Privacy policy

Who is responsible for your data

The data controller is CDCT, registered at Keizerskroon 64, 3353 XR Papendrecht, Netherlands (Chamber of Commerce / KvK 87669234, VAT / BTW NL004466212B92). For any privacy question or request, contact us at support@mac-mini-ssd.com.

What data we collect

We collect only the data we need to run the shop. You give us most of it yourself; the rest is created when you use the site:

• Order data: your name, email address, phone number, delivery and billing address, what you ordered and the payment status. For a business order also the company name and VAT number.
• Account data (if you create an account): name, email address, a securely hashed password, your saved delivery address, and a login history with the time, IP address and browser of each login.
• Messages: what you send us through the contact form, an order-problem report or by email, with your name, email address and, if you give it, your phone number.
• Reviews: your rating, your review text and the name you choose to publish with it.
• M4 Pro notification: your email address and language, if you ask to be told when the M4 Pro version is available.
• Technical data: your IP address and browser details in our server error logs, and the data our anti-abuse check (hCaptcha) collects when you submit a protected form.
• Payment data: handled directly by our payment provider, Mollie. We receive the payment status and method, never your full card details.

Why we process your data and the legal basis

• To process, deliver and support your order. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Your phone number: so we or the carrier can reach you if there is a problem delivering your order. Legal basis: performance of a contract.
• To send transactional emails (order confirmation, shipping and delivery updates, return and refund updates). Legal basis: performance of a contract.
• To run your account, if you create one. Legal basis: performance of a contract.
• To keep our tax and accounting records. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
• To secure the site and prevent abuse and fraud (the anti-abuse check, limits on repeated requests, your login history and our error logs). Legal basis: our legitimate interest in a safe, working shop (Art. 6(1)(f) GDPR).
• To publish your review with the name you chose. Legal basis: your consent (Art. 6(1)(a) GDPR). You can ask us to remove it at any time.
• To send one email when the M4 Pro version is available, if you signed up for it. Legal basis: your consent. It is a single notification, not a newsletter.
• To invite you to review us on Trustpilot after a purchase, if invitations are switched on. Legal basis: our legitimate interest in customer feedback. You can ignore the invitation.
• To send you, once, a thank-you email with a discount code after a purchase, unless you ticked "Don't email me offers" at checkout. Legal basis: our legitimate interest in thanking customers, under the rule for existing customers (Art. 11.7(3) Telecommunicatiewet). You can object at any time by writing to us, and we won't send another.

Do you have to give us your data?

To place an order you must give your name, email address, phone number and delivery address; without them we cannot conclude or deliver the order. Creating an account, writing a review, using the contact form and signing up for the M4 Pro notification are all optional.

Who we share data with

We share data only with the parties we need to run the shop. Most act as our processors, on our instructions:

• Mollie (Netherlands): payment processing.
• Resend (United States): sending our emails.
• hCaptcha, by Intuition Machines (United States): the anti-abuse check on the registration, password reset, contact, guest review and M4 Pro notification forms. It receives your IP address and browser data.
• Cloudflare (United States): the network and security service that every request to our site passes through, including your IP address.
• PostNL (Netherlands): delivering your order. It receives your name and delivery address, and the contact details needed for delivery.
• Trustpilot (Denmark): review invitations, if switched on. After a purchase we send it only your name, email address and order number, so it can invite you. It does not receive your address, phone number or what you ordered.
• Our hosting provider: the server that runs the site and its database.
• YouTube (Google): only when you press play on an embedded video. Until then the video is not loaded; after the click it loads from youtube-nocookie.com.
• The Dutch tax authority, when the law requires us to share records.

Transfers outside the European Economic Area

Resend, hCaptcha, Cloudflare and Google are based in the United States, so data sent to them can be processed there. These transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses. You can ask us for a copy of the safeguards that apply.

How long we keep your data

We keep order and invoice data for as long as required by law (in the Netherlands, tax records must generally be kept for 7 years). Account data, including your login history, is kept until you ask us to delete your account. Contact-form messages are kept only as long as needed to handle your request. Reviews stay published until you ask us to remove them. Your M4 Pro notification address is kept until we have emailed you that the M4 Pro module is available, or until you ask us to delete it sooner. We do not use it for a newsletter. Shipping labels are deleted automatically after about a year.

Server error and warning logs, including your IP address and browser details, are kept for 90 days to help us find and fix faults, then deleted.

Automated decisions

We do not make decisions about you by automated means alone, including profiling, that have legal or similarly significant effects for you.

Your rights

Under the GDPR you have the right to access, correct, or delete your personal data, to restrict or object to processing, and to data portability. Where we rely on your consent, you can withdraw it at any time; this does not affect processing before the withdrawal. You also have the right to lodge a complaint with your local data protection authority (in the Netherlands, the Autoriteit Persoonsgegevens).

To exercise any of these rights, email us at support@mac-mini-ssd.com.