Privacy Policy

1. Who We Are
BVDART ("we", "us", "our") is operated from the Netherlands by Berend van Dijk. We sell limited-edition algorithmic abstract art prints and on-demand reproductions through our website at https://bvdart.nl.
Contact: berend@bvdart.nl

2. What Data We Collect
We collect personal data only when necessary for the purposes listed below.

2.1 Orders & Payments
When you purchase a print we collect:
- Full name and email address
- Shipping address
- Payment details (processed securely by Stripe; we never see or store your card number)

2.2 Newsletter
When you subscribe to our newsletter we collect:
- Email address
- First name (optional)
- Source page and referrer
- UTM campaign parameters (if present)

2.3 Contact Inquiries
When you use our contact form we collect:
- Name and email address
- Your message content

2.4 Automated Data
Our website may automatically collect:
- IP address (anonymised by default)
- Browser type and device information
- Pages visited and interaction events
- Referral source
This data is only collected when you have given consent (see Section 4).

3. How We Use Your Data
We use collected data for the following purposes:
- Order fulfilment — processing payments, generating invoices, arranging shipping
- Customer communication — order confirmations, shipping updates, responding to inquiries
- Newsletter — sending art updates and releases (only with your opt-in)
- Analytics — understanding how visitors use our site to improve the experience (only with consent)
- Marketing — measuring ad performance (only with consent, and currently disabled by default)
We do not sell your personal data to third parties.

4. Cookies & Consent
We use a tiered consent system. On your first visit you can choose which categories to allow.

Necessary Cookies
Always active. These are required for core functionality such as theme preferences and shopping sessions. No personal data is tracked.

Analytics Cookies (opt-in)
When you consent to analytics, we activate:
- Vercel Analytics — anonymous page-view and performance metrics
- Google Analytics 4 — site usage statistics with IP anonymisation enabled

Marketing Cookies (opt-in)
When you consent to marketing, we may activate:
- Meta Pixel — page-view tracking for Facebook/Instagram ad performance reporting
Marketing tracking is feature-flagged and disabled by default. You can change your preferences at any time through the cookie consent banner.

5. Third-Party Services
We share data with the following processors, solely for the purposes described:
- Stripe — Payment processing. Data shared: name, email, address, payment information.
- Resend — Transactional and newsletter email. Data shared: email address, first name.
- Attio — Customer relationship management. Data shared: email, name, order history, inquiry details.
- Vercel — Website hosting and analytics. Data shared: anonymous usage data.
- Google Analytics — Site analytics. Data shared: anonymous browsing data (IP anonymised).
- Meta (Facebook) — Marketing measurement. Data shared: page-view events (only with consent).
- Werk aan de Muur — Print-on-demand fulfilment. Data shared: order and shipping details for reproductions.

Each of these services operates under their own privacy policy. We ensure that all processors comply with GDPR / AVG requirements through appropriate agreements.

6. Data Retention
- Order data is retained for 7 years to comply with Dutch tax and accounting regulations.
- Newsletter subscriptions are kept until you unsubscribe.
- Analytics data is retained according to the default retention periods of each analytics service.
- Contact inquiries are retained for up to 2 years after the last interaction.

7. Your Rights (GDPR / AVG)
Under the General Data Protection Regulation you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — request deletion of your data ("right to be forgotten")
- Restriction — ask us to limit processing of your data
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interests
- Withdraw consent — revoke consent at any time (this does not affect lawfulness of prior processing)

To exercise any of these rights, contact us at berend@bvdart.nl. We will respond within 30 days.

If you believe your rights have not been respected, you have the right to lodge a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) at autoriteitpersoonsgegevens.nl.

8. Data Security
We take appropriate technical and organisational measures to protect your personal data, including:
- Encrypted connections (HTTPS/TLS) for all data transfer
- Secure payment processing via Stripe (PCI DSS compliant)
- Access controls and audit logging for administrative systems
- Regular review of third-party processor agreements

9. International Transfers
Some of our processors operate outside the European Economic Area (EEA). Where this is the case, we ensure adequate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions by the European Commission.

10. Changes to This Policy
We may update this privacy policy from time to time. Significant changes will be communicated via our website. The "Last updated" date at the top of this page indicates when the policy was last revised.

11. Contact
For any questions about this privacy policy or how we handle your data:
Email: berend@bvdart.nl
Website: https://bvdart.nl