Privacy policy

Who processes your data

SuriBook is a trade name of BlueOceanSolutions B.V., Dutch Chamber of Commerce (KvK) no. 92101550, registered at Duintopstraat 11, 1361 BJ Almere, the Netherlands. BlueOceanSolutions B.V. is the data controller for the data collected through this website: we decide what it's used for and how.

Questions about your data or this notice? Get in touch via the contact option on this site. You'll get a reply within a month.

What SuriBook is, and what it isn't

SuriBook is a directory: you find providers of services, travel and transport in Suriname, and you contact them yourself.

Online booking and online payment are not in use. Those features are switched off, and no booking, payment or identity check is processed through SuriBook at present. If that changes, this notice will be updated first.

Browsing and searching

You don't need an account to view or search listings. Our server logs technical data that any web server logs, including your IP address, to keep the site running and secure.

Creating an account

Sign-in runs through Microsoft Entra External ID, with an email address and password or a federated sign-in option. We do not store passwords ourselves — those are managed by Microsoft Entra.

With your account we store your preferences, including your favourites and whether you want to receive reminders.

Contacting a provider

When you message a provider we process your name, email address, phone number (if you give one), your message and your language, and pass them to that provider so they can respond.

We also store a hashed form of your IP address. That is not additional profiling but a measure against abuse of the contact form.

Reporting a listing

If you report a listing as incorrect or inappropriate, we process your email address, the reason and your explanation, plus a hashed form of your IP address, so we can assess the report and prevent abuse of the reporting form.

Providers: business account and listing

From providers we process: the legal and trading name, KKF or KvK registration number, a contact person with email address and phone number (and a WhatsApp number if given), country, VAT details, a public business description and a profile photo or logo.

Most of this appears on your public listing — that is its purpose. What you don't want published, don't enter.

Subscriptions and payments

Payments for a provider subscription (Directory Plus) are handled by Stripe. We do not store card details ourselves — Stripe processes and stores those. What we do store: your Stripe customer ID, which subscription you hold and its status, so we know which features your account can use.

Listings compiled from public sources

Some listings on SuriBook are compiled from publicly available sources, without the provider having done anything to be included. This concerns business information: name, address, opening hours and contact details.

Contact details of sole traders and small firms are treated as personal data. The basis is legitimate interest: a directory is only useful if it is complete. If you want your listing corrected or removed, or want to take it over and manage it yourself, get in touch.

Chatbot

Your question to the chatbot is sent to our search-and-answer service so it can respond. If you're signed in, we also send your name and email address. Don't type anything into it you don't want to share; a chat window invites sharing more than is needed.

Cookies and analytics

We use Google Tag Manager and Google Analytics to see how the site is used. These are only set if you consent via the cookie banner. You can withdraw consent at any time via 'Cookie preferences' at the bottom of every page — that's as easy as giving it.

We also use a strictly necessary cookie to keep you signed in. That needs no consent and cannot be switched off without signing out.

On what legal basis

Consent (Art. 6(1)(a) GDPR) — for analytics cookies. You may withdraw consent at any time.

Performance of a contract (sub b) — for your account and, for providers, the subscription.

Legitimate interest (sub f) — for security and abuse prevention, and for compiling the directory from public sources.

Legal obligation (sub c) — where the law requires us to retain something, for example for payment-related bookkeeping.

Who we share data with

With the provider you choose to message.

With suppliers who work on our behalf and may not use your data for themselves: Microsoft (Azure hosting and storage, and Entra External ID for sign-in), Stripe (payments), Google (Tag Manager and Analytics, after your consent) and the supplier behind our chatbot. A data processing agreement is in place with each of them.

We do not sell your data and do not use it for advertising.

Transfers outside the EEA

Our servers are located in the European Union. Some suppliers are based outside the European Economic Area, for example in the United States. For those transfers we rely on Standard Contractual Clauses (SCCs) and assess whether they provide sufficient protection in practice.

Your rights, and deleting your account

You have the right to access, correct and delete your data, to restrict or object to certain processing, and to receive a copy of data you provided yourself.

In your profile you can download your data and request deletion of your account. Deletion has a short recovery window before data is permanently removed, so a mistake can be undone. You can also email us; you'll get a reply within a month. You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Changes to this notice

We may update this notice, for example when we add a feature that processes personal data. The date at the top of this page shows when it was last updated.