§ 01The short version

We think that should be normal. It is also consistent with what we sell: a file you own, that does not phone home.

§ 02Who is responsible

The controller of your personal data is «BEDRIJFSNAAM ZOALS INGESCHREVEN BIJ DE KVK», trading as Just Wanna Train.

Address

«STRAAT EN HUISNUMMER», «POSTCODE EN PLAATS», The Netherlands

Chamber of Commerce

«KVK-NUMMER»

Privacy contact

«E-MAILADRES»

We are a small operation and we are not required to appoint a data protection officer. Privacy questions go to the address above and are answered by a person.

§ 03What we collect, and why

If you buy something

Your email address, your name if you give it, your country, and what you ordered. We need this to deliver the files, to send your receipt and the confirmation of your withdrawal-right agreement, and to meet our tax obligations. Legal basis: performance of the contract, and legal obligation for the accounting records.

We never see your card details. Those go straight to Shopify Payments. We receive only the outcome of the payment and the last four digits.

If you sign up for the newsletter

Your email address, and nothing else. Legal basis: your consent. Every email contains a one-click unsubscribe, and withdrawing consent is as easy as giving it.

If you email us

Your address and whatever you write. Legal basis: our legitimate interest in answering you.

When you simply visit

Our host, Cloudflare, records standard server logs including a truncated IP address, for security and to keep the site up. Legal basis: our legitimate interest in a site that works and is not being attacked. We do not use these logs to build any picture of you.

We also count page views with Cloudflare Web Analytics, so we know which pages people read and which ones they leave. It records the page, the referring site, the country, the browser and how fast the page loaded. It sets no cookie, stores nothing in your browser, does not fingerprint your device and cannot recognise you on a return visit or on any other website. We see totals, never individuals. Legal basis: our legitimate interest in knowing whether the site works — and because no cookie or similar identifier is placed, your consent is not required for it.

§ 04What we do not do

• We do not sell, rent or trade your data. Not to anyone, at any price.
• We do not run advertising or retargeting, so there is nothing to feed.
• We do not use Google Analytics, Meta Pixel or any tool that follows you between websites.
• We do not profile you or make automated decisions about you.
• We do not enrich your data with anything bought from a third party.
• We do not need an account from you, so we hold no password.

§ 05Cookies and local storage

We set no cookies at all — not for tracking, not for statistics, not for anything. That is also why there is no cookie banner: consent is required for storing or reading information on your device, and we do neither.

What does get stored in your browser:

• One preference on the product pages, remembering whether you last viewed men’s or women’s schedules, and one on the legal pages remembering your language. Both stay on your device.
• Shopify sets cookies on the checkout page, to keep your basket together and to prevent fraud. That happens on Shopify’s own domain and is covered by their policy.

Clearing your browser storage removes ours entirely, with no effect other than forgetting those two choices.

§ 06Who processes data on our behalf

Shopify

Webshop, checkout, payments and receipts. Contracted through Shopify’s Irish entity, with processing in Canada and the United States under the EU Standard Contractual Clauses.

Cloudflare

Hosting, security and cookieless page-view statistics. EU data centres where available.

Kit

Email delivery for the newsletter, once that is switched on. United States, under the EU Standard Contractual Clauses.

Each is bound by a processing agreement and may use your data only to perform its service for us.

§ 07How long we keep it

• Order and invoice records: seven years. Not our choice — that is the statutory retention period for tax records in The Netherlands.
• Newsletter address: until you unsubscribe, then removed.
• Email correspondence: up to two years after the conversation ends.
• Server logs: as retained by Cloudflare, typically days rather than months.

§ 08Your rights

Under the GDPR you can ask us to:

• Show you what we hold about you;
• Correct anything wrong;
• Delete it, except where we are legally required to keep invoice records;
• Hand it over in a portable format;
• Restrict or object to our processing;
• Withdraw consent at any time, for anything based on consent.

Email «E-MAILADRES». We answer within 2 working days and never charge for it.

If you are not satisfied with how we handle it, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the supervisory authority in your own country.

§ 09Security

The site is served over HTTPS only, with HSTS enforced. Payment data never reaches our systems. Access to order records is limited to the people who need it, which at our size is a very short list.

No system is perfect. If you believe you have found a vulnerability, email us rather than publishing it, and we will fix it and credit you if you would like that.

§ 10Children

Our products are not aimed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, email us and we will delete it.

§ 11Changes to this statement

If we change how we handle data — for example when the newsletter goes live — we update this page and the date at the top. Material changes to anything based on consent will be asked for again rather than assumed.