Privacy policy

The controller for the personal data processed on this website is BrabantLabs (sole proprietorship (eenmanszaak), KvK: 42151504). You can reach us at info@brabantlabs.nl.

We process the following categories of personal data:

• Order data: name, email address, phone number, billing and shipping address, and the contents of your order.
• Payment status: whether and when an order has been paid, and the type of payment method used. For a bank transfer, we see the payer’s name and account number as shown on our bank statement; we use these only to verify your payment.
• Contact data: anything you share with us yourself by email, WhatsApp or a contact form.
• Account data, if you create an account: your email address, your name (optional), an encrypted fingerprint of your password (never the password itself), your saved addresses, and when you created the account and last signed in. We link your orders to your account through your confirmed email address.
• Abuse-prevention data: for sign-in attempts, password resets and order lookups we count attempts per email and IP address. We keep only an encrypted fingerprint for this, never the address itself.
• Partner programme: if you become a partner, your name, email address, where you share, your partner code, any Chamber of Commerce and VAT number, your IBAN for payouts and the clicks and orders through your code (order number, date and amount only; a partner never sees customer details). If you order with a partner code or through a partner link, we link your orders of the next 12 months to that partner to calculate commission. The partner code from a link is kept only in your own browser, visible in your cart, where you can remove it.
• If you have consented to marketing integrations and your order has been paid, we may share your name, email address, order number and product details with Trustpilot in order to send a review invitation.
• Technical and usage data: only to the extent that you have consented to this via the cookie banner. See our cookie policy. This includes GA4 usage data, such as pages visited and interactions with the website, only after analytics consent.

• Performance of the contract — processing, shipping and handling your order, answering questions about it, and keeping your account if you create one.
• Legal obligation — retaining invoices and the associated data for the statutory tax retention obligation.
• Legitimate interest — prevention of fraud and misuse, and the security of our systems.
• Consent — analytics cookies and marketing integrations, including Trustpilot review invitations, only after your explicit consent, which you can withdraw at any time via the cookie settings.

To provide our services, we use the following processors and recipients. A data processing agreement appropriate under the GDPR (AVG) has been or will be concluded with each processor.

• bunq — receipt of payments by bank transfer and via bunq.me.
• Resend — sending transactional email (order confirmations, shipping notifications).
• Trustpilot — processing order and contact data to send a review invitation after payment, only after marketing consent.
• Sendcloud — creating shipping labels and passing address details to the carrier.
• Vercel — hosting of the website and application.
• Google Analytics 4 — measuring website usage after analytics consent. More information can be found in Google’s privacy policy.
• Neon — hosting of the database (EU region) in which order and customer data are stored.
• Anthropic — answers questions in the “Ask the Brabander” chat with AI. Only what you type in the chat is sent; we do not store the conversation. Anthropic (US) keeps it temporarily under its API terms (usually up to 30 days) and does not use it to train models; the transfer outside the EU is covered by the EU-US Data Privacy Framework and standard contractual clauses. Do not share personal data in the chat.

We never sell personal data to third parties and do not share it beyond what is necessary to fulfil your order, to comply with a legal obligation or for the processing to which you have consented.

• Invoices and the associated order data: 7 years, in connection with the Dutch statutory tax retention obligation.
• Contact form and support data: as long as necessary to handle your question, and thereafter for a maximum of 2 years.
• Partner data and payouts: as long as you are a partner, and payouts for 7 years after that (tax retention).
• Data processed on the basis of consent (analytics, marketing): until you withdraw that consent.
• Account data: until you delete your account. We automatically delete an account that has not been used for 3 years, and one whose email address was not confirmed within 7 days. Your orders and invoices fall under the 7-year retention period and therefore remain when you delete your account.
• Abuse-prevention data (counts per email or IP address): at most 1 day.

We take appropriate technical and organisational measures to protect personal data against loss or unlawful processing, including encrypted data traffic (TLS) and restricted access to systems that contain personal data.

You have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to the processing. You can send a request to this effect to info@brabantlabs.nl. We will in principle respond within one month. If you have an account, you can delete it yourself straight away under My account.

If we cannot resolve the matter together, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.

We may amend this privacy policy. The current version can always be found on this page.