Coffeeshop De Kade B.V. - Privacy Policy

Not only do we at Coffeeshop De Kade try to provide you with our finest products, we also try to be completely transparent about how we (might) use – or in legal terms: “Process” – your Personal data (hence the information you provide us) e.g. for the Purpose of being able to send you our kick ass products once ordered or in case you want to provide us with information on your own accord - e.g. if you want to ‘catch up’ with us via e-mail about your – soon to arrive – order.

In this pretty long document, we try to explain step by step how we deal with your privacy in the different contexts that we might have the pleasure to meet each other. Although we realise that this document might not be as exciting as a good book, we do suggest to take the time to read it as we find it very important that our customers, visitors and other Data subjects involved know that their privacy is respected! (Estimated reading time: far too long, but not so long that you would say: screw it!)

1. Who are we and why this privacy policy?

We – Coffeeshop De Kade (hereinafter “DE KADE B.V.”, “we” or “us”) – describe to you – our Data subjects (hereinafter “you”, the “customer” or “Data subject”) – in this Privacy policy how we deal with your privacy while collecting and further Processing your Personal data (see section 3 for the definition) in accordance with the General Data Protection Regulation (in short: the GDPR). With this Privacy policy, we intend to specifically inform you in detail about: us as the Controller of your Personal data, in which (different) capacities we might be in contact with each other (hence: the categories of Data subjects), information about the Processing of your Personal data, the Purposes we rely on while Processing your Personal data, the Legal ground(s) on which the Processing of the Personal data is based on, the Retention periods that we apply while Processing your Personal data, the use of cookies and tracking technologies on our website(s), if and under what conditions data transfer takes place to other organisations/countries, what organisational and technical measures we have taken and the rights you can exercise in context of Processing your Personal data. This Privacy policy is not necessarily a comprehensive documentation of our complete data Process. We have attempted to incorporate the most relevant topics as careful and comprehensible as possible. It is however possible that, depending on the specific circumstances and/or the relationship between us, other Privacy policies, protocols, Processing agreements, disclaimers, general terms and conditions, conditions of participation and/or other documents may be applicable while we have a business relation.

If you cannot seem to find the desired information in this privacy policy, please also take a look at the privacy policy on our webshop as we might have taken care of what you are looking for over there: dekade-boutique.com

The Controller - Who we are:

DE KADE B.V
Address: Stadionkade 107, 1076 BN (Amsterdam)
E-mail: info@coffeeshopdekade.nl
Tel: + 31 (0) 20 67 38 102
Chamber of Commerce: 60970677 (NL)
VAT(btw)-Number: NL854142368B01

Please note: In the case that a certain term is defined within the GDPR, any (undefined) term in this privacy policy shall have the same meaning as defined in the GDPR itself. You may find the GDPR in any (European) language by clicking here

This Privacy policy was last revised on the 1st of July 2021. DE KADE B.V. reserves at all times the right to change or revise the current version of this Privacy policy. We advise you for that reason to revisit this page on a regular basis in order to stay updated with the latest version of our Privacy policy. If we find it necessary to make major changes to (parts of) this Privacy policy, we will make sure that a clear statement will follow on the homepage of our website: https://coffeeshopdekade.nl and/or will be communicated to you by e-mail (if you have registered your e-mail address with us) when it is required that the modified version of the Privacy policy is made directly available to you.

If you in any case want to contact us about any (Personal) data (protection) related concern(s), then please do not hesitate to contact us with the contact details provided above!

2. Categories of concerned Data subjects

We, you and DE KADE B.V., might be involved with each other in different capacities. In these different capacities, we might Process (different sets of) your Personal data. To clarify whose Personal data we (might) Process, you’ll find below a list of the most common Data subjects we interact with (please be advised that this list is not intended to be complete):

• Potential, past and current online customers (interested in) purchasing our products;
• Potential, past and current customers (interested in) purchasing our products (physically) in the store;
• Business partners/contacts, affiliated partners and/or other affiliated parties involved (in particular (Third) parties involved in the business - operations and/or creation, facilitation or realisation of our (online) services and/or products);
• (Web)users on our website or (via) online (social media) platforms (e.g. Facebook and Instagram);
• (Legal) representatives, proxies, contact persons, and/or employees involved in the (business) relationship between any of the above-mentioned categories - _of Data subjects and DE KADE B.V.;
• Employees of DE KADE B.V.;
• Other categories of Data subjects not specifically mentioned herein.

If you and DE KADE B.V. are involved in any other capacity which is not explicitly referred to in this privacy policy, please visit the privacy policy on our webshop for more information: dekade-boutique.com.

3. The Collection and Processing of Personal data

Let’s start with defining what is meant by Personal data. In this Privacy policy “Personal data” is defined as: “any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular, but not limited to, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”. Or simply said: every piece of information that alone, or in combination with other information, could eventually identify a (specific) person.

We will only collect and Process Personal data that we effectively need for our (pre-)specified Purposes for Processing as laid out in section 4 of this Privacy policy. We also periodically review the Personal data that we obtained from you and delete anything we do not need, use (anymore) or have no (longer a) Purpose for.

We furthermore primarily Process Personal data – according to our Purposes – acquired (directly) from our customers, business partners/contacts, affiliated partners and/or other affiliated parties, as well as from other categories of Data subjects as mentioned under section 2 in the context of our business relationship(s) with them and/or collected from them as web users when operating our website(s), (social media) platforms, and/or other (online) applications.

If you at this point wonder what is meant with Process or a synonym of that, then please be informed of the following: “Processing means any operation or set of operations which is performed on Personal data or on sets of Personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.” Or simply said: basically, any use of Personal data of (EU) Data subjects.

Please be advised of the following: our (digital) services, the purchasing of products, website(s) and/or other online (social) platforms do not intend to collect the Personal data of website visitors under the age of 16 or visitors in the age range of 16-18 years. In the unusual case that we do need to Process data of a minor, we then only do so with the explicit legal Consent of the parent(s) or guardian(s). Unfortunately, we can never confirm (with certainty) the age and/or technically prohibit a minor visiting the website(s) and/or social media platforms as they are (also) accessible to minors. For that reason, we recommend that you are involved in the online activities of your minors so that it can be prevented that they disperse their Personal data without your Consent. If you believe that we have erroneously Processed the Personal data of a minor, then please contact us (section 1) so that we can inspect this immediately and, if necessary, correct it accordingly.

Please also note that if you provide us with Personal data of other individuals (e.g. from contacts, colleagues, acquaintances, friends, family members and/or other individuals), please make sure that the respective individual(s) is (or are) aware of this Privacy policy and only provide us with their Personal data if you have their permission to do so and provided such Personal data is accurate and truthful.

There are various methods by which you can provide us with and/or by which we collect/Process Personal data from you. For your information, in this Privacy policy we only refer to the most common ways in which Personal data is collected/Processed by DE KADE B.V. The categories of Data subjects mentioned in section 2 may provide us with their Personal data while:

• Visiting our store in Amsterdam;
• Visiting and/or browsing through our website;
• Purchasing our products/entering an agreement (online);
• Filling in the dedicated (web)forms;
• Registering to our (digital) services/newsletter;
• Communicating by means of e-mail, telephone, (certified) postal mail and/or similar communication methods;
• Responding to our (general) messages and/or sending (private) messages via social media platforms (such as Facebook or Instagram);
• Voluntarily providing us with your Personal data via any of the above- or similar methods;
• Other contacting/distributing methods not taken into consideration herein.

Insofar it is necessary and permitted to us, we may also obtain Personal data from you in addition to the above-mentioned methods of data collection/ processing. DE KADE B.V. may for example also obtain Personal data from publicly accessible sources (e.g. commercial registers, debt registers, press, internet and social media) and/or may Process such information from business partners/contacts, affiliated partners, other associated parties and/or otherwise involved (Third) parties (e.g. legal representatives, expert/specialists, authorities and ICT services providers) while engaging with and/or performing the agreement between us, under the condition that we have a (specific) pre-designated Purpose and a Legal basis for the Processing of such Personal data. However, generally spoken we will not Process such information from most of our Data subjects – e.g. (web) visitors and/or our customers. In case we do (need to) Process such information, we will then make sure to inform you properly beforehand.

Apart from the (requested) Personal data you directly provide to us or is provided at your own discretion, the categories of Personal data that DE KADE B.V. collects and Processes (either being requested or sourced as specified above) depends on the type of business relationship you have with us. Some of the following categories of Personal data might therefore not be applicable to your business relationship with us. For transparency, please find the following – non-exhaustive – list of categories of Personal data that we (might) Process during our business relationship while having a pre-designated Purpose and a Legal basis for it, as will be further explained in section 4 of this Privacy policy. We furthermore do not Process more (Personal) data than is necessary for the Purpose that we Process your Personal data for (e.g. we will only Process your e-mail address while subscribing for our newsletter and not ask you for your name, address or phone number as we do not need this information in order to be able to send you our amazing newsletter full of valuable information):

1. (First and last/business) name, e-mail address, (shipping/billing) address and phone number;
2. Bank account number (usually the last 4 digits), file/case references, order numbers/references (in case of an online order: IP address), and/or all other (Personal) data necessary or helpful in the performance of the agreement(s) between us;
3. Information/extracts from (public or restricted) registers (e.g. Chamber of Commerce);
4. Information in connection with your professional role and activities;
5. Personal data about you in correspondence and discussions with other (Third) parties;
6. Credit/debit rating information;
7. Information provided to us by individuals associated with you such as friends, family, consultants, legal representatives and/or in other ways involved (Third) parties (e.g. in the form of references, delivery address(es), powers of attorney, information regarding legal regulations such as anti-money laundering and export restrictions for Purposes such as concluding or Processing agreements with you);
8. Information from or regarding distributors and other business partners for the Purpose of ordering or delivering products or services to you or by you;
9. Information about you Processed from social media or internet (insofar required in connection to e.g. job applications, media reviews, marketing/sales, personalisation of our (digital) services or products et cetera);
10. (General) statistical data in connection with your use of our websites (e.g. anonymised IP address(es), information regarding your device and settings, (our) cookies, date and time of your visit, websites/pages and content retrieved, applications used, referring website, localisation data and/or other general statistical data about the use of our website and/or content);
11. Data received in connection with administrative or court proceedings (e.g. in the unlikely event that there is a conflict between us);
12. In some cases, in context of our business relationship: company details, financial information, signature, Personal data in correspondence between you and other (Third) parties as well as all other (Personal) data necessary, legally obligated and/or helpful during the (business) relationship between DE KADE B.V. and you;
13. Information about you(r) (appearance - in the form of images and/or videos of recorded situations) obtained via camera surveillance in order to, protect our visitors/customers or employees and/or their/our properties as well to prevent mischief. Please also inform yourself about our Camera surveillance protocol;
14. (Identification) information like your date of birth and picture from an official legal document in order to confirm that you meet the legal age requirement to enter our store;
15. Any other (Personal) data necessary and/or relevant while conducting our business relationship with you (e.g. feedback, (e-mail) correspondence, information provided on your own initiative – e.g. socio-demographic data – et cetera);
16. In context of an (open) job application we might Process Personal data such as contact details, CV, grade lists, reference letters, diplomas, a motivation letter and/or other (job) specific information while assessing for potential employment. For screening Purposes, we may also Process online/publicly available information about you such as your social media profiles.

4. The most common Purposes, Legal basis and Retention period(s) for the Processing of your Personal data

We primarily use your Personal data for the Purpose of concluding and executing agreements with our customers and business partners, in particular in connection to: carrying out our services/delivering our products in accordance with our agreement(s), providing our services and content as well as expanding, developing and/or investing into new services, products and/or business opportunities. We might also use your Personal data for the Purpose of providing (information on) our other (really potentially interesting) service(s) and/or products to you and for the procurement of services from our business partners/contacts, affiliated partners and/or other affiliated parties involved, as well as to comply with our domestic and foreign Legal obligations. It is also possible that you are involved in our data processing in the capacity of other categories of Data subjects, as stated in section 2.

To provide you a clear overview, below you’ll find the most common Purposes that we (might) invoke while Processing your (or other individuals) Personal data. In this paragraph, we explain on which Legal basis the Processing of your Personal data relies and which Retention period we apply for the Personal data we Process. Please note however that this list is not exhaustive; we also may Process your Personal data in case we have a Purpose that is compatible with an ‘original’ Purpose as mentioned under section 4.

Entering into and executing agreements (online) in regard to our services and products and/or creating an online account:

Your Personal data (section 3: A, B & H) may be Processed by us for entering into and executing online agreements with you in context of purchasing and delivering our products, (online) services and (might) be further used for among other things: maintaining contact with you about and in regard to our (online) agreement, the order status, for invoicing/payment Purposes, for (online) account management (and other administrative matters) and for maintaining our online business relationships with you. We also allow our customers to create an online account on our website(s). While creating an online account, we (may) Process Personal data (section 3: A) to allow for an easy and optimised order Process. When logged-in, customers do not have to fill in their Personal data to be able to conclude the agreement/order products with/from us.

We Process the Personal data on the Legal basis of ‘Contractual necessity’. If we cannot invoke the Legal basis of Contractual necessity, we then may assert the Legal basis of our ‘Legitimate interest’, insofar we have one. We may also Process the Personal data because of our ‘Legal obligation’ or sometimes (e.g. when creating an account) ask for your ‘Consent’. The above-mentioned information is kept for as long as necessary to properly perform the agreement between us and/or delivering our products to you. We then afterwards delete or anonymise your Personal data, unless we are legally obligated to keep (part of) it longer or have another Purpose and/or Legal Basis for the continuance of Processing the Personal data. The financial/tax information in regard with our business relationship is kept for as long as is necessary to comply with our Legal obligation to keep our (tax) administration (seven years minimum).

Entering into and executing agreements (in store) in regard to our services and products:

Your Personal data (section 3: B & M) may be Processed by us for entering into and executing the agreements between you and DE KADE B.V. in context of purchasing our products and (might) be further used for e.g.: maintaining contact about and in regard to the agreement concluded between us, for invoicing/payment Purposes, for account management (and other administrative matters) as well for maintaining our business relationships with you.

We Process the Personal data on the Legal basis of ‘Contractual necessity’. If we cannot invoke the Legal basis of Contractual necessity, we may then assert the Legal basis of our ‘Legitimate interest’, insofar we have one. We may also Process the Personal data because of our ‘Legal obligation’ or sometimes also ask you for your explicit ‘Consent’. The above-mentioned information is kept for as long as necessary to properly perform the agreement between us and/or delivering our products to you. We then afterwards delete or anonymise your Personal data, unless we are legally obligated to keep (part of) it longer or have another Purpose and/or Legal Basis for the continuance of Processing the Personal data. The financial/tax information in regard to our business relationship is kept for as long as is necessary to comply with our Legal obligation to keep our (tax) administration (seven years minimum).

To contact – or reply – to you (after contacting us):

In case you ask us questions, make requests, fill-in online (contact) forms or use the alternative messaging options on our online (social media) platforms/website(s), we in that case (may) Process your Personal data (depending on the information you provide us: see section 3: A - O). With the use of this Personal data we (try to) get back to you and - depending on the extent of your question, request or registration - address you promptly and accordingly as soon as possible.

We Process this information either under the Legal basis of ’Contractual necessity’ or under the Legal basis of our ‘Legitimate interest’ to respond to you and/or to (eventually) conclude the contact with you in case we cannot invoke the Legal basis of Contractual necessity. In some cases, we might ask you for your explicit ‘Consent’. In any case we will keep your Personal data until we think you are satisfied with our response, unless another Purpose or Legal basis justifies a longer Retention period for the use of this Personal data. If you have registered to- or purchased our products, we then will keep the registration information until the agreement with you has been executed, or longer insofar we can invoke another Purpose and/or Legal Basis for the continuance of Processing the Personal data and/or as long it is necessary to comply with our ‘Legal obligation’ to keep our (tax) administration (seven years minimum).

For marketing, advertising and market/opinion research of our (digital) services and products:

While visiting us online, your Personal data (see section 3: A, C, D, I, J & O) may be Processed for the marketing and advertising of our (digital) services and product(s) (content) or those of our (affiliated) business partners/contacts, affiliated partners and/or other affiliated parties, and provided that you have not objected to the use of your Personal data for this Purpose.

We primarily Process this information on the Legal Basis of your ‘Consent’ or because it is in our ‘Legitimate interest’ (e.g. business continuity) to Process this Personal data. We keep this information as long as we have your Consent and/or may exert (any of) our Legitimate interests. In any case your Personal data for this Purpose will be deleted after three years, unless we have agreed upon differently or still have an active business relationship with each other.

Sending and providing our newsletter:

We send out a quarterly newsletter for which we provide the option to subscribe (see section 3: A). Once subscribed, you receive a periodical newsletter via e-mail with information, news and developments in regard to our products, services/content as well as general news items. If you wish to cancel this subscription, you may do so at any time via the unsubscribe link provided in the e-mail(s) sent to you.

Your e-mail address will only be added to the list of subscribers after obtaining your ‘Consent’ while registering to our newsletter. We keep this information until you cancel the subscription or in a different way withdraw your Consent. In case you withdraw your Consent/unsubscribe, we then register your e-mail address on the blocking list to be certain you do not receive the newsletter again.

Protecting the safety of our customers and that of our employees, property and products through the use of in store Camera surveillance:

To protect the property and safety of our visitors/customers and employees, as well as to prevent/minimise theft, nuisance, destruction, vandalism, other criminal activities or to support private- or criminal proceedings, we use visible camera surveillance in some (generally accessible) areas as well as the front portal of our bathroom. We, of course, will make sure that you’ll be notified of the presence of camera surveillance as well as the position of the (individual) cameras by means of a sticker with the symbol of a camera. With the use of this camera surveillance, DE KADE B.V. (may) Process(es) Personal data (section 3: M) by means of video recordings for surveillance Purposes. In the rest of this paragraph, you can read what we do with the recordings, how long we keep them, what rights you have and how you can exercise them. In addition to this, we have a specific Camera surveillance protocol wherein we describe our (GDPR) approach in (more) detail in regard to the camera surveillance. Please don’t hesitate to ask us while visiting our store in Amsterdam if you wish to inform yourself more in detail about the camera surveillance.

We use the Personal data that we (might) Process via camera surveillance on the Legal basis of our ‘Legitimate interest’ to protect the safety and property of our visitors/customers, employees in and around our store as well as to prevent and/or minimise theft, nuisance, destruction, vandalism, other criminal activities or to support private- or criminal proceedings. The impact on the privacy of the person(s) involved is limited to that which is necessary to protect the visitors/customers, employees and (their) property of DE KADE B.V., as well as the objects and persons who at that moment are in any way entrusted to the security of DE KADE B.V. and e.g. to be able to make a substantiated report of incidents. In our considerations regarding camera surveillance, we have taken the interests of the persons whose data is being Processed as much as possible into account. For example, we do not place cameras in locations where people should generally be able to assume their privacy unharmed. For the safeguards put in place to limit the invasion of the privacy of the Data subject(s), please see our Camera surveillance protocol.

Use and exchange of information obtained from our camera installation

In the (sole) event of incidents or suspected criminal offenses of which DE KADE B.V., one of its employees or visitors/customers wishes to report to the investigative authorities, the video material can be used to identify those involved. To this end, the images can be made available to the investigative authorities in support of a report of a criminal offense. The camera material will not be shared with other (Third) parties, unless there is a (legal) obligation to do so. The persons involved in the Processing of the camera images have an explicit duty of confidentiality. DE KADE B.V. does not use facial recognition or other methods with which persons can be identified electronically. Additionally, no sound recordings are made.

Security and storage of Personal data obtained from our camera installation

The camera images are stored (and Processed) only within the Netherlands. The security of the video images is ensured as set out in section 7 of this Privacy policy. Access to the video material is strictly regulated and may require additional verification compared to the exercise of your (other) rights as set out under section 11. The video material is kept for a maximum of two weeks, or in the event of an incident, for the duration until the incident has been resolved.

An obligated ID-check while visiting our store in Amsterdam to make sure that all our customers are at least 18 or 21 years of age:*

When you visit us in our store in Amsterdam, we, most of the times, have to perform an “ID-check” (and therefore Process your Personal data) for the sole (legal) Purpose of making sure that all our customers are at least 18 or 21 years of age (before 17:00) (section 3: N). We are legally obligated to check your age as we cannot allow minors to enter our premises. For this Purpose, we will ask you for an official legal document where we can verify that all our customers are at least 18 or 21 years of age. We will only Process your Personal data like date of birth and picture (to make sure it’s you) when confirming your age.

We Process your picture and date of birth from the legal document you show us on the Legal basis of our ‘Legal obligation’ and/or our ‘Legitimate interest’ to make sure that all our customers are at least 18 or 21 years of age. The above-mentioned information is not kept or saved anywhere and will only be Processed for the aforementioned Purpose while visiting our store in Amsterdam. We furthermore try to know our customers personally so that we do not have to keep bothering you with the question as to whether you’re old enough to visit us. It can, however, sometimes occur that we (might) ask you for your legal document for a second (or a third) time. In this context, please appreciate us asking more than once as a compliment; it just means you are still looking young and flex!

*Between 08:00 and 17:00 all our customers/visitors must at least have reached the age of 21 years because of the neighbouring schools that surround our premises. After 17:00 all customers/visitors that have reached the age of 18 years are welcome to try our delicacies.

To respond to and/or go through an (open) job application procedure

We may Process your Personal data (section 3: A, G, I & P) in case you send us an (open) job application. For this Purpose, we may Process Personal data such as your name, age, contact details, CV, grade lists, (optional) reference letters, (optional) diplomas, a motivation letter and/or other (job) specific information while assessing for potential employment. For screening Purposes, we may also (on the Legal basis of our Legitimate interests) Process online/publicly available information about you such as your social media profiles and use the outcomes for further assessment; this will (afterwards) always be discussed/communicated to you. The (results of the screening) itself will never be the (sole) reason for which we reject applicants. In some cases, we may refer to the help of external HR consultants in regard to your application; in these instances, we (may) share (some of) your Personal data with them.

The Legal basis on which we Process your Personal data in case of an (open) job application is either ‘Consent’, ‘Contractual necessity’ (insofar we enter into an agreement) or ‘Legitimate interest’ (to assess whether we are employing you). We do not keep your Personal data for the aforementioned Purposes longer than necessary. If the application Process does not conclude to being employed by DE KADE B.V., we will not keep the data for longer than eight weeks after the procedure in case we might still approach you if another candidate doesn’t complete the procedure. In some cases, we may ask you to give us Consent to keep your Personal data for a longer period of time. In that case we will keep your data for the duration of maximum one year after the application Process has ended.

To enter into or execute agreements with Suppliers, producers and other partners with whom DE KADE B.V. has or (will do) business:

Personal data (section 3: A, B & O) may be Processed by us while entering into and executing the agreements between you (the supplier, producer or other partner) and DE KADE B.V. in context of providing us services and or products and (might) be further used for e.g.: maintaining contact with you about and in regard to the agreement concluded between us, for invoicing/payment Purposes, for account management (and other administrative matters) as well as for maintaining our business relationships with you.

We Process the Personal data for this specific Purpose on the Legal basis of ‘Contractual necessity’. If we cannot invoke the Legal basis of Contractual necessity, we then may assert the Legal basis of our ‘Legitimate interest’, insofar we have one. Sometimes we may also Process your Personal data based on our ‘Legal obligation’, or on your explicit ‘Consent’. The above-mentioned information is kept for as long as necessary to properly perform the agreement between us and/or receiving or providing our products, services from or to you. We then afterwards delete or anonymise your Personal data, unless we are legally obligated to keep (part of) it for a longer period of time or have another Purpose and/or Legal Basis for the continuance of Processing the Personal data. The financial/tax information in regard to our business relationship is kept for as long as is necessary to comply with our Legal obligation to keep our (tax) administration (seven years minimum).

To be able to accommodate our lost and found ‘corner’:

In some cases, when a customer/visitor loses an item while visiting our store in Amsterdam (e.g. because you have become so ecstatic about our great products that you forget to put back your debit card), we (might) Process your Personal data in order to reunite the rightful owner with his/her lost property. In the case that it is evident that you are the rightful owner of a lost property (for example, because you can describe exactly what the lost property looks like), we then will not Process your Personal data. However, if, for example, you have lost your debit card, ID card et cetera, we will then have to ask you to identify yourself in order to ensure that the property is returned exclusively to the rightful owner.

We (might) Process your name, date of birth and/or picture from the legal document you show us on the Legal basis of our ‘Legal obligation’ and/or our ‘Legitimate interest’ to make sure that we only return found objects to their rightful owner. The above-mentioned information is not kept/saved anywhere and will only be Processed for the aforementioned Purpose while visiting our store in Amsterdam.

Additionally, In compliance with applicable law and where deemed appropriate, we may exert the Legal basis of ‘Legitimate interest’ to Process (part of) your or other individual’s (Personal) data for the following Purposes:

• Ensuring, providing and developing our products, services, website(s), apps and/or (content on) other (social media) platforms (Facebook, Twitter, YouTube, Instagram and LinkedIn);
• To communicate information regarding our products, services, promotions, events and competitions which might interest you (during our active business relationship);
• For communication with other (Third) parties and administering of their requests (e.g. inquiries from legal representative(s));
• To maintain, explore and grow business/customer-relationships;
• To send information regarding changes to our terms and conditions for our services, Privacy policy (including the Cookie section) and/or other legal documents;
• Follow-up e-mails with other products customers may be interested in after having placed their order;
• For reviewing and optimising procedures regarding a ‘needs assessment’ for the Purpose of direct customer approach as well as for customer acquisition (e.g. analysing activity from users on (our) Social media connected to our products, services or business as a whole);
• To carry out administration, marketing, planning, product and service development, and quality control;
• To create/send orders, tax invoices, receipts, record transactions, create files and/or to satisfy other administrative requirements;
• Asserting legal claims and (acquiring evidence in regard to our (or our (business)partner’s)) defence in legal disputes and official proceedings;
• Prevention and investigation of criminal- or contractual offences and other misconduct (e.g. through the use of: system/file logging, camera surveillance, conducting internal investigations, data analysis to eliminate fraud and/or loss prevention activities);
• Ensuring the operation of our IT-department, website(s), apps and other IT-related matters;
• Acquisition and sale of business divisions, companies or parts of companies and other corporate transactions and the transfer of Personal data related thereto, as well as measures for business management and compliance with legal and regulatory obligations and/or the internal regulations of DE KADE B.V.;
• Any other Purposes compatible with an ‘original’ Purpose as mentioned in the above list.

In the event that we require additional Personal data from you for a specific Purpose while we do not have or cannot invoke a compatible Purpose, or while we have not communicated the Processing of the specific Personal data beforehand, we in that case will contact you at the moment that we require the additional Personal data and will of course provide you with the necessary information so that you can decide whether you want to provide us with the additional data, insofar we do not hold this Personal data yet. We will in that case also explicitly request your Consent, insofar necessary, before initiating the Processing of this additional Personal data.

Insofar we have not provided an exact Retention period for Processing your Personal data for a particular Purpose, then the following norm applies for the Retention of your Personal data: we Process and retain your Personal data as long as required for the performance of our Contractual necessity, our Legitimate interest and/or compliance with our Legal obligations, as well as for other Purposes we pursue while Processing. For example, we keep your Personal data for the duration of the entire business relationship (from the initiation, during the performance of the contract, for invoicing Purposes, up until it is terminated or) as well as beyond this duration in accordance with our Legitimate interest, your Consent, the period of limitations of (legal) actions and/or documentation/administration obligations, unless we have specifically made (a) different agreement(s). Personal data may furthermore be retained for the period during which claims can be asserted against our company, insofar as the Personal data serves a particular Purpose. Furthermore, your Personal data can be retained insofar our affiliated partner’s Legitimate interests require further Retention (e.g. for evidence and documentation Purposes). As soon as your Personal data is no longer required for any of the above-mentioned Purposes under section 4 of this Privacy policy, this Personal data will be deleted or anonymised to the greatest extent possible. In general, shorter Retention periods of no more than twelve months apply for operational data (e.g. system logs insofar they involve Personal data).

Please note: If you have given us your Consent to Process your Personal data for certain Purposes (for example when registering to receive our newsletters), we will then only Process your Personal data within the scope of, and based on, this given Consent, unless we have another Legal basis, provided that we require one. Given Consent can be withdrawn at any time. This, however, does not affect the Personal data Processed prior to the withdrawal of your Consent. Please be advised that the withdrawal of (your) Consent may in some cases result in us not being able to provide/deliver certain services/products to you and/or us not being able to guarantee any longer the correct execution of an agreement between us. In case you want to withdraw your Consent (other than for cookies), please send us an e-mail to info@coffeshopdekade.nl telling us for which Purpose and/or Processing of your Personal data you wish to withdraw your consent for.

5. The use of Cookies and similair technologies

We may use ‘cookies’ and similar techniques on our websites which, after obtaining your Consent, allow for identification of your browser or device, to personalise content and ads, to provide social media features and to allow (generally) analysing traffic on the website. We will however, before we use cookies, provide you with the relevant information so that you actively can choose to accept the cookies – or not.

A cookie is a small text file that is sent to your computer and automatically saved by the web browser on your computer or mobile device, when you visit our website. If you revisit our website, we may ‘recognise’ you through the use of cookies, even if we do not know your identity. Besides cookies that are only used during a session and deleted after your visit on the website (“session cookies”), we may also use cookies in order to save user configurations and other information for a certain time period (“persistent cookies”). We may also use persistent cookies for the Purpose of saving user configuration (e.g., language, automated login, remembering your cookie preferences and/or e.g. to create a session-ID) or in order to understand how you use our services and content and to enable us to show you customised offers and advertisement which may also happen on websites of (business)partners or other companies. Certain cookies may be sent to you by us, while others may come from our business partners with which we collaborate. Notwithstanding the foregoing, you may configure your browser settings in a way that it rejects cookies, only saves them for one session or deletes them right away. Most browsers are pre-set to accept cookies. If you block (our) cookies or do not Consent to them, it is however possible that certain functions (such as, language settings, ordering Processes) are no longer available to you.

Cookie pop- up box during your first visit on our website

When you visit our website for the first time, we display a pop-up message explaining the use of cookies with a referring link to this Privacy policy (section 5) where you can find all the information about the cookies we use. Insofar applicable, we have made agreements with other businesses that place cookies on our website(s) about the use of these cookies. However, we do not have full control over what they do with the cookies themselves. It is for this reason advised that you also pay attention to their Privacy Policies. In any case DE KADE B.V. will store cookies on your device that are strictly necessary for the operation of our website or provide us with general statistical information about the use of our website and/or services.

If you Consent to all our cookies, we also use marketing/tracking cookies that enables us to show you customised offers and advertisement, which may also happen on websites of other organisations. Should your identity be known to us, such companies will not learn your identity from us. They will only know that the same user (ID) that previously visited a certain website is visiting the website again.

CHANGE MY COOKIE CONSENT

Please check our Cookie table below for more detailed information about our (use of) cookies, the Purposes they serve and which Retention period we have set for these cookies while using them.

Cookie table

Our cookies
Name of cookie	Provider	Purpose / Category of Personal data	Retention period	Type of cookie
CookieConsent (First party)	De Kade	Saves the cookie consent status of the current user of the current domain.	Max. 31 days	HTML
_ga	Google	The _ga Cookie from Google Analytics records a unique ID for our web visitors that is used to generate statistical data about how the visitor uses the website. We have set our Google Analytics Cookies as privacy-friendly as possible. This Cookie collects information such as: the number of visitors to the website, where visitors come from and the pages they have visited.	Expires after 2 years	HTTP
_gid	Google	This cookie registers a unique ID that is used to generate statistical data on how the visitor uses the website	Max. 24 hours	HTTP
_gat_gtag_xxxxx	Google	This cookie registers a unique ID that is used to generate statistical data on how the visitor uses the website.	1 minute	HTTP

As can be seen from the Cookie table in section 5, most cookies have a pre-set expiration date. They expire automatically after a set period of time and will from that point no longer record any data. Please see our Cookie table for the specific Retention period for each type of cookie. You can also choose to delete the cookies manually before the expiration date. If you wish to do so, please read the instructions of your browser on how to do this.

Social media buttons

In addition, we may use plug-ins (‘buttons’) from social networks such as Facebook and Instagram on our websites. The buttons work by using pieces of code that come from the social media providers themselves and is visible for the website visitor (typically based on the respective symbols). We have configured these elements to be disabled by default. When activated (by clicking on them and/or by accepting all our cookies when you (first) visit our website), the operators of the respective social networks may record Personal data like IP addresses and/or place tracking cookies for their own Purposes. This Processing of your Personal data lies in the responsibility of the respective operator and occurs according to their data protection regulations. We do not receive any information about you from the respective social (media) networks. Please read the concerned Privacy Policies from respectively Facebook and/or Instagram (which may change regularly) to find out how they Process your Personal data when they collect Personal data from you. The information they Process is usually transferred to and stored by social media networks on servers in, among other places, the United States.

Please note: We are aware of the latest judgment of the Court of Justice of the EU dated on the 16th of July 2020 and the implications that this ruling has brought for the transfer of Personal data outside the EEA. We are currently awaiting further developments regarding this and in the meantime, we are also examining what we can do ourselves to overcome this while keeping the disruption to a minimum. If we have a suitable solution, we will inform you via this Privacy policy. Do you have questions about the Processing of your Personal data? Please contact us using the contact details in section 1 of this Privacy policy.

6. Data transfer and Transfer of data abroad

In the context of our business activities, products, (digital) services, and in line with the Purposes of the data Processing set out in section 4, we may transfer Personal data to other (Third) parties, insofar as such a transfer is permitted, necessary and deemed appropriate, in order for them to Process Personal data for us or, as the case may be, their own Purposes. In this context, the most common categories of Recipients are:

• Our service providers (within DE KADE B.V. or externally, e.g. Mollie, banks, insurances), including Processors and other IT providers;
• Our affiliated partners;
• Suppliers, subcontractors, business partners (in particular in connection with (providing) our products, (digital) services and content as well as expanding, developing and/or investing into new products, (digital) services or content);
• Domestic and foreign authorities or courts;
• Acquirers or parties interested in the acquisition of business divisions, companies or other parts of the DE KADE B.V.;
• Other parties in possible or pending legal proceedings;
• Other (Third) parties not taken into consideration herein.

(Together: “Recipients”).

Certain Recipients of your Personal data may be within Europe (EEA), and insofar applicable, have appointed a suitable Data Protection Officer, but they may also be located outside Europe (EEA). In particular, you must anticipate your Personal data to be transmitted to other countries in Europe (EEA) and the USA depending on where our service providers are located (such as Mollie, PostNL, Worldline, Google etc). If we transfer data to a foreign country, we ensure an appropriate level of protection as legally required and we will conclude an appropriate (Processor) agreement with them. If we transfer your data to non-EEA Processors, we will only do so on the basis of the standard contract clauses issued by the European Commission, binding corporate rules and while relying on the statutory exceptions of Consent, Contractual necessity or Legitimate interest (such as the establishment, exercise or enforcement of legal claims, publically accessible Personal data or because it is necessary to protect the integrity of the individuals concerned).

We do not sell, trade, or otherwise transfer your Personal data to other (Third) parties unless we provide you with an advance notice, have your explicit Consent and adequate legal data protection is guaranteed by the Third party. This does not include website hosting partners and other parties who assist us in operating our website, conducting our business or services, as long as those parties comply with the GDPR and agree to keep this information confidential. We may also release your information when we believe releasing this data is appropriate to comply with the law, enforce our site policies, protect our or others’ rights, property, or safety. Non-personally identifiable (visitor) information may be provided to other parties for marketing, advertising or for other Purposes.

Third-party providers of our cookies and other (Third) parties providers involved with the product(s) and services of DE KADE B.V.

Google Analytics | We use Google Analytics on our website. These are services provided by Third parties, which may be located in any country worldwide (in the case of Google Analytics, Google LLC is in the U.S.A., www.google.com and which allow us to measure and evaluate the use of our website (on an Anonymised basis). For this Purpose, permanent cookies are used, which are set by the service provider. The service provider does not receive (and does not retain) any Personal data from us, but the service provider may in their own capacity track your use of the website, combine this information with data from other websites you have visited, which are also tracked by the respective service provider and whom may use this information for its/their own Purposes (e.g. personalising advertisements). We have arranged the settings for Google Analytics to be as privacy friendly as possible and have concluded a processing agreement with Google. If you have registered with the service provider, the service provider will also know your identity. In this case, the Processing of your Personal data by the service provider will be conducted in accordance with their data protection regulations. The service provider only provides us with data regarding the use of the website(s) (but not any Personal data about you). Furthermore, in no way do we have influence on what these Third-parties do with the (Personal) data that they acquire from you during their services. For this reason, we suggest in order for you to be fully informed, that you also take notice of the Privacy policy (or Policies) (also known as Privacy Statement, Privacy data protection statement or an abbreviation of that) of these Third parties. The Processing of your Personal data via Google Analytics is based on your ‘Consent’ or our ‘Legitimate interest’ in obtaining general statistics (e.g. (anonymised) IP addresses from our website visitors). For more information about Google’s Privacy policy, please click here or for the specific Privacy policy applicable to the cookies of Google Analytics please click here.#zippy=%2Cin-dit-artikel)

Google Tag Manager | Our website(s) uses Google Tag Manager. Google Tag Manager cookies allow us to measure traffic and user behaviour, understand the effect of online advertisements and social channels, use remarketing and target group marketing and test and improve our site. The Processing of your data via Google Analytics is based on your ‘Consent’. We have made the settings for Google Tag Manager as privacy-friendly as possible for your Personal Data. When you have registered yourself (on your own initiative) with the service provider, the service provider may also know your identity. In this case, the Processing of your Personal Data will be carried out by the service provider in accordance with their data protection regulations. The service provider only provides us with data about the use of the website, but no Personal Data. Furthermore, we have no influence in any way on what these Third Parties do with the (Personal) Data that they (independently) obtain/Process from you during their services. Read more information about Google’s Privacy policy here.

Mollie/Plink/Snipcart | Our website uses the payment services of Mollie in order to conduct and carry out any payment via our website. Mollie helps e-commerce businesses of all sizes to sell and build more efficiently with a solid but easy-to-use payment solution. Mollie believes that the Processing of Personal data under the user agreement with us is not covered therein. When it comes to the Processing of Personal data, Mollie does not work on behalf of the merchant and the merchant does not work on behalf of Mollie. The data that Mollie receives is Processed on the basis of a personal responsibility. Mollie is therefore not a Processor, but an independent Controller as referred to in the GDPR. We have in no way influence on what Mollie does with the (Personal) data that they acquire from you during their services. For this reason, we suggest, that you also take notice of the Privacy policy of Mollie by clicking here. When you go to a page where you can place an order (shopping cart), a connection to Snipcart is also made. Snipcart takes care of the handling of the shopping cart and customer data (name, address, zip code, place of residence, and payment method) in the webshop. This data is then sent to our payment provider Mollie. This information is necessary for reporting this to you as well as for Processing the payment. Read more about Snipcart’s Privacy policy here.

Worldline | In order to Process payments via our payment terminal in our store, we use the Worldline platform in our shop. Worldline may Processes your name, address and residence details and your payment details such as your bank account or credit card number. Worldline has taken appropriate technical and organisational measures to protect your Personal data. Worldline reserves the right to use your data to further improve the service and to share (anonymised) data with third parties in this context. All the above-mentioned guarantees with regard to the protection of your Personal data also apply to the parts of Worldline’s services for which they engage third parties. Worldline does not store your data for longer than permitted by law. DE KADE B.V. has entered into specific processing conditions (Processing agreement) with Worldline in which the specific agreements and responsibilities between us are clearly determined. Read more information about Worldline’s Privacy policy here or read the specific processing conditions that we agreed upon here.

Afterpay | Afterpay only takes over part of the transaction, as a result of which they enter into a direct agreement with our customer(s). Afterpay is therefore not a Processor of Personal data with regard to our webshop De Kade boutique. As a result, it is not necessary for Afterpay and DE KADE B.V. to conclude a Processing agreement. Afterpay takes over the order on the basis of a deed of assignment. Read more information about Afterpay’s Privacy policy here.

Hostnet B.V. | Our website and e-mail services are hosted via Hostnet B.V. (Hostnet.nl). Hostnet.nl Processes Personal data from our website(s) on our behalf and does not use your data for its own Purposes. However, this (Third) party can collect metadata about the use of its services. This is not Personal data. Hostnet.nl has taken appropriate technical and organisational measures to prevent loss and unauthorised use of your Personal data. We have concluded a Processing agreement with Hostnet.nl in which the responsibilities and obligations of both parties have clearly been set out. Hostnet.nl is obligated to observe secrecy on the basis of the agreement. For more information about Hostnet.nl’s Privacy policy, please click here.

PostNL | If you place an (online) order with us, it is our job to have your package delivered. We use the services of PostNL to carry out the deliveries. It is therefore necessary that we share your name, address and residence details with PostNL. PostNL only uses this information for the execution of the agreement. In the event that PostNL engages subcontractors, PostNL will also make your data available to these parties. PostNL

has taken appropriate technical and organizational measures to protect your Personal Data. During the conclusion of our agreement with PostNL, specific processing agreements are made in place that clearly defines the agreements and responsibilities between us. Click here to see the specific processing conditions that we have agreed with them. Read more information about PostNL’s Privacy Policy by clicking here.

7. Data Security

We have taken appropriate technical and organisational security measures to reliably protect your Personal data from unauthorised access, loss, destruction, distortion, manipulation, unauthorised copying, unauthorised access and/or other data Processing offenses in accordance with ‘Privacy by design’ and ‘Privacy by default’.

DE KADE B.V. has different internal policies in place such as a data breach protocol, a Processing register, a Camera surveillance protocol and for example clear privacy directives with or for service providers and/or other involved (Third) parties. The staff of DE KADE B.V. is further regularly updated and informed with the latest privacy developments and/or legislation.

As for technical measures, DE KADE B.V. has made sure that there are IT and network security solutions in place such as access controls and restrictions (e.g. password protection on our IT systems), physical access measures and organisational measures for access security, security of network connections via Transport Layer Security (TLS) technology, encryption of data (carriers) and transmissions, Pseudonymisation and/or Anonymisation of Personal data, regular inspections, quality assurance and other technical and organisational (security measures) while Processing your Personal data. Please also see the other (privacy) documentation of DE KADE B.V. for more specific information regarding our technical and organisational measures for different aspects of our data process.

8. Third-party website(s)

Please be advised that this Privacy policy and Cookie section do not apply to any other (Third) party websites linked to- or from our website through hyperlinks. We have no overview and/or influence and can therefore not guarantee that these other (Third) parties handle your Personal data in a reliable, safe manner and in accordance with the GDPR. Please read the Privacy Policies of these other (Third) parties before sharing Personal data with them.

9. If you do not want to provide Personal data to us in context of our business relationship

In the context of our business relationship, we ask you to provide us with any Personal data that is necessary for the conclusion and performance of our business relationship and the performance of our contractual/Legal obligations. As a rule, however, no statutory requirement exists to provide us with your Personal data. Do be advised that, without certain information, we will usually not be able to enter into- or carry out an agreement with you (or the entity or individual you represent).

10. Profiling and automated individual decision-making

In establishing, and while carrying out, a business relationship or while using our website, we generally do not use any automated individual decision-making (such as pursuant to article 22 of the GDPR). Should we decide to use such methods, we will then inform you separately on this and advise you of your relevant rights insofar required by law.

We may, however, partially Process your Personal data automatically with the aim of evaluating certain personal aspects (Profiling). In particular, Profiling allows us to inform and advise you more accurately about products and services possibly relevant to you. For this Purpose, we may use evaluation tools that enable us to communicate with you and advertise to you, including market and opinion research (see also section 5 & 6 of this Privacy policy).

11. Your rights under the GDPR

• Right of access (Art. 15 GDPR)
  This right grants the Data subject insight in the Personal data concerning him or her and into other important information such as the Purposes of the Processing or the period for which the data is retained;

• Right to rectification (Art. 16 GDPR)
  This right gives the Data subject the possibility to have inaccurate Personal data concerning them rectified;

• Right to erasure (Art. 17 GDPR)
  This right entails the possibility for the Data subject to have Personal data in possession of the Processor/Controller erased under the conditions as set out in art. 17 of the GDPR;

• Right to restriction of Processing (Art. 18 GDPR)
  This right gives the Data subject the possibility to (temporarily) forfend further Processing of Personal data concerning the Data subject. A restriction mainly occurs at the stage of examining other exercises of rights by the Data subjects;

• Right to data portability (Art. 20 GDPR)
  This right entails the possibility for Data subjects to receive their Personal data (after submitting a request) from the Processor/Controller in a commonly used, machine-readable format and have this data transferred to another Controller or Processor;

• Right to object (Art. 21 GDPR)
  This right includes the possibility for Data subjects to object to the further Processing of their Personal data. Please note that we reserve the right to enforce statutory restrictions on our part, for example if we are obligated to retain or Process certain data, have an overriding interest (insofar as we may invoke such interests) or need the Personal data for asserting claims.

In general, exercising these rights requires that you are able to prove your identity. In some cases, we might ask you to identify yourself in order to prevent us from sending you incorrect Personal data. In order to assert these rights, please contact us at the address provided in section 1. We attempt to reply to your request, question or complaint as soon as possible, but no later than one month after sending us your communication. If you have a complaint about the (manner of) Processing of your Personal data, we are always at your disposal to find a correct answer/solution to any question or remark regarding your privacy. Should you nevertheless not be able to reach a solution with us, we then would like to point out that you always have the opportunity to file a complaint with the Data protection authority (see hereunder).

Complaints and the Data protection authorities

While we are at all times at your disposal for any privacy related matter, every Data subject has the right to enforce his/her rights in court or to lodge a complaint with the competent Data protection authority.

• The competent Data protection authority of The Netherlands is the Autoriteit Persoonsgegevens https://www.autoriteitpersoonsgegevens.nl/

12. Amendments of this privacy policy

We may amend this Privacy policy at any time without prior notice. The current version published on our website is the most current version and applies to all the relationships between DE KADE B.V. and Data subjects. If the Privacy policy is part of an agreement with you, we will notify you by e-mail or other appropriate means in case of an important amendment of this Privacy policy. When important modifications have been made to the current version of the Privacy policy, we will notify you by publishing a notice on our homepage. To keep yourself updated with the latest version of our Privacy policy, it is therefore suggested that you check this Privacy policy on a regular basis.