Who is responsible for your data?
The data controller within the meaning of the General Data Protection Regulation (GDPR) is Squffy:
- Squffy
- Voltaweg 14, 5466AZ Veghel, the Netherlands
- Email: [email protected]
- WhatsApp: +31 6 82054650
For privacy-related questions, contact us at [email protected].
What data do we collect?
Account and orders
First and last name · Delivery and billing address · Phone number · Email address · Personalization details (your dog's name, font, thread color, dog pin selections) · IP address · Order history
Website visits
Anonymized IP address · Browser type and version · Device type and operating system · Pages visited and visit time · Referrer
Newsletter
First and last name · Email address · Sign-up date and interaction data
Customer service
Our team has access to your account data and order history so we can answer your question effectively. Correspondence is kept for quality assurance.
Why do we process this data?
| Purpose | Data used |
|---|---|
| Order fulfilment and delivery | Name, address, email, phone, personalization details |
| Account management | Name, email, encrypted password, order history |
| Customer service and warranty | Account and order data, correspondence |
| Fraud prevention and security | IP address, order behavior, payment data |
| Newsletter (with consent) | Name, email, preferences |
| Cart reminders (you can opt out) | Email, first name, cart contents |
| Analytics for improvement | Anonymized IP address, click behavior |
| Legal (fiscal) obligations | Invoice data |
| Advertising measurement | Advertising cookies and identifiers, advertisement interaction, purchase value and currency |
On what legal basis?
- Performance of a contract (Art. 6(1)(b) GDPR), orders, deliveries, account management
- Legal obligation (Art. 6(1)(c) GDPR), fiscal records (7 years), requests from competent authorities
- Consent (Art. 6(1)(a) GDPR), newsletter, personalized recommendations, non-functional cookies, analytics measurement, advertising measurement. Withdrawable at any time.
- Legitimate interest (Art. 6(1)(f) GDPR), cart reminders (at most two emails about a cart you left at checkout, with an opt-out at checkout and in every email), fraud prevention, security, anonymized improvements. A balancing test has been conducted.
How long do we keep your data?
| Data | Retention period |
|---|---|
| Account data | As long as account is active + 12 months after inactivity |
| Order data and invoices | 7 years (Dutch fiscal law, Art. 52 AWR) |
| Customer service correspondence | 2 years after last contact |
| Newsletter | Until withdrawal + monthly relevance check |
| Cookies | Maximum 24 months, see cookie policy |
| Log files (IP, security) | 6 months |
| Job application data | 4 weeks after completion (without consent) |
After the retention period, data is permanently deleted or anonymized.
Transfers outside the EEA
Some service providers process data outside the European Economic Area. Safeguards in place:
- Standard Contractual Clauses (SCCs) from the European Commission
- EU-US Data Privacy Framework for certified American parties
- Additional encryption and pseudonymisation
A full overview of sub-processors is available on request via [email protected].
How do we protect your data?
Measures in accordance with Art. 32 GDPR:
- TLS 1.3 encryption for data in transit
- AES-256 encryption for storage of sensitive data
- Bcrypt hashing for passwords
- PCI-DSS compliance for payments (we do not store credit card data)
- IP-level access control
- Role-based access for staff
- Periodic security audits by internal security manager
- Data breach protocol (notification to Dutch DPA within 72 hours if required)
Your rights under the GDPR
As a data subject, you have the following rights:
- Right of access
- Right to rectification
- Right to erasure ("right to be forgotten")
- Right to restriction of processing
- Right to data portability
- Right to object
- Right to withdraw consent
- Right not to be subject to automated decision-making
Exercise your rights via [email protected] or our contact form. We respond within 30 days (extendable by 60 days for complex requests).
Filing a complaint
Not satisfied? Please contact us first at [email protected]. If we cannot resolve your concern:
- Dutch Data Protection Authority (Autoriteit Persoonsgegevens)
- Postbus 93374, 2509 AJ The Hague
- Phone: 088 - 1805 250
- autoriteitpersoonsgegevens.nl
Changes to this policy
For significant changes, we will notify you via email or a website notice.
Version history
- v4.2 (27 September 2026), Cart reminders added (legitimate interest, opt-out at checkout and in every email)
- v4.1 (18 September 2026), Advertising measurement added as a separate consent purpose, Google advertising cookies and data sharing disclosed
- v4.0 (28 April 2026), Full revision, GDPR rights clarified, retention table added
- v3.2 (15 January 2025), Cookie policy updated
- v3.0 (10 March 2024), Addition of EU-US Data Privacy Framework
Contact
- Squffy
- Voltaweg 14, 5466AZ Veghel, the Netherlands
- Email: [email protected]
- WhatsApp: +31 6 82054650 (Mon-Fri, replies within 24h)
Frequently asked questions
Does Squffy sell my data to third parties?
No. We only share data with partners necessary for delivery and service, under a data processing agreement.
How do I delete my account?
Send a request to [email protected] from the email address linked to your account. Deletion is completed within 30 days, except for data with a legal retention obligation (e.g. invoices, 7 years).
Is data stored outside Europe?
Our main servers are in the EU. Some analytics and advertising services partially process data in the US, under Standard Contractual Clauses or the Data Privacy Framework.
What happens to the personalization details on my order?
Your dog's name, font, thread color, and dog pin choices are stored on the order so we can produce it correctly and reorder it later if you want. We don't use these details for marketing.