Privacy policy

Who is responsible for your data

We are. And you can always ask us about it.

This privacy policy explains how Smells 'n Burns handles personal data when you visit smellsnburns.nl, place an order, subscribe to our newsletter or contact us. The controller within the meaning of the General Data Protection Regulation (GDPR, in Dutch: AVG) is:

• [legal name], trading as Smells 'n Burns
• [address]
• KvK: [KvK number]
• Email: info@smellsnburns.nl

For any question about your personal data, email us at info@smellsnburns.nl.

What we collect, why, and on what legal basis

Only what we need to get your candle to you, plus your email for the newsletter if you ask for it.

• Orders. Your name, email address, delivery address, the contents and amount of your order, and the payment status (not your card or bank details). We use this to process, ship and support your order, to send order emails (confirmation, shipping, and help with returns or complaints) and to handle your rights under consumer law. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Bookkeeping. Order and payment records that we must keep for tax purposes. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
• Newsletter. Your email address, and the date and proof of your sign-up and confirmation. We only add you after you confirm via the link we email you (double opt-in). We send at most one newsletter per month. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time via the unsubscribe link in every newsletter or by emailing us; this does not affect the lawfulness of earlier mailings.
• Contact. If you email us, your email address, name and whatever you write, so we can answer you. Legal basis: our legitimate interest in answering your question (Art. 6(1)(f) GDPR), or the contract if it concerns an order.
• Withdrawals and complaints. Your name, order number, email address and the content, date and time of your withdrawal or complaint, so we can process it and prove that we did. Legal basis: legal obligation and performance of the contract (Art. 6(1)(b) and (c) GDPR).
• Technical data. Our hosting provider automatically keeps server logs (such as IP address, date and time, and the page requested) to keep the website running and secure. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

Providing order details is necessary to conclude the contract; without them we cannot deliver your order. We do not use automated decision-making or profiling, and we never sell your data.

Cookies

One tiny cookie that remembers your basket. No tracking, no ads, so no consent banner needed, just a friendly note.

We use one functional cookie, called snb. It is a session cookie that remembers what is in your shopping basket while you browse and check out. It contains a random identifier only, cannot be read by other websites, and is deleted when you close your browser.

This cookie is strictly necessary to provide the webshop you ask for, so under the Dutch Telecommunications Act we do not need your consent to place it. We do not use analytics, advertising or social media tracking cookies. If we ever want to, we will ask for your consent first and update this policy.

When you close our cookie note, your browser also stores a small flag (snb-cookie-note-seen) in its local storage, so the note doesn't pop up again. It contains nothing but "seen", never leaves your device and is not sent to us. You can remove it at any time by clearing your browser's site data.

Who we share your data with

Only the services that help us take payment, send email, host the site and deliver your parcel.

We share personal data only where needed for the purposes above:

• Mollie B.V. (Netherlands), payment processing. Mollie processes payment data partly on our behalf and partly as an independent controller for its own legal obligations (for example anti-money-laundering checks). See Mollie's own privacy statement.
• MailerLite (EU), sending our newsletter. Processor on our behalf, under a data processing agreement.
• Hostinger (EU), hosting of our website, database and email. Processor on our behalf, under a data processing agreement.
• PostNL (Netherlands), delivery of your parcel. PostNL receives your name and delivery address, and your email address for track-and-trace messages, and processes these for delivery under its own privacy statement.

We may also share data with our accountant for bookkeeping, or with authorities where the law requires it.

Data outside the EU

We keep things in the EU. If a provider does use a non-EU sub-supplier, legal safeguards apply.

Our providers are based in the European Union. Some of them may use sub-processors outside the European Economic Area (for example in the United States). Where that happens, the transfer is protected by an adequacy decision (such as the EU-US Data Privacy Framework) or by the European Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards.

How long we keep your data

Order records for 7 years because the tax office says so; everything else only as long as it's useful.

• Order and payment records: 7 years after the end of the financial year, as required by Dutch tax law.
• Newsletter: until you unsubscribe. We keep proof of your consent for as long as we need to be able to demonstrate it, and no longer than 2 years after you unsubscribe.
• Emails and complaints not linked to an order: up to 2 years after our last contact.
• Basket cookie: until you close your browser.
• Server logs: as briefly as our hosting provider allows, normally no more than a few weeks.

How we protect your data

Encrypted connections, locked-down admin, and we never touch your card details.

We take appropriate technical and organisational measures to protect your data, including an encrypted (HTTPS) connection, secure cookie settings, two-step login protection for our shop administration, and limiting access to your data to the people who need it to handle your order. Payments are handled entirely by Mollie. If a data breach occurs that poses a risk to you, we will report it to the Dutch Data Protection Authority and, where required, inform you.

Your rights

It's your data. Ask to see it, fix it, delete it, take it with you, or object. We'll reply within a month.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have incorrect data corrected;
• have your data deleted, unless we are legally required to keep it (such as order records for tax purposes);
• restrict the processing of your data;
• receive your data in a commonly used, machine-readable format (data portability);
• object to processing based on our legitimate interest;
• withdraw your consent at any time, where we rely on it.

Send your request to info@smellsnburns.nl. We respond within one month. We may ask you to confirm your identity, for example by replying from the email address you used for your order.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl. We'd appreciate the chance to sort it out with you first.

Changes to this policy

If something important changes (hello, subscriptions), we'll update this page and tell you where needed.

We may update this privacy policy, for example when we launch candle subscriptions with a login link, which will involve processing your subscription and payment mandate details. The current version is always on this page. If a change significantly affects you, we will inform you by email. This version applies from [date].