Privacy policy

Privacy Statement of AIR Bandenservice We consider your privacy important. In this statement we explain which personal data we process, what we use it for, how long we keep it and what rights you have. We do not sell data and we do not send marketing without your consent. You do not need an account to order from us. 1. Who we are AIR Bandenservice, Jan Tademaweg 16, 2031 CV Haarlem, is responsible for the processing of the personal data that we collect via this website, by email, by telephone and in the workshop (the "controller" under the GDPR). Chamber of Commerce (KvK) number: 67181503. Questions about your data? Email info@airbandenservice.com or call 023 785 37 31. 2. What data we process, why and for how long Below, for each situation, you can see which data we use, for what purpose, on which legal basis under the GDPR, and how long we keep it. Order in the webshop or in the workshop - Data: name, email address, telephone number, postcode and address (for delivery), for a business order your company name and VAT number if applicable, your licence plate number if you want fitting, what you order, the agreed fitting appointment and the status of your payment. - Purpose: processing your order, reserving and ordering tyres for you, scheduling the fitting, delivering, sending you a confirmation or invoice, and informing you about your order. - Legal basis: performance of the contract, and our legal obligation to keep accounting records. - Retention period: 7 years. This is the statutory tax retention obligation for our accounting records. Payment - If you pay online, Mollie processes your payment. We see the status of your payment and the amount, not your card or bank details. If you pay on collection, we process your payment in the workshop. - Legal basis: performance of the contract. Retention period: 7 years (accounting records). Licence plate check - If you click "Check registration", we send your licence plate number via a secure request from our server to the Netherlands Vehicle Authority (RDW) (public vehicle data). The licence plate number does not appear in the address bar or in a link. The RDW can see that the request comes from our server. We use the result to show your vehicle and do not store the result separately, except that the licence plate number remains with your order if you entered it for fitting. - Legal basis: your consent by clicking the button (and for the licence plate number with an order: performance of the contract). Contact form, email and telephone - Data: your name, email address, telephone number (if you enter it), your licence plate number (if you enter it), the subject and your message. - Purpose: answering your question and handling follow-up questions. - Legal basis: our legitimate interest in answering your question, and if you request an appointment or quotation: taking steps prior to entering into a contract. - Retention period: no longer than necessary to handle your question and answer any follow-up questions. You can always ask us to have your message anonymised. Request for rims - The data and purpose are the same as for the contact form: we use what you fill in to answer your request. - Retention period: as for the contact form. Notification for an unavailable tyre - Data: your email address and which tyre and quantity you are looking for. We store your email address encrypted, so that only we can use it. - Purpose: sending you a message once when the tyre is available again. - Legal basis: your consent. You can withdraw the notification at any time via the link in the email you receive from us. - Retention period: the period stated in the confirmation you receive from us. After that, we delete your email address. Security and preventing misuse - Data: your IP address and technical data of your request (such as the requested page and the time). - Purpose: protecting the website against misuse, for example by limiting the number of requests per minute. For some security checks we use only a non-traceable fingerprint (hash) of your IP address. Our hosting provider also keeps technical log files for a short time. - Legal basis: our legitimate interest in keeping our website secure and available. - Retention period: short. We do not store IP addresses in our customer data. Cookies and storage in your browser - We use necessary storage in your browser for your shopping cart and to remember your cookie preference. No consent is required for this. - Analytical cookies from PostHog (visitor statistics) only load if you give your consent for them in the cookie banner. Web addresses are stored without personal links (such as the link to your order). External content, such as the Google Maps map, only loads after your consent and a separate click. You can change your choice at any time via "Cookie preferences" at the bottom of the website. - Without cookies or any other storage in your browser, we count on our server how many pages are opened. We only keep the page (without the rest of the web address), the language, the domain of the website you came from and campaign codes in the link (utm_source, utm_medium, utm_campaign). We do not keep an IP address, device or browser data, or any identifier that could link a visit to you or to another visit. Legal basis: our legitimate interest in seeing how the website is used. No consent is needed for this, because it has little or no impact on your privacy. Retention period: 1 year. 3. With whom we share data We only share data when necessary. These are our data processors: parties that process data on our behalf and have agreements with us about this, and a few other recipients: - Vercel: hosting of the website and the secure processing of requests. - Neon: the database in which we store orders, messages and settings. - Mollie: the processing of online payments, only if you pay online. - Google (Google Workspace): our email. Via Google we receive your emails and send emails to you, such as an order confirmation. - PostHog (servers in the EU): visitor statistics (only after your consent) and anonymous order totals (amount, delivery or collection, payment method), without name, contact details or order number. In addition, we anonymously count how many visits come in via an AI assistant (such as ChatGPT or Perplexity): only the name of the assistant and the page viewed, without IP address, cookie or device data. PostHog also processes the anonymous page counts without cookies for us (see "Cookies and storage in your browser"). - Google: Google Maps (only after your consent and a click). - RDW: receives your licence plate number during the licence plate check. - A delivery service: if we have your order delivered, we share your name, address and telephone number with the delivery service. - Government authorities and other parties if the law requires this of us. We do not sell your data. 4. Transfers outside the European Economic Area Our database and the servers of our website are located in the European Union (Frankfurt). Some parties, such as Vercel and Google, are American companies or may process data in the United States. For such transfers we use the safeguards permitted by the GDPR, such as an adequacy decision (the EU-U.S. Data Privacy Framework) or standard contractual clauses of the European Commission. 5. How we secure your data Our website uses a secure connection (HTTPS). Only authorised persons have access to the administration, and it is protected with a password. We encrypt email addresses for availability notifications, limit the number of requests per minute to prevent misuse and only work with parties that offer appropriate security. 6. Your rights You have the right to: - access your data; - have your data rectified; - have your data erased or anonymised (data that we are legally required to keep, such as order data for our accounting records, we keep until the end of the statutory period); - have the processing restricted or object to it; - take your data with you in a commonly used format; - withdraw any consent you have given, without this making the processing up to that moment unlawful. Send your request to info@airbandenservice.com. We may ask you to identify yourself, so that we are sure we are giving data to the right person. We aim to respond within one week and will in any case do so within one month. 7. Complaints Are you not satisfied with how we handle your data? Please contact us first, we are happy to help. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl. 8. Changes We may amend this statement, for example if we offer a new service. The most recent version is always on this page. The Dutch text is binding.