- Introduction and Data Controller
Welcome to Drapenook (“we,” “our,” or “us”). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website www.drapenook.com and purchase our decorative door curtains.
For the purposes of applicable data protection laws, including the European Union General Data Protection Regulation (GDPR), the Dutch Implementation Act of the GDPR (Uitvoeringswet AVG), and United States federal and state privacy regulations (such as the California Consumer Privacy Act/California Privacy Rights Act, CCPA/CPRA), the data controller is:
Company Name: Drapenook
Address: XXXX
Email: decorative@drapenook.com
Telephone: XXXX
- Information We Collect
We collect personal data that you voluntarily provide to us when you make a purchase, create an account, subscribe to our communications, or contact our customer service. This information may include:
Identity and Contact Data: Full name, billing address, shipping address, email address, and telephone number.
Transaction and Order Data: Details concerning the decorative door curtains you purchase, order history, and fulfillment preferences.
Technical and Device Data: Internet Protocol (IP) address, browser type and version, time zone setting, browser plug-in types and versions, operating system, and platform on which you access www.drapenook.com.
Usage Data: Information about how you navigate and interact with our website.
- How We Process and Secure Your Payments
We utilize Stripe as our primary payment processing service provider to handle financial transactions securely. When you complete a purchase, your payment details (such as credit or debit card information) are provided directly to Stripe.
Stripe processes your financial data in accordance with its own privacy policy and PCI-DSS security standards. We do not store complete credit card numbers or sensitive payment authentication data on our servers.
- Purposes and Legal Bases for Processing
We process your personal data under strict legal grounds mandated by European and United States legal frameworks:
Performance of a Contract: To process orders, deliver your decorative door curtains, issue invoices, and manage customer service inquiries.
Compliance with Legal Obligations: To maintain accounting records, fulfill tax reporting obligations mandated by Dutch, European, and United States authorities, and comply with lawful governmental requests.
Legitimate Interests: To prevent fraud, secure our website infrastructure, improve our product offerings, and maintain business operations, provided such interests are not overridden by your fundamental rights and freedoms.
Consent: Where required by law, we process specific optional categories of data based on your explicit consent, which you may withdraw at any time.
- Data Retention Periods
We retain your personal data only for as long as strictly necessary to fulfill the purposes outlined in this policy, including satisfying any legal, accounting, tax, or reporting requirements.
Transactional and Financial Records: In compliance with Dutch tax and commercial law (Awb and Burgerlijk Wetboek), accounting records, invoices, and associated customer transaction data are retained for 7 years from the end of the financial year in which the transaction occurred.
Account and Customer Profile Data: Retained for as long as your account remains active or until you request deletion, provided no overriding legal retention obligation applies.
Customer Service Communications: Retained for up to 2 years following the closure of the inquiry to ensure proper customer relationship management and quality control.
Technical and Log Data: Retained for a maximum of 12 months for security monitoring and system optimization purposes.
Once the applicable retention period expires, personal data is securely deleted, shredded, or anonymized.
- International Data Transfers
Drapenook is headquartered in the Netherlands, and we serve customers located within Europe and the United States.
Because we operate internationally, your personal data may be transferred to, stored, and processed in countries outside your country of residence, including the United States. Where personal data originating from Europe is transferred to countries not recognized by the European Commission as providing an adequate level of data protection, we implement appropriate legal safeguards, such as Standard Contractual Clauses (SCCs) approved by the European Commission, to ensure your information remains protected in accordance with European standards.
- Your Data Protection Rights
Depending on your jurisdiction of residence (including the EEA, the Netherlands, and United States jurisdictions such as California), you possess specific rights regarding your personal data:
Right of Access: You have the right to request confirmation regarding whether we process your personal data and to obtain a copy of such data.
Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data.
Right to Erasure (“Right to be Forgotten”): You may request the deletion of your personal data where there is no compelling legal reason for us to continue processing it.
Right to Restriction of Processing: You can request the suspension of data processing under specific statutory circumstances.
Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
Right to Object: You may object to the processing of your personal data based on legitimate interests.
Right to Lodge a Complaint: If you reside in the Netherlands or the EEA, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local supervisory authority. United States residents may contact their respective state regulatory bodies.
To exercise any of these rights, please contact us at decorative@drapenook.com.
- Data Security
We implement commercially reasonable technical, administrative, and physical security measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.
While we employ rigorous industry-standard security protocols to safeguard your information, no method of transmission over the internet or electronic storage is completely infallible. We strive to protect your personal data using robust procedures, but we cannot warrant absolute data security.
- Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our business practices, technological advancements, or legal requirements. Any modifications will be posted directly on this page with an updated effective date. We encourage you to review this policy periodically to stay informed about how we protect your information.