Privacy policy

Damage Control VOF ("Damage Control", "we", "us") is the controller responsible for the personal data we collect through damagecontrol.store, our webshop and our other online services (together, the "Service"). We are based in the Netherlands, so the EU General Data Protection Regulation (GDPR) is the primary framework for this policy. Some rights depend on where you live — see the region sections in section 9.

Our webshop is not live yet. We do not sell products and we do not process payments at this time, and we have not engaged a payment provider. This policy therefore does not describe any payment processing. Before the first payment is processed we will name our payment provider, describe what it receives and update this policy — in advance, not afterwards.

• Company: Damage Control VOF
• Address: Berkterdries 19, 5571 WH Bergeijk, The Netherlands
• Chamber of Commerce (KvK): 42133718
• Privacy contact: privacy@damagecontrol.store

Because we are established in the Netherlands, we do not need an EU representative — we are the point of contact ourselves. We have not appointed a Data Protection Officer, as this is not mandatory for our processing activities.

Data you give us directly:

• Contact data — name, email address, phone number, billing and shipping address
• Account data — username and password (stored encrypted) when you create an account
• Order and transaction data — order numbers, products ordered, transaction history
• Payment data — none. Because we do not sell anything yet, we collect no card or payment details. When our webshop goes live, payments will be handled directly by a specialist payment provider and we will never see or store your full card details.
• Communications — messages you send us by email, through contact forms or social media
• Newsletter and waitlist data — your email address and preferences when you sign up for product updates or a waitlist
• Request and application data — what you submit through our request-a-product and become-a-dev forms

Data collected automatically:

• Device data — browser type, operating system, IP address, language settings
• Usage data — pages visited, click behaviour, referring website, time and duration of your visit

Automatic collection happens through cookies and similar technologies, and only after consent where required. See our Cookie Policy for the full list and how to manage your preferences. You can change or withdraw your cookie consent at any time through the "Manage consent" link at the bottom of every page.

Some data is necessary to enter into or perform a contract with you: we cannot process and deliver your order without your contact, order and payment details, or create an account without account data. If you do not provide this data, we cannot provide those parts of the Service. All other data is optional.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

We only share personal data with:

• Processors who provide services on our behalf: hosting Cloud86, email delivery and newsletter Google Workspace, website analytics (Google Analytics 4 via Google Tag Manager), and the internal workspace where form submissions and customer correspondence are stored (Notion). We have a data processing agreement with each of them. We do not yet work with a payment provider or a carrier, because we do not sell products yet.
• Authorities, only when we are legally required to.

We never sell your personal data.

We work with processors inside the EU/EEA wherever possible. Where a processor handles data outside the EU/EEA — for example US-based services such as Google and Notion — the transfer only takes place under an appropriate safeguard: an adequacy decision (such as the EU–US Data Privacy Framework) or EU Standard Contractual Clauses. You can contact privacy@damagecontrol.store to find out which safeguard applies to a specific transfer and to request a copy of it.

• Order and invoice data: 7 years (Dutch tax retention obligation) — this applies once we start selling; today we hold no order or invoice data
• Account data: until you delete your account, plus 0 months
• Newsletter and waitlist data: until you unsubscribe, or after 24 months of inactivity
• Analytics data: 14 months — the retention period configured in Google Analytics 4 (see our Cookie Policy)
• Security and server logs: 12 months

After that, we delete or anonymize  the data.

We take appropriate technical and organisational measures — including encrypted connections and restricted access — to protect your personal data. No system is 100% secure. If a personal data breach occurs, we follow the GDPR breach notification rules, including notifying the supervisory authority and, where required, the people affected.

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing
• Data portability — receive your data in a machine-readable format
• Object to processing based on legitimate interests, including direct marketing
• Withdraw consent at any time — without affecting the lawfulness of processing before withdrawal

You can unsubscribe from our newsletter through the link at the bottom of every email, and manage or withdraw cookie consent through the "Manage consent" link at the bottom of every page. For all other requests, email privacy@damagecontrol.store. We respond within one month and may ask you to confirm your identity. If you are not happy with our response, you can lodge a complaint with your supervisory authority — see section 9.

European Economic Area (including the Netherlands)

The GDPR applies in full. You can lodge a complaint with the Autoriteit Persoonsgegevens (Postbus 93374, 2509 AJ The Hague, autoriteitpersoonsgegevens.nl) or with the supervisory authority in your country of residence.

United Kingdom

The UK GDPR applies. You can lodge a complaint with the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk. [UK REPRESENTATIVE — if required under Article 27 UK GDPR once we actively sell to UK customers, our UK representative's details will be listed here.]

United States

There is no single federal US privacy law. Individual states (such as California, Virginia, Colorado and Texas) have their own privacy laws, each with its own scope. Where such a law applies to us, residents of that state may request access to, correction of, or deletion of their personal information, may request a portable copy of it, may appeal a refused request, and will not be treated differently for exercising these rights. Email privacy@damagecontrol.store to make a request.

We do not sell your personal information for money, and we do not share it for cross-context behavioural or targeted advertising. If that changes, we will update this policy, add a "Do Not Sell or Share My Personal Information" option and honour Global Privacy Control signals where required.

The Service is not intended for anyone under the age of 16. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. The current version is always available on this page, with the date of the latest change. If we make material changes, we will inform you actively — for example by email or a notice on the website.

Questions or privacy requests: privacy@damagecontrol.store, or in writing to Damage Control VOF, Berkterdries 19, 5571 WH Bergeijk, The Netherlands.