Privacy policy

Last updated: 18 October 2026

At Spellen-Direct.nl we handle your data with care. We ask for no more than necessary, sell nothing on and use no advertising or tracking cookies. Below you can read exactly what we store, why, and what your rights are.

Who we are

Spellen-Direct.nl is responsible for processing your personal data via this website (https://spellen-direct.nl), registered with the Dutch Chamber of Commerce under number 42198075. Questions about privacy or your data? Email [email protected].

Which data we use and why

Ordering

When you order, we need your name, address, email address and (if you fill it in) your phone number, plus what you order and whether the payment succeeded. We use this to process and ship your order, send confirmation and shipping emails and handle returns and questions. This is necessary to perform the purchase agreement. If you order a ticket for an event, we also store the names of participants you provide.

Account, loyalty points and want list

An account is not required: you can also order as a guest. With an account we store your login details, addresses and previous orders, so you can see them under My account. With an account you also earn points (1 point per euro spent on products) which you exchange for a discount code, and you can keep a want list of cards you're looking for. As soon as something from your want list comes in, we send you an email about it.

Back-in-stock alert

If you ask for an email when a sold-out product is back in stock, we store your email address and the product. You get one email. 30 days after that we delete your sign-up. If the product doesn't come back, we delete the sign-up after a year. You can also unsubscribe earlier via the link in the email.

Reviews

A few days after your order is completed, we send you one email asking for a review of our shop. We do this because you are our customer (legitimate interest). You can unsubscribe via the link in that email; then you'll never get a review request from us again. To remember that, we store an irreversible code (hash) of your email address, not the address itself.

If you write a review, we store your stars, your text, the name you give and which order the review belongs to, so we can show it comes from a real customer. On the site we only show your stars, text, name and the date; not your email address or your order.

Contact

If you email us, we only use your email address and what you write to answer your question.

Comments on the blog

If you leave a comment under a blog post, we store your name, email address, comment, IP address and browser details (to detect spam). Your name and comment are public, your email address is not. To show a profile picture we send an irreversible code (hash) of your email address to Gravatar (Automattic). If you don't have a profile there, you see a default image. You can read Gravatar's privacy policy at https://automattic.com/privacy/.

Statistics and cookies

To see how the shop is used (for example which pages are popular and how many visitors put something in their basket), we use Umami. Umami places no cookies, stores no IP addresses and creates no visitor profiles: we only see aggregated numbers. If “Do Not Track” is enabled in your browser, we don't measure your visit at all.

We only use cookies that are needed to make the shop work:

• Basket: WooCommerce remembers what's in your basket (cookies starting with woocommerce_ and wp_woocommerce_session_). These expire after at most two days.
• Logging in: when you log in, cookies remember that you're logged in. They disappear when you log out, or after two days (two weeks if you tick “Remember me”).
• Payment: at checkout PayPal may place cookies that are needed for a secure payment and to prevent fraud.
• Comments: if you post a comment on the blog, you can indicate that your name and email address may be remembered for a year.

Some parts (such as the lore counter) only store your settings in your own browser. That data never reaches us. Because we don't use tracking or advertising cookies, we don't ask for your consent via a cookie banner.

Who we share your data with

We never sell your data. We only share it with parties needed to handle your order or make the shop work, and only what they need for that:

• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) processes your payment, also when you pay with iDEAL, Apple Pay, Google Pay or a credit card. If you pay by bank transfer, we see your name and account number on our bank statement.
• PostNL receives your name and address (and for parcels sometimes your email address for track-and-trace) to deliver your order.
• mailbox.org (Heinlein Support GmbH, Germany) sends and receives our email, such as your order confirmation.
• Our accountant and the Dutch Tax Administration see order data insofar as this is necessary for the accounts and tax returns.

Agreements on security and confidentiality have been made with parties that process your data for us. All these parties are located in the European Union.

How long we keep your data

• Orders and invoices: 7 years, because the law (tax retention obligation) requires it.
• Account: until you have your account deleted. We still keep orders after that until the 7 years are up.
• Back-in-stock alerts: until 30 days after the email, or a year if the product doesn't come back.
• Reviews: as long as they're on the site, or until you ask us to change or remove them.
• Unsubscribing from review requests: we keep the code of your email address for as long as we send review requests, so you really don't get anything anymore.
• Emails to us: for as long as necessary to handle your question.

Security

The website uses a secure connection (https). Only we can access the data in the shop, with a personal login. Payment details such as your credit card number never reach us: they go directly to PayPal.

Your rights

You may always ask what data we hold about you (access) and have it corrected, deleted or transferred. You can also object to processing, for example to the review email. To do so, email [email protected]. We respond within a month. Data we are legally required to keep, such as orders for tax purposes, can only be deleted once that period has expired.

If you're not happy with how we handle your data, please let us know first and we'll look for a solution together. You also always have the right to file a complaint with the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority).

We don't make decisions about you based solely on automated processing and don't create profiles for advertising.

Changes

If we change anything in how we handle data, we update this page. At the top you can see when that last happened.