Privacy policy
Customers applicants contacts and website users
Last updated 15 September 2026. This Notice explains how Het Deco Duo V.O.F., trading as BalloonSupply, processes personal data in connection with balloonsupply.eu and its B2B operations.
Controller and contact
Het Deco Duo V.O.F. trading as BalloonSupply is the controller for the processing described here. Chamber of Commerce 71867201. VAT NL858880593B01. Address: Nieuw-Mathenesserstraat 71, 3113 AE Schiedam, the Netherlands. Privacy requests: info@balloonsupply.eu. Telephone: +31 (0)10 3077 227.
Personal data we process
• identity and business information, including name, company, role, Chamber of Commerce details, VAT number and business type
• contact and account information, including email, telephone, addresses, login and account permissions
• application information, including website or social profile, country and estimated purchasing volume
• order, payment, invoice, discount, return, complaint, workshop and customer-service information
• delivery, fulfilment, tracking, device, security, log and fraud-prevention information
• marketing preferences, newsletter interaction, cookie identifiers, analytics, advertising and attribution data where consent is required
• communications and files supplied through email, chat or support, including information needed to answer a request
Please do not provide special-category personal data, identity documents or confidential third-party information unless we specifically request it and there is a lawful and secure reason.
Purposes and legal bases
| Purpose | Data and legal basis |
|---|---|
| B2B account application and access | Identity, business, contact and verification data. Necessary to take steps before a contract and for our legitimate interests in restricting wholesale access, preventing misuse and administering customer groups. |
| Orders payments delivery and returns | Account, order, payment, delivery and communications data. Necessary to perform the contract and take requested pre-contract steps. |
| Invoices tax and records | Transaction, invoice, VAT and payment data. Necessary to comply with tax, accounting and other legal obligations. |
| Support complaints and legal claims | Order, communication and evidence data. Contract performance and our legitimate interests in service, dispute resolution, security and establishing or defending claims. |
| Workshops and events | Participant, booking, payment and access information. Contract performance, safety and our legitimate interest in organising the service. |
| Service and security improvement | Technical, usage, device, account and fraud signals. Our legitimate interests in secure, reliable and efficient B2B operations, balanced against individual rights. |
| Direct business marketing | Business contact, purchase history and preferences. Consent where legally required; otherwise our legitimate interest in relevant B2B customer communication. Every marketing message offers an opt-out. |
| Analytics personalisation and advertising | Cookie, device, browsing, attribution and advertising data. Consent, except for strictly necessary technology. |
| Reviews and public content | Review, name or public profile data. Consent or the action requested by the person, with a separate basis for moderation and fraud prevention. |
Sources
We receive data from the person concerned, the Buyer's authorised colleagues, Shopify account and checkout activity, payment and delivery providers, business registers, fraud and VAT validation services, cookies and marketing platforms, and connected systems used to fulfil or administer the relationship.
Service providers and recipients
We disclose only the data reasonably required for the stated purpose. Depending on the transaction and consent choices, recipients include:
• Shopify for the web shop, account, checkout, hosting and customer privacy functions
• SparkLayer for B2B account, catalogue and ordering functions, and SP Hide Price or Shopplaza for access and price visibility
• Goedgepickt and the configured DHL integration or other carriers for warehouse, fulfilment, shipping and tracking
• Shopify Payments and selected payment providers such as PayPal and Klarna for payment and fraud checks
• Exact for accounting and financial administration
• Microsoft Outlook and OneDrive for business email, files and internal collaboration
• CCV Shop where a business process, customer record or product and order administration is legitimately shared within Het Deco Duo V.O.F.
• Google Analytics and Google Ads, Meta Pixel, and related measurement or advertising services only after required consent
• Klaviyo, Mailchimp and Shopify Email for newsletter and lifecycle communication according to the configured campaign and consent status
• customer chat and review applications shown in the applicable interface or cookie settings
• OpenAI ChatGPT where authorised staff use it to assist with business content, analysis or support; staff must minimise personal data and must not enter sensitive data unless specifically authorised and protected
• professional advisers, insurers, IT and security providers, regulators, tax authorities, courts and law-enforcement bodies where required or reasonably necessary
Some recipients, such as payment providers, may act as independent controllers for their own legal, fraud and payment obligations. Their own privacy notices then also apply.
International transfers
Some providers or their subprocessors process data outside the European Economic Area. Where no adequacy decision applies, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where required, supplementary measures. Provider-specific information is available in their privacy terms or on request.
Retention
| Record | Normal retention |
|---|---|
| Invoices VAT and accounting records | At least 7 years after the relevant financial year, or longer where a legal obligation applies. |
| Accepted orders delivery and payment records | Normally 7 years where part of the financial administration; operational copies are deleted or minimised earlier where possible. |
| Active B2B account | For the customer relationship. Inactive accounts are reviewed and normally deleted or anonymised after 2 years of inactivity, except data required for records, security or claims. |
| Rejected or incomplete applications | Normally up to 12 months after the decision or last activity, unless needed to prevent misuse or handle a dispute. |
| Support complaints returns and claims | Normally 2 years after closure; up to 5 years or the applicable limitation period where needed for a legal claim. |
| Workshop participant administration | Normally 2 years after the event, with invoice records retained for the statutory period. |
| Marketing contacts | Until opt-out or withdrawal, and normally removed after 24 months without meaningful engagement unless another lawful basis applies. |
| Consent and suppression records | For as long as needed to respect the preference and normally up to 5 years as evidence of compliance. |
| Security and technical logs | Normally 3 to 12 months, longer only for an incident, fraud investigation or legal duty. |
We may retain data longer where a law, audit, dispute, fraud concern, recall or authority request requires it. We then restrict use to that purpose.
Cookies direct marketing and automated decisions
Strictly necessary cookies operate without consent where permitted. Personalisation, analytics and marketing technology is activated only according to the consent settings described in the Cookie Policy. Consent can be withdrawn at any time without affecting earlier lawful processing.
Business marketing recipients can unsubscribe through the message or by emailing us. We do not make decisions producing legal or similarly significant effects based solely on automated processing. Account checks and unusual-order screening may use automated signals, but a person can review a consequential decision on request.
Your rights
Subject to the GDPR and applicable exceptions, individuals may request access, correction, deletion, restriction, portability or objection, and may withdraw consent. An objection to direct marketing is honoured without balancing interests.
Send a request to info@balloonsupply.eu. We may request proportionate information to verify identity and authority. We normally respond within one month; the GDPR permits an extension for complex or numerous requests, with notice within the first month.
Security and incidents
We use access controls, account permissions, supplier agreements, updates, backups and organisational measures proportionate to the processing. No system is completely secure. We assess suspected personal-data breaches and notify the competent authority and affected persons where the GDPR requires.
Complaints and changes
Questions should first be sent to info@balloonsupply.eu. A person may also complain to the Dutch Data Protection Authority, Autoriteit Personsgegevens, or another competent EEA supervisory authority.
We may update this Notice when systems, purposes or law change. The current version and date will be published on balloonsupply.eu. Material changes will be communicated where required.