Your information at Busy Fox
Privacy policy.
When you order from Busy Fox, create an account or contact us, we use personal data. Here we explain what data we use, why we use it and who we share it with. We also explain how long we keep it and the choices and rights you have.
Articles 1–3
The basics
01Who is responsible
1.1
Busy Fox is the trading name of the company identified below. This company is responsible for the processing of personal data described in this policy.
| Detail | Information |
|---|---|
| Legal company name | Novastars B.V. |
| Legal form | B.V. |
| Trading name | Busy Fox |
| Registered address | Hagengracht 88 |
| Postcode and city | 7607 EE Almelo |
| Country of establishment | NL |
| Trade register number | 97091677 |
| Website | https://busyfox.eu |
| Contact for privacy questions | [email protected] |
| Data protection officer, if applicable | Not applicable. |
| EEA representative, if applicable | Not applicable. |
1.2
This policy applies to visitors to our website, customers, business contacts, people who contact us and participants in collaborations with Busy Fox. A business email address or an employee’s name can also be personal data.
1.3
Other providers, such as a printer app or payment provider, may also have their own privacy policies for the processing they control. This policy continues to apply to the data we receive and use ourselves.
02How we obtain your data
2.1
We receive most data from you, for example when you place an order, complete a form, create an account or send us a message. We may also receive technical data when you use our website.
2.2
We may also receive data from a payment provider, carrier or collaboration partner. This may include a payment status, delivery confirmation or information needed to verify a referral or commission.
2.3
Sometimes someone else provides your data. For example, a business may order for an employee or send a gift to a recipient. We use that data to fulfil the order. We do not sign the recipient up for marketing as a result.
2.4
If we receive personal data from another party, we inform you about the processing and its source when the GDPR requires us to. In principle, we do this within one month, or earlier if we contact you or disclose the data before then. We do not need to repeat information you already have, or provide it where a statutory exception applies.
2.5
We only ask for data needed for the relevant purpose. Our forms identify required fields. For example, we cannot deliver a parcel without a delivery address. Leaving an optional field empty does not affect the other services you use.
2.6
Do not send a citizen service number, a complete copy of an identity document or sensitive information unless necessary. Redact other people’s data in photos and documents if it is unrelated to your question. If we receive unnecessary data, we delete it or restrict its use where possible.
03Why we may use personal data
3.1
Every processing activity needs a valid legal basis. In this policy, we use the following legal grounds:
- Contract: processing necessary to enter into or perform a contract with you.
- Legal obligation: processing necessary to comply with the law, such as keeping statutory financial records.
- Legitimate interest: processing necessary for a specific interest, after weighing that interest against your rights and interests.
- Consent: processing you have freely and specifically agreed to. You can withdraw your consent.
3.2
For each use described below, we explain its purpose and applicable legal basis. A purchase or account registration is not general consent for other processing.
Articles 4–11
When we use personal data
04Orders and delivery
4.1
When you order, we use your name, email address, billing and delivery addresses, ordered products, quantities, prices and order number. For business orders, we also use necessary company and invoicing details. We use a telephone number if it is needed for delivery or you provide it for contact about your order.
4.2
We use this data to process and deliver your order, handle changes and keep you informed. Where this is necessary to perform a contract with you, the legal basis is that contract.
4.3
If you act on behalf of a business, we process your contact details on the basis of our legitimate interest in handling the business order and communicating with that business. This also applies to necessary processing of another recipient’s data.
4.4
We retain data needed for invoices, payments and tax records on the basis of a legal obligation. We only keep other order data while there is a separate reason to do so, such as providing support or resolving a dispute.
05Payments and refunds
5.1
Payments are processed through Stripe. Depending on the payment method, data is provided to Stripe and the financial parties involved to carry out and secure the payment. This may include your name, contact details, billing address, amount, currency, order reference and payment information.
5.2
We use the payment confirmation, transaction reference and other necessary payment details to handle your order, administration and any refund. The legal basis is our contract with you and, for statutory records, a legal obligation.
5.3
Where we use data to prevent payment abuse or handle a disputed payment, our legitimate interest is protecting customers and Busy Fox against abuse and financial loss. We limit this to the data needed for that purpose.
5.4
The information our staff can see:
Our staff cannot see payment details. They can only see the customer information you have entered.
5.5
Stripe may process data on our behalf for some activities and be independently responsible for others, for example its own legal obligations. Read Stripe’s privacy policy for details. This link does not change our responsibility for the data we process ourselves.
06Your account and customer benefits
6.1
If you create an account, we use your name, email address, login details, saved addresses and order history to manage it. Business accounts may also include company details and contact persons’ details.
6.2
The legal basis for providing account features to you is our contract. For managing access by a business customer’s employees, the legal basis is our legitimate interest in giving that customer access to its customer account.
6.3
We use your account status and applicable discount agreements to calculate and display customer benefits. Having an account with a discount does not mean you are subscribed to newsletters or other advertising.
6.4
We also use technical login data to protect accounts against unauthorised access. Our legal basis is the legitimate interest in securing our services and users’ data.
6.5
You can ask us to delete your account by emailing [email protected]. Data still needed for an order, statutory records or another valid reason is not automatically deleted with your account. Article 14 explains how we handle this.
07Questions, returns and warranty
7.1
If you contact us, we use your contact details, message and the information needed to answer your question. For a product issue, this may also include an order number, product model, serial number, photo or video.
7.2
We use this data for support, returns, complaints and warranty claims. Where necessary for our contract with you, that contract is the legal basis. For legal obligations, the basis is the relevant obligation. For other questions and business contacts, the basis is our legitimate interest in handling questions and problems carefully.
7.3
We sometimes need support from a manufacturer, supplier or repair provider. We only share data needed to assess or resolve the issue. Where possible, we share a technical description or images without your name and contact details. Contact and address details may be needed for a direct repair or shipment.
7.4
We do not automatically use a photo, video or review submitted for support as advertising. For separate use in marketing, we make an appropriate agreement in advance and ask for consent where required.
08Business enquiries and collaborations
8.1
For enquiries about business orders, larger quantities, corporate gifts, brands or creator collaborations, we use your name, business contact details, company name and the information in your enquiry. We process a website, social media account or portfolio when you include it or it is directly relevant to the proposed collaboration.
8.2
We use the data to assess your proposal, stay in touch, prepare a quotation and record agreements. If you are the intended contracting party yourself, the basis may be steps towards or performance of that contract. If you represent an organisation, the basis is our legitimate interest in assessing and maintaining business relationships.
8.3
If a collaboration starts, we also process necessary contractual, invoicing and payment details. The contract and applicable statutory record-keeping obligations apply. We process business contacts’ personal data on the basis of the legitimate interest described above.
8.4
We do not automatically add people making a business enquiry to a marketing list. If we want to retain a proposal for a future opportunity after the normal retention period ends, we ask for separate consent.
09Creators and affiliate commissions
9.1
If you participate in our affiliate programme as a creator, we use your contact details, agreed link or discount code and the data needed to attribute sales, calculate commissions and pay them. The legal basis for our agreement with you is that contract. A legal obligation also applies to tax records.
9.2
As a customer, you may order through a creator’s link or discount code. A used discount code may form part of the order and commission calculation. To allocate and verify commission, we process the necessary order reference, date, value and status on the basis of our legitimate interest in settling collaboration agreements correctly. For tracking technologies requiring consent, we ask for separate consent in advance.
9.3
Under this policy proposal, creators receive only the information needed to check their results and commissions. We do not provide customer names, email addresses or delivery addresses for that purpose. An order reference that does not directly identify someone may still be personal data.
9.4
Affiliate platform used:
Not yet completed
Attribution method and any tracking duration:
Not yet completedData visible in the creator overview:
Not yet completed9.5
Without the required consent, we do not place or read tracking cookies for affiliate recognition. Refusing them does not prevent an order. A discount code deliberately entered can still be processed to apply the discount and settle the related agreements.
10Newsletters and marketing messages
10.1
We send newsletters and other marketing emails when you have separately subscribed to them. We use your email address and the preferences you provide. The legal basis for this chosen approach is consent.
10.2
You can easily unsubscribe in every marketing message. You can also email us. Unsubscribing does not affect your account, customer discount or order fulfilment.
10.3
We may continue to send necessary messages about an order, payment, delivery, account security or support request. These messages belong to the relevant service and are not used as disguised newsletters.
10.4
We keep a limited record of your subscription and unsubscribe request to demonstrate and respect your choice. We process unsubscribe requests as soon as possible. We use suppression-list data only to prevent unwanted marketing being sent to you again.
10.5
Provider for marketing emails:
Not yet completed
Any measurement of opens and clicks, including purpose, data and legal basis:
Not yet completedAny personalised recommendations or basket reminders, including data and legal basis:
Not yet completed11Reviews
11.1
When you submit a review, we process its content, rating and the name or display name used for publication. It must be clear on submission which data will be public. We do not publish your email address or order number.
11.2
For the approach chosen in this draft, we ask for consent to publicly publish your personal data in a review. You can withdraw that consent. To verify authenticity and prevent abuse, we may process limited data on the basis of our legitimate interest in showing trustworthy reviews.
11.3
Review platform used:
Product reviews on the Busy Fox website.
Method, data and legal basis for any review invitations:
Not yet completed11.4
Before reusing an identifiable review, photo or video in a separate advertising campaign, we reassess which consent or other valid legal basis is needed. Posting a review is not unlimited consent for every future use.
Articles 12–17
Sharing, keeping and protecting data
12Website use, cookies and security
12.1
Technical data may be needed to operate and secure the website, such as an IP address, timestamp, browser details, error message and information about a login attempt. We use no more data than necessary. The legal basis for necessary security processing is our legitimate interest in keeping the website available and preventing abuse.
12.2
Some cookies or similar technologies are needed for a feature you request, such as remembering your basket or logged-in session. Where the law requires consent, we ask for it before using the technology. This also applies when a technology is not called a cookie but falls under the same rules.
12.3
For website analytics, the data processed and whether consent is needed must be established for each service and configuration. We only describe statistics as anonymous when individuals can genuinely no longer be identified. Removing a name is not always enough.
12.4
For advertising tracking or similar purposes, we ask for prior consent. Refusing must be as easy as accepting. You can withdraw consent. The website remains usable without optional tracking.
12.5
The cookie overview describes each technology’s provider, purpose, data, duration and whether consent is needed. It also covers relevant pixels, local storage and embedded videos. If a video player requires consent, the relevant processing only starts after that consent.
| Component | Service and configuration |
|---|---|
| Hosting and website platform | Website built on MODX with Commerce. Hosting provider to be confirmed. |
| Technical logs | Not yet completed |
| Analytics | Not yet completed |
| Advertising tracking | Not yet completed |
| Embedded videos and other external content | Locally hosted videos and support for YouTube through youtube-nocookie.com. The consent configuration still needs confirmation. |
| Cookie consent service | Not yet completed |
| Link to cookie overview | Not yet completed |
| Link to cookie preferences | Not yet completed |
13Who we share personal data with
13.1
We only share personal data when necessary for a stated purpose, when you have validly consented or when required by law. We do not give every service provider access to all customer data.
| Recipient | Purpose and types of data |
|---|---|
| Hosting and software providers | Operating the website, account and data storage. Only data needed for the service provided. |
| Stripe and financial parties involved | Payments, refunds and related checks. Necessary transaction, contact and payment data. |
| Carriers and fulfilment partners | Processing and delivering orders. Name, delivery address, parcel details and necessary contact data. |
| Email and customer service providers | Delivering messages and handling support questions. Contact details, messages and necessary case information. |
| Accountant and accounting software | Keeping financial records. Invoice, transaction and necessary company details. |
| Manufacturers and repair providers | Resolving product issues. Necessary product and case details and, if needed, contact and delivery data. |
| Affiliate and review providers, if used | Operating the relevant programme. Only the data described for that programme. |
| Legal advisers, insurers or competent authorities | Handling a specific claim or complying with a legal obligation. Only relevant data. |
13.2
Parties processing personal data solely on our behalf receive appropriate instructions and a processing agreement where required. Other parties may be independently responsible for their own processing. A payment provider or carrier is not automatically our processor for every activity.
13.3
We do not sell customer data to others for their own marketing. Any advertising or analytics platforms are covered separately in article 12. This promise does not replace that explanation.
13.4
The specific suppliers, their roles and relevant processing locations are listed below.
| Provider | Service and role | Countries of processing or access | Privacy information |
|---|---|---|---|
| Stripe | Payment services; role depends on the activity. | Not yet completed | https://stripe.com/privacy |
14How long we keep personal data
14.1
We do not keep personal data longer than necessary for its purpose. We then delete it or make it genuinely anonymous. Some data is subject to a statutory retention obligation. For other data, we apply the periods described below.
14.2
The non-statutory periods below are a policy proposal for Busy Fox. They must be confirmed and configured in the relevant systems before publication.
| Data | Retention period or criterion |
|---|---|
| Core tax records | Where Dutch tax retention requirements apply, generally seven years from the applicable statutory starting point. Data still forming a current part of the records may be needed longer. |
| Data covered by OSS or IOSS | Where applicable, ten years after the end of the year in which the relevant transaction took place. Only data covered by that obligation. |
| Account data | While the account is actively used. After two years without a login or order, we ask whether you want to keep it. Without a response, we delete the separate account data after thirty days. Data subject to an independent retention requirement is retained separately. |
| General questions without an order or dispute | Up to twelve months after the question is resolved. |
| Return and warranty files | Up to two years after the case is closed. Necessary data is kept longer if a specific claim remains ongoing or a legal obligation requires it. |
| Photos, videos and technical support attachments | Up to three months after the assessment or resolution is completed. Only relevant evidence remains part of the case file where necessary. |
| Business enquiries without an agreement | Up to twelve months after the last substantive contact. |
| Declined brand or creator enquiries | Up to six months after the decision. We ask for separate consent to retain them longer for future opportunities. |
| Agreements with business partners and creators | During the collaboration. Afterwards, we retain only data needed for tax obligations or establishing, exercising or defending specific legal claims, until that reason no longer applies. |
| Affiliate sales data | Detailed attribution data up to twelve months after final commission settlement. Data forming part of tax records follows the statutory period. |
| Newsletter data | Until unsubscribing, or no later than two years after the last demonstrable interaction if the subscription is not renewed. We only use lawfully available information for this. |
| Evidence of marketing consent | The necessary record up to five years after the last marketing message for which that consent was used. |
| Unsubscribe records | A minimal record for as long as needed to respect your unsubscribe request in the mailing lists used. We review this annually and delete it when no longer necessary for that purpose. |
| Published reviews | While the review is relevant to the product and a valid publication basis remains. If publication consent is withdrawn, we delete or anonymise the personal data without undue delay. |
| Ordinary technical access and security logs | A maximum of ninety days. Relevant data about a specific incident may be needed longer for investigation and handling. |
| Privacy requests | A limited record up to two years after completion. We delete the full copy of data provided and unnecessary identification information earlier, once no longer needed. |
| Cookies, analytics and other tracking | The individual periods in the completed cookie and service overview. |
14.3
A longer retention period does not automatically apply to an entire customer file. For a dispute or incident, we only retain data still needed for that matter. We regularly review whether the reason still applies.
14.4
Deleted data may remain temporarily in restricted backups. We do not use it for normal services or marketing. When restoring a backup, we reapply relevant deletions. Data is removed from backups as soon as possible under the established backup cycle.
Maximum backup retention and deletion procedure:
Not yet completed15Personal data outside the EEA
15.1
The European Economic Area consists of the EU countries, Norway, Iceland and Liechtenstein. A service provider may process data outside the EEA. Access from another country, for example for support, may also constitute a transfer.
15.2
For a transfer, we ensure a valid mechanism under the GDPR. Depending on the circumstances, this is an applicable European Commission adequacy decision or appropriate safeguards, such as European standard contractual clauses. Where necessary, we assess additional protective measures. We do not assume without verification that a supplier is covered by a particular mechanism.
15.3
Actual transfers are recorded below. If there are no transfers, this is explicitly stated after verification.
| Service provider and processing | Country outside the EEA | Applicable mechanism and additional safeguards |
|---|---|---|
| Stripe | Not yet completed | Not yet completed |
15.4
You can email [email protected] to ask about the applicable safeguards and, where relevant, request a copy. We may redact information that must remain confidential.
16Printer apps and external services
16.1
Designing and printing may require another provider’s app. That provider may process personal data when you create an app account, save designs or use app features. Please consult that provider’s privacy information.
| App or service | Provider | Privacy information |
|---|---|---|
| Print Master | PHOMEMO PTE. LTD. | https://www.qu-in.com/about/download/xiaobiao_privacypolicy_us |
| Phomemo | PHOMEMO PTE. LTD. | https://www.qu-in.top/about/download/phomemo_privacy_agreement/ |
| Labelife | PHOMEMO PTE. LTD. | https://www.aimotech.com/labelife/privacy_en.pdf |
16.2
Any integrations with Busy Fox and the app, design or print data Busy Fox receives through them:
Not yet completed
16.3
If you send app data, a screenshot or a design for support, we use it as described in article 7. Remove personal data about your customers or other people if it is not needed to understand the problem.
16.4
Linking to an external service does not mean that all data exchange with it falls outside our responsibility. We retain our legal obligations for processing we determine ourselves or jointly with another party.
17Security and automated decisions
17.1
We take technical and organisational measures appropriate to the data and risks. Our policy principles include limited access rights, secure connections, careful account management and agreements with service providers. Employees and other authorised people only receive access as needed for their work.
Overview of specific security measures in use:
Not yet completed17.2
No system can guarantee absolute security. In the event of a data breach, we take measures to limit the consequences. We report it to the competent authority and inform affected people when required by law.
17.3
An automatically calculated volume discount or standard account discount is not, by itself, a decision producing legal effects or similarly significant effects under article 22 GDPR. Payment and fraud-detection systems must be assessed separately for this.
Use of solely automated decisions with such effects:
Not yet completedData involved, responsible party, operation, consequences and applicable legal basis:
Not yet completedOpportunity for human intervention, expressing your view and contesting a decision, where applicable:
Not yet completed17.4
Any profiling for recommendations or advertising is also described when it does not fall under article 22 GDPR. We state the purpose, data, legal basis and your options to withdraw consent or object.
Profiling in use:
Not yet completedArticles 18–20
Your rights and choices
18Your privacy rights
18.1
You can ask which personal data we use about you and receive a copy. You can also ask us to correct inaccurate data, complete data or delete it where you have that right.
18.2
In the situations specified by the GDPR, you can ask us to restrict processing. For example, you may ask us to temporarily stop using data while its accuracy is investigated.
18.3
If we process data on the basis of a legitimate interest, you can object on grounds relating to your particular situation. We then stop processing unless we demonstrate compelling legitimate grounds that override your interests, or the data is needed to establish, exercise or defend a legal claim.
18.4
You can always object to processing for direct marketing. We then stop using your data for that purpose, including related profiling.
18.5
Where processing is based on your consent, you can withdraw it at any time. This does not affect the lawfulness of processing before withdrawal. Withdrawing is as easy as giving consent.
18.6
If we process data you provided by automated means on the basis of consent or a contract with you, you can, subject to the GDPR’s conditions, ask to receive it in a commonly used, structured and machine-readable format. Where technically feasible, you can ask us to transfer it directly to another organisation.
18.7
Your rights are not unlimited in every situation. For example, we cannot delete data we are legally required to retain. We explain what remains, why and for how long. We also protect other people’s rights when providing information.
19Making a request or complaint
19.1
Email your privacy question or request to [email protected]. Describe what your request concerns. An account or specific form is not required.
19.2
We verify your identity in a way appropriate to the request, preferably using data we already have. We do not routinely ask for a copy of an identity document. If we have reasonable doubts, we may ask for additional information, but no more than necessary.
19.3
We respond without undue delay and within one month of receipt at the latest. Where we act on your request, we generally do so within the same period. For complex or multiple requests, we may extend it by up to two further months if necessary. We tell you within the first month why and when you can expect our response.
19.4
Requests are generally free of charge. Only in legally permitted circumstances, such as a manifestly unfounded or excessive request, may we charge a reasonable fee or refuse it. We explain that decision.
19.5
If you have a complaint, we are happy to help through the same email address. You may also complain directly to a competent data protection authority. You do not have to wait for our internal handling. In the Netherlands, this is the Autoriteit Persoonsgegevens. You may also contact the competent authority in the country of your habitual residence, workplace or the alleged infringement. You retain your right to take legal action.
20Changes to this policy
20.1
We update this policy when our services, data processing or legal obligations change. The date at the top shows when the policy was last updated.
20.2
We inform affected people appropriately about important changes. If we want to use existing data for a new purpose, we first assess whether that is permitted and inform you before processing starts. If new consent is needed, we ask for it separately. Continued use of the website does not automatically constitute consent.
A question or request