Privacy Policy
Version 1 · Effective date: 2026-09-24
Draft under legal review. This text is not yet final.
Controller
EPEVER Technologies Europe B.V. (trade name EPEVER)
Delftechpark 37G, 2628 XJ Delft, the Netherlands
Chamber of Commerce (KvK): 97511145 · VAT: NL868084578B01
Email: ecommerce@epever.eu · Phone: [LAWYER TO CONFIRM: customer service phone number]
This policy covers both websites operated by EPEVER Technologies Europe B.V.: the corporate website pilot.epever.eu and the webshop shop.epever.eu. It gives the information required by Articles 13 and 14 GDPR.
Data protection officer: not appointed [LAWYER TO CONFIRM: whether a DPO is required]. Privacy contact: ecommerce@epever.eu.
What we do with your data
| Activity | Purpose | Data | Legal basis | Retention | Recipients |
|---|---|---|---|---|---|
| Account and login | Create and secure your account | Name, email, password hash, phone, language, sign-in logs | Contract (Art. 6(1)(b)) | While the account exists; removed when you delete it | Hosting provider |
| Orders, invoices and payments | Sell and invoice goods | Contact and address data, order lines, VAT number, payment status | Contract; legal obligation (Art. 6(1)(c)) | Invoices and accounting records 7 years (Dutch General Tax Act, art. 52 AWR) | Stripe, Microsoft Business Central, accountant |
| Shipping | Deliver your order | Name, address, phone, email | Contract | 2 years after delivery, then in the accounting records only | CheapCargo and the carrier |
| Customer service and support cases | Answer questions, handle defects | Messages, photos, serial numbers, order data | Contract; legitimate interest (quality) | 2 years after closure [LAWYER TO CONFIRM] | EPEVER Partner Hub, Microsoft Dynamics 365 |
| Product registration and warranty | Warranty handling | Serial number, purchase date, product | Contract | Warranty period plus 2 years | EPEVER Partner Hub |
| Quotations | Prepare and follow up quotations | Contact data, products, delivery country, company data | Steps at your request (Art. 6(1)(b)) | 2 years after the quotation, or longer if it becomes an order | Business Central |
| Business customers and company members | Manage company accounts and invited members | Company data, VAT number, members' names and emails, roles | Contract; legitimate interest | While the company account exists | Business Central |
| Marketing emails | Product news | Email, name, language, consent log | Consent (Art. 6(1)(a)); or for existing customers, similar own products with opt-out in every message (art. 11.7 Dutch Telecommunications Act) | Until you unsubscribe | Email middleware |
| Abandoned cart emails | Remind you of a cart | Email, cart content | Consent only | 90 days | Email middleware |
| Reviews | Publish product reviews | Review, rating, the name you choose | Consent | While published; deleted on request | Public on the product page |
| Cookies and analytics | Necessary site functions; optional statistics | See Cookie Policy | Necessary: legitimate interest; others: consent | See Cookie Policy | — |
| Fraud prevention and security | Protect accounts, payments and the site | IP address, hashed identifiers in rate-limit records, security logs | Legitimate interest (Art. 6(1)(f)) | Rate-limit records 24 hours; logs 24 months | Hosting provider, Stripe |
| Legal obligations | Tax, customs, product safety recalls | Invoice and delivery data | Legal obligation | As the law requires | Authorities on request |
| Contact forms and recruitment (pilot.epever.eu) | Answer requests and applications | Name, email, company, message, CV where sent | Steps at your request; consent for applications | 1 year; applications 4 weeks after the procedure, or 1 year with consent | Microsoft 365 |
Processors and other recipients
- Supabase — hosting and database, EU region [LAWYER TO CONFIRM: region], processor.
- Stripe Payments Europe Ltd. — payment processing; for fraud prevention Stripe is an independent controller. Transfers to Stripe, Inc. (USA) under the EU–US Data Privacy Framework.
- CheapCargo and the carriers — shipping; they receive name, address, phone and email.
- Microsoft — Dynamics 365 Business Central (ERP), Dynamics 365 customer service, Microsoft 365 (email, documents); EU Data Boundary [LAWYER TO CONFIRM].
- EPEVER middleware (sys.epever.com) — connects the shop with ERP and sends our emails from ecommerce@epever.eu. Operator and location: [LAWYER TO CONFIRM: who operates sys.epever.com and where].
- Google — the Merchant Center feed contains product data only, no personal data. Web fonts are self-hosted, so no visitor data goes to Google Fonts.
- Lovable — development platform used to build the shop [LAWYER TO CONFIRM: whether Lovable processes production personal data].
- EPEVER parent company in China — [LAWYER TO CONFIRM: whether any personal data is shared; if yes, the transfer mechanism (standard contractual clauses and transfer impact assessment)].
We do not sell personal data.
International transfers
| Recipient | Country | Mechanism |
|---|---|---|
| Supabase | EU [LAWYER TO CONFIRM] | No transfer; sub-processors under SCCs |
| Stripe | USA | EU–US Data Privacy Framework and SCCs |
| Microsoft | EU / USA | EU Data Boundary; DPF and SCCs |
| CheapCargo, carriers | EU | No transfer |
| Middleware operator | [LAWYER TO CONFIRM] | [LAWYER TO CONFIRM] |
| EPEVER China | China | [LAWYER TO CONFIRM] |
Your rights
You have the right of access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interest, and to withdraw consent at any time. You can download your data and delete your account in My Account › Profile, or email ecommerce@epever.eu. We answer within one month. You may complain to the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) or the supervisory authority of your country.
Automated decisions
We do not take decisions based solely on automated processing that have legal or similarly significant effects on you.
Children
We do not sell to minors and do not knowingly collect data from children.
Security
Encrypted connections, hashed passwords, row-level access control so customers only reach their own records, role-based staff access, rate limiting on sign-in and lookups, and audit logs of administrative actions.
Retention summary
| Data | Period |
|---|---|
| Invoices, credit notes, accounting records | 7 years |
| Email outbox | 24 months |
| Audit logs | 24 months |
| Guest carts | 90 days |
| Deleted accounts | Anonymised immediately; orders kept anonymised for the tax period |
Changes and contact
We publish every new version here with its version number and date. Contact: ecommerce@epever.eu.