Privacy Statement

Yellow Cookie Amsterdam bakes fresh cookies for same-day pickup and delivery. This statement explains what we do with your personal data and how we look after it.

You can reach us any time at hello@yellowcookie.nl. We are registered with the Dutch Chamber of Commerce (KvK) under number 99089238. You can collect orders at Makassarplein 1, 1095 RP Amsterdam.

When you place an order, we collect your first name, last name, email address, and phone number. For delivery, we also collect your street, postal code, and city, together with your chosen pickup or 3-hour delivery window. We use this to bake your order, keep you updated, and get it to you.

Your payment is handled securely by Mollie. We receive confirmation that a payment succeeded, and we keep your full card details out of our hands entirely.

When you send a gift, we collect the recipient's name and address so we can deliver it, along with an optional gift message and an optional delivery wish. We also collect your own address once, as the buyer.

Each gift box earns you a store credit as a thank-you. To keep this fair at one reward per customer, we store a normalized version of the email, name, and address linked to each gift code. If the same email or the same address comes back, the extra reward is held back, while a matching name on its own is only a soft flag we review. Your order always goes through as normal; only the second reward is set aside.

We rely on the following legal grounds under the GDPR:

• Contract: to take and fulfil your orders, deliver gifts, and send your order and gift emails.
• Consent: to run Google Analytics, which you choose in our cookie banner.
• Legitimate interest: to keep the gift reward fair, prevent misuse, and keep the site secure.
• Legal obligation: to keep order and invoice records for tax purposes.

We work with a small set of trusted providers, each of which handles data only for the purpose we describe:

• Mollie handles payments at checkout.
• Supabase hosts our database and order backend.
• Resend sends your order and gift emails.
• Framer hosts the website and provides cookieless visitor statistics.
• Google provides Analytics, which runs only after you consent.
• jsDelivr is a content delivery network that serves our fonts; loading a page sends your IP address to this network so the font can appear.

Some providers may process data outside the European Union. Where they do, we rely on appropriate safeguards such as EU Standard Contractual Clauses or a recognised adequacy framework.

Your shopping cart is saved in your browser using local storage (yc_cart_v1) so your basket stays put when you refresh the page. This is strictly necessary, so it needs no consent.

Framer's built-in visitor statistics use no cookies and no lasting identifiers, so they also need no consent.

Google Analytics is different: it sets cookies and runs only after you agree in our cookie banner. You can change your choice any time through Cookie Settings. For the full list of cookies and their purpose, see our Cookie Policy.

We keep personal data only for as long as we need it.

• Order and invoice records: 7 years, because Dutch tax law requires us to keep our administration for that period.
• Gift reward records: for as long as the reward programme runs, so we can keep it fair.
• Analytics data: in line with our Google Analytics retention settings.

Once data is no longer needed, we remove it.

You are in control of your data. You can ask us to:

• see the data we hold about you,
• correct anything that is wrong,
• delete your data,
• limit or object to how we use it,
• receive a copy to take elsewhere,
• withdraw your consent at any time.

Email hello@yellowcookie.nl and we will help. If you feel something is not right, you can also contact the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.

We may update this statement as Yellow Cookie grows or as the law changes. The date at the top shows when we last made a change.