Skip to content
Sjamaan

Privacy policy

Last updated: 28 October 2026

Translated from Dutch. If the versions differ, the Dutch text prevails.

This privacy policy explains which personal data Sjamaan.nl processes, why, who we share it with and how long we keep it. We collect no more than we need, we never sell your data and we do not use it for advertising.

1. Who we are

Sjamaan.nl is the controller of your personal data.

  • Sjamaan.nl, Duivenwaardsedijk 6, 3244 LG Nieuwe-Tonge, the Netherlands
  • Chamber of Commerce (KvK) number: 92325114
  • Email: info@sjamaan.nl
  • Phone: +31 6 27437019

2. What data we process and why

Data from our previous webshop

We have moved to a new webshop. We took over the customer accounts, orders, withdrawals and reviews from the previous webshop. The same purposes and retention periods as below apply to them.

Orders and invoices

When you order, we process your name, delivery and billing address, email address, phone number (if you enter one), what you order, the amounts, the payment method, the payment status and your comment if you write one. If you order as a business, also your company name and VAT number. We use this data to process, ship and invoice your order, and to help you if something goes wrong.

Legal basis: the performance of the purchase contract; for invoices also the legal retention obligation. Retention: paid orders and invoices 7 years, because tax law requires it. An order that was never paid is kept for 12 months.

Yearly discount

If you have an account, the webshop adds up your paid orders of this calendar year at checkout (the items, without shipping, minus refunds). If you reach the amount of the yearly discount, you get that discount automatically. We only use the orders in your account for this, and keep no separate profile of it.

Legal basis: the performance of the purchase contract (the discount is part of our offer). Retention: we keep nothing extra for this: the webshop works it out again for every order.

Your account

If you request a sign-in link for an email address we do not know yet, we create an account for you with that email address. In your account we keep your email address, name, phone number (if you enter one), your addresses, your wishlist and your security settings (such as two-step verification). You sign in with a sign-in link we send you by email; the link works for 15 minutes. You stay signed in until you sign out or have not visited the shop for 30 days.

Legal basis: the contract with you (your account). Retention: as long as your account exists. An account that was never signed in to is deleted after 12 months. If you already had an account in our previous shop, those 12 months count from the move to this shop: if you don't sign in during that time, we delete it. If you ask us to delete your account, we delete your data or make it anonymous. What tax law requires us to keep, such as your invoices, stays in our accounts for 7 years.

Payment

You pay through Pay.nl. For that we give Pay.nl your name, email address, address, your phone number if you entered one, the order number and the amount. You pay on Pay.nl's payment page; we never see your bank or card details. We keep the payment method (for iDEAL also the bank you chose), the payment status and the payment reference. Pay.nl also uses your data for its own purposes, for example to prevent fraud; Pay.nl is responsible for that itself (see Pay.nl's privacy policy).

Legal basis: the performance of the purchase contract. Retention: as for orders.

Shipping

We ship your parcel with DPD. For that DPD receives your name, your address (and your company name, if any), your email address, your phone number if you entered one, the order number and the parcel's weight. DPD uses your email address to keep you informed about the delivery. If you choose a DPD pickup point, the search sends only the postcode and town to DPD. In another country, that country's DPD company delivers.

Legal basis: the performance of the purchase contract. Retention: we delete the shipping label (with your name and address) 12 months after it was made. We keep the tracking number with your order.

Filling in your address

If you enter an address in the Netherlands, we look up the street and town for your postcode and house number in the Dutch address register (Basisregistratie Adressen en Gebouwen) of the Kadaster, through its PDOK service. Our server sends only the postcode and the house number; your name, email address and IP address are not sent. We keep nothing of that lookup. The Kadaster keeps its own logs for its service and is responsible for them itself.

Legal basis: performance of the purchase contract or of our contract with you (your account): a correct address. Retention: nothing of the lookup; the address itself as for orders or in your account.

Checking a VAT number

If you enter a VAT number, we check it in VIES, the European Commission's VAT register. Only the VAT number is sent. We keep the result, the registered company name and the reference of the check with your order, so that we can show that we were right to invoice without VAT.

Legal basis: a legal obligation (the VAT rules). Retention: as for orders.

Accounting

We keep our accounts in the accounting software e-Boekhouden.nl. It holds our invoices and the customer data that belongs to them (name or company name, address, email address, phone number, VAT number and the products ordered). Our accountant has access to it.

Legal basis: a legal obligation (tax law). Retention: 7 years.

Emails we send you

We send you emails about your order, the shipping, your account (such as sign-in links) and your withdrawal. We send these emails through Postmark. Postmark keeps the content and the details of a sent email for 45 days. We do not track whether you open our emails or click their links. We do not send you a newsletter or advertising.

Legal basis: the performance of the purchase contract.

Contact and customer service

  • Contact form: your name, email address, your message and the order number if you enter one. We keep this for 12 months.
  • Messages in your account: your messages to us and our replies. We keep a conversation until 24 months after its last message. Photos and PDFs you attach (for example a photo of a damaged drum) are deleted after 12 months. When you upload a photo, we remove its hidden data, such as the place where it was taken.
  • WhatsApp: if you send us a WhatsApp message, it arrives on our shop's phone. We see your phone number, your WhatsApp name and your messages. We delete the conversation once we no longer need it for your question or order, at the latest after 24 months. WhatsApp is a service of Meta.
  • Email: emails to info@sjamaan.nl arrive in our mailbox at Microsoft 365. A copy of a message sent through the contact form, or of a withdrawal, arrives there too. We keep emails as long as we need them for your question, your order or the warranty. Emails that belong to our accounts are kept for 7 years.

Legal basis: our legitimate interest in answering your questions, or the performance of the contract when your question is about an order.

Reviews

If you write a review, we keep your name, your email address, your rating, the title and your text. On the website we show your rating, the title, your text, the date, whether you bought the product from us, and only your first name and the first letter of your surname (for example 'Anna V.'), never your email address. We check a review before we publish it. For reviews from our previous webshop, we keep the email address only as a hash: a code that lets us find the review if you ask us to remove it, but from which your email address cannot be read.

Legal basis: your consent: you choose to write a review. Retention: as long as the review is on the website. You can delete your review yourself in your account, or ask us to do it; if we delete your account, your reviews go too.

Invitation to review us on Trustpilot

After your order has been shipped, we give Trustpilot your name, your email address, the order number and the language of your order. Trustpilot then sends you, on our behalf, an invitation (and sometimes a reminder) to write a review of our webshop. Trustpilot receives no other data about your order. If you do not want an invitation, you can unsubscribe with the link in Trustpilot's email, or email us at info@sjamaan.nl. If you write a review, Trustpilot itself is responsible for your review and your Trustpilot account (see Trustpilot's privacy policy).

Legal basis: our legitimate interest in hearing what customers think of our webshop. Retention: Trustpilot keeps this data for at most 2 years.

Withdrawal

If you use our withdrawal form, we keep your name, email address, order number, the reason (if you give one) and the moment you withdrew. You immediately receive an acknowledgement by email (through Postmark), and we receive a copy. We use this data to handle your withdrawal and to be able to show that you exercised your statutory right of withdrawal.

Legal basis: a legal obligation (the right of withdrawal). Retention: 24 months; after that we delete the data automatically.

Website statistics

To see how our shop is used, we use Umami. Umami runs on a server in Germany that The Werks manages for us; no data goes to anyone else. Umami sets no cookies and does not store your IP address. It counts which pages are viewed (without the rest of the web address, except the campaign code if you arrive through a link in an ad, a newsletter or social media), which website you came from, your browser, operating system, type of device, screen size, language, and your country, region and town (derived from your IP address, which is not kept afterwards). It also counts what happens in the shop, such as adding something to your cart, the checkout steps, sending a form and the search terms used in the shop. Your name, email address, order number or phone number never go along. To be able to count visits, Umami turns your IP address and browser into a code that changes every month.

Legal basis: our legitimate interest in improving the shop. Retention: at most 25 months; after that we keep only monthly totals.

Error reports

If something goes wrong on the website, we receive an error report in Bugsink, which runs on a server in Germany that The Werks manages for us. An error report contains the web address of the page (without the rest of the web address), your browser and what went wrong. Before the report is sent, we filter out personal data such as email addresses, phone numbers, IP addresses, account numbers and address fields. We use no cookies for this.

Legal basis: our legitimate interest in keeping the shop working. Retention: we keep the 10,000 most recent reports; older reports are deleted automatically.

Protecting the shop

To protect the shop against abuse, our server processes your IP address. We limit how often someone can, for example, sign in or send a form; for that we keep a code derived from your IP address, your email address or your account for at most 24 hours. If you request a sign-in link for a new email address, or if we refuse a sign-in attempt, your email address and IP address go into the server log. That log has a fixed maximum size, older lines are overwritten, and it is cleared at every update of the shop. If someone sends a forged message to our link with Pay.nl or WhatsApp, we keep the sender's IP address for at most 12 months to investigate the misuse. If an IP address carries out an attack, our security system CrowdSec blocks that address for 4 hours. We then share the IP address, the type of attack and the time with CrowdSec (France), so that others can protect themselves against that attack too, and we keep them in our own overview for 30 days. Ordinary visitors are not shared.

Legal basis: our legitimate interest in protecting the shop and your data.

Changes made by our staff

If a member of staff changes your data or deletes your account, we record who did what and when, and for a change the old and the new data. That lets us correct mistakes and detect misuse. We keep this for 24 months. If we delete your account, we erase the data about you in this record.

Legal basis: our legitimate interest in protecting your data.

Backups

Every night a backup is made of our database and of our storage for photos and files. The backups are kept at Scaleway in Amsterdam (the Netherlands) and at Hetzner in Falkenstein (Germany). Each backup is kept for 30 days. A file we delete or replace stays in the backup for another 30 days. So when we delete your data, it is also gone from the backups no later than 30 days later.

Legal basis: our legitimate interest in not losing your data.

3. Who we share your data with

We share your data only with parties we need for our shop. With the parties that process your data on our behalf we have a data processing agreement. We never sell your data.

  • The Werks (the Netherlands): builds and manages our shop, the servers, Umami, Bugsink and the backups. For this, The Werks uses Hetzner and Scaleway.
  • Hetzner (Germany): the servers of our shop, of Umami and of Bugsink, and the storage for photos and files.
  • Scaleway (data centre in Amsterdam, the Netherlands): backups.
  • Pay.nl (the Netherlands): payments.
  • DPD (the Netherlands, and in the destination country that country's DPD company): delivery.
  • Postmark (United States): sending our emails.
  • Microsoft 365: our mailbox info@sjamaan.nl.
  • Meta (WhatsApp, Ireland): WhatsApp messages.
  • Trustpilot (Denmark): invitations to write a review.
  • e-Boekhouden.nl (the Netherlands) and our accountant: the accounts.
  • The European Commission (VIES): checking VAT numbers.
  • The Kadaster (PDOK, the Netherlands): the street and town for a Dutch postcode and house number. Only the postcode and the house number are sent.
  • CrowdSec (France): the IP addresses of attacks, as described above.

We also pass on your data when the law requires it, for example to the Dutch Tax Administration.

4. Data outside the European Union

Most of the parties above process your data within the European Union. There are three exceptions:

  • Postmark processes our emails on servers in the United States. For this we have agreed the European Commission's standard contractual clauses with Postmark.
  • Meta may also process WhatsApp messages in the United States. For this, Meta takes part in the EU-US Data Privacy Framework.
  • Trustpilot also uses companies in the United States, for example to send the invitations. For this, Trustpilot uses the safeguards the GDPR requires (a decision of the European Commission or its standard contractual clauses).

Microsoft keeps our mailbox in data centres in the European Union.

5. No profiling

We make no decisions about you that are taken by a computer alone, and we do not build profiles of you for advertising.

The webshop works out the yearly discount above by itself. It only ever works in your favour: without it, you pay the normal price.

6. Your rights

You have the right to:

  • access your data;
  • have incorrect data corrected;
  • have your data erased;
  • have the processing restricted;
  • receive your data in a common file format, so that you can give it to someone else;
  • object to processing we base on our legitimate interest;
  • withdraw a consent you have given.

Email us at info@sjamaan.nl or use our contact page. We reply within one month. To make sure we do not give data to the wrong person, we may ask you to confirm that the request comes from you, for example by replying from your account's email address.

7. Cookies

We only use cookies the shop needs to work. See our cookie policy.

8. Security

We protect your data with appropriate technical and organisational measures. All connections to the shop are encrypted (https). You sign in with a sign-in link by email instead of a password. Only we, our staff and the parties in section 3, as far as their task requires, can access your data; everyone who works in the shop's admin area signs in with two-step verification. Photos and files you send us in messages are not public: only you and we can open them.

9. Complaints

If you are not happy with how we handle your data, please let us know. You can also file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the data protection authority of the country where you live.

10. Changes

We update this privacy policy when our shop changes. The date of the last change is at the top.