank account number (IBAN).

To participate in De Groene Jackpot, you enter into an agreement with Beter Lot B.V. Beter Lot is the licence holder for the lottery and processes personal data for its own obligations as licence holder. These may include obligations relating to the draw, payment of prizes, gambling tax, reporting to the Netherlands Gambling Authority and other legal obligations. Beter Lot's privacy statement explains how Beter Lot handles your personal data.

Scan je statiegeldbon & win!

You can participate in the Scan je statiegeldbon & win! promotion using a deposit return receipt from a supermarket. We process personal data for this purpose.

When you scan your deposit return receipt, we process the data shown on the receipt. This includes the unique barcode, the number of PET deposit containers and/or cans, and other information relating to the return of the bottles or cans, such as the date and time of return. We link this data to your account in the Deposit Return app. To create an account, we process your email address. You can also enter your name, but this is not mandatory. After logging in, we ask you to confirm that you are aged 18 or over. You cannot participate without this confirmation.

If you participate in a draw, we process data about your tickets, previous participation and the outcome of the draw. We use this data to register your participation. We also link your tickets to the correct draw, determine the outcome and verify whether you are entitled to a prize.

If you are eligible for a prize, your age and bank account must first be verified. For this purpose, we process your name, email address, date of birth, unique participant number, bank account number (IBAN), and information about the winning ticket and draw. We use this data to verify that you are aged 18 or over and that the bank account belongs to you. Once the checks have been completed and you are entitled to the prize, we will pay the prize money to you.

Circular Economy teaching materials

Verpact offers the ‘Circular Economy | From packaging to new raw material’ teaching materials free of charge. The teaching materials are intended for years 7 and 8 of primary school and the lower years of pre-vocational secondary education (VMBO). If you request the teaching materials, your name, email address and telephone number may be processed. You can provide either your business or personal contact details.

We use this data to register your application, provide you with access to the teaching materials, arrange delivery of a free donation bin, and inform you about news and developments. To deliver a free donation bin, it is necessary to share your name and contact details with the supplier. The supplier uses this data to arrange a delivery appointment with you.

Technical data may also be processed on the website where you register your school or yourself. The types of data concerned are described under ‘Website and cookies’ in this Privacy Statement.

Afval Goed Geregeld

Verpact offers organisations a system for collecting waste generated during their normal activities. This may include waste from visitors, employees or other users. Verpact processes personal data in connection with this service.

If your organisation participates in the collection system, you enter the name, job title and contact details of the contact person in the online portal, among other information. This includes an email address and telephone number. These may be business or personal contact details.

Verpact uses this personal data to prepare and provide our Afval Goed Geregeld services. Once you have registered for the collection system, we will keep you informed about your registration and important developments relating to the collection system.

To provide services under the Afval Goed Geregeld scheme, it may be necessary to share personal data with specialised service providers. We explain this under ‘Who has access to your data?’

Retention periods

Verpact does not retain personal data for longer than necessary for the purpose for which we collected it. In some cases, we are required to retain data for longer, for example because this is required by law or necessary for legal proceedings.

For personal data processed by Verpact for reporting and declaring the Waste Management Contribution for Packaging, we generally retain the data for as long as necessary to meet our obligations under the Packaging Waste Management Contribution Agreement (ABBO).

For personal data processed in connection with your participation in De Groene Jackpot, your name, contact details, date of birth and unique participant number are retained for up to one year after the draw. Financial data, such as your IBAN and account holder name, is retained for up to seven years after the transaction date, insofar as this is necessary for tax administration and other legal obligations.

If you unsubscribe from our newsletter, we will delete the personal data we process for this purpose as soon as reasonably possible. We will also do this if you withdraw your consent for another type of processing.

We retain technical data relating to your website visit, such as your IP address and browser data, for no longer than one month.

Who has access to your data?

To provide our services, we may share your personal data with other organisations. We do not share more personal data than is necessary for the purpose for which it is processed.

Verpact may share your personal data with other parties where this is necessary to provide our services. These may include parties that host our website, manage software, support our financial administration or handle complaints. We may also share personal data where required by law, for example with supervisory authorities or the Dutch Tax and Customs Administration.

For some of our services, we work with specialised service providers. For the app and games of chance, for example, we use service providers that provide technical support. For Afval Goed Geregeld, this includes external waste collectors that collect and transport the waste. These service providers are only given access to the personal data they need to perform their work.

We enter into a data processing agreement with parties that process personal data on behalf of Verpact (‘processors’). These agreements include provisions on the careful use, security and confidentiality of personal data. Verpact remains responsible for this processing.

As a general principle, we process personal data only within the European Economic Area (EEA). If processing outside the EEA is necessary, we ensure that appropriate safeguards are in place in accordance with the GDPR. We make agreements about this with the processor. This may, for example, involve standard contractual clauses approved by the European Commission.

Automated decision-making

Verpact does not make decisions about you that are made entirely automatically without human review. Verpact also does not use profiling.

Security of personal data

Verpact treats your personal data confidentially. We take appropriate technical and organisational measures to protect your personal data against misuse, loss, unauthorised access and unlawful processing. Examples of these measures include secure servers, firewalls, encryption and physical security of areas where data is stored.

We ensure that only individuals who need personal data for their work have access to it. These may include employees, representatives, contractors or other third parties. They may only process personal data in accordance with our instructions and are required to treat the data confidentially.

Verpact regularly carries out risk assessments. We also take account of new developments in information security and potential threats. In addition, we assess whether our information security measures are working effectively.

Links to other websites

Our website and app may contain links to external websites. Verpact is not responsible for the use or content of these websites. Verpact is also not responsible for the processing of personal data through these external websites. This Privacy and Cookie Statement only applies to Verpact's website and app.

Your privacy rights

Under the GDPR, you have various rights in relation to your personal data. You can ask us to:

• provide access to the personal data we process about you;
• correct or supplement inaccurate or incomplete data;
• delete your personal data;
• restrict the processing of your personal data;
• transfer your personal data to you or another party.

You may also object to certain types of processing of your personal data. If we process your personal data on the basis of your consent, you can withdraw that consent at any time. This does not affect the lawfulness of any processing carried out before you withdrew your consent. You can also change certain information yourself through the personal settings in your Packtool account.

If you would like to exercise your legal rights or have any other questions or comments about Verpact's processing and/or protection of your personal data, please send a detailed request to info@verpact.nl or by post to Stichting Verpact, Postbus 13799, 2501 ET The Hague, the Netherlands. We will respond to your request as soon as possible, and in any event within one month. To process your request to exercise your legal rights, we may ask you for additional information where necessary to verify your identity.

Verpact would also like to point out that you have the option of submitting a complaint about the processing of your personal data to the national supervisory authority, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), Postbus 93374, 2509 AJ The Hague, the Netherlands.

Applicable law

This Privacy and Cookie Statement is governed by Dutch law. This also applies to disputes relating to this Privacy and Cookie Statement.

Changes

Verpact may amend this Privacy and Cookie Statement, for example in response to changes in legislation or our services. We recommend that you review this Privacy and Cookie Statement regularly so that you are aware of the most recent version.

This Privacy and Cookie Statement is dated September 2026.