Privacy and cookie statement

This is a translation for your convenience. The Dutch version prevails in the event of any differences.

1. Who are we?

This website belongs to Elshof Alpaca’s, Hatertseweg 34, 6581 KG Malden, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 93093055. We are the controller for the personal data processed through this website and during our activities.

Questions about privacy? E-mail elshofalpacas@gmail.com. We do not have a data protection officer (this is not required for a small business like ours).

2. Which data do we process and why?

• Contact form, e-mail and WhatsApp – name, e-mail address, phone number (optional) and your message. Purpose: answering your question. Legal basis: our legitimate interest in answering questions, or taking steps prior to entering into a contract.
• Orders in the web shop (alpaca wool, gift vouchers) – name, e-mail address, phone number, delivery address (not for collection or a digital voucher), products ordered, amount and payment status. Purpose: processing, paying for and shipping the order, and customer service. Legal basis: performance of the contract and our statutory (tax) retention obligation.
• Bookings of activities – name, e-mail address, phone number, chosen activity, date, time, number of people, any comments (such as dietary requirements) and payment status. Purpose: scheduling the booking in our calendar, confirming and carrying it out. Legal basis: performance of the contract. Health information (such as an allergy) is only entered if you choose to; we only use it for your visit.
• Registrations for special events (such as the Christmas event) – name, e-mail address, phone number, number of people, chosen day and payment status. Purpose and legal basis: as for bookings.
• Payments – via our payment provider Mollie. We receive the payment status, payment method and amount, and possibly the payer’s name and account number. Legal basis: performance of the contract and the statutory retention obligation.
• Website visits – our hosting provider records technical data (such as IP address, browser and time) in server logs for security and to keep the site working properly. Legal basis: legitimate interest.
• Statistics and marketing – only if you give your consent (see section 6). Legal basis: consent, which you can withdraw at any time.

We do not use your data for automated decision-making and we never sell it. Are you under 16? Then please ask a parent or guardian to place the order, booking or registration.

3. Who do we share data with?

We work with the following service providers (processors). They may only use your data on our behalf:

• Netlify – hosting of this website and the technical layer for forms and availability.
• Google (Google Workspace: Gmail, Google Apps Script, Google Sheets and Google Calendar) – receiving and sending e-mail and confirmations, keeping records of orders, bookings and registrations, and the calendar with visiting times.
• Mollie (Amsterdam) – processing online payments (iDEAL, Wero, Google Pay, Apple Pay). Mollie is also independently responsible for the payment itself.
• PostNL – delivery of orders (name and address), only if you choose shipping.
• Only with your consent: Google Analytics 4, Google Ads and Meta (Facebook/Instagram) – see section 6. The Google Maps map on the contact page is only loaded when you click it.

Some of these parties (Google, Meta, Netlify) are based in the United States. Transfers take place on the basis of the EU-US Data Privacy Framework and/or the European Commission’s standard contractual clauses. Apart from this, we only share data where the law requires us to.

4. How long do we keep your data?

• Contact messages: up to 1 year after your question has been dealt with.
• Bookings and registrations without payment: up to 2 years after the visit.
• Orders, paid bookings and registrations: 7 years, because of the statutory tax retention obligation.
• Hosting server logs: a short period, in line with Netlify’s policy.
• Statistics in Google Analytics: up to 14 months. Cookies: see the tables below.

5. Your rights

You have the right to access your data and to have it corrected or erased. You can also ask us to restrict processing, object to processing based on legitimate interest, and request your data in a common file format (data portability). You can withdraw consent at any time; for cookies, use Cookie settings.

Send your request to elshofalpacas@gmail.com. We will respond within one month. To prevent misuse, we may ask you to identify yourself (please do not send a copy of your passport). Not happy with how we handle your data? You can lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens. We would appreciate it if you contacted us first.

6. Cookies and similar technologies

A cookie is a small file that a website stores on your device; localStorage and sessionStorage are similar storage in your browser. We always use necessary storage. We only set statistics and marketing cookies after you have given consent in the cookie banner. Without consent, the Google Analytics, Google Ads and Meta scripts are not even loaded (Google Consent Mode is set to ‘denied’ by default). We remember your choice for 12 months and then ask again.

Visitor statistics without cookies

To see how the website is used, we count page views ourselves: which page, which website or campaign link (utm) you came from, the language, whether it is a mobile or larger screen, and the number of orders, bookings and registrations with their amounts. We do this without cookies, without identifiable IDs and without a ‘fingerprint’ of your device. Only a temporary flag in sessionStorage remembers whether you have already viewed a page in this tab (so we can count visits); it disappears when you close the tab. We do not store your IP address. To count visitors per day, we turn your IP address, browser and language into an irreversible code using a secret key that changes every day; those codes and the key are deleted after that day. We only keep daily totals that cannot be traced back to you. Because this measurement has little impact on your privacy, we do not ask for consent (legitimate interest).

Necessary (always on)

Statistics (only with consent)

We have configured Google Analytics so that IP addresses are not stored, Google signals and ad personalisation are switched off, and data is not used for advertising as long as you only allow statistics. We only see totals (such as visitor numbers, popular pages and the number of orders), never who you are.

Marketing (only with consent)

Meta and Google are also responsible themselves for what they do with this data; see the privacy policies of Meta and Google.

Embedded content

The map on the contact page comes from Google Maps. It is only loaded when you click ‘Load map’ (or if you have accepted marketing cookies); Google may then set cookies. Links to Facebook, Instagram and WhatsApp are ordinary links: only when you click them do you go to that service, with its own privacy policy.

Changing your choice or deleting cookies

You can change your choice at any time via Cookie settings at the bottom of every page or with the button at the top of this page. If you withdraw consent, we delete the related cookies for this domain and reload the page. You can also clear cookies and site data yourself in your browser settings.

7. Security

The website only works over a secure connection (https). Only we ourselves have access to our records, using secured accounts. Payment details never reach our website; they are processed directly by Mollie.

8. Changes

We update this statement when our way of working changes. The date at the top shows which version you are reading. If there are important changes to the cookies, we will ask for your consent again.