Privacy policy

Who is responsible

SB Digital, Gripvelden 14, 4707 ZD Roosendaal, Netherlands, KvK 90232119, info@sidneyvandenboogaard.com, is responsible (the “controller”) for the personal data described here.

What we use, and why

• Your order. Name, delivery address, email address, phone number (only if you give one), the prints you ordered and the order history. We need these to make, deliver and support your order (performance of a contract), and we keep the order records because tax law requires it (legal obligation).
• Payment. Payments are handled by Stripe. We receive the payment status and the payment method, never your full card or bank details.
• The private list. Your email address and language, only after you have confirmed your signup (double opt-in). Based on your consent; you can unsubscribe with the link in every email.
• Emails you send us. To answer your question.
• Server logs. Technical logs (IP address, time, requested page) are kept briefly to keep the site secure and working (legitimate interest).

Cookies and your browser

We do not use tracking or advertising cookies. Your bag is saved in your browser (local storage) so it is still there when you come back. We receive its items when checking current prices and availability, and when you check out. The checkout page of Stripe (on stripe.com) uses its own cookies to prevent fraud.

Who helps us (processors)

We share personal data only with the companies we need to run the shop, and never sell it:

• Stripe (Stripe Payments Europe Ltd., Ireland) — payments. Stripe may also process data in the United States, under the EU–US Data Privacy Framework and standard contractual clauses.
• Prodigi (United Kingdom) — prints and ships your order through its print network; receives your name, delivery address and order details. The United Kingdom has an adequacy decision of the European Commission.
• The carrier that delivers your parcel — receives your name and delivery address.
• Brevo (France) — sends order emails and the private list.
• Hetzner (Germany) — hosts the website, the database and the backups.
• OVHcloud (France) — manages domain DNS and the business email inbox.

How long we keep it

• Order and invoice records: 7 years, because Dutch tax law requires it.
• Emails with questions: kept for as long as needed to answer and follow up on the question, then deleted.
• The private list: until you unsubscribe. We then keep only a note that you unsubscribed, so we never email you again.
• Server logs and backups: kept only for as long as needed for security, recovery and maintenance, then deleted or replaced.

Your rights

You may ask to see, correct or delete your data, to limit its use, to receive it in a common format, or object to its use. Where we rely on your consent, you can withdraw it at any time. Email info@sidneyvandenboogaard.com; we reply within one month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Security

The site uses an encrypted connection. Access to order data and the shop’s systems is restricted to the people and service providers who need it to run the shop.