Login

Language

Cart

Your cart is empty

Privacy Policy

Protecting your personal data matters to us. This privacy policy explains which data we collect, why we process it, and which rights you have. We process personal data in accordance with the General Data Protection Regulation (GDPR).

1. Who we are

The controller responsible for data processing on this website is:

Pieces of Art Dwarsryd 1 D 9291 NL Kollum The Netherlands Email: info@piecesofart.nl Phone: +31 6 29776701 Website: www.piecesofart.com Chamber of Commerce (KvK): 89095200 VAT ID: NL004691592B39

2. Which data we collect

Depending on how you use our website and services, we process the following data:

When you place an order

  • First and last name
  • Email address and phone number
  • Billing and delivery address
  • Payment details (processed by our payment provider; we do not store full payment details ourselves)
  • Order history

When you use the contact form

  • Name
  • Email address
  • The content of your message

When you subscribe to our newsletter

  • Name and email address
  • Data about your interaction with our emails (such as opens and clicks)

When you visit our website

  • IP address (anonymised where possible)
  • Information about your device and browser
  • Usage data such as pages visited and click behaviour (via cookies and similar technologies, see section 4)

3. Purposes and legal bases

We process personal data for the following purposes and on the following legal bases:

Purpose Legal basis
Processing orders, including delivery and invoicing Performance of a contract (Art. 6(1)(b) GDPR)
Responding to enquiries via the contact form or email Legitimate interest (Art. 6(1)(f) GDPR)
Sending our newsletter Consent (Art. 6(1)(a) GDPR)
Improving our website and analysing visitor behaviour Consent (Art. 6(1)(a) GDPR)
Showing personalised advertising on platforms such as Meta and Pinterest Consent (Art. 6(1)(a) GDPR)
Complying with legal obligations, in particular tax retention requirements Legal obligation (Art. 6(1)(c) GDPR)

4. Cookies and similar technologies

Our website uses cookies. On your first visit, we ask for your consent to place non-essential cookies via a cookie banner. You can withdraw your consent or change your preferences at any time.

Essential cookies Required for the website and shop to function (such as the shopping cart and session management). No consent is required for these.

Analytics — Google Analytics 4 We use Google Analytics 4, a web analytics service provided by Google Ireland Ltd., to understand how our website is used (such as visitor numbers and frequently visited pages). Data may be transferred to servers outside the EU, including in the United States.

Behaviour analysis — Hotjar We use Hotjar to analyse how visitors use our website (for example through anonymised heatmaps). This helps us improve the website. Hotjar is only loaded after your consent.

Marketing — Meta Pixel and Pinterest Tag We use the Meta Pixel of Meta Platforms Ireland Ltd. (Facebook and Instagram) and the Pinterest Tag of Pinterest Europe Ltd. to measure the effectiveness of our advertising and to show relevant ads to visitors of our website. These providers may combine this data with other information available to them. These technologies are only used after your consent.

Email marketing — Klaviyo We use Klaviyo to send our newsletter. Klaviyo also records interactions with our emails and, after your consent, behaviour on our website to make content more relevant. You can unsubscribe at any time via the link in every email.

5. Sharing data with third parties

We never sell your data. We only share data with service providers that are necessary for our services:

  • Shopify: the platform on which our shop runs and is hosted
  • Payment providers (such as Mollie, Stripe and Klarna): to process payments
  • Shipping carriers (such as PostNL and DHL): to deliver orders (name and delivery address)
  • Klaviyo: for email marketing
  • Google, Meta, Pinterest and Hotjar: for analytics and advertising (see section 4)
  • Accounting and administration services: for invoicing and tax administration

We have data processing agreements (Art. 28 GDPR) in place with providers that process personal data on our behalf. Some of these providers (such as Google, Meta, Pinterest, Klaviyo, Hotjar and Shopify) process data on servers outside the European Economic Area, including in the United States. In those cases, transfers take place on the basis of the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission (Art. 46 GDPR).

6. Hosting

Our shop runs on the platform of Shopify International Ltd. Our domain and business email are managed through Hostnet, a Dutch hosting provider. GDPR-compliant agreements are in place with both providers.

7. How long we keep your data

We do not keep personal data longer than necessary:

  • Order and invoice data: 7 years, in line with the statutory retention obligation in the Netherlands
  • Contact form enquiries: up to 1 year after the enquiry has been handled
  • Newsletter data: until you unsubscribe
  • Analytics and marketing data: according to the retention periods of the respective providers, with a maximum of 26 months

8. How we protect your data

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. Our website uses an encrypted connection (SSL/TLS), and access to systems is limited to staff who need it for their work.

9. Your rights

Under the GDPR, you have the following rights:

  • Access (Art. 15 GDPR): you can ask which data we process about you
  • Rectification (Art. 16 GDPR): you can have inaccurate data corrected
  • Erasure (Art. 17 GDPR): you can request deletion of your data, insofar as no statutory retention obligations apply
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR): you can receive your data in a commonly used format
  • Withdrawal of consent (Art. 7(3) GDPR): you can withdraw any consent you have given at any time, for example for cookies or the newsletter

Right to object (Art. 21 GDPR): you have the right to object at any time, on grounds relating to your particular situation, to processing of your data based on legitimate interests. You can object to processing for direct marketing purposes at any time, without giving reasons.

To exercise your rights, simply send an email to info@piecesofart.nl. We will respond within four weeks. To verify your identity, we may ask for additional information.

You also have the right to lodge a complaint with a data protection supervisory authority:

  • The Netherlands: Autoriteit Persoonsgegevens, www.autoriteitpersoonsgegevens.nl
  • Germany: the state data protection authority of your place of residence, or the Federal Commissioner for Data Protection and Freedom of Information, www.bfdi.bund.de
  • Belgium: Data Protection Authority, www.dataprotectionauthority.be
  • Or the supervisory authority of your own EU member state

10. Changes to this privacy policy

We may update this privacy policy, for example when our services or the legal situation change. The most recent version is always available on our website.

11. Contact

If you have any questions about this privacy policy or about how we process your data, you can reach us at info@piecesofart.nl.