1. Data controller
Teddy Peps is the data controller for the processing of personal data described in this policy.
Contact: support@teddypeps.nl
Chamber of Commerce: 42087952
2. What data we process
- Order and invoice data: name, address, email, phone number, payment details.
- Communication: messages via email, contact form or WhatsApp.
- Technical data: IP address, browser and device information for security and analytics.
- Newsletter: email address if you subscribe.
- Marketing emails: email address, first name (if provided), language, signup source (e.g. footer, popup or checkout), date and time of consent or unsubscribe, and delivery status of our emails (delivered, bounced, spam complaint, unsubscribed).
- Purchase history: products ordered, order dates and order amounts, used to send relevant emails and to group customers (for example new customers, repeat customers or customers who have not ordered for a while).
- Returns: order number, products, reason for return and contact details you enter in the return form.
- Partners (affiliates): name, email address, partner code, orders placed with your code, commission and payout details.
3. Purposes and legal bases
- Performance of the contract (Art. 6(1)(b) GDPR): processing and shipping of orders.
- Legal obligation (Art. 6(1)(c) GDPR): statutory tax retention periods.
- Legitimate interest (Art. 6(1)(f) GDPR): fraud prevention, security and service improvement.
- Consent (Art. 6(1)(a) GDPR) or, for existing customers, legitimate interest for similar products (Art. 13 Dutch Telecommunications Act): newsletters, offers and product updates by email.
4. Marketing emails and unsubscribing
When you subscribe via our website (footer, popup) or place an order without opting out, we may send you newsletters, offers, product information and reminders such as an unfinished order.
We use your purchase history and language to choose which emails are relevant to you. We do not make decisions with legal effects based on this, and we do not sell or rent your email address.
Every marketing email contains an unsubscribe link and supports one-click unsubscribe in your mail app. After unsubscribing you will no longer receive marketing emails; an unsubscribe always overrides any earlier consent. You will still receive service emails about your orders, shipments and returns.
We keep a record of when and how you gave or withdrew consent, so we can prove it and respect your choice. Addresses that bounce or report spam are automatically excluded.
5. Retention periods
We do not retain personal data longer than necessary. Order and invoice data are kept for the statutory tax period of 7 years. Communications are kept for a maximum of 2 years after the last contact.
6. Sharing with third parties
We only share data with processors that are necessary for our services, such as payment providers, shipping partners, hosting provider and email platform. Data processing agreements are in place with these parties. We never sell personal data.
Processors we use include: our webshop and payment providers, MyParcel and PostNL (shipping), Resend (sending email), and our hosting and database provider.
7. Transfers outside the EU
If data is transferred outside the EU, we only do so on the basis of appropriate safeguards (such as the European Commission's Standard Contractual Clauses).
8. Storage in your browser
We do not place tracking, analytical or marketing cookies. Only strictly necessary technical storage is used to make the website work, such as your language choice and age confirmation.
9. Your rights (GDPR)
- Right of access to your data;
- Right to rectification or completion;
- Right to erasure ("right to be forgotten");
- Right to restriction of processing;
- Right to data portability;
- Right to object to processing based on legitimate interest;
- Right to withdraw consent at any time.
You can submit requests via support@teddypeps.nl. We respond within 30 days.
10. Complaints
Do you believe we are not handling your data correctly? Then you have the right to file a complaint with the Dutch Data Protection Authority.
11. Security
We take appropriate technical and organisational measures to protect your data against loss or unlawful processing, including encrypted connections (HTTPS) and restricted access to systems.
12. California residents (CCPA / CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the following rights with respect to your personal information:
- Right to know: what personal information we have collected about you, the categories of sources, the purposes for collection, and the categories of third parties with whom we share it.
- Right to delete: personal information we hold about you, subject to legal exceptions, such as records we must keep to complete a transaction, comply with a legal obligation, or defend against legal claims.
- Right to correct: inaccurate personal information.
- Right to opt out of the sale or sharing: Teddy Peps does not sell personal information and does not share it for cross-context behavioural advertising.
- Right to limit the use of sensitive personal information: we do not collect sensitive personal information as defined by the CPRA.
- Right to non-discrimination: for exercising any of these rights.
You may exercise these rights yourself or through an authorised agent. To submit a verifiable request, email support@teddypeps.nl with the subject line ‘CCPA request’ and enough information for us to identify you and confirm the request. An authorised agent must provide written proof of authorisation. We respond within 45 calendar days and may extend that window by an additional 45 days where reasonably necessary, with notice.