# Email correspondence — privacy notifications to Gemeente Assen and Stichting TT Festival

This folder collects the **email correspondence** in which the independent
researcher (Geert de Graaf) notified both **Gemeente Assen** (the municipality)
and **Stichting TT Festival / its app‑builder** about the privacy and data‑transfer
problems documented elsewhere in this repository, and the **replies received**.

These messages are the human counterpart to the technical evidence: they show that
the responsible parties were **put on notice**, what they were told, and how they
responded. One reply contains a direct **admission** that location data is
processed in the United States — the exact point the app's own privacy policy
denies.

> **Primary source:** every message is preserved byte‑for‑byte as the original
> `.eml` file under each thread's `raw/` folder (full headers, MIME structure,
> `Message-ID`, `In-Reply-To`). The `NN_*.txt` files are convenience renderings
> (headers + body text) and the `NN_attachments/` folders hold extracted
> attachments. If a rendering and the `.eml` ever disagree, **the `.eml` governs.**

## Timeline

| When (local) | From → To | Thread | Summary |
|---|---|---|---|
| 2026‑06‑07 21:18 | Geert → Ranco van Bergeijk (ttfestival.nl) | 03 | Opens the privacy/security investigation; asks to talk. |
| 2026‑06‑08 15:23 | Ranco → Geert | 03 | Not available that week; proposes the next. |
| 2026‑06‑16 12:01 | Gemeente Assen *"Berichten van de Brink"* → residents | 01 | Municipal newsletter: **"Download de TT Festival App"** (quoted in thread 02). |
| 2026‑06‑16 17:56 | Geert → `info@assen.nl`, `s.gils2@assen.nl` | 02 | Notifies the **municipality**: 60 km location collection sent to the **USA**, contradicting the app's "EU‑only" policy; advises **temporarily suspending promotion** of the app. |
| 2026‑06‑16 17:56 | `info@assen.nl` (auto) → Geert | 02 | Automatic acknowledgement of receipt. |
| 2026‑06‑16 18:11 | Geert → Ranco, `info@ttfestival.nl` | 03 | Full technical findings to the **organisation** (60 km zone, `login_user_id` linkage, us‑east‑1 transfer, hardcoded credentials, silent pages). |
| 2026‑06‑16 18:17 | **Sebas van Gils** (Gemeente Assen, *Adviseur openbare orde en veiligheid*) → Geert | 02 | **Acknowledges** the concern: *"Als dit inderdaad het geval is in de mate die jij zegt, dan moeten wij hier zeker iets mee."* Will escalate internally and follow up. |
| 2026‑06‑23 14:29 | Ranco → Geert (forwarding the app‑builder) | 03 | **Admission:** Crowd Connected **confirms** location data is processed via **AWS us‑east‑1 (Virginia, USA)**; says the privacy statement is being re‑checked. Frames the 60 km / two‑days‑before‑to‑one‑day‑after window as a Crowd Connected default. |
| 2026‑06‑25 01:16 | Geert → Ranco, `info@ttfestival.nl` | 03 | Detailed legal rebuttal; pseudonymised ≠ anonymous (`app_user_id`/`login_user_id`); Dutch‑language requirement (Art. 12); files a formal **GDPR Art. 15 access request**. |
| 2026‑06‑25 01:56 | Geert → Ranco | 03 | Asks the responsibility question: is this the position of **Stichting TT Festival** itself (the controller named in the stores)? |

*(Times shown as written in each message's `Date` header; senders' timezones differ — e.g. some are `+0000`, some `+0200`.)*

## The three threads

### 01 — `01_gemeente-assen_nieuwsbrief-brink/`
The municipal newsletter **"Berichten van de Brink" (16 June 2026)** from
`newsroom@assen.nl`, which tells residents to **"Download de TT Festival App"** for
the programme and practical information. This is the municipal promotion that the
rest of the evidence chain responds to.

### 02 — `02_gemeente-assen_privacy-zorgen/` — *"Zorgen omtrent privacy en datadeling in de gepromote TT Festival App"*
The researcher's notice to **Gemeente Assen**, the automatic acknowledgement, and
the substantive reply from **Sebas van Gils**, *Adviseur openbare orde en
veiligheid* at the municipality. The municipality is told that it is promoting an
app whose real behaviour contradicts its own privacy policy, and is advised to
**pause promotion**. Van Gils replies that if it is as described, *"dan moeten wij
hier zeker iets mee"* ("then we definitely have to act on this") and will escalate.

### 03 — `03_ttfestival_privacyonderzoek/` — *"TT app – privacyonderzoek"*
The six‑message exchange with **Ranco van Bergeijk (Marketing & communicatie,
ttfestival.nl)**. It contains the researcher's full technical write‑up, the
**app‑builder's response confirming US (us‑east‑1) processing**, the researcher's
point‑by‑point legal rebuttal and **Art. 15 access request**, and the unanswered
question of whether Stichting TT Festival accepts controller responsibility.

## Why this is evidence

1. **The responsible parties were demonstrably notified.** Both the municipality
   that promotes the app and the organisation that publishes it received a clear,
   dated, written description of the problems — with a link to this repository —
   well before and during the 2026 festival.

2. **The US data transfer is admitted in writing.** The organisation, relaying
   Crowd Connected, **confirms** that location data is processed via **AWS
   us‑east‑1 (Virginia, USA)**. The app's published privacy statement says the
   opposite ("all data within the EU, Cloudflare excepted"). The contradiction is
   no longer just inferred from code — it is conceded by the operator.

3. **The municipality acknowledged it must act.** A municipal safety adviser
   confirmed receipt, said the concern — if accurate — requires action, and
   undertook to escalate and follow up. That makes the municipality's subsequent
   posture (continuing to promote the app) assessable against its own words.

4. **It frames the controllership question.** The correspondence repeatedly puts
   to Stichting TT Festival that, as the named publisher in the app stores, it is
   the GDPR controller (Art. 4(7)/24) and cannot offload responsibility to the
   app‑builder — a question left open at the end of the thread.

> These are records of correspondence with parties acting in an **official /
> professional capacity** (a municipal adviser and an organisation's
> communications officer) about a matter of public interest. They are reproduced
> to document the notice given and the responses received. Personal contact
> details that appear in the messages are part of the original records.

## Folder layout

```
email-correspondence/
  README.md                ← this file
  SHA256SUMS.txt           ← sha256 of every .eml, .txt and attachment
  01_gemeente-assen_nieuwsbrief-brink/
    raw/<original>.eml      ← byte-exact source (primary evidence)
    01_*.txt                ← rendered headers + body
  02_gemeente-assen_privacy-zorgen/
    raw/*.eml
    0N_*.txt
    0N_attachments/…        ← PGP public key, signature images, etc.
  03_ttfestival_privacyonderzoek/
    raw/*.eml
    0N_*.txt
    0N_attachments/…
```

## Verifying

```bash
sha256sum -c SHA256SUMS.txt
```

`SHA256SUMS.txt` lists every artifact except this `README.md` and the manifest
itself. The `evidence/.gitattributes` rule (`* -text`) keeps the `.eml` bytes
unchanged through git, so the hashes stay valid after cloning.