Privacy notice

WebshopXL processes little data, and you should be able to see exactly which. This notice follows the GDPR, Regulation (EU) 2016/679. We do not ask consent for something we then do on another basis. Where we use legitimate interest, that is stated, including your right to object.

Who is responsible

The controller is Erik Waal, trading as WebshopXL, the Netherlands. Privacy requests go to privacy@webshopxl.com. Other mail goes to info@webshopxl.com. There is no data protection officer. At this scale one is not required.

We do not sell data. We do not share it with ad networks. We do not build a profile of your shopping to show you ads.

Visitors

When you click through to a shop, we store on the server: the shop, the offer id, the product title (truncated), the delivery date shown, the cutoff, the origin of the score (measured, stated or estimated), the target URL (truncated) and the time. We do not store a name, an email address or a postcode with that row. The purpose is to check whether the date you saw was met. Legal basis: legitimate interest, article 6(1)(f) GDPR. The interest is a comparison that rests on measurement rather than on a slogan. You have a stake in that too, because a score without measurement is empty.

We weigh that interest against your rights. The set has no directly identifying field. You can object. Email the time and the shop, and we delete the row if we can point to it. If we cannot, we say so.

Your four-digit postcode, the shops you compare, and the last 20 click promises sit in your browser's local storage. The keys are webshopxl.pc4, webshopxl.compare and webshopxl.promises. They are not sent to us as a profile. You use the postcode yourself so same-day and distance can be calculated in your session. Clear them in your browser, or read Cookies.

Hosting logs can keep an IP address and a user agent for a short time to stop abuse. That is the same legitimate interest. We do not use those logs to recognise visitors on the comparison.

Forms that do not go anywhere yet

The shop signup form, the complaint form and the opt-out form keep what you type, in this version, only in the page's memory. No email is sent and we do not write the address to a file. Close the tab and it is gone. If you want us to act, email info@webshopxl.com.

If you email us

If you email us, we process your address, your name if you include it, and the content. Purpose: to reply, to fix a listing, or to carry out an opt-out. Legal basis: legitimate interest in handling your request, or, if it is about an account or a feed, steps toward a contract, article 6(1)(b) GDPR. We keep that correspondence until the request is done and then for at most 24 months, longer only if a dispute is open.

Webshops and administrators

A shop login is an email address and a password hash (scrypt). We do not store the password itself and it is not in the shop profile. Legal basis: contract, article 6(1)(b) GDPR. We keep the account until the shop or we delete it.

The XLadmin account works the same way: email address and hash, in a separate cookie. That account is not meant for visitors.

A feed contains the shop's product data: title, price, stock, link. It should not contain customer data. Do not send a customer list. If we do receive a file with personal data of your customers, we delete it and email you.

How long clicks are kept

The click log on the server keeps the latest 5,000 rows. Older rows fall off when the file is full. We do not keep a row longer than 24 months in any case. The measurement does not need a permanent archive.

Sharing and transfers

The site runs on a server we administer, inside the European Union. We do not use a separate analytics or advertising service that sends data to another continent. A carrier or a shop does not see your data through us, apart from what you do yourself when you open their site.

We disclose data when the law requires it, for example an order from a competent authority. We ask for the legal basis and we do not give more than the order covers.

Security

Passwords are stored as a hash. Session cookies are httpOnly, so a script on the page cannot read them. They are SameSite lax and valid for seven days. The connection to webshopxl.com should run over HTTPS once the certificate is in place. Until then you may hit the site over plain HTTP. Do not type a password if you do not trust the network, and email us if you are unsure.

Your rights

• Access: which data we hold about you.
• Rectification: have a wrong address or a wrong shop detail corrected.
• Erasure: deletion, unless we must keep something by law.
• Restriction: pause the processing for a while.
• Objection: against processing based on legitimate interest, including the click log. We stop, unless we have a compelling ground that overrides yours. For direct marketing, which we do not do, an objection would always succeed.
• Portability: this right applies when the basis is contract or consent and the processing is automated. For a shop login we can give the email address and the shop link in a readable file. The click log usually falls outside this right, because the basis is legitimate interest.

Email the request to privacy@webshopxl.com. We reply within one month. If the request is large or vague, we may extend that by two months, and we say so within the first month. We may ask for enough detail to see that it is you, and no more.

You can lodge a complaint with the Dutch Data Protection Authority: autoriteitpersoonsgegevens.nl. If you live in another EU country, you may also go to the authority there. This does not block a case in court.

Children

The site is not aimed at children under 16. We do not ask for an age and we do not build a child profile. If an email or an account turns out to belong to a child under 16, we delete it.

Changes

We change this text when the processing changes. The date at the top moves with it. A translation can lag. If there is a difference, the Dutch text wins.