Privacy Policy
We only collect the details we need to deliver your boxes, keep you informed and run our business, and we never sell your data. This policy explains what we collect, why, and what you can ask of us. Items in [square brackets] still need to be filled in.
1. Who we are
Bubbles & Bites is a trade name of Bubbles and Bites BV, located in Haarlem, the Netherlands. KvK number 42083072, VAT number NL869629190B01.
We are the controller of your personal data, which means we decide how and why it is used. For any privacy question, email us at info@bubbles-bites.com or call [phone number]. We aim to reply within 24 hours.
2. What data we collect
We collect data that you give us when you order, sign up or contact us:
- Contact details: first and last name, email address and phone number.
- Delivery details: delivery address, chosen delivery day and any delivery notes you add.
- Order details: which box or package you chose, your order history, pauses, skips and cancellations.
- Payment details: payment status, payment method and, for packages, the SEPA direct debit or card authorisation. Your full bank or card details are handled by Mollie; we never see or store your full card number.
- Age confirmation: your confirmation at checkout that you are 18 or older. At the door we look at your ID, but we never copy, photograph or store it.
- Communication: emails, messages and complaints you send us.
- Marketing preferences: whether you agreed to receive news and offers.
- Sign-up forms: details you leave on our sign-up or waiting list forms.
- Website data: technical data such as IP address, browser type and pages visited (see section 6).
3. Why we use your data
Under the GDPR (AVG), we need a legal basis for every use of your data. This is what we use your data for, and why we are allowed to.
| Purpose | Data used | Legal basis |
|---|---|---|
| Processing your order and delivering your boxes | Contact, delivery and order details | Performing our agreement with you |
| Collecting payments and handling refunds | Payment and order details | Performing our agreement with you |
| Sending reminders, payment notices and delivery updates by email or text | Contact and order details | Performing our agreement with you |
| Checking that you are 18 or older | Age confirmation | Legal obligation (Dutch Alcohol Act) |
| Keeping our bookkeeping and invoices | Order and payment details | Legal obligation (tax law) |
| Answering questions and handling complaints | Contact details and communication | Performing our agreement, or our legitimate interest in helping you |
| Sending news, offers and the occasional survey | Contact details and marketing preferences | Your consent, which you can withdraw at any time |
| Improving our website and service | Website data | Our legitimate interest, or your consent for non-essential cookies |
We do not use automated decision-making or profiling that has legal effects for you.
4. Who we share your data with
We deliver the boxes ourselves, so your address stays with us. We do use a few trusted service providers to run our business. They only process your data on our instructions, under a data processing agreement.
| Provider | What they do for us | Where data is stored |
|---|---|---|
| Mollie | Payment processing | European Union |
| HubSpot | Customer relationship management (CRM) and emails | [EU data centre / United States] |
| Jotform | Sign-up and waiting list forms | [EU data centre / United States] |
| Microsoft 365 | Our business email | [European Union] |
| Vercel | Hosting our website | [United States / European Union] |
| [Accounting software] | Invoices and bookkeeping | [European Union] |
When a provider stores data outside the European Union, we make sure it is properly protected, for example through the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
We only share your data with others when the law requires it, for example with the Tax Authority (Belastingdienst). We never sell or rent your data.
5. How long we keep your data
We keep your data no longer than we need it, or than the law requires.
| Data | How long |
|---|---|
| Invoices, payments and order records | 7 years, as required by Dutch tax law |
| Customer account, contact and delivery details | As long as you are a customer, then [2] years after your last order |
| Questions and complaints | [2] years after the matter is closed |
| Marketing preferences | Until you unsubscribe or withdraw your consent |
| Sign-up and waiting list details | Until you place an order, unsubscribe, or at most [1] year |
| Website data | See our cookie settings (section 6) |
After these periods, we delete or anonymise your data.
6. Cookies and analytics
Our website uses cookies: small files stored on your device.
- Essential cookies make the website work, for example to keep your basket and log you in to your account. These do not need your consent.
- Analytics cookies help us understand how visitors use the website, so we can improve it. We use [analytics tool, e.g. Vercel Web Analytics / Google Analytics], [set up in a privacy-friendly way, without sharing data for advertising].
- Marketing cookies are [not used / only placed with your consent, for example HubSpot tracking or social media pixels].
When you first visit, you can choose which non-essential cookies to accept. You can change your choice at any time via [cookie settings link] or delete cookies in your browser.
7. Your rights
You are always in control of your data. You have the right to:
- See which personal data we hold about you.
- Correct data that is wrong or incomplete. Many details you can change yourself in your account.
- Delete your data, unless we must keep it by law (for example invoices).
- Restrict how we use your data while a question or complaint is being handled.
- Receive your data in a common format, or have us send it to another company.
- Object to our use of your data based on our legitimate interest.
- Withdraw your consent for news and offers at any time, using the unsubscribe link in every email or by contacting us.
To use any of these rights, email info@bubbles-bites.com. We may ask you to confirm your identity first. We respond within one month.
Not happy with how we handle your data? Please tell us first, so we can put it right. You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
8. Security, age and changes
Security. We protect your data with appropriate measures, such as secure (HTTPS) connections, strong passwords with two-factor authentication on our business accounts, and access limited to the people who need it. If a data breach occurs that puts your data at risk, we will inform you and the authorities as required by law.
Age. Our products contain alcohol, so we do not knowingly collect data from anyone under 18. If we find out that we have, we delete it.
Changes. We may update this policy, for example when we add a new service provider. The latest version is always on our website. If a change is important, we will let you know by email.
Last updated: [date]