Privacy policy

Who is responsible for your data?

HobbyDeals, trading as HobbyDeals, is the controller of the personal data you give us through this web shop.
Address: de savornin lohmanstraat, 16, 4571 KH axel, Netherlands
Email: info@racktrace.io
Phone: 0614926946
Chamber of Commerce (KvK) number: 42194504

For questions about your data, contact info@racktrace.io. We do not have a data protection officer; for a shop of our size this is not required.

Which data do we process?

• Order data: your name, your email address, the delivery address and the billing address, your phone number if you give it, and for a business order the company name and the VAT number. Also what you order, the amounts and the version of the terms you accepted.
• Payment data: the status of your payment and the references Stripe gives us for it. You enter your card or account details with Stripe; they do not reach us.
• Account data, if you create an account: your email address, your password in encrypted form (we do not know your password itself), your profile, your saved addresses and your choices about consents, such as the newsletter.
• Shipping and returns: the carrier and the tracking code of your shipment, and for a return the products, the reason and your explanation.
• Messages: what you write to us, and the notes we make to handle your order or your question.
• Security log: for actions with your account we record what happened, when, and from which IP address. This includes, among other things, signing in (including a failed attempt), signing out, registering, confirming or changing your email address, resetting or changing your password, linking an order placed without an account to your account, downloading your data and deleting your account.
• Technical data: for each request the server logs the type of request, the address of the page, the status and the duration, without your IP address. To slow down too many requests, the server also uses your IP address briefly in memory.

What do we use your data for, and on what legal basis?

• Carrying out your order: payment, shipping, messages about your order, returns, complaints and refunds. Legal basis: the contract with you (Article 6(1)(b) GDPR).
• Your account: signing in, and showing your addresses and orders. Legal basis: the contract with you (Article 6(1)(b) GDPR).
• Our records: keeping invoices, credit notes and the accounts. Legal basis: a legal obligation, the statutory tax retention duty (Article 6(1)(c) GDPR).
• Security: protecting the web shop and your account against misuse, with the security log, the technical logs, slowing down too many requests and securing sign-in. Legal basis: our legitimate interest in a secure web shop, which is also in your interest (Article 6(1)(f) GDPR).
• The newsletter: only if you choose it. Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time in your account; this does not affect what we did before.

Without your name, email address and delivery address we cannot carry out your order. Your phone number is optional. We do not take decisions about you based solely on automated processing, and we do not create profiles.

Who do we share data with?

• Stripe, our payment service, processes your payment. Stripe also checks payments for fraud, and is itself responsible for that and for its own legal obligations. See Stripe's privacy policy.
• The carrier that delivers your parcel receives your name and the delivery address.
• Our email provider sends the web shop's emails, such as your order confirmation.
• Our hosting provider stores the web shop and the database.
• Our accountant and the Dutch Tax Administration receive data where the law requires it.

Parties that process data on our behalf do so only on our instructions, under a data processing agreement. We never sell your data.

Data outside the European Economic Area

Stripe may transfer data to Stripe, Inc. in the United States. For this, Stripe is certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision, and also uses the European Commission's standard contractual clauses. Our other recipients process your data within the European Economic Area.

How long do we keep data?

• Invoices, credit notes and paid orders, with the data that belongs to them: 7 years. This is the statutory tax retention period.
• A cancelled order without an account, without payment and without an invoice: after 1 year we make your name, email address, address and phone number in it unrecognisable.
• Completed background tasks, such as sending an email: we delete them after 30 days.
• Your account: for as long as you have it. If you delete it, we immediately delete your account, your profile, your saved addresses, your consents, your cart, your sessions and the messages you sent through the web shop while signed in. We immediately make a cancelled order of your account without payment and without an invoice unrecognisable. We unlink your other orders from your account; we keep those with a payment or invoice until the end of the tax retention period.
• The security log: we keep the IP address for 12 months; after that we remove it from the log. What happened and when remains. If you delete your account, the security log remains, no longer linked to your account.
• Your session expires after 12 hours without a visit, and after 7 days at the latest.
• We keep messages you send us for as long as we need them to handle your question, unless they form part of our records.

Cookies

The shop only sets functional cookies, so there is no cookie banner. There are no analytics cookies, no advertising cookies and no tracking cookies.

• Session cookie __Host-hobbydeals_session: keeps you signed in and remembers your cart. The CSRF token that protects forms belongs to this session and is a hidden form field, not a separate cookie. The cookie is only sent over HTTPS and cannot be read by scripts. It expires after 12 hours without a visit, and after 7 days at the latest.
• Language cookie hd_locale: remembers the language you chose. It is kept for 1 year.

When you pay, you go to Stripe's payment page. Stripe sets its own cookies there, under Stripe's privacy policy.

Your rights

• Access and portability: in your account, under Privacy, you download all the data we keep in your account, as a JSON file.
• Rectification: you change your profile and your addresses yourself in your account.
• Erasure: under Privacy in your account you delete your account. Data we must keep by law is kept until the end of that period.
• Restriction and objection: you can ask us to do less with your data, and object to its use on the basis of our legitimate interest.
• Withdrawing consent: you switch off the newsletter in your account.

No account, or do you want something you cannot do yourself in your account? Email info@racktrace.io. We respond within one month. We may ask you to confirm that the request comes from you, for example by emailing from the email address of your order.

Complaints to the supervisory authority

If you are not satisfied with how we handle your data, please let us know first. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). If you live in Belgium, you can also turn to the Belgian Data Protection Authority.

Security

We protect your data with appropriate technical and organisational measures. The web shop only works over HTTPS, we only store passwords in encrypted form, only authorised administrators have access to the back office, and payment details stay with Stripe. If something does go wrong with your data, we report it to the Dutch Data Protection Authority as the law requires, and to you where necessary.

Changes

We may change this privacy policy. The current version is always on this page.