1. Who is responsible?
Fruggals, a sole proprietorship (eenmanszaak), is the controller responsible for the processing described here.
- Address
- Filarskiweg 3, 1862 VA Bergen (NH), the Netherlands
- Privacy contact
- info@fruggals.com
This policy covers the website, waitlist, campaigns, purchases, support and supplier enquiries.
2. What This Policy Explains
We explain what information we use, why we use it, who receives it, how long it is kept and what rights individuals have.
Different activities can have different legal bases. We do not rely on one general consent for everything.
Required and optional information is distinguished at collection. GDPR information requirements
3. Information Provided Directly
Depending on the interaction, we may receive:
- Your email address, which is your account.
- Your delivery addresses.
- Your campaign participation and product selections: which campaign, which products, the amounts.
- Order and return details.
- Your language preference.
- Whether you asked for marketing email.
- Messages and complaint information you send us.
- Photographs you send us for product support.
- Supplier business and contact details.
4. Payment Information Through Stripe
Customers provide payment details through the Stripe form used to join a campaign. Card and bank details never reach us: payment runs entirely through Stripe, our payment provider.
Stripe processes the information necessary for payment setup, verification, collection, refunds and related payment functions.
Fruggals receives information needed to manage the transaction, which can include payment references, status, billing details and limited payment-method information.
Providing a payment method does not itself mean a purchase charge has been collected.
Stripe’s role can vary by activity. Its own privacy policy explains relevant processing. Stripe Privacy Policy
5. Technical and Device Information
Our website and providers may process technical information such as:
- IP address.
- Browser and device type.
- Access timestamps.
- Error and security logs.
- The session identifier that keeps you logged in.
These are the operational logs needed to run and secure the site. We use no analytics.
6. Information From Other Organisations
Where relevant, we may receive:
- Payment status from payment providers.
- Delivery updates from carriers.
- Fulfilment information from suppliers.
- Fraud or security information from relevant services.
- Business contact information from a supplier representative.
7. Purposes and Legal Bases
| Activity | Information used | Legal basis |
|---|---|---|
| Process campaign participation | Contact, selection and campaign information | Contract or requested pre-contract steps |
| Manage payments | Payment references, status and billing information | Contract; legal obligations where applicable |
| Deliver goods | Address, contact and order information | Contract |
| Manage returns and remedies | Order, correspondence and product information | Contract; relevant legal obligations |
| Keep financial records | Invoice and transaction information | Legal obligation |
| Respond to general enquiries | Contact details and correspondence | Relevant legitimate interests |
| Handle supplier proposals | Business and contact information | Pre-contract steps or relevant legitimate interests |
| Maintain website security | Necessary technical and security information | Relevant legitimate interests |
| Send requested launch notifications | Email and signup preferences | Consent |
| Send optional promotional messages | Email and marketing preferences | Consent |
Contract necessity covers processing genuinely needed for the requested service. It is not a general basis for unrelated advertising.
Where we rely on legitimate interests, we identify the actual interest and assess its effect on individuals. EDPB lawful-processing guidance
8. Providing Information
Where data is needed to process a purchase, failing to provide it may prevent participation or fulfilment.
Optional preferences are not presented as mandatory order information.
We explain any statutory requirement to provide information where it applies.
9. Payment Authorisation and Privacy Consent
Authorising a campaign payment and consenting to personal-data processing are separate matters.
We process necessary purchase information under the appropriate legal basis.
Marketing email is a separate choice.
10. Organisations Receiving Information
Information may be disclosed where necessary to:
- Stripe and other involved payment providers.
- Carriers and logistics providers.
- Suppliers fulfilling orders or supporting remedies.
- Hosting and technical providers.
- Customer support providers.
- Email delivery services.
- Accounting and professional advisers.
- Authorities where legally required.
The providers we use today are Stripe (payments), OVH (hosting of our servers and email, in the EU) and Telegram (internal alerts to our team, which carry no payment details and only masked email addresses).
When a campaign ships, your delivery address goes to the party fulfilling the order, and a fulfilment recipient receives only what it needs for the task. We never sell personal data.
11. Providers’ Data Protection Roles
Some providers act on our instructions as processors. Others may act as independent controllers for specific activities.
Stripe processes payments on our behalf as our processor. For its own fraud prevention and legal obligations, such as anti-money-laundering checks, Stripe acts as an independent controller. OVH hosts our servers and email as our processor. Telegram carries our internal alerts as an independent controller and receives no information that identifies you.
Carriers and suppliers that deliver an order receive the delivery details they need and handle them as independent controllers for that delivery.
Where required, we put appropriate processing arrangements in place.
12. Transfers Outside the EEA
Our servers are hosted in the EU.
Stripe may process payment data outside the European Economic Area, for example in the United States. Stripe relies on the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses. Telegram, which we use only for internal alerts, receives no information that identifies you.
Where a transfer occurs, we use the applicable lawful mechanism, such as an adequacy decision or appropriate safeguards.
Email info@fruggals.com for more information about these safeguards. EDPB international-transfer guidance
13. Retention
We retain information according to its purpose and legal requirements.
| Information | Period or clear retention criterion |
|---|---|
| Account information | As long as you have an account; deleted within 30 days of closing it, except records we must keep |
| Successful order records | Seven years, as Dutch tax law requires |
| Financial records | Seven years, as Dutch tax law requires |
| Waitlist records | Until you unsubscribe |
| Marketing preferences | Until you unsubscribe; after that only what we need to stop further emails |
| Consent evidence | Five years after your consent ends |
| Failed campaign records | One year after the campaign closes |
| Support and complaints | Two years after the matter is closed |
| Security logs | 90 days |
| Supplier enquiries | Two years after our last contact |
| Backups | 14 days, after which deleted data is gone from them too |
We may retain limited records after an unsubscribe to prevent further unwanted messages.
Deleting an account does not require immediate removal of records that must lawfully be retained. EDPB retention guidance
14. Cookies and Similar Tools
One cookie, and it is purely functional: it keeps you logged in. There are no tracking or analytics cookies, no pixels and no similar tools.
Because that cookie is strictly necessary, we do not ask for cookie consent.
Should we ever add an optional tool, it is activated only with your consent, refusing it does not stop you shopping, and withdrawing consent is as easy as giving it. EU cookie guidance
15. Cookie Inventory
| Cookie | Provider | Purpose | Duration | Consent |
|---|---|---|---|---|
| session | Fruggals | Keeps you logged in | 30 days | Strictly necessary; no consent needed |
16. Marketing Email
Only if you ask for it. You can opt in through the box at the bottom of the site or the checkbox when you log in or join a campaign, and in no other way — buying something never puts you on the list. Every marketing email carries an unsubscribe link, and you can withdraw at any time without giving a reason.
Email about your own orders is separate and keeps coming: the legal basis for marketing is your consent, and for order email it is our contract with you. Unsubscribing does not stop necessary messages about a campaign you joined or a purchase you made.
We build no profiles and run no advertising.
17. Your Rights
Depending on the circumstances, you may request access, correction, erasure, restriction or portability.
You may object to legitimate-interest processing and direct marketing, and withdraw consent where processing relies on it.
Some rights have legal conditions and exceptions.
Email info@fruggals.com. We may request proportionate information to verify identity.
We normally respond within one month. If a lawful extension is needed, we inform you during that initial period. EDPB individual-rights guidance
18. Automated Decisions
We make no decisions about you based solely on automated processing that have legal or similarly significant effects. Whether a campaign succeeds depends on its overall totals, not on an assessment of you.
Stripe screens payments for fraud and may decline a payment on that basis.
19. Security
We use technical and organisational safeguards appropriate to the information and risks.
Connections to the site are encrypted with HTTPS, and browsers are told to always use it. Signing in uses one-time email codes instead of passwords, with a limit on attempts. Card and bank details go into Stripe’s payment form and never reach our servers. Our servers are in the EU, can be administered only with an SSH key, and are backed up every night.
We review these arrangements and handle personal-data incidents under applicable law.
20. Children
You must be 18 or older to join a campaign, because joining is a commitment to pay. We don't knowingly collect personal data from anyone younger; if you think we have, contact us and we delete it.
21. External Links and Social Media
Links may lead to third-party services with their own privacy practices.
We link to Instagram but load nothing from it: no Instagram or other social-media component runs on our pages.
22. Complaints
Email info@fruggals.com with concerns.
You can also complain to a competent data protection authority. Under the assumed Dutch establishment, the relevant national authority is the Autoriteit Persoonsgegevens.
You do not have to complain to Fruggals first.
23. Updates
We update this policy when relevant practices or legal requirements change.
The date identifies the current version. Where required, we notify individuals or request fresh consent.
Continued browsing does not itself constitute consent to new optional processing.