New Relic (performance monitoring and error diagnostics)
Mailchimp (email newsletters and subscriber management)
We may also disclose information if required by law, to protect rights and safety, or in connection with a business transaction (e.g., merger or acquisition) with appropriate safeguards.
5) International data transfers
Where processing involves transfers outside the EEA/UK, we rely on an adequacy decision or appropriate safeguards such as the EU Standard Contractual Clauses (SCCs). You can contact us to request information on relevant safeguards.
6) Data retention
Account data: retained while your account is active and for up to 24 months after deletion, unless we must keep it longer for legal reasons.
Orders & transaction records: retained as required by law (e.g., up to 7 years for tax/accounting records).
Authentication & security logs: typically retained for up to 12 months.
Analytics (Google Analytics): retained for up to 14 months (configurable).
Hotjar: recordings and heatmaps typically retained for up to 12 months (configurable).
New Relic telemetry: diagnostics data typically retained for up to 90 days (configurable).
Marketing (Mailchimp): retained until you unsubscribe; we keep a minimal suppression record to honor future opt-out requests.
User-generated content (e.g., comments): retained until you delete it or your account is removed.
7) Security
We apply technical and organizational measures appropriate to risk, including HTTPS encryption in transit, access controls, monitoring, and regular updates. No method is 100% secure, but we work to protect your data.
8) Your rights (GDPR)
Access, rectification, erasure, restriction, portability, and objection to processing.
Withdraw consent at any time (for consent-based processing).
Lodge a complaint with a supervisory authority (e.g., in NL: Autoriteit Persoonsgegevens).
To exercise your rights, contact us at {{PRIVACY_EMAIL}}. We may need to verify your identity.
9) Children
This service is not intended for children under 16. We do not knowingly allow accounts for children under 16, or a lower age only where permitted by local law with verifiable parental consent. If you believe a child has provided us personal data, please contact us to delete it.
10) Changes to this policy
We may update this policy from time to time. We will post the updated version here and update the “Effective date”.
11) Contact
Questions or requests? Email {{PRIVACY_EMAIL}}. Controller: {{COMPANY_NAME}}.
