HelloStraw B.V. (“HelloStraw”, “we”, “us”) is committed to protecting your personal data and respecting your privacy. This policy explains what personal data we collect when you visit hellostraw.com or contact us, why we collect it, how we use it, and what rights you have over it.
This policy applies to all visitors, enquirers, customers, and job applicants who interact with HelloStraw through our website or direct communications.
1. Who we are
The data controller responsible for your personal data is:
| Detail | Value |
|---|---|
| Legal name | HelloStraw B.V. |
| Registered address | [Keizersgracht 62, Amsterdam, Netherlands — confirm with ops] |
| KVK number | [8-digit KVK number — confirm with ops] |
| VAT number | [NL000000000B01 — confirm with finance] |
| [privacy@hellostraw.com — create this mailbox before launch] | |
| Phone | [+31 (0)XX XXX XXXX — confirm with ops] |
| Data Protection Officer | [Name + email, or “We have designated a DPO. Contact: [email]” — required if processing at scale under UAVG] |
2. What data we collect and why
We collect personal data only when you actively provide it or when it is generated by your use of our website. We never sell personal data to third parties.
| Activity | Data collected | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Quote request form | Name, business email, company name, phone, country, message content | To respond to your product or pricing enquiry and manage the commercial relationship | GDPR Art. 6(1)(b) — pre-contractual steps / contract performance | 3 years from last contact, or duration of commercial relationship + 7 years (Dutch tax law) |
| Sample request | Name, business email, company name, shipping address | To fulfil and ship your sample order | GDPR Art. 6(1)(b) — contract performance | 3 years from order date |
| Contact page / email | Name, email, message content | To respond to your enquiry | GDPR Art. 6(1)(f) — legitimate interest (responding to unsolicited enquiries) | 2 years from last contact |
| Newsletter subscription | Business email address, name (optional) | To send HelloStraw product updates, sustainability news, and industry insights | GDPR Art. 6(1)(a) — consent (opt-in required) | Until you unsubscribe + 30 days for processing. Consent records: 3 years |
| Careers / job application | Name, email, CV/résumé, cover letter, LinkedIn URL (if provided) | To assess your application for a role at HelloStraw | GDPR Art. 6(1)(b) — pre-contractual steps | If unsuccessful: 4 weeks after rejection (NL standard), or up to 1 year with your written consent. If hired: duration of employment + statutory retention periods |
| Website analytics | IP address (anonymised), pages visited, browser type, session duration, referring URL | To understand how visitors use hellostraw.com and improve user experience | GDPR Art. 6(1)(f) — legitimate interest (subject to cookie consent) | 26 months (Google Analytics default, anonymised) |
| Cookie consent records | Consent timestamp, choices made by category, policy version, jurisdiction | To demonstrate compliance with GDPR Art. 7 | GDPR Art. 6(1)(c) — legal obligation | 18 months minimum (Dutch AP requirement) |
3. How long we keep your data
We keep personal data only for as long as necessary for the purpose it was collected, or as required by Dutch law. Key retention periods are shown in the table in Section 2. General principles:
- Financial records (including customer invoices and order data) must be retained for 7 years under Dutch tax law (Belastingdienst requirement)
- Data no longer needed is securely deleted or anonymised
- You can request deletion of your data at any time (see Section 7 — Your rights), subject to overriding legal retention obligations
- If HelloStraw is required by law or court order to retain specific data beyond these periods, we will inform you where possible
4. Who we share your data with
We share personal data only where necessary and only with trusted third-party service providers who process data on our behalf under a written Data Processing Agreement (DPA). We do not sell data to third parties or share it for advertising purposes.
| Third party | Purpose | Location | Safeguard |
|---|---|---|---|
| [CRM provider — e.g. HubSpot] | Managing customer and prospect contact records | USA | EU-US Data Privacy Framework adequacy decision (2023) + SCCs |
| [Email platform — e.g. Mailchimp / HubSpot] | Sending transactional emails and newsletters | USA | SCCs / EU-US DPF adequacy |
| [Logistics / shipping partner] | Fulfilling sample orders — name and shipping address shared | [EU / confirm] | DPA in place |
| [Hosting provider — e.g. WP Engine, Kinsta] | Hosting hellostraw.com and storing website data | [confirm location] | DPA in place, EU hosting preferred |
| [Analytics — e.g. Google Analytics 4] | Anonymised website usage analytics | USA | SCCs + IP anonymisation enabled + consent required before firing |
| Dutch tax authorities (Belastingdienst) | Legal obligation — financial records disclosure | Netherlands | Legal obligation under Art. 6(1)(c) |
| Dutch courts / law enforcement | If required by court order or legal obligation | Netherlands / EU | Legal obligation under Art. 6(1)(c) |
5. International data transfers
Some of our service providers are based outside the European Economic Area (EEA). Where we transfer personal data outside the EEA, we ensure at least one of the following safeguards is in place:
- The country has been granted an adequacy decision by the European Commission (e.g. the EU-US Data Privacy Framework covers many US providers)
- We have put Standard Contractual Clauses (SCCs) in place with the provider, as approved by the European Commission
- The provider participates in an approved certification scheme
You can request a copy of the safeguards we use for specific transfers by contacting us at hello@hellostraw.com.
6. Cookies and tracking technologies
We use cookies and similar technologies on hellostraw.com. Under Dutch law (Telecommunicatiewet Art. 11.7a) and GDPR, we require your explicit consent before placing any non-essential cookies on your device.
| Cookie category | Description | Consent required |
|---|---|---|
| Strictly necessary | Essential for the website to function — e.g. session management, load balancing, security tokens. Cannot be turned off. | No — exempt |
| Functional / preference | Remember your choices — e.g. language preference, form autofill. Do not track across sites. | Yes — opt-in |
| Analytics | Anonymised data about how visitors use the site (e.g. Google Analytics 4 with IP anonymisation). Helps us improve content and navigation. | Yes — opt-in |
| Marketing / retargeting | Track visits across websites to show relevant advertising. Currently: [LinkedIn Insight Tag / Meta Pixel / Google Ads — confirm which apply]. | Yes — opt-in |
You can manage your cookie preferences at any time using the Cookie Settings link in the footer of every page. You can also withdraw consent previously given — this will not affect the lawfulness of processing before withdrawal.
7. Your rights
Under GDPR, you have the following rights in relation to your personal data. We will respond to all valid requests within 30 days (extendable to 3 months for complex requests, with notice).
| Right | What it means |
|---|---|
| Right of access (Art. 15) | You can request a copy of all personal data we hold about you, free of charge. |
| Right to rectification (Art. 16) | You can ask us to correct inaccurate or incomplete data without undue delay. |
| Right to erasure — “right to be forgotten” (Art. 17) | You can ask us to delete your data where there is no legitimate reason for us to continue holding it. Note: we may be legally required to retain certain data (e.g. invoices for 7 years). |
| Right to restriction of processing (Art. 18) | You can ask us to pause processing your data in certain circumstances, for example while we verify its accuracy. |
| Right to data portability (Art. 20) | Where processing is based on consent or contract and carried out by automated means, you can ask us to provide your data in a structured, machine-readable format. |
| Right to object (Art. 21) | You can object to processing based on legitimate interests. We must stop unless we have compelling legitimate grounds that override your interests. |
| Right not to be subject to automated decision-making (Art. 22) | You have the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal or similarly significant effects. We [do / do not — confirm] use automated decision-making. |
| Right to withdraw consent (Art. 7(3)) | Where processing is based on consent, you can withdraw it at any time. Withdrawal does not affect prior processing. Use the Cookie Settings link for cookie consent, or contact us for other consent-based processing. |
To exercise any right, contact us at hello@hellostraw.com or write to [HelloStraw B.V., Keizersgracht 62, Amsterdam]. We will verify your identity before processing your request. We do not charge a fee for exercising rights unless requests are manifestly unfounded or excessive.
8. How to contact us
For any questions about this privacy policy, to exercise your rights, or to raise a concern about how we handle your data:
| Channel | Contact details |
|---|---|
| Email (preferred) | [privacy@hellostraw.com] |
| Post | HelloStraw B.V., [registered address], Amsterdam, Netherlands |
| Data Protection Officer | [DPO name] — [dpo@hellostraw.com] (if DPO appointed) |
| Response time | We aim to respond within 5 business days and will always respond within the 30-day GDPR deadline |
9. How to complain
If you are unhappy with how we have handled your personal data, we encourage you to contact us first so we can try to resolve it. You also have the right to lodge a complaint directly with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):
| Supervisory authority | Contact |
|---|---|
| Autoriteit Persoonsgegevens (AP) | autoriteitpersoonsgegevens.nl |
| Postal address | Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, Netherlands |
| Phone | +31 (0)70 888 85 00 |
| Online complaint form | autoriteitpersoonsgegevens.nl/meldformulier |
If you are based in another EU member state, you may also contact your local supervisory authority. A list of all EU supervisory authorities is available at edpb.europa.eu.
10. Changes to this policy
We review and update this privacy policy periodically, particularly when we change how we process data, launch new features on hellostraw.com, or when legal requirements change. We will:
- Update the “Last updated” date at the top of this page whenever material changes are made
- Notify active subscribers by email if changes are significant and affect how we use their data
- Maintain a version log so you can see what has changed
We encourage you to review this policy periodically. Continued use of hellostraw.com after a policy update constitutes acceptance of the revised policy.
