Privacy policy
Last updated: [DATUM]
In brief
We ask only for the data we need to sell your shirt, ship it and comply with the law. We never see your bank or card details. We only send you a newsletter if you choose that separately and confirm your sign-up. We don't sell your data. You have rights over your data and we explain them below.
1. Who is responsible for your data?
[NAAM], trading as Shirts N Stories, [ADRES], company number [ONDERNEMINGSNUMMER]. For anything to do with privacy you can reach us at [E-MAIL].
2. Which data do we use, what for and for how long?
| What for | Which data | On what ground | How long do we keep it? |
|---|---|---|---|
| Carrying out and shipping your order | Name, delivery address, email address, telephone (optional), shirts ordered, delivery method, payment status | Performance of the contract | Until the order has been dealt with, including withdrawal and guarantee. After that, see the Accounting row. |
| Accounting and taxes | Order number, amount, date, payment method, customer's name and address on invoices | Legal obligation | [10 years] (tax retention period), see the note below |
| Payments | Payment ID, status and payment method (no card or account numbers) | Performance of the contract | As for Accounting |
| Withdrawal, returns and guarantee | Your statement, order number, details of the return | Performance of the contract and legal obligation | As long as needed to deal with the matter; after that as for Accounting |
| Questions and complaints by email or the contact form | Name, email address, content of your message | Legitimate interest (answering your question) | [24 months] after the last contact (example) |
| Newsletter | Email address, time of sign-up and confirmation | Consent | Until you unsubscribe. After that we keep only your email address on an unsubscribe list, so that you receive no more emails (legitimate interest). |
| Security and preventing misuse | IP address, browser type, time | Legitimate interest (keeping the shop secure) | [30 days] (example) |
| Visitor statistics | No cookies and no profiles; only counts of page visits through [ANALYSETOOL], aggregated | Legitimate interest (knowing what is read) | Aggregated, [x] (fill in once the tool is chosen) |
| Your cart and reservation | Data in your own browser and a random session number, without a name | Performance of the contract (cart) | Until you close it or the reservation expires (15 minutes) |
When you order, your name, delivery address and email address are compulsory, otherwise we can't deliver your order. Your telephone number is optional and is used only for the courier. We take no automated decisions about you.
3. Who do we share your data with?
We work with a limited number of parties who help us keep the shop running. With most of them we sign a data processing agreement, or they offer one as standard in their terms.
| Party | What for | Which data | Where |
|---|---|---|---|
| Cloudflare | Hosting of the website and processing of orders (Cloudflare Workers), DNS and security | IP address, order data passing through the Worker | Worldwide, including the US |
| Sanity | Managing the content (shirts, stories) | No customer data, unless orders are stored here: [CONFIRM WHICH DATA IS IN SANITY] | Including the US and Norway |
| Stripe | Payments (Bancontact, iDEAL, Visa, Mastercard) | Name, email address, amount, payment method, and the payment details you enter yourself on the Stripe page | Stripe is itself responsible for the payment details it collects from you |
| Resend | Sending emails about your order | Name, email address, content of the email | US |
| [NIEUWSBRIEFTOOL] | Sending the newsletter | Email address | [fill in] |
| [VERVOERDER] | Delivering your parcel | Name, address, telephone (if given), email address | [fill in] |
| [BOEKHOUDER] | Accounting and VAT returns | Invoices and payment details | Belgium |
| GitHub | Storing the code of the website | Normally no customer data (delete this row if so) | US |
| Meta (Instagram) | Our Instagram account @shirtsnstories | Only what you do yourself on Instagram. We don't show Instagram content on our website. | US and elsewhere |
We share your data otherwise only if the law requires it (for example with the tax authorities) or if you ask us to.
4. Does your data leave Europe?
Some of these parties are in the United States. They generally use the EU-US Data Privacy Framework and/or the European Commission's standard contractual clauses to protect your data. According to their own documentation, that is:
- Cloudflare: certification under the EU-US Data Privacy Framework, with standard contractual clauses as a fallback.
- Resend: standard contractual clauses and the EU-US Data Privacy Framework.
- Sanity: standard contractual clauses.
- Stripe: [NOT VERIFIED: details about Stripe as processor (legal entity, transfers outside the EU, data processing agreement) to be checked by a lawyer]
For GitHub and the other parties we have not checked this. You can ask us which safeguards we use.
5. What are your rights?
You have the right to:
- see your data and get a copy;
- have mistakes corrected;
- have your data erased, if we no longer need it or may no longer keep it (some of it we still have to keep because of the accounting law);
- have the processing restricted;
- object, and always in the case of direct marketing;
- take your data with you (portability), where that applies;
- withdraw your consent, for example for the newsletter, with the unsubscribe link at the bottom of every email. Withdrawing does not affect what we did before.
Email us at [E-MAIL]. We reply within one month. We may ask you to prove who you are. If you are not satisfied with our answer, you can lodge a complaint with the supervisory authority:
Gegevensbeschermingsautoriteit (the Belgian Data Protection Authority), Drukpersstraat 35, 1000 Brussels, https://www.gegevensbeschermingsautoriteit.be.
6. How do we protect your data?
Our website uses a secure connection (HTTPS). We don't store card details. Our partners work according to their own security measures. Access to order data is limited to those who need it.
7. Cookies
Our site uses no tracking or advertising cookies. What we store on your device is set out in the Cookie policy.
8. Changes
We may change this policy. The date at the top shows when it was last changed. For major changes we will let you know.
9. Contact
Questions about this policy? Email [E-MAIL] or write to [NAAM], [ADRES].
This text comes from the Sanity studio and is updated there.