Privacy policy

1. Who we are

This policy explains how we process personal data when you use babyprintlab.nl, babyprintlab.de or babyprintlab.fr (together "the shop"), order from us or contact us. The controller responsible for this processing is:

Bergh Software (sole proprietorship of Daan van den Bergh), trading as Babyprint Lab

Ensahlaan 25, 3723 HT Bilthoven, the Netherlands

Chamber of Commerce (KvK) number: 75538288

Email for privacy requests: legal@babyprintlab.nl

2. What data we process

When you design a product. The details you enter for the print: your baby's name, date of birth and, if you enter them, time of birth, weight and length, together with the style and colour you choose. Until you continue to payment, this design and your basket are stored only in your own browser (see section 8). When you continue to payment, we store the design with your order. Weight, length and time of birth may count as data concerning health under the GDPR; we process them only with your explicit consent (see section 3).

When you order. Your email address, the name and address you enter for delivery, the design you approved, the products, quantities and prices, and the status of your order and its delivery (including the carrier's tracking details). Payment details, such as your card number, are entered on the payment page of our payment provider Stripe; we do not receive them. From Stripe we receive whether and how much you paid, the payment and invoice references, and your invoice.

When we email you. Whether our emails about your order bounced, were delayed or were marked as spam, as reported by our email provider.

When you contact us. Your name, email address, the topic and your message, and the IP address from which you sent the contact form. If you email us directly, we receive your email address and whatever your message contains.

When you visit the shop. Our hosting provider processes your IP address and technical request data to deliver the pages and protect the shop against abuse.

3. Why we process it and on what legal basis

• To make, deliver and bill your order and send you the emails about it (the confirmation with your invoice, the shipping notice, and a notice if your order is delayed or refunded), and to show you your order's status: necessary to perform our contract with you (Article 6(1)(b) GDPR). Where the data concerns someone other than you, such as your baby or a delivery recipient you name, we process it only to make and deliver the order you asked for, on the basis of our legitimate interest, and yours, in doing so (Article 6(1)(f) GDPR).
• To print your baby's weight, length and time of birth, if you enter them: because these details may count as data concerning health (Article 9 GDPR), we process them only on the basis of your explicit consent (Article 9(2)(a) GDPR), which you give by ticking the consent box in your basket before you pay. We use them only to make and deliver your order as described in this policy, which includes passing them to Gelato in the print file. We record when you gave your consent and which version of this policy it referred to (not the details themselves), so that we can show that you gave it; we keep that record with the records of your order (section 6). Without this consent we cannot accept an order that contains these details; you can order the same design without them.
• To keep our accounting and tax records: necessary to comply with our legal obligations (Article 6(1)(c) GDPR).
• To answer your questions and complaints: to perform our contract with you where your message concerns an order, and otherwise our legitimate interest in replying to messages sent to us (Article 6(1)(b) and (f) GDPR).
• To keep the shop secure and prevent abuse, for example by limiting how often the contact form can be sent from one IP address, and to find out when an email about your order did not reach you: our legitimate interest in running a secure and reliable shop (Article 6(1)(f) GDPR).

You need to provide your email address, the delivery address and the details for the print to place an order; without them we cannot make or deliver it. Weight, length and time of birth are optional. To use the contact form you need to provide your name, email address and message; without them we cannot answer you.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

4. Who receives your data

We do not sell your personal data. We share it only with the service providers we need to run the shop, which process it on our behalf and on our instructions:

• Gelato prints and ships your order. It receives your name, delivery address and email address and the print file with your design, and passes the details needed for that on to the production partner that prints your order and the carrier that delivers it.
• Stripe processes your payment and issues your invoice. Stripe also processes payment data as an independent controller, for example to prevent fraud and to meet its own legal obligations; its own privacy policy applies to that.
• Resend sends our emails to you and delivers contact-form messages to us.
• Cloudflare hosts the shop and the database in which we store orders, creates and stores the print files and protects the shop against attacks.
• The provider of our email inbox receives the emails you send us, including messages from the contact form.

We also disclose personal data to authorities, such as the tax authorities, where the law obliges us to.

5. Transfers outside the European Economic Area

Some of these providers, or their sub-processors, are located in or process data from countries outside the European Economic Area, such as the United States. Where personal data is transferred to such a country, the transfer is based on an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework, for certified companies) or on the European Commission's standard contractual clauses. You can ask us for more information about these safeguards at the email address in section 1.

6. How long we keep your data

• Orders that are not paid: we delete them automatically, as a rule within a few days after they were created.
• Your design, delivery address and email address for a paid order: we delete them automatically once your order is finished, as a rule 14 days after delivery or after a refund or cancellation. If the carrier does not report a delivery, we delete them as a rule 60 days after shipping. The print files are deleted automatically, as a rule 60 days after they were made. If a payment issue for your order is still open, such as a refund we owe you, we may keep the data until it is resolved.
• Accounting records: the amounts, VAT, dates, payment and invoice references of your order, and your invoice (which shows your name, email address and address), are kept for as long as tax and accounting law requires, in the Netherlands 7 years.
• Contact messages: we keep them for as long as we need them to handle your question and any follow-up.
• Technical request data: our hosting provider keeps it for a short period, as needed to deliver the pages and protect the shop.

7. Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict its processing, to receive the data you provided to us in a structured, machine-readable format (data portability), and to object to processing based on our legitimate interests. These rights apply within the conditions and limits the GDPR sets; for example, we cannot erase data we are legally obliged to keep. If you gave us your baby's details, you can exercise these rights for your baby as their parent or guardian.

Withdrawing your consent. You can withdraw your consent to the processing of your baby's weight, length and time of birth at any time by emailing legal@babyprintlab.nl. Withdrawing it does not affect the lawfulness of the processing before the withdrawal. After you withdraw it, we stop using these details and delete them from our records, except where we still need them for an order that is already in production. Because the details are printed on your product and an order is sent to production automatically shortly after payment, an order that has been sent to production can no longer be changed or stopped: it will be printed and delivered as ordered.

To exercise your rights, email legal@babyprintlab.nl. We may ask you to confirm your identity, for example by writing from the email address you used for your order. We respond within the periods the GDPR sets.

You also have the right to lodge a complaint with a data protection supervisory authority: in the Netherlands the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the authority in the EU country where you live or work, or where you believe your rights were infringed.

8. Cookies and local storage

The shop stores your design and basket in your browser's local storage so they are still there when you come back. How the shop uses cookies and local storage is explained in our cookie policy.

9. Changes to this policy

We may change this policy. The version published in the shop applies, and its date shows when it took effect.