Free-text fields may, by their nature, contain information about the customer, recipient or other individuals.

Shavi Studio does not actively request special categories of personal data, such as information about health, religion, political opinions or sex life.

Please provide such information only where it genuinely needs to form part of the personal message or is necessary for the requested service.

Shavi Studio may use AI-assisted tools in carrying out its work.

As a general principle, only information necessary for the relevant purpose is processed. Directly identifying personal data, such as names, addresses, email addresses and telephone numbers, is not unnecessarily shared with such tools.

Personal Love Holland messages are not shared with AI services for the purpose of fulfilling the order.

Shavi Studio remains responsible for the processing of personal data and for the final performance of the service.

Where an order is placed for or sent to someone else, personal data relating to that recipient may be processed, such as their name and delivery address.

For Love Holland, this may also include the recipient's name and the personal message intended for that person.

This data is used only to the extent necessary to fulfil and deliver the order and to deal with any issues relating to the order or delivery.

When providing another person's data, please provide only the information necessary for this purpose and ensure that it is accurate.

Where the webshop offers this option, a customer account may be created, for example to view order history and address details.

A customer account is not required to place an order where the webshop is configured to allow checkout without one.

Deletion of an account may be requested. Data subject to a statutory retention obligation or another valid basis for continued processing may be retained even after the account is deleted.

Shavi Studio does not sell personal data.

Personal data is shared only where necessary to provide the service, comply with a legal obligation or where another valid legal basis exists.

Shavi Studio uses, among others

Odoo - for the website, webshop, questionnaires, hosting and business administration. Personal data in the Odoo environment may therefore be processed by Odoo as a service provider/processor.

Mollie - for processing online payments. The necessary payment data is processed for this purpose. Shavi Studio does not itself receive or retain all complete bank or payment card details processed by the payment provider.

PostNL - for delivering physical orders. Only the data necessary for the relevant shipment is shared, such as the recipient's name and delivery address and, where necessary, additional delivery information.

·Where necessary, personal data may also be shared with professional service providers in areas such as accounting, IT or legal support.

·Where a service provider processes personal data on behalf of Shavi Studio, appropriate data protection arrangements are made where required.

Shavi Studio may photograph its own products and packaged orders for purposes such as the website and social media.

Personal data relating to customers or recipients, such as names, address labels and personal messages, is not shown in an identifiable manner.

Where a photograph, review or other content provided by a customer is republished, separate consent will be requested where necessary.

Personal data is not retained longer than necessary for the purpose for which it was collected, unless a statutory retention obligation or another justified need requires a longer period.

As a general rule:

• Pre-Loved questionnaire: up to 3 months after the relevant order has been fully completed;
• Book Hunt questionnaire: up to 3 months after the relevant service has been fully completed;
• personal Love Holland message: generally up to 30 days after the order has been fully completed;
• basic tax and administrative records: generally 7 years where a statutory tax retention obligation applies;
• account data: for as long as the account remains active and afterwards to the extent further retention is necessary or legally required;
• customer service, complaints, returns and withdrawal data: for as long as necessary to deal with the matter and afterwards to the extent necessary for administration, evidence or legal obligations.

Where possible, personal data is deleted or anonymised when it is no longer required.

Shavi Studio takes appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration and unwanted disclosure.

Access to personal data is limited as far as possible to what is necessary to carry out the relevant work.

Depending on the circumstances, you have various rights under the GDPR in relation to your personal data. You may, among other things, request:

• access to your personal data;
• correction of inaccurate or incomplete personal data;
• deletion where you have a legal right to erasure;
• restriction of processing;
• objection to certain processing activities;
• transfer of personal data you provided where the right to data portability applies;
• withdrawal of previously given consent.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

A request can be sent to info@shavi.studio. Where reasonably necessary to verify the identity of the person making the request, additional information may be requested.

Requests will be answered within the statutory time limit.

If you have a complaint about the processing of your personal data, you can contact Shavi Studio. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).