Privacy policy

Last updated: 30 July 2026.

Who is responsible for your data

Pawkit (pawkit.eu) is a trading name of Botlease, the data controller for personal data processed through this shop. Contact: via our contact form. KVK 95943420.

What we collect and why

  • Order data: your name, email, shipping address and order contents. We need this to process and deliver your order and to provide support. Legal basis: performance of a contract.
  • Payment data: handled by our payment provider on its own secure pages. We receive a payment confirmation and reference, not your full card number.
  • Communications: messages you send us, kept so we can help you.
  • Technical data: every website sees the IP address and browser of the device that requests a page or an image. It is used to deliver the site and to keep it working; we do not build profiles from it.

Who we share it with

Only the parties we actually need, and only the data they need to do their job. The list below is complete: no other outside party receives anything from us or is contacted by this site. Meta aside (see below), the parties we hand data to act as our processors: they may use your data to deliver their service to us, not for their own purposes. Two entries are different in kind — the image servers of CJ and Pexels get nothing from us, but your own browser has to contact them to fetch the photos on a page, so they see your IP address. We never sell your data.

  • Stripe (payments, Ireland/US): your payment details, email and order amount. You enter your card or iDEAL details on Stripe's own page, not ours.
  • CJ Dropshipping (fulfilment, China/Hong Kong): your name, delivery address and the items you ordered, so your parcel can be packed and shipped. Two things worth knowing. This is a transfer outside the EU. And the product photos on this site are loaded straight from CJ's image servers (cf.cjdropshipping.com and oss-cf.cjdropshipping.com), so CJ's CDN sees your IP address and browser as soon as a page with product photos loads, before any cookie question: images are part of the page itself, not a tracking choice. CJ sets no cookie on our behalf.
  • Pexels (photo CDN): nearly every page loads its photography straight from images.pexels.com, and the pages tell your browser to open that connection early (preconnect), so Pexels sees your IP address and browser as soon as a page loads — again before any cookie question, for the same reason: images are part of the page, not a tracking choice. We send Pexels nothing about you and it sets no cookie on our behalf.
  • Resend (email delivery, US): your email address and the content of your order confirmation.
  • Vercel (hosting and visitor statistics, US): this site runs on Vercel's servers, so Vercel processes the requests you make, including your IP address, your browser and the page you asked for.
  • Meta (advertising, US): only if we are running ads and only after you press Accept in the cookie bar. Meta then also uses that data for its own purposes as an independent controller, so this is not a plain processor relationship. See the cookie section below.

Transfers to the US and China rest on the European Commission's standard contractual clauses (and, for Stripe and Meta in the US, the EU–US Data Privacy Framework). You can ask us for the details at any time.

How long we keep it

We keep order and invoice data for as long as required by law (Dutch tax law generally requires seven years for financial records) and delete other data when it is no longer needed.

Your rights

Under the GDPR you can request access to, correction of, or deletion of your personal data, object to processing, or ask for a copy of your data. Send your request via our contact form. You also have the right to complain to your national data-protection authority.

Cookies and similar technologies

We keep this short because there is not much to tell. Three categories exist on this site:

  • Functional (always on): local storage in your own browser, not cookies. It holds your shopping cart (pawkit.cart.v1), your light/dark theme choice (pawkit.theme), your cookie choice if you were asked one (pawkit.consent.v1 — the choice itself, the moment you made it and the version of the question you answered) and the order you just placed (pawkit.pendingOrder, or pawkit.lastOrder for a demonstration order) so the confirmation page can show it. That last one holds your email address, what you ordered and the total, plus your name in the case of a demonstration order. Opening the confirmation page for that order deletes the record from your browser straight away. If you never open it — you close the tab during payment, for instance — the record simply stays in your own browser until you clear the site data for pawkit.eu; it is never sent anywhere by us. If your browser blocks local storage, your cookie choice and that order record fall back to session storage and then to memory, so they last only for the current session. None of this is readable by a third party, and it is strictly necessary to run the shop, so no consent is required. Note that your cart does leave your browser at one moment: when you press the pay button, the items and your address are sent to our own API so the amount can be recalculated server-side and a payment can be started.
  • Visitor statistics (always on): we use Vercel Web Analytics to count page views and see which pages are used. It is cookieless and sets no identifier on your device. To tell two visitors apart within a day, Vercel derives a short technical hash from the incoming request (things like IP address and browser). It is not stored as a profile, it is not shared with advertisers and it cannot follow you to other websites.
  • Advertising (off unless we run ads, and then only with your consent): when we advertise, the cookie bar asks you first. Press Accept and we load the Meta (Facebook/Instagram) pixel so we can measure our ads and reach people with similar interests. It sets cookies and sends Meta the pages and products you view, what you add to your cart, when you start a checkout and what you order — including the amounts — and Meta uses that for its own purposes too (a transfer to the US). Press Decline, or choose nothing, and no advertising code is loaded and nothing is sent to Meta. Legal basis: your consent (GDPR art. 6(1)(a)). The pixel is configured since 30 July 2026, so the bar appears on your first visit and nothing is loaded until you answer it.

Changed your mind? Whenever the cookie bar is in use, a Cookie settings link sits at the bottom of every page: it wipes the choice we stored and asks again, so withdrawing is exactly as easy as accepting. Questions about this, or want us to delete data Meta holds about your visit? Mail hallo@botlease.nl.

Contact

Questions about your privacy? Use the form on our contact page; we reply within one business day. See also our Terms & conditions.