Privacy policy
Last updated: 10 November 2026
Draft. This policy will be reviewed by a lawyer before launch and may still change. If the Dutch and English versions differ, the Dutch version prevails.
Who we are
Zendhal, Simon Koopmanstraat 204, 1693 BL Wervershoof, the Netherlands, Chamber of Commerce (KvK) 94071446. Questions about privacy: info@zendhal.nl.
Which data and why
| Data | Why | Retention |
|---|---|---|
| Waitlist (name, email, webshop, orders per month, source of your visit) | Inviting you once we launch | Until your invitation, at most 12 months after signing up |
| Account data (name, email, password hash) | Logging in and contact | As long as your account exists |
| Company data (registration number, VAT, address) | Agreement and invoices | 7 years (tax retention obligation) |
| Balance, ledger and invoices | Accounting | 7 years (tax retention obligation) |
| Addresses of your customers (recipients) | Shipping orders | 2 years, then anonymised |
| Audit log (only IDs and field names: who changed what) | Accounting and control | 7 years (tax retention obligation) |
| Login attempts (hashed keys) | Protection against abuse | 24 hours |
| Security log (only IDs, no addresses) | Security | 90 days |
| Photos of shipments, returns and products; comments | Proof of receipt and condition, contact about your orders | As long as you are a client, then 12 months (proposal, subject to legal review) |
| Language and notification preferences | The portal and emails in your language and as you chose | As long as your account exists |
For the addresses of your customers, you are the controller and we are the processor; the data processing agreement applies.
Who we share data with
We do not sell data. We use these service providers (sub-processors):
- Cloudflare: hosting, database and security (data in the EU)
- Cloudflare Turnstile: protection against abuse when logging in and on forms
- Cloudflare Web Analytics: visitor statistics, without cookies
- PostNL and Sendcloud: shipping
- Mollie: payments
- SiteGround: sending and receiving emails about your account and orders (data centre in the EU, to be confirmed in the legal review)
- Have I Been Pwned: checking whether a new password was ever leaked; we only send the first 5 characters of a hash, never your password
- Our business mailbox: when you email us (provider: *owner to fill in*)
- WhatsApp (Meta): contact, if you contact us through WhatsApp
We update this list before we add a new service provider.
Cookies
We only use functional cookies: to log in and to remember your language choice in the portal. No tracking or advertising cookies. See cookies.
Your rights
You can access your data, have it corrected, have it deleted (as far as we are not legally required to keep it) and object to its use. Email info@zendhal.nl. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Security
We only store passwords as a hash, connections are encrypted, and each customer only sees their own data. In case of a data breach, we report it within 72 hours to the Dutch Data Protection Authority when required, and we inform you.