This Privacy Policy describes how Tommy’s Service processes personal data through the website www.tommysservice.nl.
1. Data Controller
The controller of your personal data is:
Tommy’s Service Noorddammerweg 50b 1187 ZT Amstelveen The Netherlands
Chamber of Commerce (KvK): 62541536 VAT number: NL002482777B97
Contact email: contact@tommysservice.nl
2. What Data We Collect
We may collect the following personal data:
- Name
- Email address
- Phone number
- Address (if provided in contact forms)
- Any other information voluntarily submitted through contact forms
3. Purpose of Processing
Personal data is processed for:
- Responding to inquiries
- Preparing quotations
- Performing renovation or construction services
- Fulfilling legal and accounting obligations
- Website analytics (if applicable)
4. Legal Basis for Processing
We process personal data based on:
- Your consent (Article 6(1)(a) GDPR)
- Performance of a contract (Article 6(1)(b) GDPR)
- Legal obligation (Article 6(1)(c) GDPR)
- Legitimate interest (Article 6(1)(f) GDPR)
5. Data Retention
Personal data is retained only as long as necessary:
- Contact form data: up to 2 years
- Accounting data: according to Dutch tax law (7 years)
6. Data Sharing
We work with a small number of processors, all of whom process data on our instructions only:
- Netlify - website hosting and delivery. Contact form submissions, including any photographs you attach, are stored in Netlify's storage in the EU.
- Brevo (Sendinblue, France) - sending the confirmation e-mail to you and the notification e-mail to us.
- Proton Mail (Switzerland) - our business mailbox, where your message is read and answered.
- Umami, self-hosted by Firmatic on a server in the European Union - website statistics. Umami sets no cookies, does not use device fingerprinting and does not collect personal data; it only counts aggregated visits, pages, referrers, countries and device types. Because no personal data is involved, it runs without a consent banner.
- Accounting and IT service providers, where a specific task requires it.
We do not sell data to third parties and we do not use it for advertising profiling. Where a transfer outside the EU is unavoidable, appropriate safeguards such as Standard Contractual Clauses are applied.
7. Your Rights
Under GDPR, you have the right to:
- Access your data
- Correct your data
- Delete your data
- Restrict processing
- Data portability
- Withdraw consent
- Lodge a complaint with:
Autoriteit Persoonsgegevens Bezuidenhoutseweg 30 2594 AV The Hague Netherlands
8. Cookies
This website uses only what is strictly necessary to work and to keep you safe. We do not use advertising or tracking cookies, and our website statistics (Umami) work entirely without cookies.
- Technical storage needed for the site to function and for the contact form to be submitted securely.
- A session cookie for the private administration area, set only for the site owner after signing in.
You can manage storage and cookie preferences through your browser settings at any time.
9. Security
We use SSL encryption and take appropriate technical and organizational measures to protect personal data.
Webshop, customer accounts and orders
When you buy in our webshop we process the data needed to conclude and perform the contract (article 6(1)(b) GDPR): name, e-mail address, telephone number if given, delivery address, the items ordered, amounts paid and the order status. Order records, including these details, are kept for 7 years because Dutch tax law obliges us to (article 6(1)(c) GDPR); after that they are deleted.
Payments are handled by Mollie B.V., Amsterdam, a licensed payment institution. Mollie processes your payment data (for example bank account or card details) as an independent controller under its own privacy statement; we only receive the payment status, method and a transaction reference. We never see your card or bank details.
If you create a customer account, we store your e-mail address, a hashed password, your name and optionally your address and telephone number, so that you can see your orders and check out faster. You can change or delete the account yourself at any time in the account settings. Deleting the account removes your profile and sign-in details immediately; order records are kept detached from the account for the period stated above.
Transactional e-mails about your account and your orders (confirmation, verification links, shipping notices) are sent through Brevo (Sendinblue SAS, Paris) as our processor. We only send marketing e-mails if you opted in; you can withdraw that consent at any time via the link in every mailing or in your account settings.
The webshop uses local storage in your browser to remember the contents of your cart and your delivery preference. This is strictly necessary for the shop to work and is not used for tracking.