Privacy Policy

This privacy policy explains which personal data Stadesks processes when you visit the webshop at www.stadesks.com, place an order, or email us. The policy has been drawn up in accordance with the General Data Protection Regulation (GDPR). The version is dated September 26, 2026.

Who is responsible

The data controller is:

Stadesks
Representative: mas marcos miguel
Setersedwarsweg
4903 RT Oosterhout
The Netherlands
E-mail: [email protected]

For questions about your data, an access request, or a privacy complaint, please use that email address with the subject line “Privacy”. We have not appointed a separate data protection officer. For a webshop of this size, that is not required. The email address above is the point of contact.

What data we process

Data you provide yourself

Identity and contact details: first name, last name, email address, phone number if provided, billing address, and delivery address.
Order: the products, the specifications (color, dimensions), quantity, price, shipping costs, order number, and any messages you include with the order.
Account: if you create an account, the login details and preferences saved there. You can also checkout as a guest. In that case, we only process what is necessary for that order.
Correspondence: the content of emails to [email protected], photos of damage or defects, and our response.
Business details: company name and VAT number when you request an invoice or a quote.

Payment data

Payment is processed via the payment service you choose during the checkout process. That service processes the card number or the details of the payment method. Stadesks does not store the full card number. We do receive the result: whether the payment was successful, the amount, a payment reference, and, where the service provides it, the last digits of a card to link the payment to the order.

Technical data

When visiting the site, the IP address, date and time, browser language, device type, and cookie identifiers may be processed. Which cookies these are is set out in the cookie policy. Strictly necessary cookies maintain the shopping cart and the checkout process. We only place other cookies if you give your consent when such a choice is requested on the site.

Why we do this, and on what grounds

The agreement. We process name, address, email, and order details to deliver the desk, register the payment, send an invoice, and answer your questions about that order. Without this data, we cannot deliver.
A legal obligation. We keep invoices and the data required by VAT and accounting laws because the law mandates it. For the retention of accounting documents, we apply a period of seven years, which is in line with the fiscal retention obligation in the Netherlands and the usual retention period that is also relevant for deliveries to Belgian customers.
Legitimate interest. We use order and usage data to limit fraud, document a disputed payment, secure the site technically, and improve our service in a way that does not impact your privacy more heavily than that interest. You may object to this. We will then stop, unless we have compelling grounds that outweigh your interest, such as an ongoing fraud investigation.
Consent. We only send commercial emails if you agree to this during checkout or via a separate subscription. You can withdraw this consent at any time via the unsubscribe link in that email or via a message to [email protected]. An email about your order, shipping, or a warranty is not advertising and is based on the agreement.

Who we share data with

We do not sell personal data. We pass data on to parties that perform a task for the order:

Shopify. The webshop runs on the Shopify platform. Shopify processes the data necessary for the site, the shopping cart, the order, and the payment to work technically, acting as a processor for these components.
The payment service that you see at checkout. It receives the amount and the data required for the payment and the prevention of abuse.
The carrier that delivers the package in Belgium or the Netherlands. It receives your name, the delivery address, the email address or phone number necessary for delivery notification, and a description of the shipment. Not the content of your medical situation or a complaint unrelated to that.
An email service to send the order confirmation and our response.
An advisor or government body when the law requires it, for example, a tax audit or an order from a competent authority. We limit such transfer to what that obligation requires.

We make agreements with processors regarding security and the prohibition of using the data for their own advertising, insofar as the GDPR requires it.

Data outside the European Economic Area

Shopify is a company that may also use infrastructure outside the European Economic Area. Where personal data leaves the EEA, such transfer is based on an adequacy decision by the European Commission or on standard contractual clauses, supplemented by the measures the processor provides for that flow. You can ask us which guarantee applies to a specific process. We will then refer you to the appropriate documentation from that processor.

How long we keep data

Invoices, payments, and fiscal order data: seven years after the financial year.
Warranty and complaints: up to two years after closing the file, or longer if a legal warranty or an ongoing dispute makes it necessary. The legal warranty for consumers in Belgium runs for two years from delivery. A commercial warranty of up to five years on the product page means that we may need the proof of purchase for at least that long to fulfill that warranty.
Emails without an order, such as a sizing question: up to two years after the last message, unless you request deletion earlier and there is no legal obligation to retain it.
Marketing: until you unsubscribe, and thereafter only the suppression necessary to avoid emailing you again.
Technical logs and strictly necessary cookies: the duration stated in the cookie policy, and no longer than necessary for security and the shopping cart.

Your rights

Within the limits of the GDPR, you have the right to:

access the data we process about you;
rectify incorrect data;
erasure, when retention is no longer necessary and no legal obligation prevents it;
restriction of processing while a dispute is ongoing;
portability of data you provided yourself and which we process automatically based on the agreement or consent;
object to processing based on legitimate interest;
withdraw consent, without affecting the lawfulness of processing before that withdrawal.

Email the request to [email protected]. State which right you are exercising and via which email address you are known to us. We may ask for reasonable verification so that we do not give one customer's data to another. We will respond within a month. If the request is complex, we will extend this by two months and let you know within the first month.

We may refuse or charge a reasonable fee for a request that is manifestly unfounded or excessive. A standard access request from a customer is not.

We do not take decisions based solely on automated processing that have legal consequences for you, such as refusing an order without human review. A payment refused by the payment service is a decision by that service according to its own rules.

Children

The webshop is aimed at adults buying a workspace. We do not knowingly collect data from children under 16. If you notice that a minor without parental consent has created an account or placed an order, please email us. We will delete that data, provided that the law does not mandate the retention of a placed and paid order.

Security

The connection to the webshop is encrypted. We limit access to orders to those who need it for processing. No method provides complete certainty. If we discover a breach involving personal data that poses a risk to you, we will report it to the competent supervisory authority and, when the GDPR requires it, to you.

Complaint to a supervisory authority

You can email us first. We expect to be able to resolve a complaint this way. You also have the right to file a complaint with a supervisory authority.

Because Stadesks is based in the Netherlands, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) is the lead authority: www.autoriteitpersoonsgegevens.nl.

If you live in Belgium, you can also contact the Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, www.gegevensbeschermingsautoriteit.be.

Changes

We will update this policy when processing or legislation makes it necessary. The date at the top of this page is the date of the current version. We will not quietly mention a significant change that affects your existing order only in a footnote: if your order is still ongoing, the version in force at the time of that order remains applicable for its execution, unless a new version is more favorable or the law mandates an adjustment.