Privacy statement

Who is responsible for your data?

• •Identity of the controller: Butterly Bakery
• •KvK (trade register number): 42195981
• •VAT number: to be issued by the Dutch Tax Administration
• •Registered address: Laan Rozenburg 7, 1181 ER Amstelveen, the Netherlands
• •Contact for privacy matters: hello@butterlybakery.nl

What personal data do we process and how do we obtain it?

We collect your personal data mainly when you use our webshop, place an order, create an account or subscribe to our newsletter. The categories of data we process are:

• •Identification and contact data: first name, last name, delivery address, email address and, if you provide it, your phone number.
• •Transaction and purchase data: ordered products, delivery dates, subscription orders, pause/cancellation requests and their status, and any gift message you provide.
• •Visit and preference data: pages viewed, referring links, approximate city/country, device type and session identifiers. For signed-in visitors, activity may be linked to their account.
• •Newsletter data: your email address and your communication preferences.

For what purpose and on what legal basis do we process your data?

• •Managing orders and accounts: arranging delivery, saving signed-in customers’ delivery details for future checkout, processing subscription pause/cancellation requests and notifying the bakery to handle them. Legal basis: performance of the agreement (art. 6.1.b GDPR).
• •Meeting legal obligations: keeping the accounting and tax records required under Dutch law. Legal basis: legal obligation (art. 6.1.c GDPR).
• •Customer service: answering your questions, complaints or information requests via our official channels. Legal basis: performance of the agreement or our legitimate interest in helping you (art. 6.1.f GDPR).
• •Newsletters and seasonal-product promotions require separate newsletter consent (art. 6.1.a GDPR). Creating an account or buying a subscription does not automatically sign you up. You can withdraw consent at any time.
• •Understanding visits and shopping activity to improve the shop, including pages, referrers, approximate location and checkout progress. We limit the data used for this purpose. Legal basis: our legitimate interest (art. 6.1.f GDPR).
• •When you check delivery availability, we record the entered postcode, time and result to investigate problems with the postcode check. These records are accessible only to the administrator, contain no name or street address and are not sent to Meta. Legal basis: our legitimate interest in a working delivery check (art. 6.1.f GDPR). You can object by contacting us by email.

To which recipients do we disclose your data?

To provide our services, we share your data with trusted suppliers who act as processors under strict security conditions:

• •Payment and transaction providers, so your order can be paid securely (we never see or store your card details).
• •Delivery planning based on the postcode you give us, so your order reaches you.
• •Technology suppliers such as hosting, email and analytics services that help us run the webshop.
• •Meta Platforms Ireland Ltd. (Facebook & Instagram), only if you accept advertising cookies: pages and products viewed, basket additions, completed purchases (order reference, amount and currency, products), ad-click reference, Meta browser cookies, browser details and IP address, to measure and improve our ads. Meta acts as a joint controller for this; see Meta’s privacy policy. Legal basis: consent (art. 6.1.a GDPR), which you can withdraw at any time via Cookie settings.
• •Public authorities and official bodies where there is a legal obligation to share data.

We do not sell or hand over your personal data to third parties for their own commercial purposes without your explicit consent.

Chat with the bakery

When you message us in the chat, we store your name, email address and messages to answer your request. Only the bakery can access the inbox. This is not an AI chat. A random access key saved in your browser keeps your conversation available on this device. Do not share this key and avoid sensitive information in your messages. Chat does not use advertising tracking. Legal basis: responding to your request (art. 6.1.b GDPR). You can request deletion at hello@butterlybakery.nl.

How long do we keep your data?

We only keep your personal data as long as necessary for the purposes for which it was collected, or as long as a contractual or commercial relationship exists. Once the relationship ends, you unsubscribe or you withdraw your consent, your data is no longer used for active processing or communication. Order and invoice data are kept for 7 years because of Dutch tax retention rules; account data is kept until you ask us to delete it; newsletter data is kept until you unsubscribe. After the statutory retention periods, your data is permanently deleted.

Postcodes from availability checks are visible in the administrator’s report for up to 30 days. Older postcodes and results are removed when the next shop activity is recorded.

What are your rights and how can you exercise them?

You have the right to:

• •Access: know whether we process your data and obtain access to it.
• •Rectification: ask us to correct incorrect or incomplete data.
• •Erasure ("right to be forgotten"): ask us to delete your data when it is no longer needed.
• •Objection: object at any time to the processing of your data for commercial purposes.
• •Restriction of processing: ask us to suspend processing in the cases provided by law.
• •Portability: receive your data in a structured, commonly used and machine-readable format.
• •Withdraw consent: withdraw consents previously given at any time.

To exercise any of these rights, send a request to hello@butterlybakery.nl with "GDPR rights" in the subject line, and we will respond within one month. If you believe we have not handled your rights correctly, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via www.autoriteitpersoonsgegevens.nl.

Security

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Access to personal data is limited to the people and systems that need it to run the bakery.