Privacy policy

Last updated: 1 November 2026

This policy explains what personal data Wispaire collects when you visit wispaire.com or buy from us, why, who we share it with, how long we keep it and what your rights are.

Who we are

Wispaire is a trade name of CJS Services, the controller of your personal data.

• CJS Services, trading as Wispaire
• Haarlemmerdijk 137, 1013 KG Amsterdam, the Netherlands
• KvK 91002443 (Dutch Chamber of Commerce)
• VAT NL865523319B01
• info@wispaire.com

Write to info@wispaire.com with any question about your data. We do not have a data protection officer; the founder answers these emails.

What we collect and why

When you order. Your name, email address, delivery and billing address, phone number if you give it, what you bought and the order history. We need these to make and deliver your order, send order and shipping emails and handle returns. Legal basis: performance of the contract (GDPR art. 6(1)(b)). Payment details go straight to the payment provider; we never see your full card number.

For our accounts. Order and invoice records, because Dutch tax law requires us to keep them. Legal basis: legal obligation (art. 6(1)(c)).

When you contact us. Your email address and what you write, so we can answer. Legal basis: our legitimate interest in answering you (art. 6(1)(f)).

Newsletter. Your email address, only when you sign up. Legal basis: your consent (art. 6(1)(a)). Every email has an unsubscribe link.

When you browse. Shopify sets the cookies the shop needs to work (your bag, checkout, security and your cookie choice). Legal basis: legitimate interest and, for the cookies themselves, the exemption for strictly necessary cookies. With your consent only, we also use:

• Google Analytics 4, to see which pages and designs people look at and where they leave;
• Microsoft Clarity, which records how pages are used (clicks, scrolling and mouse movement, with text you type masked) and builds heatmaps;
• Google Ads conversion tracking, to measure which ads lead to visits and orders. When you buy and have allowed marketing cookies, a hashed (scrambled, one-way) copy of your email address goes to Google so it can match the order to an ad click (enhanced conversions).

Legal basis for these: your consent (art. 6(1)(a)), given or refused in our cookie banner. You can change your choice at any time through Cookie settings at the foot of every page. Our cookie policy lists every cookie by name.

Order attribution. With each order we store the page you landed on and where the visit came from (for example a Google ad). This contains no personal data beyond what the order already holds and helps us see which pages lead to orders. Legal basis: legitimate interest (art. 6(1)(f)). Only when you have allowed marketing cookies do we also store the Google click id, so we can match the order to the ad click. Legal basis: your consent (art. 6(1)(a)).

We do not sell your personal data, and we do not use it for automated decisions with legal or similarly significant effects.

Processors we share data with

We share data only with companies that help us run the shop, under a data processing agreement, and only as far as each needs it:

• Shopify (Shopify International Ltd., Ireland, and Shopify Inc., Canada): hosts the shop and checkout, processes orders and payments, sends order emails and our newsletter (Shopify Email) and sets the necessary cookies.
• Printify (Printify, Inc., USA) and MWW On Demand (USA): make and ship your order. They receive your name, delivery address and the items ordered.
• Shipping carriers chosen by our print partners: deliver the parcel. They receive your name, address and, where needed for delivery, your phone number or email.
• Payment providers (Shopify Payments, and PayPal if you choose it): process your payment.
• Google (Google Ireland Ltd. and Google LLC, USA): Google Analytics and Google Ads, only with your consent.
• Microsoft (Microsoft Ireland Operations Ltd. and Microsoft Corporation, USA): Microsoft Clarity, only with your consent.

International transfers

Some of these processors handle data outside the European Economic Area:

• United States (Google, Microsoft, Printify, MWW On Demand and some carriers): transfers rely on the EU-US Data Privacy Framework where the recipient is certified (Google and Microsoft are), and otherwise on the European Commission's standard contractual clauses.
• Canada (Shopify Inc.): the European Commission has decided that Canada offers an adequate level of protection for commercial organisations.

Ask us at info@wispaire.com for a copy of the safeguards that apply.

How long we keep your data (retention)

• Orders, invoices and the related customer details: 7 years after the end of the financial year, as Dutch tax law requires.
• Emails with us: up to 2 years after the conversation ends, unless they belong to an order.
• Newsletter: until you unsubscribe.
• Google Analytics: 14 months, then deleted by Google.
• Microsoft Clarity: recordings for 30 days, heatmaps and summary data for up to 13 months.
• Cookies: as listed in our cookie policy.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have it corrected if it is wrong;
• have it deleted, unless we must keep it by law (for example invoices);
• restrict how we use it;
• object to processing based on our legitimate interest;
• receive the data you gave us in a common, machine-readable format (data portability);
• withdraw your consent at any time, without affecting what we did before you withdrew it. For cookies, use Cookie settings at the foot of every page.

Email info@wispaire.com to use any of these rights. We answer within one month. You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the authority where you live.

US residents. We do not sell personal information. Some states treat the sharing of data with ad partners as a sale or sharing; where that applies, the shop shows a "Do not sell or share my personal information" link at the foot of every page, and we honour Global Privacy Control signals.

Security

The shop and checkout run on Shopify, which encrypts traffic and is certified to the PCI DSS standard for card payments. Access to order data is limited to the people who need it.

Children

The shop is not meant for children under 16, and we do not knowingly collect their data.

Changes

We update this policy when what we do with data changes. The date at the top shows the latest version.