Privacy policy

Droplet Brands B.V. (“Droplet”, “we”, “us”) takes your privacy seriously. This page explains what personal data we collect when you use this website or place an order with us, why we collect it, and the rights you have over it under the EU General Data Protection Regulation (GDPR).

1. Who we are

Droplet Brands B.V., registered in the Netherlands at Prinses Irenelaan 77, 2273 DH Voorburg. You can reach us at hello@dropletbrands.com or +31 (0)85 301 4242.

2. What we collect

When you visit the website

• Pages you view and basic technical info (browser, device, IP address) needed to serve the site securely.
• Session cookies (small files in your browser) so things like your shopping cart and language preference persist between page loads.

When you submit the contact or order form

• Your name, email, phone, company, and the content of your enquiry.
• Order specifics: garment type, sizes, colours, designs you upload, delivery address.

When you place an order

• Billing and shipping details.
• Order history, communications, files you send us for printing.
• Payment status (we use WeFact for invoicing — we do not store full card numbers ourselves).

3. Why we use it

• To reply to enquiries and fulfil orders — the data you give us on a form goes straight into our CRM (Pipedrive) and order system (Droplet Flow).
• To send order-related emails — confirmations, shipping updates, invoice reminders.
• To improve the website — anonymised usage stats only.
• To meet legal obligations — Dutch tax law requires us to keep invoices for seven years.

4. Who we share it with

We only share your data with the third-party services we need to run the business:

• Pipedrive — CRM, stores your contact details and enquiry history.
• WeFact — Dutch invoicing platform that issues the bills you receive.
• Resend — sends transactional emails on our behalf.
• Supabase — hosts our database and your design files on EU servers.
• DHL Express (and other carriers) — for delivery of physical goods.

We do not sell your data to anyone. Ever.

5. How long we keep it

• Enquiry data from forms — kept while the lead is active and for 12 months after.
• Order data — kept for the legally required 7 years.
• Design files you upload — kept while we're fulfilling your order, then archived for reorder. Deleted on request.
• Newsletter consent — kept until you unsubscribe.

6. Your rights

Under GDPR you can:

• Ask us what data we hold about you (right of access).
• Ask us to correct it (rectification).
• Ask us to delete it (right to erasure), subject to legal retention rules.
• Object to specific uses or withdraw consent.
• Request a portable copy of your data.
• Complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if you think we're mishandling things.

To exercise any of these, email hello@dropletbrands.com and we'll respond within 30 days.

7. Security

We store data on servers inside the EU. Passwords are hashed, files are encrypted at rest, and we use HTTPS site-wide. If we ever discover a breach that affects you, we notify you and the Dutch Data Protection Authority within 72 hours.

8. Changes to this policy

We'll update this page when we change how we handle data, and bump the “Last updated” date at the top so you can tell something's changed.