Privacy

What this shop knows about you, written from what the software actually does rather than from a template. The controller is Donker Solutions; the registration details are on contact & details. Write to robbedonker@gmail.com about anything on this page.

There is no tracking here

No analytics, no advertising pixels, no social buttons, no fonts fetched from someone else's server. This site loads nothing from any third party at all — that is enforced by a content security policy in the site's own configuration, not merely intended. Nobody is building a profile of you from these pages, because there is nothing here to build one with.

This is also why there is no cookie banner. The only cookies set are the ones below, all of them strictly necessary to do the thing you asked for, and those need no consent.

Cookies

cart: Holds the product codes and quantities in your cart, and nothing else — no identifier, no name, nothing that says who you are. It is how the cart survives a page load. Set when you add something, lasts 30 days, and cannot be read by scripts. It is the entire cart: there is no basket sitting on our server with your name on it.
lang: Whether you are reading the shop in Dutch or in English, and nothing else. Set when you press the language button, lasts a year, and cannot be read by scripts. With no cookie you get Dutch.
checkout: The ids of the checkout sessions this browser started, at most three, for 24 hours. It is how the thank-you page can tell that you are the person who paid rather than someone who came across the session id. No name, no amount, no payment details.
admin_session: The shopkeeper's sign-in, on the staff pages only. Lasts 12 hours. If you are reading this as a customer, you will never have one.

What we hold when you buy something

Payment happens on Stripe's own pages. Your card number never reaches this shop — we are told that a payment succeeded and no more.

Stripe passes back, and we keep, a record of the sale containing:

your name and email address;
the delivery address you gave;
what you bought, the quantities, and what you paid;
the payment reference and the date.

We need this to send you a rug and to keep an account of what we sold, which is the contract between us — that is the legal basis, and it is why we cannot simply delete a recent order on request without unwinding the sale.

Where it lives, and for how long

The authoritative record is Stripe's. Ours is a convenience list on the shop's own server so the shopkeeper can see what to make and pack; it holds the most recent 500 orders and the oldest drop off the end as new ones arrive. Stripe keeps its record for as long as the tax authorities require, which in the Netherlands is seven years.

If you supply your own design

A rug made to your own design lets you upload a picture. For as long as you are only looking at what it would become, we keep nothing at all: the picture is processed in memory and sent back with the answer, and no file is written to our disk. So there is nothing to delete, nothing to leak and nothing to forget.

Once you put the rug in your basket we do keep it — we cannot make the rug otherwise. If you do not pay, it is gone within a day without anyone having to do anything about it. If you do pay, we keep it until 90 days after your rug is finished, so that we can make it again or look into a complaint, and then it is deleted. If your order is cancelled and refunded, we delete the picture straight away. Only the shopkeeper can see it, behind a password; there is no public link to a supplied design.

Processors

Stripe: Stripe Payments Europe, Ltd., Ireland. Takes the payment, holds the card details we never see, sends your receipt, and handles refunds. Stripe is a controller in its own right for fraud prevention and has its own privacy policy.
Our host: The server this site runs on, and the carrier that delivers the rug — both see what they need to do their job and no more.

There is no one else. We do not sell, rent or share personal data, and there is no mailing list to be added to.

Server logs

The server records requests as they arrive, including IP addresses, for security and to work out what broke when something breaks. Repeated failed sign-ins to the staff pages are counted per IP address so that guessing the shopkeeper's password locks out the guesser rather than the shopkeeper. Both are our legitimate interest in keeping the shop standing up, and neither is used to identify a shopper.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, or ask for it in a portable form. Write to robbedonker@gmail.com and we will answer within a month.

The honest caveat: for an order we have fulfilled, most of the record is a commercial and tax document that we are required to keep, so "delete everything" usually means "delete everything we are not obliged to retain". We will tell you exactly what stayed and why.

If we handle it badly you can complain to the Autoriteit Persoonsgegevens, the Dutch data protection authority. We would rather you told us first, but it is your right either way and you do not need our permission.