This policy explains which personal data Tweedy uses when you visit our website or buy from us, why we do so and what your rights are (Article 13 GDPR). In short: we use your data to carry out your order, for our accounts and to prevent fraud. Never for advertising.
1. Who is responsible
The controller is Ibrahim Alouissa, sole trader, trading as Tweedy, Koningin Astridlaan 161, 2880 Bornem, Belgium, enterprise number 0776.419.474. For any question about your data: [email protected] or +32 483 48 33 16.
2. Which data we use and why
Carrying out your order
- Data: your name, email address, phone number, delivery and billing address, the devices you bought, the confirmations you ticked (with date, time and IP address) and the status of your payment.
- Why: to process and ship your order, and to email you about it.
- Legal basis: the performance of the sales contract (Article 6(1)(b) GDPR). We keep your confirmations with date, time and IP address on the basis of our legitimate interest in being able to prove what we agreed with you (Article 6(1)(f) GDPR).
Invoices and accounts
- Data: your name and address, what you bought, the price and the payment method.
- Why: we have to issue invoices and keep accounts.
- Legal basis: a legal obligation (Article 6(1)(c) GDPR), including under the Belgian VAT Code.
Questions, withdrawal, guarantee and complaints
- Data: what you email or tell us, photos and videos you send us, your withdrawal statement with date, time and IP address, and our inspection report on the device.
- Why: to handle your question, withdrawal, guarantee claim or complaint, and to be able to show when and how this happened.
- Legal basis: the contract (Article 6(1)(b) GDPR) and our legal obligations as a seller (Article 6(1)(c) GDPR), such as acknowledging receipt of a withdrawal.
Preventing fraud
- Data: your IP address, data about your device and browser (such as the browser type), the check of your delivery and billing address, the result of your payment (such as 3-D Secure), the number of orders on the same email address, phone number or address, and photos and videos of the devices we ship and receive back, with their serial or IMEI number.
- Why: to prevent, and be able to prove, payments with stolen details, misuse of the right of withdrawal and the return of a different device.
- Legal basis: our legitimate interest in preventing fraud (Article 6(1)(f) GDPR). You can object to this (see point 6).
Keeping our website safe and working
- Data: your IP address, the time, the page requested and browser data in technical logs, and the strictly necessary cookies listed on our Cookies page.
- Why: to run the website, secure it and find errors.
- Legal basis: our legitimate interest in a safe, working website (Article 6(1)(f) GDPR).
3. No advertising, no profiles, no automated decisions
We send no newsletter and no advertising. We do not build marketing profiles of you, and we never sell or rent out your data.
Our fraud check uses fixed rules, for example a first order above a certain amount or a delivery address that differs from the billing address. Such a rule never decides on its own: a person reviews the order and makes the decision. So we take no decisions based solely on automated processing (Article 22 GDPR).
4. Who receives your data
We only share your data with those who need it for the purposes above:
- Mollie B.V. (Amsterdam, the Netherlands) processes your payment. For the payment itself, Mollie is also a controller in its own right, under its own privacy policy.
- Sendcloud B.V. (Eindhoven, the Netherlands) creates our shipping labels and passes your name and address to the carrier.
- bpost (Belgium) delivers your parcel. For the delivery, bpost is also a controller in its own right.
- Amazon Web Services (AWS) sends and receives our emails with Amazon SES, in the AWS data centre in Frankfurt (Germany).
- Cloudflare secures our website and forwards traffic to our server. Cloudflare also stores our encrypted backups, in the EU.
- Our own server, in the EU, runs the shop and the database. We manage this server ourselves.
- Dexxter, our bookkeeping software, receives your invoices.
- Public authorities, such as the tax administration or the police, if the law requires it or if we report fraud.
Cloudflare and AWS are American companies. Our email runs through Frankfurt and our backups are stored in the EU. Traffic to our website runs through Cloudflare’s network, usually through a data centre close to you. If data does end up in the United States, this is based on the EU-US Data Privacy Framework, under which both companies are certified, or on the standard contractual clauses of the European Commission (Articles 45 and 46 GDPR).
5. How long we keep your data
- Orders, invoices and accounts: 10 years, as accounting and VAT law require.
- Evidence about an order, such as your confirmations with IP address, browser data, photos and videos of shipped and returned devices, inspection reports and messages about a withdrawal or guarantee claim: until 1 year after the end of the guarantee period. If a dispute or fraud case is open, we keep what it needs until it is closed and no claim is possible any more.
- Data about established fraud, such as an email address or address used to commit fraud: as long as needed to prevent new fraud or to bring or defend a claim.
- Technical logs: 30 days at most.
- Cookies: see our Cookies page. The cart cookie expires after 7 days.
6. Your rights
You have the right to:
- access your data (Article 15 GDPR);
- have incorrect data corrected (Article 16 GDPR);
- have your data erased (Article 17 GDPR), except what we must keep, such as invoices;
- have the processing restricted (Article 18 GDPR);
- receive your data in a common, machine-readable format and have it transmitted to another controller (Article 20 GDPR);
- receive your data in a common, machine-readable format, or have it sent to someone else (Article 20 GDPR);
- object to processing based on our legitimate interest, such as the fraud check (Article 21 GDPR).
Email [email protected] or write to Tweedy, Koningin Astridlaan 161, 2880 Bornem, Belgium. We answer within one month, and it costs you nothing. If we are not sure that the request comes from you, we may ask you to confirm your identity.
7. Making a complaint
If you disagree with how we handle your data, please tell us. You can also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be.
8. Do you have to provide your data?
We need your name, email address and delivery address to carry out and invoice your order. Without this data you cannot order from us. We use a phone number only for delivery and to check an order.
9. Security
We protect your data with encrypted connections (https) and encrypted backups. Our admin environment can only be reached through a closed private network. We completely wipe every device that comes in, following a fixed procedure.
10. Changes
If we change this policy, it gets a new version number and a new date. Both are shown at the top.