Dream Ops B.V. (Bouwkit) is the controller for the personal data you leave on this website. Privacy questions: [email protected].
TODO legal review: Have the retention periods and the list of processors checked; put data processing agreements in place where they are missing.
Which data and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Fulfilling and delivering your order | name, e-mail address, address, phone number, products ordered | performance of the contract | 7 years (tax retention duty for invoices) |
| Processing payment | payment method, Mollie payment reference | performance of the contract | 7 years |
| Making made-to-measure products | the dimensions and options you enter | performance of the contract | for the duration of the order, then with the order |
| Delivering building plans | download link, download count, watermark with order number | performance of the contract | 30 days after the last link, order history 7 years |
| Cutting-service quotes | name, e-mail address, description, uploaded drawings | pre-contractual steps | 1 year after the quote |
| Customer account (login link by e-mail) | e-mail address, time of login | performance of the contract | as long as your account exists |
| Service e-mails about your order | e-mail address, delivery and bounce status | performance of the contract | 1 year |
| Preventing abuse | hashed IP addresses in short-lived counters | legitimate interest | at most 10 minutes |
| Visitor statistics | aggregated page views without cookies (Plausible) | legitimate interest | no personal data |
Processors
- Amazon Web Services (Ireland region, eu-west-1): hosting, database, file storage and e-mail delivery (Amazon SES).
- Mollie B.V. (Amsterdam): payments. Mollie is the controller for the payment data itself.
- Plausible Analytics: cookieless visitor statistics without personal data (only when the shop has enabled it).
- PostNL / DHL: delivery; they receive name, address and, where given, phone number.
- Kadaster (PDOK): Dutch address lookup by postcode and house number; no personal data is stored.
We do not sell data and only pass it on to the parties above, as far as necessary.
Cookies
The shop uses functional cookies only: your basket, your session after logging in and your confirmation page. For visitor statistics we use Plausible, which works without cookies. Only if the shop enables Google Tag Manager do we ask your consent first through the cookie banner; your choice is stored with date and text version.
Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. Send your request to [email protected]; we answer within one month. You can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Security
Data is stored and transmitted encrypted (TLS). Access to the back office is limited to staff with two-step verification, and every change is logged.