Privacy statement

Last updated: 25 September 2026

Who is responsible

HS Services (KvK 27314126) is the controller for the personal data processed through mrspennington.nl. Contact: hello@mrspennington.nl.

What we process, why, and on what basis

• Email address and order details (product, amount, dates, payment reference, your agreement to immediate delivery and to our terms), to deliver your download, send your order confirmation and answer questions. Basis: performing our contract with you (GDPR art. 6(1)(b)).
• Bookkeeping records of paid orders. Basis: our legal obligation to keep accounts (art. 6(1)(c)).
• Technical data: server logs with your IP address, browser type, date and the page requested, and a hashed version of your IP address to limit abuse of the checkout. Basis: our legitimate interest in keeping the site secure (art. 6(1)(f)).
• Two functional cookies, set only when you check out: one that protects the order form and one that lets your own browser see your thank-you page. No advertising cookies. Fonts are served from our own server, not from Google.
• Google Analytics (Google Ireland Ltd.), to see how many people visit and how they find us. It sets analytics cookies (such as _ga) and collects your shortened IP address, device and browser type, the pages you view (without any order or download codes) and where you came from. Google may process this data in the United States under the EU-US Data Privacy Framework. We do not use it for advertising and do not link it to your order. Basis: our legitimate interest in understanding how the site is used (art. 6(1)(f)). You can block these cookies in your browser or with Google's opt-out add-on.

Who else receives data

Mollie B.V. handles payments. For this Mollie processes your payment details (such as your name and IBAN or card details), partly as an independent controller under its own privacy statement. We never see full card details. Our hosting provider stores the website, the order database and our mail server on our behalf. Google receives the Google Analytics data described above and may process it in the United States. We do not sell data.

How long we keep it

• Paid orders: 7 years after the year of purchase, because Dutch tax law requires it, then deleted automatically.
• Unpaid, cancelled or expired orders: deleted automatically after 30 days.
• Download links stop working after 7 days.
• Google Analytics data: kept by Google for the retention period set in our account (at most 14 months).
• Hashed IP addresses used to limit checkout abuse: deleted automatically after 24 hours.
• Server logs: kept for a limited period (normally no longer than 3 months).
• Emails you send us: as long as needed to help you, at most 2 years.

Your rights

You can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. Email hello@mrspennington.nl or reply to any email from us. You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Under 16?

Please ask a parent or guardian to buy for you.