Butter & Bread Data ("we," "us," "our," or the "Company") is committed to protecting the privacy and safeguarding the personal data of visitors to our website and users of our dashboard products (collectively, the "Services"). This Privacy Policy has been prepared to explain, in a manner intended to be clear and comprehensive, the nature, scope, and purposes of the personal data processing activities we carry out, the legal bases upon which such processing relies, the rights available to individuals whose data we process ("data subjects," "you," or "your"), and the measures we undertake to protect that data.
This Privacy Policy has been drafted with reference to the requirements of Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"), and applicable implementing and supplementary legislation of the Netherlands (Uitvoeringswet AVG). It is intended to apply to all personal data processed by the Company in connection with the operation of the Services, irrespective of the means by which such data is collected or the format in which it is stored.
We encourage you to read this Privacy Policy in full before using the Services. Your continued use of the Services following any revision to this Privacy Policy constitutes your acknowledgment of the revised terms; where a revision materially affects your rights, we will provide additional notice as described in Section 13.
For the purposes of the GDPR, the data controller responsible for determining the purposes and means of the processing of personal data described in this Privacy Policy is:
| Trading name | Butter & Bread Data |
|---|---|
| Proprietor | Jurjen van Genugten |
| Jurisdiction | The Netherlands |
| Chamber of Commerce (KVK) number | 94125988 |
| Registered business address | Langvennen-Zuid 119, 5063CA Oisterwijk |
| General correspondence | info@butterbreaddata.com |
We have not appointed a formal Data Protection Officer, as this is not presently required of an undertaking of our size and processing activities under Article 37 GDPR. All privacy-related correspondence should nonetheless be directed to the contact address above, and will be handled by the data controller personally.
In the ordinary course of operating the Services, we may process personal data falling within the following general categories. Not every category will be applicable to every individual; the data actually processed in respect of any given individual will depend on the nature of their interaction with the Services.
We do not solicit, and ask that you refrain from voluntarily submitting to us, any special category of personal data within the meaning of Article 9 GDPR (such as data concerning health, racial or ethnic origin, political opinions, religious beliefs, or trade union membership), as such data is not required for, and falls outside the scope of, the purposes described in this Privacy Policy.
Consistent with the requirements of Article 6(1) GDPR, each processing activity undertaken by the Company is undertaken in reliance upon one or more of the following legal bases, as applicable to the particular processing activity in question:
Where we rely upon legitimate interests as the legal basis for a given processing activity, we have conducted an internal assessment to confirm that such interests are not overridden by the interests, rights, or freedoms of the relevant data subjects, and we are able to provide further particulars of that assessment upon request.
Personal data collected in connection with the Services is used for the following purposes:
We do not use personal data for any purpose incompatible with those enumerated above without first providing notice and, where required by applicable law, obtaining consent.
The Services make use of browser-based storage mechanisms — including cookies, local storage, and session storage — for the following categories of purpose:
We do not deploy third-party advertising or behavioural-tracking cookies of any kind, and we do not permit third-party advertising networks, data brokers, or comparable entities to place tracking technology of any description upon the Services.
We do not sell, rent, or otherwise trade personal data to third parties for their own independent commercial purposes. Personal data may, however, be disclosed in the following limited circumstances:
By operation of Chapter III of the GDPR, and subject in each instance to the conditions, exceptions, and limitations prescribed by that Regulation, you may be entitled to exercise the following rights in respect of personal data we hold concerning you:
| Right | Summary |
|---|---|
| Right of access (Art. 15) | To obtain confirmation of, and access to, personal data we process concerning you |
| Right to rectification (Art. 16) | To obtain correction of inaccurate or incomplete personal data |
| Right to erasure (Art. 17) | To obtain deletion of personal data, subject to applicable retention obligations |
| Right to restriction of processing (Art. 18) | To obtain limitation of processing in specified circumstances |
| Right to data portability (Art. 20) | To receive personal data in a structured, commonly used, machine-readable format |
| Right to object (Art. 21) | To object to processing conducted on the basis of legitimate interests, including direct marketing |
| Right to withdraw consent (Art. 7(3)) | To withdraw consent at any time, without affecting the lawfulness of prior processing |
| Right to lodge a complaint (Art. 77) | To lodge a complaint with a supervisory authority |
Requests to exercise any of the foregoing rights should be directed to info@butterbreaddata.com. We will endeavour to respond to any such request within one calendar month of receipt, as prescribed by Article 12(3) GDPR, and will notify you if an extension of that period is reasonably required in light of the complexity or number of requests received.
Should you consider that our processing of your personal data infringes applicable data protection law, you are entitled, without prejudice to any other administrative or judicial remedy, to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (www.autoriteitpersoonsgegevens.nl), or with the supervisory authority of the EU member state of your habitual residence, place of work, or place of the alleged infringement.
The general provisions set out above are supplemented, in this Section 9, by a specific and factually accurate account of the data-collection mechanisms actually operative on the Services, provided so that a reader may understand, in concrete terms, how the general principles described above translate into practice.
Upon first visiting the marketing website, a visitor is presented with a banner inviting them to indicate whether they consent to being recognised, on subsequent visits, as a returning visitor.
Independent of the foregoing election, and irrespective of whether consent has been given, the ordinary operation of the marketing website generates records of the pages viewed, labelled interface interactions (for example, activation of a form-submission control), and the approximate duration of each page visit. The Company confirms, as a specific and material representation, that this category of marketing-website usage data is not associated with, and does not incorporate, the visitor's Internet Protocol (IP) address; the data-collection pathway applicable to the marketing website has been specifically configured to omit IP address capture in its entirety.
Where an individual accesses the Services in the capacity of a customer utilising one of the Company's dashboard products, a materially different data-collection pathway is operative, and — in the interest of the completeness and accuracy which this Privacy Policy is intended to embody — the Company discloses the following expressly: usage events generated within dashboard products do incorporate the user's IP address as captured by the underlying transmission protocol. That IP address is stored, in the ordinary course, in two forms: the address itself, and a value derived from it by a one-way cryptographic hashing transformation. Both forms are stored in association with the corresponding usage event (comprising, for example, the page accessed, the interface control activated, and the duration of the session). The Company does not, at present, delete or redact the stored IP address separately from the usage event of which it forms part.
The purpose for which this data is processed is limited to the differentiation and enumeration of distinct visits for usage-analytics purposes, and to the detection of anomalous or abusive traffic patterns; it is not processed for the purpose of geolocation or identification of the individual concerned, notwithstanding that the address is technically capable of supporting such identification. A browser-storage visitor identifier, comparable in nature to that described in Section 9.1, is additionally set in connection with dashboard usage; unlike the marketing-website identifier, this is set as a matter of technical necessity incident to authenticated dashboard functionality, and is not separately subject to the consent mechanism described in Section 9.1.
The Company has elected to draw this distinction explicitly, notwithstanding that a single, undifferentiated statement might have been administratively more convenient, because the marketing website and the dashboard products are, in fact, subject to materially different data-handling practices, and the Company considers that a data subject is better served by an accurate account of that difference than by a generalised statement that does not hold true across the whole of the Services.
The Company has implemented technical and organisational measures reasonably designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage, having regard to the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity to the rights and freedoms of natural persons. Such measures include, without limitation, access controls restricting data access to authorised personnel, cryptographic hashing of sensitive identifiers as described in Section 9.2, and encrypted transmission of data via HTTPS.
Notwithstanding the foregoing, no method of electronic transmission or storage can be guaranteed to be entirely secure, and the Company is accordingly unable to warrant or guarantee the absolute security of personal data transmitted to or stored by it.
The infrastructure supporting the Services is, as of the date of this Privacy Policy, hosted exclusively within the European Union / European Economic Area. In the event that personal data is, in future, transferred to a jurisdiction outside the EU/EEA, the Company will ensure that such transfer is subject to appropriate safeguards recognised under Chapter V of the GDPR, such as the European Commission's Standard Contractual Clauses, or is made to a jurisdiction benefiting from an applicable adequacy decision.
The Services are not directed to, and are not intended for use by, individuals under the age of sixteen (16) years, and the Company does not knowingly collect personal data from such individuals. Should the Company become aware that it has inadvertently collected personal data from an individual under this age, it will take reasonable steps to delete such data promptly.
The Company reserves the right to amend this Privacy Policy from time to time, in order to reflect changes to its data-processing practices, to legal or regulatory requirements, or otherwise. The date of the most recent revision is indicated at the head of this document. Where an amendment is material in nature, the Company will provide additional prominent notice, by means reasonably calculated to bring the amendment to the attention of affected individuals, in advance of such amendment taking effect.
Inquiries, requests, or complaints concerning this Privacy Policy, or concerning the processing of personal data by the Company, should be directed to: info@butterbreaddata.com.