Email correspondence — privacy notifications to Gemeente Assen and Stichting TT Festival

This folder collects the email correspondence in which the independent researcher (Geert de Graaf) notified both Gemeente Assen (the municipality) and Stichting TT Festival / its app‑builder about the privacy and data‑transfer problems documented elsewhere in this repository, and the replies received.

These messages are the human counterpart to the technical evidence: they show that the responsible parties were put on notice, what they were told, and how they responded. One reply contains a direct admission that location data is processed in the United States — the exact point the app’s own privacy policy denies.

Primary source: every message is preserved byte‑for‑byte as the original .eml file under each thread’s raw/ folder (full headers, MIME structure, Message-ID, In-Reply-To). The NN_*.txt files are convenience renderings (headers + body text) and the NN_attachments/ folders hold extracted attachments. If a rendering and the .eml ever disagree, the .eml governs.

Timeline

When (local)	From → To	Thread	Summary
2026‑06‑07 21:18	Geert → Ranco van Bergeijk (ttfestival.nl)	03	Opens the privacy/security investigation; asks to talk.
2026‑06‑08 15:23	Ranco → Geert	03	Not available that week; proposes the next.
2026‑06‑16 12:01	Gemeente Assen “Berichten van de Brink” → residents	01	Municipal newsletter: “Download de TT Festival App” (quoted in thread 02).
2026‑06‑16 17:56	Geert → `info@assen.nl`, `s.gils2@assen.nl`	02	Notifies the municipality: 60 km location collection sent to the USA, contradicting the app’s “EU‑only” policy; advises temporarily suspending promotion of the app.
2026‑06‑16 17:56	`info@assen.nl` (auto) → Geert	02	Automatic acknowledgement of receipt.
2026‑06‑16 18:11	Geert → Ranco, `info@ttfestival.nl`	03	Full technical findings to the organisation (60 km zone, `login_user_id` linkage, us‑east‑1 transfer, hardcoded credentials, silent pages).
2026‑06‑16 18:17	Sebas van Gils (Gemeente Assen, Adviseur openbare orde en veiligheid) → Geert	02	Acknowledges the concern: “Als dit inderdaad het geval is in de mate die jij zegt, dan moeten wij hier zeker iets mee.” Will escalate internally and follow up.
2026‑06‑23 14:29	Ranco → Geert (forwarding the app‑builder)	03	Admission: Crowd Connected confirms location data is processed via AWS us‑east‑1 (Virginia, USA); says the privacy statement is being re‑checked. Frames the 60 km / two‑days‑before‑to‑one‑day‑after window as a Crowd Connected default.
2026‑06‑25 01:16	Geert → Ranco, `info@ttfestival.nl`	03	Detailed legal rebuttal; pseudonymised ≠ anonymous (`app_user_id`/`login_user_id`); Dutch‑language requirement (Art. 12); files a formal GDPR Art. 15 access request.
2026‑06‑25 01:56	Geert → Ranco	03	Asks the responsibility question: is this the position of Stichting TT Festival itself (the controller named in the stores)?

(Times shown as written in each message’s Date header; senders’ timezones differ — e.g. some are +0000, some +0200.)

The three threads

01 — `01_gemeente-assen_nieuwsbrief-brink/`

The municipal newsletter “Berichten van de Brink” (16 June 2026) from newsroom@assen.nl, which tells residents to “Download de TT Festival App” for the programme and practical information. This is the municipal promotion that the rest of the evidence chain responds to.

02 — `02_gemeente-assen_privacy-zorgen/` — “Zorgen omtrent privacy en datadeling in de gepromote TT Festival App”

The researcher’s notice to Gemeente Assen, the automatic acknowledgement, and the substantive reply from Sebas van Gils, Adviseur openbare orde en veiligheid at the municipality. The municipality is told that it is promoting an app whose real behaviour contradicts its own privacy policy, and is advised to pause promotion. Van Gils replies that if it is as described, “dan moeten wij hier zeker iets mee” (“then we definitely have to act on this”) and will escalate.

03 — `03_ttfestival_privacyonderzoek/` — “TT app – privacyonderzoek”

The six‑message exchange with Ranco van Bergeijk (Marketing & communicatie, ttfestival.nl). It contains the researcher’s full technical write‑up, the app‑builder’s response confirming US (us‑east‑1) processing, the researcher’s point‑by‑point legal rebuttal and Art. 15 access request, and the unanswered question of whether Stichting TT Festival accepts controller responsibility.

Why this is evidence

The responsible parties were demonstrably notified. Both the municipality that promotes the app and the organisation that publishes it received a clear, dated, written description of the problems — with a link to this repository — well before and during the 2026 festival.
The US data transfer is admitted in writing. The organisation, relaying Crowd Connected, confirms that location data is processed via AWS us‑east‑1 (Virginia, USA). The app’s published privacy statement says the opposite (“all data within the EU, Cloudflare excepted”). The contradiction is no longer just inferred from code — it is conceded by the operator.
The municipality acknowledged it must act. A municipal safety adviser confirmed receipt, said the concern — if accurate — requires action, and undertook to escalate and follow up. That makes the municipality’s subsequent posture (continuing to promote the app) assessable against its own words.
It frames the controllership question. The correspondence repeatedly puts to Stichting TT Festival that, as the named publisher in the app stores, it is the GDPR controller (Art. 4(7)/24) and cannot offload responsibility to the app‑builder — a question left open at the end of the thread.

These are records of correspondence with parties acting in an official / professional capacity (a municipal adviser and an organisation’s communications officer) about a matter of public interest. They are reproduced to document the notice given and the responses received. Personal contact details that appear in the messages are part of the original records.

Folder layout

email-correspondence/
  README.md                ← this file
  SHA256SUMS.txt           ← sha256 of every .eml, .txt and attachment
  01_gemeente-assen_nieuwsbrief-brink/
    raw/<original>.eml      ← byte-exact source (primary evidence)
    01_*.txt                ← rendered headers + body
  02_gemeente-assen_privacy-zorgen/
    raw/*.eml
    0N_*.txt
    0N_attachments/…        ← PGP public key, signature images, etc.
  03_ttfestival_privacyonderzoek/
    raw/*.eml
    0N_*.txt
    0N_attachments/…

Verifying

sha256sum -c SHA256SUMS.txt

SHA256SUMS.txt lists every artifact except this README.md and the manifest itself. The evidence/.gitattributes rule (* -text) keeps the .eml bytes unchanged through git, so the hashes stay valid after cloning.