Dream Ops B.V. (Bouwkit) is the controller for the personal data you leave on this website. Privacy questions: info@bouwkit.com.
Which data and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Fulfilling and delivering your order | name, e-mail address, address, phone number, products ordered | performance of the contract | 7 years (tax retention duty for invoices) |
| Processing payment | payment method, Mollie payment reference | performance of the contract | 7 years |
| Making made-to-measure products | the dimensions and options you enter | performance of the contract | for the duration of the order, then with the order |
| Delivering building plans | download link, download count, watermark with order number | performance of the contract | 30 days after the last link, order history 7 years |
| Cutting-service calculator | uploaded files, measured dimensions, your choices | pre-contractual steps | 90 days; after an order with the order (7 years) |
| Cutting-service quotes | name, e-mail address, phone, description, uploaded drawings | pre-contractual steps | 1 year after the quote |
| Checking a VAT number (business customer) | VAT number, result of the VIES check | legal obligation | 7 years with the order |
| Customer account (login link by e-mail) | e-mail address, time of login | performance of the contract | as long as your account exists |
| Service e-mails about your order | e-mail address, delivery and bounce status | performance of the contract | 1 year |
| Preventing abuse | hashed IP addresses in short-lived counters | legitimate interest | at most 1 hour |
| Protecting forms against bots | a check by Cloudflare Turnstile, with your IP address | legitimate interest | not stored by us |
| Measuring errors and speed | technical data about your visit (page, load time, errors, browser), without cookies | legitimate interest | 30 days |
| Backups | all data above | legitimate interest | 90 days |
| Visitor statistics | aggregated page views without cookies (Plausible) | legitimate interest | no personal data |
Processors and recipients
- Amazon Web Services (Ireland region, eu-west-1): hosting, database, file storage, e-mail delivery (Amazon SES) and measuring errors and speed (CloudWatch RUM).
- Cloudflare: domain name (DNS) and the bot check on forms (Turnstile).
- Mollie B.V. (Amsterdam): payments. Mollie is the controller for the payment data itself.
- Plausible Analytics (EU): cookieless visitor statistics without personal data (only when the shop has enabled it).
- PostNL / DHL: delivery; they receive name, address and, where given, phone number.
- Kadaster (PDOK): Dutch address lookup by postcode and house number; no personal data is stored.
- European Commission (VIES): checking a VAT number.
We do not sell data and only pass it on to the parties above, as far as necessary. Data processing agreements are in place with processors.
Transfers outside the EU
Amazon Web Services, Cloudflare and Google are US companies. We have data processed in the EU wherever possible; where it does reach the United States, that is on the basis of the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
Cookies
The shop uses functional cookies only, needed to make the shop work:
| Cookie | Purpose | Lifetime |
|---|---|---|
bk_cart | your basket | 30 days |
bk_order | your confirmation page after ordering | 2 hours |
bk_account | your session after logging in with a login link | 30 days |
bk_consent | your choice in the cookie banner | 1 year |
For visitor statistics we use Plausible, which works without cookies, and the AWS error measurement sets no cookies either. Only if the shop enables Google Tag Manager do we first ask your consent through the cookie banner for Google statistics cookies; without consent nothing from Google is loaded. Your choice is stored with date and text version. Clearing this website's cookies withdraws your consent and we ask again.
Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. Send your request to info@bouwkit.com; we answer within one month. We take no decisions about you by automated means alone. You are not obliged to provide data, but without a name, address and e-mail address we cannot fulfil an order. You can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Security
Data is stored and transmitted encrypted (TLS). Access to the back office is limited to staff with two-step verification, and every change is logged.