Privacy policy

1. Controller

mijnKleermaker is a service of TFVS, trading under the names mijnKleermaker and Van Schoot Technologies, established at Uiterwaardenstraat 59-2, 1079 BS Amsterdam, registered with the Dutch Chamber of Commerce under number 42034174.

For questions about your personal data you can get in touch at privacy@vanschoot.nl.

2. What data do we collect?

Depending on how you use our service, we process the following categories of personal data:

Account data

• Name, email address and telephone number
• Address details for delivery and return shipment
• Login details (password, stored as a bcrypt hash)
• With social login (Google, Facebook): name, email address and profile picture

Orders and service delivery

• Order history, garments, repair and cleaning details
• Photos of garments you upload (before and damage photos)
• After-photos of the repaired garment, which you upload to complete a review
• Payment information (processed via Mollie; we store no payment details)
• Reviews: your rating and your comments; with your consent also your first name and city, for publication

Loyalty and referral programme

• Loyalty points earned and used per order
• Referral links and codes
• Referral relationships (who referred whom)

Communication

• Messages sent through the contact form or support tickets
• Email communication (transactional: order confirmation, status updates, invoices)

Technical data

• IP address, browser type, device type
• Session tokens (JWT in an HttpOnly cookie, valid for at most 7 days)
• Timestamps of actions (ordering, logging in, payments)
• Aggregated, cookieless visit statistics via Vercel Web Analytics (page views, referrer and device type), not traceable to an individual

3. What do we use your data for?

• Performance of the agreement: repair, cleaning, delivery and return shipment
• Customer communication: order confirmations, status updates and invoices
• Customer service and handling of complaints and support tickets
• Loyalty programme: tracking and awarding points
• Referral programme: awarding bonus points for referrals
• Marketing: with your consent, use of the after-photo and the review text on our website and our own social media, with your first name and city; the photo shows no faces of other people (article 11 of the terms and conditions)
• Legal obligations: invoicing and VAT administration (7-year retention obligation)
• Fraud prevention and security of our systems
• Improving our services on the basis of anonymised statistics
• Publishing reviews on our platform, only with your consent and then with your first name and city; your surname, address and email address are never shown

4. Legal basis for processing

We process personal data on the following legal bases (GDPR art. 6):

• Performance of a contract (art. 6(1)(b)): for processing orders, delivery, communication and invoicing, and for the after-photo, the review text and the rating with a review: quality control, complaints and disputes
• Legal obligation (art. 6(1)(c)): for bookkeeping, VAT administration and retention obligations
• Legitimate interest (art. 6(1)(f)): for fraud prevention, system security and anonymised service improvements. We have carried out a balancing test: your privacy interest does not outweigh our interest in a safe and properly working service. You may object to this processing (art. 21).
• Consent (art. 6(1)(a)): for the use of your review and after-photo on our website and our own social media, with your first name and city, if you tick the separate checkbox for this with your review; otherwise only when we explicitly ask for your consent for a specific processing activity. You can withdraw consent at any time, for your review via your account, or by getting in touch at privacy@vanschoot.nl. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.

5. Sharing with third parties

We provide your personal data to third parties only in so far as this is necessary to deliver the service or required by law. We conclude a data processing agreement with every processor.

For transfers outside the EU (Resend, Vercel, Railway and, only if you sign in with an external account, the chosen login provider) we rely on the European Commission's standard contractual clauses (SCCs). We never sell your data to third parties for commercial purposes.

6. Retention periods

• Account data: for as long as the account is active, then 3 years after the last activity in connection with warranty and complaint handling
• Order data and invoices: 7 years (statutory tax retention)
• Garment photos (before and damage photos): 3 years after the order is closed in connection with warranty and complaint handling
• After-photos and reviews for marketing: for as long as your consent runs; removed from our channels within 30 days of withdrawal
• Loyalty and referral data: 2 years after points expire or are redeemed
• Contact messages and support tickets: 3 years after the last message, in connection with warranty and complaint handling
• Technical logs: at most 90 days
• After-photo with a review without consent, or after withdrawal: like garment photos, 3 years after the order is closed. First name and city on a review with consent: for as long as your consent runs; erased on withdrawal. Review text and rating: with your consent, for as long as it runs; without consent, or after withdrawal, 3 years after the order is closed

7. Your rights

Under the GDPR you have the following rights:

• Access (art. 15): request which data we process about you
• Rectification (art. 16), have inaccurate data corrected
• Erasure (art. 17), have data deleted (the "right to be forgotten"), unless a statutory retention obligation applies
• Restriction (art. 18), temporarily restrict processing
• Objection (art. 21), object to processing based on legitimate interest or direct marketing
• Portability (art. 20), request your data in a structured, machine-readable format (JSON/CSV)
• Withdraw consent, withdraw consent given earlier at any time

Send a request to privacy@vanschoot.nl. We respond within 30 days. We may verify your identity before handling a request.

You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl.

8. Security

We take appropriate technical and organisational measures to protect your data:

• Encrypted connections (HTTPS/TLS)
• Passwords are stored as a bcrypt hash; we never see your password in readable form
• JWT session tokens stored in HttpOnly cookies (Secure + SameSite=Lax) valid for at most 7 days
• File storage through secured Supabase Storage with temporary access links
• Access management: production and admin roles have access only to the data they need for their task

In the event of a data breach affecting your rights and freedoms, data subjects and the Autoriteit Persoonsgegevens are informed within 72 hours at the latest (GDPR art. 33–34).

9. Cookies

mijnKleermaker uses functional cookies only, which are strictly necessary for the website to work:

• Session management and login status (JWT stored in an HttpOnly cookie, protected against XSS)
• Temporary storage of basket data (draft order)

We place no third-party tracking, advertising or analytics cookies without your explicit consent.

10. Minors

Our service is not aimed at children under 16. We do not knowingly process personal data of minors without the consent of a parent or guardian. If you suspect that we process data of a minor without valid consent, please get in touch at privacy@vanschoot.nl.

11. Automated decision-making

mijnKleermaker makes no use of fully automated decision-making or profiling that has legal effects for you or similarly significantly affects you (GDPR art. 22). Order status transitions are automated but have no adverse legal effect on you as a customer.

12. Changes

We may amend this privacy policy if our service or the law changes. In the event of material changes we will inform you by email or through a notice in the app at least 30 days before the change takes effect. The current version is always available on this page.