Privacy policy

Controller

The controller for the processing of personal data in this shop is:
FS Trading & Home Office Supply
Assinklanden 391
7542 BJ Enschede
Overijssel
Netherlands
Email: info@freddys-store.com

We have not appointed a data protection officer; we are not required to do so under Article 37 GDPR.

What we collect

When you browse the shop

Each page request causes our hosting provider to record technical access data: a truncated IP address, the date and time, the address requested, the referring page, the browser type and the operating system. This data is needed to serve and secure the shop.

When you place an order

• First and last name, billing and delivery address
• Email address and, if you give one, a phone number for questions about the delivery
• The items ordered, the order number, the order date and the amount
• Payment data you enter with the payment provider - we never see or store full card or account details
• For business customers, additionally the company name and VAT identification number

When you contact us

If you email us we process your address and the content of your message in order to answer it.

Purposes and legal bases

• Handling your order, delivery and payment: Article 6(1)(b) GDPR (performance of a contract).
• Keeping invoices and accounting records: Article 6(1)(c) GDPR (legal obligation).
• Operating and securing the shop, preventing abuse and answering enquiries: Article 6(1)(f) GDPR (legitimate interest).
• Non-essential cookies and, where offered, the newsletter: Article 6(1)(a) GDPR (consent).

Cookies and similar technologies

Essential cookies and comparable browser storage hold your basket, your language and country selection and your session security. The shop does not work without them.

Every other cookie is set only after you have agreed in the cookie banner. You can withdraw that consent at any time through the banner, with effect for the future.

Recipients and processors

• Mollie B.V., Amsterdam, Netherlands - payment processing. Mollie receives the data required for the payment method you choose. Which methods are offered depends on your country and your order and is shown during checkout.
• Cloudflare, Inc., San Francisco, USA - serving the pages, caching and protection against attacks.
• Hetzner Online GmbH, Gunzenhausen, Germany - server operation for the shop backend.
• Sanity AS, Oslo, Norway - the content system in which the text and images of this shop are maintained.
• Carriers and logistics providers - your name and delivery address, so that your order can be delivered.

We have Article 28 GDPR processing agreements with the providers that process on our behalf. Beyond that we disclose data only where we are legally required to.

Transfers outside the EEA

Cloudflare is based in the United States. The transfer relies on the EU-US Data Privacy Framework and, in addition, on standard contractual clauses under Article 46(2)(c) GDPR. Norway, where Sanity is based, is part of the European Economic Area, so no third-country transfer arises there.

Retention

• Order and invoice data is kept for as long as commercial and tax retention rules require: seven years in the Netherlands, and up to ten years towards the German tax authorities.
• Server access logs are deleted or anonymised after 30 days at the latest.
• Contact enquiries are deleted once the matter is closed and no retention duty applies, at the latest after twelve months.
• Records of consent are kept for three years after the consent is withdrawn.

Your rights

• Access to the data held about you (Article 15 GDPR)
• Rectification of inaccurate data (Article 16 GDPR)
• Erasure (Article 17 GDPR)
• Restriction of processing (Article 18 GDPR)
• Data portability (Article 20 GDPR)
• Objection to processing based on legitimate interests (Article 21 GDPR)
• Withdrawal of consent, with effect for the future (Article 7(3) GDPR)

An informal message to info@freddys-store.com is enough. We reply within the statutory period of one month.

Right to complain to a supervisory authority

You may complain to a data protection supervisory authority. For us as a Dutch company that is the Autoriteit Persoonsgegevens in The Hague. You may equally approach the authority where you habitually live, in Germany the data protection authority of your federal state.

Obligation to provide data

Your name, address, email address and payment details are necessary to enter into a contract of sale. Without them we cannot accept or deliver an order. Everything else is optional.

Automated decision-making

No automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place.