Privacy Policy

Privacy Policy WONDERBYWOOD

WONDERBYWOOD, located at Meidoornstraat 1, 1402 CM Bussum, the Netherlands, is responsible for the processing of personal data as described in this privacy policy.

Contact details:
WONDERBYWOOD
Meidoornstraat 1, 1402 CM Bussum, the Netherlands
Email: info@wonderbywood.com
Phone: +31 6 23093397
Chamber of Commerce: 82475660 | VAT: NL003690128B72

What personal data do we process?

We process personal data that you provide to us directly or that is generated through your use of our webshop:

• Orders: first and last name, address details, email address, phone number, payment-related data (no full card details)
• Newsletter: email address and language preferences
• Contact: name, email address and the content of your message
• Web analytics: IP address, browser type, pages visited, session duration (anonymised where possible)
• Fraud prevention: IP address, address and payment data

Purposes and legal bases

We process your personal data solely for the purposes listed below and on the corresponding legal basis (Art. 6 GDPR):

• Performance of a contract (Art. 6(1)(b) GDPR): processing orders, delivering products, communicating about your order, handling returns and warranty claims
• Legal obligation (Art. 6(1)(c) GDPR): retaining invoice and accounting records in compliance with statutory retention requirements (7 years)
• Legitimate interest (Art. 6(1)(f) GDPR): fraud prevention, system security, service improvement, web analytics
• Consent (Art. 6(1)(a) GDPR): newsletter, personalised email marketing, non-functional cookies. You may withdraw your consent at any time.

Retention periods

• Order data: 7 years (statutory fiscal retention obligation)
• Customer account: up to 2 years after last activity, unless you request deletion earlier
• Newsletter: for as long as you are subscribed; deleted immediately upon unsubscribing
• Contact messages: maximum 1 year after resolution
• Web analytics data: maximum 26 months (anonymised)

Disclosure to third parties

We only share your personal data with third parties where necessary for the performance of our agreement or where required by law. We enter into data processing agreements with companies that process data on our behalf to ensure the same level of security and confidentiality.

We use the following categories of processors:

• Shopify Inc. (e-commerce platform, based in Canada — adequacy decision or SCCs apply)
• Payment service providers (e.g. Mollie, iDEAL, credit card companies)
• Logistics partners (delivery services)
• Email marketing services (for newsletter)
• Web analytics services

We do not sell your personal data to third parties.

International transfers

Shopify Inc. is based in Canada. Canada has an adequacy decision from the European Commission, allowing transfers to take place. For other processors located outside the EU/EEA, we use the Standard Contractual Clauses approved by the European Commission.

Cookies

We use functional, analytical and marketing cookies.

• Functional cookies: necessary for the operation of the webshop (shopping basket, login status). No consent required.
• Analytical cookies: measure visitor behaviour to improve our website. Placed in anonymised form where possible.
• Marketing cookies: for personalised ads on external platforms. Only placed with your consent.

You can refuse or delete cookies via your browser settings.

Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or destruction. Our website uses a secure SSL/TLS connection.

Your rights

Under the GDPR you have the following rights:

• Right of access (Art. 15 GDPR): you can request which personal data we process about you
• Right to rectification (Art. 16 GDPR): you can have inaccurate data corrected
• Right to erasure (Art. 17 GDPR): you can request deletion of your personal data
• Right to restriction (Art. 18 GDPR): you can have processing restricted in certain cases
• Right to data portability (Art. 20 GDPR): you can obtain your data in a structured, commonly used format
• Right to object (Art. 21 GDPR): you can object to processing based on legitimate interest or for direct marketing
• Right to withdraw consent: you may withdraw previously given consent at any time (without retroactive effect)

Send your request to info@wonderbywood.com. We will respond within one month. We may ask for additional information to verify your identity.

Right to lodge a complaint

If you have a complaint about how we process your personal data, you have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (Dutch Data Protection Authority):
Website: www.autoriteitpersoonsgegevens.nl
Phone: +31 900 2001 201

You may also lodge a complaint with the supervisory authority in your country of residence.

Changes

We reserve the right to amend this privacy policy. The most up-to-date version is always available on this page. Last updated: May 2025.