Privacy statement

This is a translation for convenience; the Dutch text prevails.

Who is responsible?

Het Vatje, Kabouterberg 1, 5508 HE Veldhoven, the Netherlands (KvK 96056436) is the controller of your personal data. Questions? E-mail contact@hetvatje.nl.

Which data and why

• Ordering: name, address, postal code, city, e-mail address, phone number, remarks and the order itself. Needed to perform the contract (delivery or pickup, payment, contact). Legal basis: performance of the contract.
• Payment: payments are handled by Mollie. We receive the payment status and method, no bank details other than what Mollie needs for a refund.
• Invoices and accounts: we keep order and invoice data for 7 years after the end of the year of the order, as required by Dutch tax law.
• Withdrawal and complaints: name, e-mail address, order number, your message and the time, to handle your request.
• Security: to prevent abuse we count orders per IP address (only an irreversible derivative of the address, kept for at most 1 day). Our log records the time and IP address of orders, payments and withdrawals. Legal basis: legitimate interest.

Who we share data with

• Strato (hosting of the website and database, in the EU);
• Mollie (payments);
• Microsoft 365 (e-mail);
• the carrier delivering your cask (name, address, phone number);
• PDOK (Dutch Land Registry): when you enter your postal code and house number while ordering, your browser looks up the matching address with this government service.

Where required, data processing agreements are in place with these parties. We do not sell data and do not use it for advertising.

How long we keep data

• Orders and invoices: 7 years after the end of the year of the order (legal obligation); personal data is removed afterwards.
• Withdrawals and complaints: 2 years after they have been handled.
• Sent e-mails: 12 months.
• Log (including IP addresses): 24 months.

Your rights

You can ask us to access, correct or delete your data (unless we are legally required to keep it) and object to processing. E-mail contact@hetvatje.nl. If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Security

The website uses an encrypted connection (https). Only the shop's administrators have access to order data; they sign in with a personal account.