Waxline takes your privacy seriously. This policy explains what personal data we collect when you use Waxline.eu, why we collect it, how long we keep it, and which rights you have under the General Data Protection Regulation (GDPR / AVG). It applies to everyone using our website, mobile views, transactional emails and customer service.
1. Who is the controller
The controller of your personal data is Waxline, a brand operating from the Netherlands. For privacy questions or to exercise your rights, email hello@waxline.eu with “Privacy” in the subject line. We respond within 30 days.
2. What data we process
We collect and process the following categories of personal data:
- Account data — email, name, optional handle, optional avatar URL, password hash if you set one (we prefer magic links, so most accounts have none).
- Order data — shipping address (street, postcode, city, country), phone number, items purchased, order total, payment method type, payment status.
- Payment data — handled by our payment provider Mollie. We never see or store your full card or bank details. We store only the Mollie payment ID and status that links the order to the transaction.
- Communication data — emails you send to hello@waxline.eu and messages you exchange with sellers via the platform.
- Device & usage data — anonymised IP address, browser, device type, search queries, page views, the timestamps of your sign-in events.
- Collection data — records you save in your personal vinyl vault and any tags / notes you add to them. Visible to others only if you mark items public or share a collection link.
3. Why we process it
Each piece of data has a documented legal basis under article 6 GDPR:
- Performance of contract — processing your order, organising shipping, handling payments, processing returns, communicating about the order.
- Legal obligation — retaining invoices and tax records for the seven-year period required by Dutch fiscal law.
- Legitimate interest — fraud prevention, audit logging of admin actions, anonymous usage analytics, transactional emails about your orders, security monitoring of sign-in attempts.
- Consent — marketing newsletters and any non-essential cookies, both opt-in. You can withdraw consent at any time.
4. Who we share it with
Waxline never sells your personal data. We share data only with processors who help us run the marketplace, all bound by data processing agreements:
- Mollie B.V. — payment processing.
- Sendcloud B.V. — shipping label generation, tracking.
- Resend — transactional email delivery.
- Vercel Inc. — hosting, serverless compute, image storage.
- Neon Inc. — encrypted Postgres database hosting (eu-central-1, Frankfurt).
- Anthropic, PBC — only when admins use the editorial generator. No buyer or seller personal data is sent to Anthropic.
- The seller of your order — receives the shipping address and order details to fulfil the contract. We do not share email or phone unless the seller needs them to ship the order.
All processors are based in the EU/EEA or rely on EU Standard Contractual Clauses for any data transfer.
5. How long we keep it
- Account data — for as long as your account is active. Deleted within 30 days of your deletion request, except where retention is legally required.
- Order & invoice data — seven years (Dutch fiscal retention obligation).
- Security event log — 12 months, then automatically purged.
- Customer service emails — 24 months.
6. Cookies
Waxline uses only essential cookies needed to keep you signed in and to remember your preferences. We don't use advertising trackers or third-party analytics that profile you across sites. If we ever add anything beyond essential cookies, we'll ask for consent first via a banner.
7. Your rights
Under the GDPR you have the right to:
- access — receive a copy of all data we hold about you;
- rectification — have inaccurate data corrected;
- erasure — have your data deleted (within legal limits);
- restriction — pause processing while a complaint is being reviewed;
- portability — receive your data in a structured, machine-readable format;
- object — object to processing based on legitimate interest;
- withdraw consent — for any processing that requires consent;
- lodge a complaint — with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.
Email hello@waxline.eu to exercise any of these rights. We may ask you to confirm your identity to prevent unauthorised access.
8. Security
Personal data is encrypted in transit (TLS 1.3) and at rest. Database access is restricted to a minimum number of admin keys. All admin actions are logged in an append-only security audit log. We follow the principle of least privilege internally.
9. Children
Waxline is not directed at children under 16. If we learn that we hold personal data from a child without parental consent, we delete it.
10. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top reflects the most recent version. For substantial changes we notify users by email at least 30 days before the new version takes effect.
11. Contact
Customer service handles all privacy questions: hello@waxline.eu. For other ways to reach us, see our contact page.