Privacy policy

This is an English translation of the Dutch text, provided for convenience. Where the two differ in meaning, the Dutch version applies.

Last updated: 2 September 2026

Who processes your data

Gehaaktecadeautjes is responsible for the processing of personal data described on this page.

Gehaaktecadeautjes
Marcellienstraat 8
6166CR Geleen, the Netherlands
Email: gehaaktecadeautjes@hotmail.com
Chamber of Commerce (KvK) number: 42110975
VAT identification number: NL005501168B10

Gehaaktecadeautjes is a small business and is not required to appoint a data protection officer. Questions about privacy can be sent to the email address above.

What data, and why

For each purpose, the data processed and the legal basis for processing it are set out below.

Fulfilling an order

Name, email address, delivery address, billing address, telephone number (only if you fill it in), the items ordered, the amount and the payment status.
Legal basis: performance of the contract (article 6(1)(b) GDPR).

Keeping the accounts

Invoice and payment data.
Legal basis: legal obligation (article 6(1)(c) GDPR), namely the statutory retention period for tax records.

Managing an account

Only if you create an account yourself: your email address, name, address details and order history. You can also order without an account.
Legal basis: performance of the contract.

Answering a request or a question

Your name, email address and the content of your message.
Legal basis: performance of the contract or, for a question without obligation, legitimate interest (article 6(1)(f) GDPR) — namely being able to answer questions about what is on offer.

Emails about new items and offers

Only your email address, and only if you have ticked the box for it yourself. When you tick it, the moment you gave consent and the text you were shown at the time are recorded, so that it is clear afterwards exactly what you consented to. Your IP address is deliberately not stored.
Legal basis: consent (article 6(1)(a) GDPR). You can withdraw it at any time using the unsubscribe link in every email or through your account, without giving a reason and just as easily as you gave it.

If you have ordered before, Gehaaktecadeautjes may also email you about its own similar products without that tick, under article 11.7(3) of the Dutch Telecommunications Act. Every such email also carries an unsubscribe link.

Statistics about visits to the website

See the separate “Statistics” section below.
Legal basis: legitimate interest — knowing which pages are looked at in order to improve the shop, in a way that records as little as possible about the visitor.

Server logs

The web server automatically records which pages are requested, when, and from which IP address. That is needed to trace faults and to recognise and stop abuse — attempts to break in, for instance. These logs are not used to follow visitors. Their size is limited technically: once the limit is reached the oldest part is overwritten automatically, so no more than the most recent period is ever kept — a few weeks at normal traffic levels.
Legal basis: legitimate interest (article 6(1)(f) GDPR), namely the security and availability of the shop.

How long data is kept

  • Order, invoice and payment data: eight years. The statutory retention period for tax records is seven years, counted from the end of the financial year; a little longer is kept so that the period is certainly covered. After that, the personal data in the order is anonymised automatically.
  • Orders that were never completed (failed, cancelled or abandoned): one to three months, then deleted.
  • Accounts that are no longer logged into: twenty-four months, then deleted.
  • Consent for emails: until you withdraw it. After that only the date you unsubscribed is kept, so that it can be shown you did.
  • Statistics: the raw visit data is deleted after one hundred and eighty days. Only aggregated totals remain, and those cannot be traced back to a person.
  • Requests and emails that do not lead to an order: as soon as they are no longer needed.

These periods are set in the shop itself and expire automatically; no manual clearing out is involved.

Cookies

This website does not ask for cookie consent, and that is not an omission: so little is stored that it is not needed.

  • If you are only looking around, nothing is placed on your device. No cookie at all, apart from the security cookie below.
  • If you put something in your basket or log in, the shop places a functional cookie to remember what is in your basket and that it is you. Without that cookie no order can be placed, and no consent is required for it.
  • If the security layer checks you — because there have been an unusual number of login attempts, for instance — Cloudflare places a cookie to remember that the check was passed. This cookie is used only for security, not to follow you, and it expires by itself.
  • No tracking, advertising or profiling cookies, and no cookies that follow you across other websites.
  • If you choose Do not count me in the statistics yourself, that choice is kept in your browser’s local storage. That is storage at your request and for your benefit, and you can undo it.

Statistics

To see which products are being looked at, Gehaaktecadeautjes uses Matomo, a statistics program that runs on its own server. No visit data goes to Google or any other outside company.

What is recorded: which pages were looked at, in what order and for how long, which page you came from, which outgoing links were clicked, what was put in a basket, and general information about your device and browser.

How that stays privacy-friendly:

  • No cookies. Matomo is configured to place no cookie at all.
  • Your IP address is shortened before it is stored: the last two parts are removed, so that it can no longer be traced to a single connection.
  • Do Not Track is respected. If that setting is on in your browser, you are not measured at all.
  • Visitors are not followed from one day to the next. Without a cookie, a visitor is recognised by an encrypted combination of characteristics that changes daily. That key is thrown away every twenty-four hours, so after a day there is no link between two visits.
  • The data is not shared with anyone and is deleted after one hundred and eighty days.

Would you rather not be counted at all, not even anonymously? Then visit /?gc_notrack=1 once. That choice is kept on that device until you visit /?gc_notrack=0.

Who data is shared with

Only with parties needed to fulfil an order, and only with the data they need for it. A data processing agreement has been concluded with each of them. Data is never sold or used for advertising.

  • The payment service provider that handles the payment. Your payment details never reach Gehaaktecadeautjes: they are entered directly with the payment service provider or with your own bank. Gehaaktecadeautjes only sees whether a payment succeeded and by which method.
  • The carrier that delivers your parcel receives your name and delivery address. Which carrier that is appears in the dispatch confirmation you receive by email.
  • Cloudflare, Inc. provides the secure connection between your browser and the shop and blocks attacks. Traffic passes through their network in the process. Cloudflare is a US company; the transfer is covered by the European Commission’s standard contractual clauses and by their participation in the EU-US Data Privacy Framework.
  • The email service that sends the order confirmations receives your email address and the content of that email.

The website and the database run on our own equipment in the Netherlands, not at an external hosting company.

Security

Appropriate technical and organisational measures have been taken to protect your data. In concrete terms, these include:

  • all traffic between your browser and the shop is encrypted (HTTPS/TLS);
  • the administration area of the website cannot be reached from the internet — administration happens only from the local network;
  • the number of login attempts is limited, so that passwords cannot be guessed;
  • there is a single administrator account, with a strong and unique password;
  • security updates are installed automatically;
  • the shop and the database are separated from the rest of the network;
  • data is kept no longer than stated above, and that expires automatically;
  • encrypted backups are made and also kept off site, so that data can be restored after a failure;
  • a record is kept of which data is processed for what, and which measures have been taken.

Do you suspect something is wrong with your data? Let us know at gehaaktecadeautjes@hotmail.com.

Your rights

You have the right to see your data, to have it corrected or deleted, to have processing restricted, to object, and to receive your data in a readable file. Consent you have given may always be withdrawn.

Send an email to gehaaktecadeautjes@hotmail.com for this. You will receive a response within one month. To prevent someone else requesting your data, confirmation of your identity may be requested.

One limitation goes with this, and it is a legal one: invoice and order data cannot be deleted on request while the statutory retention period for tax records is running. What you can always do is withdraw your consent for emails and have your account deleted.

If you disagree with how your data is handled, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

Minors

The products are often meant for children, but the shop is aimed at adults: orders can only be placed by someone aged sixteen or over. Children’s data is not knowingly collected. If you think that has happened anyway, please get in touch at gehaaktecadeautjes@hotmail.com and it will be deleted.

Automated decision-making

No decisions about you are taken by a computer without a person looking at them, and no profile of you is built up.

Changes

If anything changes in the way data is processed, this page is amended and the date at the top is updated.