Privacy policy

1. Controller

mijnKleermaker is a service of TFVS, trading under the names mijnKleermaker and Van Schoot Technologies, established at Uiterwaardenstraat 59-2, 1079 BS Amsterdam, registered with the Dutch Chamber of Commerce under number 42034174.

For questions about your personal data you can get in touch at privacy@vanschoot.nl.

2. What data do we collect?

Depending on how you use our service, we process the following categories of personal data:

Account data

• Name, email address and telephone number
• Address details for delivery and return shipment
• Login details (password, stored as a bcrypt hash)
• With social login (Google, Facebook): name, email address and profile picture

Orders and service delivery

• Order history, garments, repair and cleaning details
• Photos of garments you upload (before and damage photos)
• After-photos of the repaired garment (with your consent for marketing purposes)
• Payment information (processed via Mollie; we store no payment details)

Loyalty and referral programme

• Loyalty points earned and used per order
• Referral links and codes
• Referral relationships (who referred whom)

Communication

• Messages sent through the contact form or support tickets
• Email communication (transactional: order confirmation, status updates, invoices)

Technical data

• IP address, browser type, device type
• Session tokens (JWT in an HttpOnly cookie, valid for at most 7 days)
• Timestamps of actions (ordering, logging in, payments)
• Aggregated, cookieless visit statistics via Vercel Web Analytics (page views, referrer and device type) — not traceable to an individual

Pilot waiting list

• Name and email address if you sign up for the closed pilot (only those two; signing up is not consent for newsletters or any other marketing)

3. What do we use your data for?

• Performance of the agreement: repair, cleaning, delivery and return shipment
• Customer communication: order confirmations, status updates and invoices
• Customer service and handling of complaints and support tickets
• Loyalty programme: tracking and awarding points
• Referral programme: awarding bonus points for referrals
• Marketing: publishing after-photos of repaired garments on our channels, only with your explicit consent when you submit a review
• Legal obligations: invoicing and VAT administration (7-year retention obligation)
• Fraud prevention and security of our systems
• Improving our services on the basis of anonymised statistics
• Pilot waiting list: contacting you as soon as there is room in the closed pilot

4. Legal basis for processing

We process personal data on the following legal bases (GDPR art. 6):

• Performance of a contract (art. 6(1)(b)): for processing orders, delivery, communication and invoicing
• Legal obligation (art. 6(1)(c)): for bookkeeping, VAT administration and retention obligations
• Legitimate interest (art. 6(1)(f)): for fraud prevention, system security and anonymised service improvements. We have carried out a balancing test and established that our interest does not outweigh your privacy interests.
• Consent (art. 6(1)(a)): for publishing after-photos for marketing purposes. You can withdraw this consent at any time by getting in touch at privacy@vanschoot.nl. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.

5. Sharing with third parties

We provide your personal data to third parties only in so far as this is necessary to deliver the service or required by law. We conclude a data processing agreement with every processor.

For transfers outside the EU (Resend, Vercel) we rely on the European Commission's standard contractual clauses (SCCs). We never sell your data to third parties for commercial purposes.

6. Retention periods

• Account data: for as long as the account is active, then 2 years after the last activity
• Order data and invoices: 7 years (statutory tax retention)
• Garment photos (before and damage photos): 1 year after the order is closed
• After-photos for marketing: for as long as consent is valid; deleted within 30 days of withdrawal
• Loyalty and referral data: 2 years after points expire or are redeemed
• Contact messages and support tickets: 2 years
• Technical logs: at most 90 days
• Pilot waiting list: no longer than 3 months after the pilot ends

7. Your rights

Under the GDPR you have the following rights:

• Access (art. 15): request which data we process about you
• Rectification (art. 16), have inaccurate data corrected
• Erasure (art. 17), have data deleted (the "right to be forgotten"), unless a statutory retention obligation applies
• Restriction (art. 18), temporarily restrict processing
• Objection (art. 21), object to processing based on legitimate interest or direct marketing
• Portability (art. 20), request your data in a structured, machine-readable format (JSON/CSV)
• Withdraw consent, withdraw consent given earlier (for example for marketing photos) at any time

Send a request to privacy@vanschoot.nl. We respond within 30 days. We may verify your identity before handling a request.

You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl.

8. Security

We take appropriate technical and organisational measures to protect your data:

• Encrypted connections (HTTPS/TLS)
• Passwords are stored as a bcrypt hash; we never see your password in readable form
• JWT session tokens stored in HttpOnly cookies (Secure + SameSite=Lax) valid for at most 7 days
• File storage through secured Supabase Storage with temporary access links
• Access management: production and admin roles have access only to the data they need for their task

In the event of a data breach affecting your rights and freedoms, data subjects and the Autoriteit Persoonsgegevens are informed within 72 hours at the latest (GDPR art. 33–34).

9. Cookies

mijnKleermaker uses functional cookies only, which are strictly necessary for the website to work:

• Session management and login status (JWT stored in an HttpOnly cookie, protected against XSS)
• Temporary storage of basket data (draft order)

We place no third-party tracking, advertising or analytics cookies without your explicit consent.

10. Minors

Our service is not aimed at children under 16. We do not knowingly process personal data of minors without the consent of a parent or guardian. If you suspect that we process data of a minor without valid consent, please get in touch at privacy@vanschoot.nl.

11. Automated decision-making

mijnKleermaker makes no use of fully automated decision-making or profiling that has legal effects for you or similarly significantly affects you (GDPR art. 22). Order status transitions are automated but have no adverse legal effect on you as a customer.

12. Changes

We may amend this privacy policy if our service or the law changes. In the event of material changes we will inform you by email or through a notice in the app at least 30 days before the change takes effect. The current version is always available on this page.