Privacy & Cookie Policy

1. Who we are and how to reach us

iQonya is the controller for the personal data processed through this website and our showroom. That means we decide why and how your data is used, and that you can hold us to everything in this policy.

For anything to do with privacy, and to exercise your rights, email info@iqonya.nl with "Privacy" in the subject line. We are not required to appoint a data protection officer — we do not process on a large scale and we carry out no systematic monitoring — but the address above is the standing contact point for this subject.

2. What this policy covers

This policy applies to:

• the website www.iqonya.nl in every language it is offered in;
• the contact and quotation forms on this website;
• booking, rescheduling and cancelling a showroom appointment;
• contact by email, telephone or WhatsApp;
• carrying out an order: design, bespoke making, delivery, installation, warranty and service.

It does not cover other people's websites that we link to. When you visit our page on Facebook or Instagram, Meta Platforms Ireland Ltd. processes data there under its own terms; for the page statistics Meta shows us, we and Meta are joint controllers. If you contact us over WhatsApp, Meta processes those messages and their metadata under its own privacy policy.

3. What data we process

We collect no more than the purpose requires. In any form, only the fields marked with an asterisk are mandatory; the rest you may leave blank.

4. Why we use data, on what legal basis, and for how long

The GDPR only permits processing where there is a legal basis for it. Below is the basis for each purpose, and how long we keep the data afterwards. Once the period ends we delete or anonymise it.

Where we rely on a legitimate interest, we have weighed that interest against your privacy. You can object to such processing; see section 9.

5. Cookies and similar techniques

A cookie is a small file placed on your device. By "cookies" we also mean similar techniques such as localStorage. Apart from strictly necessary cookies we place nothing before you agree to it: until you choose, Google Analytics is not even fetched and the map stays unloaded.

The categories

• Strictly necessary — needed to make the site work, to protect forms and to remember your choice. No consent is required for these (Art. 11.7a(3) Dutch Telecommunications Act, implementing Art. 5(3) of the ePrivacy Directive).
• Functional — embedded third-party content, such as the map of our showroom and video.
• Analytics — Google Analytics 4, which shows us which pages get read and where visitors get stuck.
• Marketing — measuring and personalising advertising. We do not currently use this category.

What is actually placed

Changing or withdrawing your choice

Withdrawing consent is exactly as easy as giving it. "Cookie settings" sits at the bottom of every page and opens the same window you saw on your first visit. You can also open it right here:

Open cookie settings

After 12 months your choice expires automatically and we ask again. If we change the categories or the purposes materially we ask again sooner — consent for one purpose does not carry over to another. You can also block or delete cookies in your browser; bear in mind that blocking all cookies can make parts of this and other websites unusable.

Global Privacy Control and Do Not Track

If your browser sends a Global Privacy Control signal we read it as an opt-out: the marketing category stays off even if you click "Accept all" by accident. The older Do Not Track signal was never finished as a standard and is honoured inconsistently across the web, so we rely on your choice in the banner and on Global Privacy Control instead.

Fonts

This site's fonts are bundled at build time and served from our own environment. Your browser therefore makes no connection to Google Fonts and no IP address is passed to that service when a page loads.

6. Who we share data with

We do not sell your data and we do not rent it out. We do engage service providers who process on our behalf; each of them is under a data processing agreement that limits them to our instructions.

If we ever sell the business or part of it, customer data may form part of that transfer. We will tell you beforehand, and the acquirer is bound by this policy until it is lawfully changed.

7. Transfers outside the European Economic Area

Our processing takes place within the EEA in principle. At Google, Cloudflare and Vercel, support or storage may partly take place from the United States. For those transfers we rely on:

• the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, to the extent the company concerned is certified under it;
• and, as a fallback, the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), supplemented by technical measures such as encryption in transit and at rest.

In Google Analytics, IP addresses of EU visitors are terminated on European servers and are not stored in the reporting; we have switched off Google Signals and ad personalisation for as long as you leave the marketing category off. A copy of the Standard Contractual Clauses we rely on is available from us at info@iqonya.nl.

8. How we protect your data

• all traffic to and from this website is encrypted over HTTPS/TLS;
• access to form submissions, the calendar and the administration is limited to the staff who need it for their work, with two-factor authentication;
• forms are protected against automated abuse with Cloudflare Turnstile;
• the link that lets you manage an appointment contains a randomly generated token that cannot be guessed and does not end up in search engines;
• every processor is under a data processing agreement;
• we keep nothing longer than the periods in section 4.

If something goes wrong anyway and it is likely to result in a risk to your rights and freedoms, we report it to the Dutch Data Protection Authority within 72 hours of becoming aware, and where the risk is high, to you directly (Arts. 33 and 34 GDPR). If you spot a vulnerability yourself, report it to info@iqonya.nl; we will be grateful, and we will not press charges against anyone who reports a flaw responsibly and does no more than needed to demonstrate it.

9. Your rights

Under the GDPR you have the following rights. Exercising them is free.

• Access (Art. 15) — a copy of the data we hold about you, and an explanation of what we use it for.
• Rectification (Art. 16) — have anything inaccurate or incomplete corrected or completed.
• Erasure (Art. 17) — have deleted what we no longer need. Data covered by the statutory tax retention period can only be deleted once that period ends.
• Restriction (Art. 18) — have processing paused while, for example, accuracy is contested.
• Portability (Art. 20) — receive the data you gave us in a common, machine-readable format, or have it sent on directly.
• Objection (Art. 21) — object to processing based on a legitimate interest. Against direct marketing you may object at any time and without giving reasons.
• Withdrawal of consent (Art. 7(3)) — at any moment, as easily as you gave it. What we did before the withdrawal remains lawful.
• Complaint (Art. 77) — to a supervisory authority.

How to make a request

Email info@iqonya.nl with "Privacy" in the subject, or write to Nijverheidscentrum 28, 2761 JP Zevenhuizen, the Netherlands. We respond within one month. If your request is complex, or you make several, we may extend that by two months and will tell you so within the first month (Art. 12(3) GDPR).

To make sure we do not hand data to the wrong person, we may ask for additional details that identify you. If we ask you to send a copy of an identity document, never send it unredacted: black out the national identification number and the photograph.

Complaining to a supervisory authority

If you disagree with how we handle your data, tell us first — we will put it right. You can also go straight to the Dutch authority, or to the one in your own country of residence if you live elsewhere in the EU or the UK.

10. Children

Our website and products are aimed at adults. We do not knowingly collect data from children under 16 without the consent of a parent or guardian. If we discover that we have, we delete it. If you believe a child has given us data, email info@iqonya.nl.

11. Automated decision-making and profiling

We take no decisions producing legal or similarly significant effects based solely on automated processing within the meaning of Art. 22 GDPR. Every quote and every order is assessed by a person. We build no profiles to predict your behaviour, and use the statistics described in section 5 only in aggregate.

12. Additional notice for residents of the United States

This section applies in addition to the rest of this policy and is intended for residents of states with a comprehensive privacy law: California (CCPA as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island. Where those laws and the GDPR overlap, whichever rule gives you more protection applies.

Categories of personal information over the past twelve months

Selling, sharing and targeted advertising

We do not sell personal information and have not done so in the past twelve months. We do not share personal information for cross-context behavioural advertising or targeted advertising as the CPRA and the laws of Virginia, Colorado, Connecticut, Texas and the other states listed define those terms. We do not knowingly sell or share the personal information of consumers under sixteen. We do not process sensitive personal information for purposes that would trigger a right to limit, and we do not use your data for profiling that produces legal or similarly significant effects.

Your rights as a US state resident

• Know and access — which categories we collect, where from, why, who we disclose them to, and a copy of the specific pieces of information.
• Delete — except for what we are legally required to keep, such as tax records.
• Correct — inaccurate information.
• Portability — receive the information in a portable and, where technically feasible, readily usable format.
• Opt out of sale, sharing and targeted advertising — we do none of the three, but you can record the opt-out anyway with the button below.
• Limit the use of sensitive personal information — we do not collect any.
• Opt out of profiling with significant effects — we do not profile.
• Non-discrimination — we will not deny you anything, charge a different price or provide a lesser quality because you exercised any of these rights. We offer no financial incentives in exchange for data.

Recording your choice

The button below opens the same window as the cookie banner. Using it records that we may not sell or share data and that no analytics or advertising cookies may be placed.

Do Not Sell or Share My Personal Information

If your browser sends a Global Privacy Control signal, we honour it automatically as an opt-out for that browser profile, without you having to do anything. No account is needed for that to work.

Making a request, verification and authorised agents

Submit your request to info@iqonya.nl with "US Privacy Request" in the subject line, or by telephone on +31 10 322 04 22. We confirm receipt within ten business days and respond substantively within forty-five days. If we need more time we will tell you within that period and take at most forty-five days more.

We verify your request by matching the details you give against what we already hold; for a request for copies of specific pieces of information we ask for a higher degree of certainty. You may use an authorised agent: the agent must produce signed permission, and we may ask you to confirm that permission with us directly.

Appealing our decision

If we refuse your request we explain why, and you may appeal within forty-five days by replying to our email with "Appeal" in the subject line. We decide on the appeal within forty-five days and set out our reasons in writing. If you still disagree, you may contact your state Attorney General; California residents may also contact the California Privacy Protection Agency.

California Shine the Light, and Nevada

Under Cal. Civ. Code § 1798.83 ("Shine the Light"), California residents may ask which personal information we disclosed to third parties in the past year for those parties' own direct marketing. Our answer is already fixed: we disclose none for that purpose. Nevada residents may submit an opt-out from the sale of covered information under NRS 603A; again, we do not sell, but we will record your opt-out on request.

13. Changes to this policy

We update this policy when our services, our service providers or the law give reason to. The date and version number of the text in force are at the top of this page. For a material change — a new purpose, a new category of recipient, a different legal basis — we ask for your consent again through the cookie banner and, where we can reach you, by email. Earlier versions are available from us on request.

14. Contact

Questions about this policy, about what we know about you, or about something you are not happy with? Write to us. A real person reads it and answers.