Privacy policy

Privacy policy

This policy explains which personal data Dailyplay processes when you visit or order from our online shop, why we do so, on which legal basis, who we share it with and what rights you have.

1. Controller

Damian Wijnhoven, trading as Dailyplay
Zonneweg 1, 5712 GN Someren, the Netherlands
Email: info@dailyplay.nl

2. What we process, why, and on which legal basis

Handling your order. Name, delivery and billing address, email address, telephone number (if you give it), the products ordered, order number, the payment method chosen and the payment status. We need this data to perform the purchase contract: payment, packing, shipping, delivery, withdrawal, returns and refunds. Legal basis: Article 6(1)(b) GDPR. Card and account details are processed by the payment provider; we do not see them.

Customer service. What you send us by email, through the chat on the website or through the withdrawal form. Legal basis: Article 6(1)(b) GDPR where it concerns an order, otherwise Article 6(1)(f) GDPR (our legitimate interest in answering questions).

Draft replies with AI support. For incoming customer questions, an AI service writes a draft reply and sorts feedback by topic. A member of our team checks every draft before a reply is sent; there is no automated decision. Legal basis: Article 6(1)(f) GDPR (our legitimate interest in answering questions quickly and correctly).

Accounting. We keep invoice and order data because tax law requires it. Legal basis: Article 6(1)(c) GDPR.

Newsletter and text messages. Email address and, if you give it, telephone number, only after you sign up, for example through a pop-up on the website. Legal basis: consent, Article 6(1)(a) GDPR. You can unsubscribe at any time through the link at the bottom of every email.

Review requests. After an order you may receive an email asking you to review the product. Legal basis: Article 6(1)(f) GDPR (our legitimate interest in showing the experiences of other customers). You can object to this at any time, by email to info@dailyplay.nl or through the link in the email.

Reviews. If you write a review, you give your name, your rating and possibly photos. Legal basis: consent, Article 6(1)(a) GDPR.

Improving the website and measuring advertising. Which pages and products are viewed, what is put in the cart, device, browser and IP address. We collect this with cookies and similar technologies (see section 6). Legal basis: consent, Article 6(1)(a) GDPR. Cookies that are strictly necessary for the website to work are placed without consent, on the basis of Article 6(1)(f) GDPR.

Partner programme. Whether a visitor came to us through one of our partners (affiliates). Legal basis: consent, Article 6(1)(a) GDPR.

3. Recipients

We never sell data. We only pass on what is needed to run the online shop:

• Shopify: the platform on which our online shop and the checkout run.
• Payment providers at checkout: Shopify Payments (for card payments, Apple Pay, Google Pay, Shop Pay and the local payment methods offered in your country), PayPal and Klarna. If you pay with PayPal or Klarna, their own privacy notices also apply.
• Stockhub and Avado: our warehouse and fulfilment partners, who pack and send your order.
• Partner warehouse for life-size dolls: receives your name and address when such a doll is sent from there.
• DHL and UPS: deliver the parcel and inform you about the delivery.
• Sendly: receives and checks returns.
• Microsoft (Microsoft 365): our email mailbox.
• Anthropic: the AI service for draft replies and for sorting feedback (see section 2).
• Omnisend: sends our emails and text messages, such as the newsletter.
• Pop Convert: shows the pop-ups on the website through which you can sign up for emails.
• Kaching: provides the cart and the bundle offers on the website.
• Loox: collects and shows product reviews and can ask you for a review after an order.
• Tidio: the chat on the website.
• Google (Google Analytics and Google Ads): measures how the website is used and the results of our advertising, partly through Stape, a service for server-side measurement.
• GoAffPro: records whether a visitor came through one of our partners.
• Our own software for the withdrawal form, administration and analyses, running on Vercel, Supabase and Resend (email).
• Our accountant and public authorities, where the law requires it.

With service providers that process data on our behalf, we have agreements on security and confidentiality under Article 28 GDPR.

4. Transfers outside the European Economic Area

Some recipients also process data outside the European Economic Area, in particular in the United States and Canada. This only happens on the basis of an adequacy decision of the European Commission (Article 45 GDPR; for the United States only with recipients certified under the EU-US Data Privacy Framework) or on the basis of the European Commission's standard contractual clauses (Article 46(2)(c) GDPR).

5. How long we keep data

• Order and invoice data: 7 years, because Dutch tax law requires us to keep our records that long.
• Newsletter data: until you unsubscribe.
• Messages to customer service and return notifications: as long as needed to handle them and to answer any follow-up questions.
• Usage data and cookies: as long as set for each cookie (see section 6).

6. Cookies

A cookie is a small file that your browser stores when you visit our website. On your first visit, a cookie banner asks for your consent to all cookies that are not strictly necessary. You can withdraw your consent at any time through the cookie settings.

• Strictly necessary cookies, for example for the cart, from Shopify and Kaching.
• Analytics cookies, which measure how the website is used, from Shopify and Google Analytics.
• Marketing cookies, which measure which advertising and emails lead to a visit or purchase, from Google Ads, Omnisend and GoAffPro (the GoAffPro cookie is kept for 7 days).
• Cookies for the chat, pop-ups and reviews, from Tidio, Pop Convert and Loox.

7. Data you have to give

For an order we need your name, delivery address, email address and payment details. Without them we cannot conclude the contract. Everything else is voluntary.

8. No automated decisions

We do not make decisions based solely on automated processing within the meaning of Article 22 GDPR. If you pay with Klarna, Klarna may carry out its own check; Klarna's privacy notice applies to that.

9. Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You can withdraw consent at any time, with effect for the future (Article 7(3) GDPR). Send your request to info@dailyplay.nl. We reply within one month and may ask you to confirm your identity, for example with the email address of your order.

Right to object (Article 21 GDPR). Where we process data on the basis of our legitimate interest (Article 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. You can object to use for direct marketing at any time and without giving reasons.

Right to lodge a complaint (Article 77 GDPR). You can lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live, where you work or where the alleged infringement took place. The authority responsible for us is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

10. Security

We protect data with appropriate technical and organisational measures. The website and the checkout use an encrypted connection (https). Only the people and service providers who need customer data for their work have access to it.

11. Changes

We update this policy when our way of working or the law changes. The version on this page applies.