Sultan's Baklava B.V. processes personal data carefully, securely and in accordance with the AVG/GDPR. This Privacy Policy explains which data we process when you use our website, place an order, contact us or use your account.
1. Controller
Sultan's Baklava B.V.
Amsterdamsestraatweg 387, 3551 CK Utrecht, The Netherlands
Chamber of Commerce: 86564447
VAT: NL864007632B01
Email: info@sultansbaklava.nl
Website: www.sultansbaklava.nl
2. Data We Process
Depending on your interaction with us, we may process: name, email address, phone number, billing and delivery address, order contents, payment status, delivery details, customer account data, contact messages, IP address, device/browser data, language preference, session and cart data.
3. Purposes and Legal Bases
We process data to receive and deliver orders, handle payments and invoices, provide customer service, manage accounts, comply with legal and tax obligations, secure the website, operate the website and improve service quality.
The legal bases include performance of a contract, legal obligation, legitimate interest and, where required, consent.
4. Payment and Delivery Services
Payments may be handled by Mollie or another payment provider shown at checkout. Delivery may be handled by PostNL or similar shipping/courier services. We share only the information needed to provide those services.
5. Accounting, Hosting and Technical Services
We may share data with accountants or tax advisers for legal accounting duties, and with hosting, email and technical service providers for website operation. Where required, appropriate data processing arrangements are used.
6. Cookies
Our website uses functional cookies for session handling, language preference, shopping cart and security. These are necessary for the website to work. If tracking or marketing cookies are used, consent will be requested where required.
7. Retention Periods
Order, invoice and payment records are generally retained for 7 years due to Dutch tax and accounting obligations. Account data is retained while the account is active or until a deletion request has been assessed. Contact messages are retained for a reasonable period to respond and follow up. Technical logs are retained for a limited period for security and operational purposes.
8. Security
We take technical and organisational measures to protect personal data against unauthorised access, loss, misuse and disclosure. Payment details are processed by the payment provider; we do not store card details in our own systems.
9. Your Rights
Under the AVG/GDPR you may have the right to access, correct, delete, restrict processing, object, request data portability and withdraw consent. You can send requests to info@sultansbaklava.nl. We may need to verify your identity.
10. Complaints
If you believe we have not handled your privacy request properly, please contact us. You also have the right to lodge a complaint with the Dutch supervisory authority, Autoriteit Persoonsgegevens.
11. Children
Our website is not specifically aimed at children. We do not knowingly intend to collect personal data from persons under 16 without permission from a parent or legal representative.
12. Changes
We may update this policy from time to time. The current version applies from the date it is published on the website.