Who is responsible for your data?
Cibdol bv is the controller for the personal data processed via cibdol.com.
Cibdol bv
Galvaniweg 11
5482 TN Schijndel
The Netherlands
Chamber of Commerce (KvK): 76495035
VAT: NL860644923B01
Email: [email protected]
Phone: +31 41 372 4806
What data do we collect?
Account and orders
First and last name · Home and invoice address · Phone number · Email address · Date of birth (age verification 18+) · Gender (optional) · IP address · Order history
Website visits
Anonymised IP address · Browser type and version · Device type and operating system · Pages visited and visit duration · Referrer
Newsletter
First and last name · Email address · Gender (optional)
Customer service
Our customer service team can access your account details and order history, so they can help you quickly and effectively.
Why do we process this data?
| Purpose | Data used |
|---|---|
| Order fulfilment and delivery | Name, address, email, phone |
| Setting up and managing your account, and contacting you about orders | Name, email, order history |
| Age and identity verification (18+ policy) and fraud prevention | Date of birth, IP address |
| Customer service | Account and order data |
| Newsletter (with your consent) | Name, email, gender |
| Market research, analyses and store improvement | Anonymised visit data |
| Legal (fiscal) obligations | Invoice data |
On what legal basis?
We process personal data only when we have a proper basis to do so:
- Performance of a contract, the data needed to process your order, arrange delivery and manage your account.
- Consent, the newsletter and any secondary use such as marketing. We ask for your consent explicitly, and you can withdraw it at any time (see “Your rights” below).
- Legal obligation, records we must keep under Dutch law, such as invoice data, and disclosures required by law.
- Protecting our store, confirming your age and identity and identifying and preventing fraud.
How long do we keep your data?
We practice data minimisation: we do not retain your data longer than necessary for the purposes in this policy. Different retention periods apply to different types of data; the longest we normally hold any personal data is 10 years.
| Data | Retention period |
|---|---|
| Account data | As long as your account exists; deleted within a reasonable period after you remove your account |
| Newsletter data | Until you withdraw consent, we also run a monthly relevance check |
| Order data and invoices | 7 years, required by Dutch tax law |
Transfers outside the EEA
Certain providers are located, or have facilities, in a different jurisdiction than either you or us. If you proceed with a transaction that involves the services of such a third party, your information may become subject to the laws of the jurisdiction in which that provider or its facilities are located. Where Google services are involved, your IP address is truncated within the EU/EEA before any transmission to servers in the United States, except in rare cases where truncation happens there.
Once you leave cibdol.com or are redirected to a third-party website or application, you are no longer governed by this privacy policy, the third party's own policy applies.
How do we protect your data?
We take reasonable precautions and follow industry best practices to make sure your personal data is not lost, misused, accessed without authorisation, disclosed, altered or destroyed:
- Payment information is encrypted in transit (SSL) and we follow all PCI-DSS requirements
- Sensitive data is stored with AES-256 encryption; account information is protected with hashing
- Database access is restricted to approved IP addresses only
- Employees only get access to the information strictly needed for their task
- Data is anonymised wherever possible
- Third-party processors are screened before we work with them, are GDPR compliant and sign a processor agreement
- A dedicated security manager periodically checks and improves these measures
Your rights under the GDPR
You stay in control of your data:
- Inspection and correction, ask us which personal data we hold about you, and have it corrected.
- Removal, remove your account, and the related data will be deleted within a reasonable period.
- Withdrawing consent, withdraw your consent for the newsletter or any other opt-in use at any time, via the opt-out link in every newsletter or by contacting us.
Send requests to [email protected].
Filing a complaint
If you are not happy with how we handle your personal data, contact us first at [email protected], we take every concern seriously. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Changes to this policy
We may modify this privacy policy from time to time, so please review it regularly. Changes and clarifications take effect immediately upon posting on this page. If we make material changes, we will update the notice here, so that you know what information we collect, how we use it, and under what circumstances we disclose it.
Contact
Questions about this policy or about your personal data:
Cibdol bv
Galvaniweg 11
5482 TN Schijndel
The Netherlands
Email: [email protected]
Phone: +31 41 372 4806
Frequently asked questions
Do you sell or share my personal data?
No. We only share data with partners necessary for delivery and service, under a data processing agreement.
How do I delete my account?
Remove your account in your account settings, or email [email protected]. Your data is deleted within a reasonable period; only records we must keep by law, such as invoices, are retained for the statutory period.
Is data stored outside Europe?
Every third-party processor we work with is screened first, is GDPR compliant and signs a processor agreement. Google services (Analytics, reCAPTCHA) may process truncated, anonymised IP data on US servers.
Why do you ask for my date of birth?
We only sell to customers aged 18 and over. Your date of birth lets us confirm your age and helps us prevent fraud.
