Who is responsible for your data?
The data controller within the meaning of the General Data Protection Regulation (GDPR) is Squffy:
- Squffy
- Voltaweg 14, 5466AZ Veghel, the Netherlands
- Email: support@squffy.com
- WhatsApp: +31 6 82054650
For privacy-related questions, contact us at support@squffy.com.
What data do we collect?
Account and orders
First and last name · Delivery and billing address · Phone number · Email address · Personalization details (your dog's name, font, thread color, dog pin selections) · IP address · Order history
Website visits
Anonymized IP address · Browser type and version · Device type and operating system · Pages visited and visit time · Referrer
Newsletter
First and last name · Email address · Sign-up date and interaction data
Customer service
Our team has access to your account data and order history so we can answer your question effectively. Correspondence is kept for quality assurance.
Why do we process this data?
| Purpose | Data used |
|---|---|
| Order fulfilment and delivery | Name, address, email, phone, personalization details |
| Account management | Name, email, encrypted password, order history |
| Customer service and warranty | Account and order data, correspondence |
| Fraud prevention and security | IP address, order behavior, payment data |
| Newsletter (with consent) | Name, email, preferences |
| Analytics for improvement | Anonymized IP address, click behavior |
| Legal (fiscal) obligations | Invoice data |
On what legal basis?
- Performance of a contract (Art. 6(1)(b) GDPR), orders, deliveries, account management
- Legal obligation (Art. 6(1)(c) GDPR), fiscal records (7 years), requests from competent authorities
- Consent (Art. 6(1)(a) GDPR), newsletter, personalized recommendations, non-functional cookies. Withdrawable at any time.
- Legitimate interest (Art. 6(1)(f) GDPR), fraud prevention, security, anonymized improvements. A balancing test has been conducted.
How long do we keep your data?
| Data | Retention period |
|---|---|
| Account data | As long as account is active + 12 months after inactivity |
| Order data and invoices | 7 years (Dutch fiscal law, Art. 52 AWR) |
| Customer service correspondence | 2 years after last contact |
| Newsletter | Until withdrawal + monthly relevance check |
| Cookies | Maximum 24 months, see cookie policy |
| Log files (IP, security) | 6 months |
| Job application data | 4 weeks after completion (without consent) |
After the retention period, data is permanently deleted or anonymized.
Transfers outside the EEA
Some service providers process data outside the European Economic Area. Safeguards in place:
- Standard Contractual Clauses (SCCs) from the European Commission
- EU-US Data Privacy Framework for certified American parties
- Additional encryption and pseudonymisation
A full overview of sub-processors is available on request via support@squffy.com.
How do we protect your data?
Measures in accordance with Art. 32 GDPR:
- TLS 1.3 encryption for data in transit
- AES-256 encryption for storage of sensitive data
- Bcrypt hashing for passwords
- PCI-DSS compliance for payments (we do not store credit card data)
- IP-level access control
- Role-based access for staff
- Periodic security audits by internal security manager
- Data breach protocol (notification to Dutch DPA within 72 hours if required)
Your rights under the GDPR
As a data subject, you have the following rights:
- Right of access
- Right to rectification
- Right to erasure ("right to be forgotten")
- Right to restriction of processing
- Right to data portability
- Right to object
- Right to withdraw consent
- Right not to be subject to automated decision-making
Exercise your rights via support@squffy.com or our contact form. We respond within 30 days (extendable by 60 days for complex requests).
Filing a complaint
Not satisfied? Please contact us first at support@squffy.com. If we cannot resolve your concern:
- Dutch Data Protection Authority (Autoriteit Persoonsgegevens)
- Postbus 93374, 2509 AJ The Hague
- Phone: 088 - 1805 250
- autoriteitpersoonsgegevens.nl
Changes to this policy
For significant changes, we will notify you via email or a website notice.
Version history
- v4.0 (28 April 2026), Full revision, GDPR rights clarified, retention table added
- v3.2 (15 January 2025), Cookie policy updated
- v3.0 (10 March 2024), Addition of EU-US Data Privacy Framework
Contact
- Squffy
- Voltaweg 14, 5466AZ Veghel, the Netherlands
- Email: support@squffy.com
- WhatsApp: +31 6 82054650 (Mon-Fri, replies within 24h)
Frequently asked questions
Does Squffy sell my data to third parties?
No. We only share data with partners necessary for delivery and service, under a data processing agreement.
How do I delete my account?
Send a request to support@squffy.com from the email address linked to your account. Deletion is completed within 30 days, except for data with a legal retention obligation (e.g. invoices, 7 years).
Is data stored outside Europe?
Our main servers are in the EU. Some analytics services partially process data in the US, under Standard Contractual Clauses or the Data Privacy Framework.
What happens to the personalization details on my order?
Your dog's name, font, thread color, and dog pin choices are stored on the order so we can produce it correctly and reorder it later if you want. We don't use these details for marketing.