Echo Room Privacy Statement
Last updated: June 2026
Who we are
Echo Room is an independent research project developed by Sanne Schoenmaker, based in Amsterdam, the Netherlands. Echo Room is currently operated by Sanne Schoenmaker as an individual data controller, pending incorporation of Stichting Echo Room. Upon incorporation, Stichting Echo Room will become the data controller and this statement will be updated accordingly.
For questions about this privacy statement or your personal data, contact us at sanne@echoroomproject.com.
What data we collect
Echo Room collects the following personal data:
- Account data: your email address and the name or username you choose when registering. This is used to create and manage your account.
- Visit logs: the museum visits you choose to log, including museum name, exhibition name, visit date, effect tags you select, your rating, any notes you write, and any photos you upload. This data is provided voluntarily by you.
- Echo check responses: your responses to the echo check questions sent eight weeks after each logged visit, covering what stayed with you visually, emotionally, and behaviourally.
- Usage data: basic technical information about how you use the app, including login timestamps and general usage patterns. This does not include location tracking, device contacts, or browsing history.
We do not collect sensitive personal data such as health information, political opinions, religious beliefs, or financial information.
Why we collect your data and the legal basis
We collect and process your data for two purposes:
- To provide the app service: your account data and visit logs are processed to operate Echo Room's core functionality — logging visits, connecting with friends, sending echo check reminders, and displaying your personal logbook. The legal basis for this processing is the performance of a contract — specifically, the terms of service you accept when registering.
- For research purposes: your visit logs and echo check responses contribute to an empirical study of the long-term cultural impact of museum visits. Before any research analysis, all data is anonymised and aggregated — individual responses are never analysed in identifiable form. The legal basis for research processing is your explicit consent, given at registration. You may withdraw this consent at any time without affecting your ability to use the app.
How your data is used
Your individual data is never sold, shared with advertisers, or used for commercial purposes of any kind.
Anonymised and aggregated findings — patterns across thousands of visits, never traceable to any individual — may be published in academic journals, sector reports, and the annual Echo Report. Museums participating in Echo Room as research partners receive aggregate insight reports about their own visitors only. These reports contain no individually identifiable data.
Named academic collaborators working under formal data sharing agreements may access the anonymised research dataset for the purpose of instrument validation and co-authorship of findings papers. No collaborator accesses individually identifiable data.
No personal data is transferred outside the European Economic Area without appropriate safeguards in place.
How long we keep your data
Your account data and visit logs are retained for as long as your account remains active. If you delete your account, your personal data is permanently removed from the dataset within 30 days. Anonymised research data — from which no individual can be identified — may be retained indefinitely as part of the research record.
Your rights under GDPR
As a data subject under the General Data Protection Regulation, you have the following rights:
- Right of access — you can request a copy of the personal data we hold about you.
- Right to rectification — you can ask us to correct inaccurate data.
- Right to erasure — you can request that your personal data be permanently deleted. Requests can be made at any time by emailing sanne@echoroomproject.com or by deleting your account in the app settings.
- Right to restriction — you can ask us to limit how we process your data while a query is being resolved.
- Right to data portability — you can request your personal data in a structured, machine-readable format.
- Right to object — you can object to processing based on legitimate interests or for research purposes.
- Right to withdraw consent — where processing is based on your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, email sanne@echoroomproject.com. We will respond within 30 days.
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.
Cookies and tracking
Echo Room does not use advertising cookies or third-party tracking technologies. Basic session cookies are used solely to keep you logged in to the app. No data is shared with advertising networks or data brokers.
Data security
We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Your data is stored securely and access is limited to authorised personnel only.
Changes to this statement
If we make material changes to this privacy statement, we will notify registered users by email and update the "last updated" date at the top of this page. Continued use of the app after notification constitutes acceptance of the updated statement.
Records of processing activities
In accordance with Article 30 of the GDPR, Echo Room maintains an internal record of data processing activities. This record is available on request to the Autoriteit Persoonsgegevens.
Contact
Sanne Schoenmaker, Echo Room, Amsterdam, the Netherlands — sanne@echoroomproject.com