Privacy Policy

Badkamer Tien B.V. ("Badkamertien", "we", "us") respects your privacy. This Privacy Policy explains which personal data we process, why, for how long, and which rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR).

De Nederlandse versie van dit privacybeleid vindt u hier. In case of differences, the Dutch version prevails.

1. Data controller

Badkamer Tien B.V., trading as Badkamertien
Leeuwenstein 15
2627 AM Delft, the Netherlands
Phone: +31 15 303 09 44
Email: info@badkamertien.nl
Chamber of Commerce (KvK): 84423099
VAT: NL863205677B01

2. Scope

This policy applies to our webshop badkamertien.nl, to our business platform erp.badkamertien.nl (including the customer portal, contact forms, appointments and live chat), to our showroom and warehouse, and to our business social media accounts and the integrations described in section 5.

3. Personal data we process

• Contact details: name, address, phone number and email address.
• Order, quotation and project data: products, delivery address, appointments, room measurements and photos you provide, installation and service details.
• Payment and invoice data: invoice details, payment status and, for refunds, your IBAN. Online payments are handled by our payment service provider; we do not receive full card details.
• Communications: messages you send us by email, phone, contact form, live chat or social media.
• Account data: login details if you use the customer portal.
• Technical data: IP address, browser and device information and cookies (see our cookie policy).

We do not process special categories of personal data and we do not make decisions based solely on automated processing.

4. Purposes and legal bases

• Handling quotations, orders, delivery, installation, invoicing and warranty — performance of a contract.
• Answering your questions via form, email, phone, chat or social media — legitimate interest / performance of a contract.
• Accounting and tax retention obligations — legal obligation.
• Newsletters and web push notifications — consent, which you can withdraw at any time.
• Security, fraud prevention and improving our services — legitimate interest.

5. Social media platform integrations

Our staff use erp.badkamertien.nl to manage our own business accounts (and those of brands we work with) on social media platforms. We connect to these platforms only through their official APIs, and only after the administrator of the business account has authorised our app. We use the data we receive solely to operate these business accounts.

Meta (Facebook Pages and Instagram professional accounts)

Permissions requested: pages_show_list, pages_manage_posts, pages_read_engagement, pages_manage_engagement, pages_manage_metadata, business_management, instagram_basic, instagram_content_publish, instagram_manage_comments, instagram_manage_insights (and the equivalent instagram_business_* permissions for Instagram Login).

We use them to list the Pages and Instagram accounts the administrator manages, publish posts to those accounts, read and reply to comments on our own posts, and view performance insights of our own content.

TikTok

Scopes requested: user.info.basic (to identify the connected TikTok account by its display name, avatar and open ID) and video.publish (to publish videos that our staff have prepared to our own TikTok account). Content is only published after a staff member explicitly chooses to publish it.

Pinterest

Scopes requested: user_accounts:read, boards:read, pins:read and pins:write, to identify the connected account, list its boards and pins, and create pins on our own boards.

How we handle platform data

• Data received: the connected account's name, ID and profile picture; access tokens; statistics for our own posts; and comments or messages that users leave on our posts and pages, including the sender's public name and platform user ID.
• No sale, no advertising profiles: we never sell platform data, never use it to build advertising or marketing profiles, and never share it with third parties except the service providers listed in section 6 that help us operate the platform.
• Security: access tokens are stored encrypted and are only accessible to authorised staff.
• Retention: tokens are deleted immediately when an account is disconnected or when the platform notifies us that access was revoked; other platform data is deleted within 30 days unless it forms part of an ongoing customer conversation.
• Revocation and deletion: you can revoke our app's access at any time in your platform account settings, or request deletion as described on our data deletion page.

We comply with the Meta Platform Terms, the TikTok Developer Terms of Service and the Pinterest Developer Guidelines. When you visit our social media pages, the platform's own privacy policy applies as well.

6. Recipients and processors

We share personal data only where necessary, with: our hosting provider (servers in the European Union, Germany); payment service providers (such as Mollie); carriers (such as DHL); installers working on our behalf; email and office software providers (such as Google Workspace); AI service providers that help us draft texts and replies (we share no more data than necessary); and our accountant and public authorities where required by law. We have data processing agreements with our processors.

7. International transfers

Some providers (such as social media, email and AI providers) may process data outside the European Economic Area. Where this happens, we rely on appropriate safeguards such as an adequacy decision (for example the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses.

8. Retention

• Orders, invoices and accounting records: 7 years (Dutch tax law).
• Quotations that do not lead to an order: up to 2 years.
• Contact requests, chat and social media messages: up to 2 years after the last contact.
• Customer portal accounts: for as long as the account is active.
• Social media access tokens: until the integration is disconnected or access is revoked.

9. Security

We use appropriate technical and organisational measures, including encrypted connections (TLS), encrypted storage of access tokens, access restricted to authorised staff, strong authentication and regular backups.

10. Your rights

You have the right to access, rectify or erase your personal data, to restrict or object to its processing, to data portability, and to withdraw your consent at any time. Send your request to info@badkamertien.nl; we respond within one month and may ask you to verify your identity. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

11. Children

Our services are not directed at children under 16.

12. Changes

We may update this policy. The current version is always published on this page, with the date of the last update at the top.

13. Contact

Questions about this policy? Contact us at info@badkamertien.nl or +31 15 303 09 44.