Dwaalstêr

Last updated: 05-07-2026
Dwaalstêr Editions respects your privacy and processes your personal data in accordance with the General Data Protection Regulation (GDPR / AVG) and applicable Dutch law. This Privacy Policy explains what personal data we collect through our website (the "Website"), why we collect it, how long we keep it, with whom we share it, and what rights you have. It applies to visitors to the Website and to customers who place orders with us.

1. Who we are (the controller)
Dwaalstêr Editions is the controller responsible for the processing of your personal data.
Dwaalstêr Editions Rombout Hogerbeetstraat 109-16 1052 VW Amsterdam The Netherlands
Chamber of Commerce (KVK) registration: 94036322 VAT (BTW) number: NL866612506B01 Email: info@dwaalster.org
Given the nature and scale of our processing, we are not required to appoint a Data Protection Officer. For any question about this Policy or about your personal data, please contact us at the email address above.

2. What personal data we collect
Depending on how you use the Website, we may process the following categories of personal data:
Identity and contact data — your name, email address, billing address, delivery address, and (if you provide it) your telephone number.
Order and transaction data — the items you order, order number, order history, amounts paid, and correspondence relating to your order.
Payment data — your payment method and confirmation of payment. Card and bank details are entered directly with our payment provider's secure systems (see Article 5) and are not stored by us.
Account data — if you create a customer account, your login details and saved preferences.
Communications — the content of messages you send us, for example by email or through a contact or complaints form.
Technical and usage data — IP address, device and browser type, and information about how you use the Website, collected through cookies and similar technologies (see Article 9).
We do not knowingly collect special categories of data (such as data on health, religion, or ethnicity), and we do not ask you to provide them.

3. Why we process your data, and our legal basis
We only process your personal data where we have a legal basis to do so under the GDPR:
To perform our contract with you (Article 6(1)(b) GDPR) — processing and confirming your order, taking payment, delivering goods and any digital content, providing customer service, and handling returns, withdrawals, and complaints.
To comply with a legal obligation (Article 6(1)(c) GDPR) — in particular, retaining invoices and order records to meet our tax and accounting obligations under Dutch law.
For our legitimate interests (Article 6(1)(f) GDPR) — keeping our Website and shop secure, preventing fraud and misuse, and keeping proper business records. Where we rely on legitimate interests, we weigh those interests against your rights and freedoms, and you may object at any time (see Article 8).
With your consent (Article 6(1)(a) GDPR) — placing analytics cookies through Google Analytics to measure and improve how the Website is used (see Article 9). You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Where processing is necessary to conclude or perform a contract, providing the relevant data is a condition of placing an order; if you do not provide it, we will not be able to process or deliver your order.

4. Automated decision-making
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects for you.
5. Who we share your data with
We do not sell your personal data. We share it only with the following providers, who process it on our behalf and only to the extent necessary to run our shop:
Shopify — provides our online shop, checkout, and payment processing. Your contact, order, and payment details are processed through Shopify so that your purchase can be completed and your payment taken. Card and bank details are entered directly into Shopify's secure payment systems and are not stored by us. Shopify is a Canadian company and may process data through infrastructure located outside the EEA (see Article 6).
DigitalOcean — provides the cloud infrastructure on which our self-hosted Website runs. DigitalOcean is a United States company (see Article 6).
Google (Google Analytics) — provides website analytics that help us understand how the Website is used so that we can improve it, as described in Article 9. Google is a United States company (see Article 6).
We may also disclose personal data to our accountant, or to tax or other authorities, where we are required to do so by law — for example, to meet the record-keeping obligations described in Article 7.
Where a provider processes personal data on our behalf, we have a data processing agreement (verwerkersovereenkomst) in place that requires them to protect your data and to process it only on our instructions.

6. International transfers
Some of the providers we use are based outside the European Economic Area (EEA), or process data through servers or group companies located outside the EEA, including in the United States and Canada. Where your personal data is transferred outside the EEA, we ensure an appropriate safeguard is in place so that it continues to enjoy an equivalent level of protection, namely one or more of the following:
an adequacy decision of the European Commission — Canada benefits from an adequacy decision for commercial organisations, and certified providers in the United States are covered by the EU–US Data Privacy Framework; and/or
the European Commission's Standard Contractual Clauses, together with additional safeguards where appropriate.
You may request further information about these safeguards, or a copy of the relevant clauses, using the contact details in Article 1.

7. How long we keep your data
We keep your personal data no longer than necessary for the purposes for which it was collected:
Order, invoice, and payment records — 7 years from the end of the relevant financial year, to meet our statutory tax retention obligation.
Account data — for as long as you maintain a customer account, and deleted within a reasonable period after you close it, subject to the retention period above for any orders you have placed.
Correspondence — for as long as needed to handle your query and for a reasonable period afterwards.
Analytics and cookie data — for the periods set out in Article 9.
After the applicable period, we delete or anonymise your personal data.

8. Your rights
Under the GDPR you have the following rights in relation to your personal data:
Access — to obtain confirmation of whether we process your data and a copy of it;
Rectification — to have inaccurate or incomplete data corrected;
Erasure — to have your data deleted in certain circumstances ("right to be forgotten");
Restriction — to have our processing restricted in certain circumstances;
Portability — to receive certain data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller;
Objection — to object to processing based on our legitimate interests, and to object at any time to the use of your data for direct marketing;
Withdrawal of consent — to withdraw any consent you have given, at any time.
To exercise any of these rights, contact us at the email address in Article 1. We will respond without undue delay and in any event within one month of receiving your request. We may ask you to confirm your identity before we act on a request. Exercising these rights is free of charge, unless a request is manifestly unfounded or excessive.

9. Cookies and similar technologies
The Website uses cookies and similar technologies.
Strictly necessary cookies are required for the Website and the shop to function — for example, to keep items in your basket, to enable secure checkout through Shopify, and to keep the Website secure. These are placed without consent because the Website cannot work properly without them.
Analytics cookies are placed by Google Analytics, which we use to measure and understand how visitors use the Website so that we can improve it. These cookies collect information such as the pages you visit, how long you stay, and the approximate location and technical characteristics of your device, and they involve a transfer of data to Google (see Article 6). Google Analytics cookies are non-essential and are placed only after you have given consent through our cookie banner. You can refuse them, or change or withdraw your consent at any time, through the cookie banner or your browser settings. Google Analytics cookies remain on your device for up to two years unless you delete them earlier.
Refusing analytics cookies does not affect your ability to browse the Website or place an order.

10. How we protect your data
We take appropriate technical and organisational measures to protect your personal data against loss, misuse, and unauthorised access. Data transmitted through the Website is sent over a secure, encrypted connection, and our shop and hosting providers (Shopify and DigitalOcean) maintain their own security measures for the infrastructure they operate. While no method of transmission or storage is completely secure, we work to maintain safeguards appropriate to the sensitivity of the data we hold.

11. Children
The Website and our products are not directed at children, and we do not knowingly collect personal data from children under the age of 16 without the consent of a parent or guardian. If you believe we have collected such data, please contact us and we will delete it.

12. Complaints to the supervisory authority
If you have a concern about how we handle your personal data, we would like the opportunity to resolve it — please contact us first. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the supervisory authority in the EU country where you live or work.

13. Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in our processing or in the law. The current version is always available on the Website, and the date at the top shows when it was last updated. Where changes are significant, we will take reasonable steps to bring them to your attention.