Privacy Policy

Protecting your personal data matters to us. This privacy policy explains which data we collect, why we do so and which rights you have. We process personal data in accordance with the General Data Protection Regulation (GDPR).

1. Who we are

The controller responsible for data processing on this website is:

Pieces of Art Dwarsryd 1 D 9291 NL Kollum The Netherlands Email: info@piecesofart.nl Phone: +31 6 29776701 Website: www.piecesofart.com Chamber of Commerce (KvK): 42097883 VAT ID: NL869709550B01.

2. Which data we collect

Depending on how you use our website and services, we process the following data:

When you place an order

• First and last name
• Email address and phone number
• Billing and delivery address
• Payment details (processed by our payment provider; we do not store full payment details ourselves)
• Order history

When you use the contact form

• Name
• Email address
• The content of your message

When you subscribe to our newsletter

• Name and email address
• Data about your interaction with our emails (such as opens and clicks)

When you visit our website

• IP address (anonymized where possible)
• Information about your device and browser
• Browsing and click behavior on our website (via cookies and similar technologies, see section 4)

3. What we use this data for

We process personal data for the following purposes and on the following legal bases:

4. Cookies and similar technologies

Our website uses cookies. On your first visit, we use the cookie banner to ask for your consent to place non-essential cookies. You can withdraw your consent or change your preferences at any time.

Functional cookies Necessary for the website and webshop to work (such as the shopping cart and session management). No consent is required for these.

Analytics cookies: Google Analytics 4 We use Google Analytics 4, a web analytics service provided by Google Ireland Ltd., to understand how our website is used, such as visitor numbers and frequently visited pages. Data may be processed on servers outside the EU, including in the United States.

Behavior analysis: Hotjar We use Hotjar to analyze how visitors use our website, for example through anonymized heatmaps. This helps us improve the website. Hotjar is only loaded after you give your consent.

Marketing cookies: Meta Pixel and Pinterest Tag We use the Meta Pixel from Meta Platforms Ireland Ltd. (Facebook and Instagram) and the Pinterest Tag from Pinterest Europe Ltd. to measure the effectiveness of our ads and to show relevant ads to website visitors. These parties may combine your data with other information they have. These technologies are only used after you give your consent.

Email marketing: Klaviyo We use Klaviyo to send our newsletter. Klaviyo also records interactions with our emails and, with your consent, behavior on our website to make the content more relevant. You can unsubscribe at any time via the link in every email.

5. Who we share data with

We never sell your data to third parties. We only share data with parties that are necessary for our services:

• Shopify: the platform on which our webshop runs and is hosted
• Payment providers (such as Mollie, Stripe and Klarna): to process payments
• Carriers (such as PostNL and DHL): to deliver orders (name and delivery address)
• Klaviyo: for email marketing
• Google, Meta, Pinterest and Hotjar: for analytics and advertising (see section 4)
• Accounting and administration services: for invoicing and tax records

We enter into a data processing agreement (Art. 28 GDPR) with parties that process personal data on our behalf. Some of these parties (such as Google, Meta, Pinterest, Klaviyo, Hotjar and Shopify) process data on servers outside the European Economic Area, including in the United States. In those cases, data is transferred on the basis of the EU-US Data Privacy Framework or the European Commission's standard contractual clauses (Art. 46 GDPR).

6. Hosting

Our webshop runs on the Shopify International Ltd. platform. Our domain name and business email are managed through Hostnet, a Dutch hosting provider. We have GDPR-compliant agreements in place with both parties.

7. How long we keep data

We do not keep personal data longer than necessary:

• Order and invoice data: 7 years, due to the statutory tax retention requirement
• Contact form messages: up to 1 year after they have been handled
• Newsletter data: until you unsubscribe
• Analytics and marketing data: according to the retention periods of the tools concerned, up to 26 months

8. How we protect data

We take appropriate technical and organizational measures to protect personal data against loss, misuse and unauthorized access. Our website uses a secure connection (SSL/TLS), and access to systems is limited to staff who need that access for their work.

9. Your rights

Under the GDPR, you have the following rights:

• Access (Art. 15 GDPR): ask which of your data we process
• Rectification (Art. 16 GDPR): have incorrect data corrected
• Erasure (Art. 17 GDPR): have your data deleted, unless a statutory retention obligation applies
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR): receive your data in a commonly used file format
• Withdrawal of consent (Art. 7(3) GDPR): withdraw consent you have given at any time, for example for cookies or the newsletter

Right to object (Art. 21 GDPR): you have the right to object at any time, on grounds relating to your particular situation, to the processing of your data based on legitimate interest. You can always object to processing for direct marketing, without giving reasons.

Would you like to exercise one of these rights? Send an email to info@piecesofart.nl. We will respond within four weeks. To make sure the request was made by you, we may ask for additional information for verification.

You also always have the right to file a complaint with a supervisory authority:

• The Netherlands: Autoriteit Persoonsgegevens (Dutch Data Protection Authority), www.autoriteitpersoonsgegevens.nl
• Germany: the data protection authority of the federal state where you live (Landesdatenschutzbehörde), or the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragte für den Datenschutz und die Informationsfreiheit), www.bfdi.bund.de
• Belgium: Data Protection Authority (Gegevensbeschermingsautoriteit), www.gegevensbeschermingsautoriteit.be
• Or the supervisory authority of your own EU member state

10. Changes

We may update this privacy policy, for example when our services or the law change. The most recent version is always available on our website.

11. Contact

Do you have questions about this privacy policy or about how we handle your data? Contact us at info@piecesofart.nl.