1. Data controller
Teddy Peps is the data controller for the processing of personal data described in this policy.
Contact: support@teddypeps.nl
Chamber of Commerce: 42087952
2. What data we process
- Order and invoice data: name, address, email, phone number, payment details.
- Communication: messages via email, contact form or WhatsApp.
- Technical data: IP address, browser and device information for security and analytics.
- Newsletter: email address if you subscribe.
3. Purposes and legal bases
- Performance of the contract (Art. 6(1)(b) GDPR): processing and shipping of orders.
- Legal obligation (Art. 6(1)(c) GDPR): statutory tax retention periods.
- Legitimate interest (Art. 6(1)(f) GDPR): fraud prevention, security and service improvement.
- Consent (Art. 6(1)(a) GDPR): newsletter and optional cookies.
4. Retention periods
We do not retain personal data longer than necessary. Order and invoice data are kept for the statutory tax period of 7 years. Communications are kept for a maximum of 2 years after the last contact.
5. Sharing with third parties
We only share data with processors that are necessary for our services, such as payment providers, shipping partners, hosting provider and email platform. Data processing agreements are in place with these parties. We never sell personal data.
6. Transfers outside the EU
If data is transferred outside the EU, we only do so on the basis of appropriate safeguards (such as the European Commission's Standard Contractual Clauses).
7. Cookies
We use functional cookies that are necessary for the website to work. Analytical and marketing cookies are only placed with your consent.
8. Your rights (GDPR)
- Right of access to your data;
- Right to rectification or completion;
- Right to erasure ("right to be forgotten");
- Right to restriction of processing;
- Right to data portability;
- Right to object to processing based on legitimate interest;
- Right to withdraw consent at any time.
You can submit requests via support@teddypeps.nl. We respond within 30 days.
9. Complaints
Do you believe we are not handling your data correctly? Then you have the right to file a complaint with the Dutch Data Protection Authority.
10. Security
We take appropriate technical and organisational measures to protect your data against loss or unlawful processing, including encrypted connections (HTTPS) and restricted access to systems.
11. California residents (CCPA / CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the following rights with respect to your personal information:
- Right to know what personal information we have collected about you, the categories of sources, the purposes for collection, and the categories of third parties with whom we share it.
- Right to delete personal information we hold about you, subject to legal exceptions (e.g. records we must keep to complete a transaction, comply with a legal obligation, or defend against legal claims).
- Right to correct inaccurate personal information.
- Right to opt out of the sale or sharing of personal information. Teddy Peps does not sell personal information and does not share it for cross-context behavioural advertising.
- Right to limit the use of sensitive personal information. We do not collect sensitive personal information as defined by the CPRA.
- Right to non-discrimination for exercising any of these rights.
You may exercise these rights yourself or through an authorised agent. To submit a verifiable request, email support@teddypeps.nl with the subject line "CCPA request" and enough information for us to identify you and confirm the request. An authorised agent must provide written proof of authorisation. We respond within 45 calendar days and may extend that window by an additional 45 days where reasonably necessary, with notice.