Privacy statement
What personal data we process as a trader on online marketplaces and on this website, why, for how long, and what rights you have.
Last updated:
Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is the general partnership (vennootschap onder firma) Timmermans & Poser. Questions and requests about your data are handled by partner Jonas Poser.
- Registered name
- Timmermans & Poser — General partnership (vennootschap onder firma, vof)
- Registered and postal address
- Timmermans & Poser
Oeverwal 10 A
6221 EN Maastricht
The Netherlands - Chamber of Commerce number (KvK)
- 42141056
- Privacy contact
- jonas@timmermans-poser.com
Buyers on online marketplaces
We sell on online marketplaces such as Amazon and bol. If you buy from us there, the marketplace gives us what we need to deliver and invoice your order: the order number, the items and amounts, and the country, postcode and city of delivery. Only for the shipping label and the invoice do we also receive your name and address and, for a business purchase, the company name and VAT identification number.
We use this data to ship your order (Article 6(1)(b) GDPR) and to issue and keep the invoice that tax law requires (Article 6(1)(c) GDPR, with Article 35a of the Dutch VAT Act 1968 and Article 52 of the Dutch General Tax Act). For the security of our systems and for handling returns and disputes, the processing is based on our legitimate interest (Article 6(1)(f) GDPR).
Your name and address appear only on the shipping label and on the invoice; our order records keep only the country, postcode and city and, for a business purchase, the VAT identification number. We do not use your data for advertising, build no profiles and take no automated decisions about you. Contact about an order goes through the marketplace’s messaging system.
Suppliers and business contacts
For contact persons at suppliers, distributors and other business relations we process name, position, business contact details and correspondence, in order to place orders and maintain the relationship. The legal basis is Article 6(1)(b) GDPR where a contract is concerned, and otherwise our legitimate interest (Article 6(1)(f) GDPR).
Contact by email or telephone
If you contact us, we process the data you provide us in doing so — your name, your contact details and the content of your message — solely in order to handle your enquiry. The legal basis is Article 6(1)(b) GDPR where the enquiry relates to a contract, and otherwise Article 6(1)(f) GDPR.
This website: no cookies, no tracking
This website sets no cookies, uses no web analytics, no tracking pixels and no advertising networks, and loads no fonts, scripts or other files from external servers. There is therefore no cookie banner: there is no consent to grant or withhold.
The website is hosted on Firebase Hosting, a service provided by Google. When a page is requested, the hosting service records technical data such as the IP address, the time, the page requested and the browser type used. That processing is necessary in order to deliver and secure the website; the legal basis is our legitimate interest under Article 6(1)(f) GDPR.
Retention periods
We keep data no longer than necessary. Specifically:
- Shipping labels (with name and address)
deleted no later than 30 days after delivery.
- Raw tracking data
30 days. After that we keep only the carrier, tracking number and the dates of dispatch and delivery, as evidence for the invoice.
- Invoices (with name, address and any VAT identification number)
seven years after the end of the year of issue, under the Dutch tax retention duty (Article 52 of the General Tax Act).
- Order records without name and address
seven years, as part of our accounting records.
- Business correspondence
for the duration of the business relationship, and seven years after that.
- Security logs
400 days. They contain no buyer names or addresses.
Recipients and processors
We do not sell data and do not pass it on for advertising. Data reaches only the following parties:
- Google Cloud EMEA Ltd (Ireland)
processor: hosting of our business software and database, stored in the EU region Belgium (europe-west1).
- Google (Firebase Hosting)
processor: hosting of this website.
- PrintNode Ltd (United Kingdom)
processor, where we print shipping labels through PrintNode: it sends the label to our own printer and does not keep it after the print job.
- IONOS SE (Germany)
processor: our email.
- Anthropic PBC (United States)
processor: AI assistant (Claude) used to develop and operate our software. It has read access to our business data, including order and invoice data, through its own account, and every access is logged.
- Amazon, bol and other marketplaces
independent controllers: they give us the order data, receive our invoices and sell the shipping labels. Their own privacy statements govern their own processing.
- Carriers
receive the parcel with its shipping label.
- Dutch Tax Administration (Belastingdienst)
on request, for tax audits.
Transfers outside the European Economic Area
Our business data is stored in the European Union (Google Cloud, region Belgium). Where Google processes data outside the EEA, for example for operations, support or the worldwide network that delivers this website, it does so under the European Commission’s Standard Contractual Clauses. PrintNode is established in the United Kingdom, for which the European Commission has adopted an adequacy decision. Anthropic processes data in the United States, under the European Commission’s Standard Contractual Clauses in Anthropic’s data processing terms.
Security
All data is stored encrypted (AES-256) and sent only over encrypted connections (TLS). Only the partners have access, each with their own account; a packer sees only the label and invoice of the parcels they pack. Each of our systems has its own, limited role. Access to data is logged and reviewed regularly. In the event of a data breach we follow our incident plan and, where required, notify the Autoriteit Persoonsgegevens within 72 hours.
Your rights
You have the right of access to the data we process about you, and rights to rectification, erasure, restriction of processing, portability, and objection to processing based on our legitimate interest. Send your request by email to the address above. We reply within one month and may ask you to show that the data is yours, for example with the order number.
We cannot delete invoices while the statutory retention period runs; until then we use them only for the tax retention duty.
You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Changes
We update this statement when our processing changes. The date at the top of this page shows when that last happened.