Privacy policy

1. Who are we?

Kindkado is an online platform for managing wishlists and sharing gift ideas. For questions about privacy, you can contact us at info@kindkado.nl.

2. What data do we collect?

We only collect data that is needed to provide the service:

• Account data: name, email address (when you register or log in with Google)
• Family data: names and (optionally) month/year of birth of family members you add yourself
• Wishlists: titles, descriptions, links and images of gifts you add
• Drawing names: names, email addresses and (optionally) phone numbers of participants you invite to a draw
• Technical data: IP address and browser type, to solve technical problems

3. Why do we collect this data?

• To create and manage your account
• To save and share wishlists
• To organise a name draw and inform participants by email
• To send email notifications (such as login links and sharing invitations)
• To find and fix technical errors
• To analyse product popularity per age group and improve our service. This analysis is fully anonymised — names and contact details are not used

Legal basis: performance of the agreement (you use our service), legitimate interest (technical management, security and anonymised analysis) and consent (when inviting participants to a name draw).

4. Do we share data with third parties?

We never sell your data. To run Kindkado we use a limited number of service providers, who may use your data only to provide that service:

• Our hosting provider — running the website
• Our database provider — storing your data and images, on servers within the EU (Frankfurt)
• Our email service — sending confirmation and login emails
• Form protection — a service that temporarily keeps track of how often someone logs in or sends a form from one internet address, to prevent abuse. This data expires automatically within an hour
• Error reporting — if something goes wrong on the site, we are notified automatically so we can fix it. No names, wishlists or email addresses are sent along: the key in a sharing link is made unrecognisable before sending. This data is stored on servers within the EU (Germany)
• Google — only if you choose to log in with your Google account

Transfers outside Europe. Some of these service providers are based in the United States. Such transfers take place on the basis of the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission. Your data in our database is stored on servers within the EU.

5. Cookies

Kindkado uses the following kinds of cookies:

• Functional cookies (always on): NextAuth session cookies to keep you logged in, and a cookie (kk_bewaard) that remembers what you created without an account: the gifts you save with the heart, and the wishlists you create, with the names you enter for them. The cookie itself only contains a random number — no name, email address or anything that identifies you. What is linked to it is stored on our server and can only be retrieved with that cookie: we cannot see who you are, and nobody else can get to your list. These cookies are strictly necessary for features you use yourself — comparable to a shopping basket — and are not used for tracking. That is why we don’t ask for consent.
• Ticking off a gift on a list: if you tick off a gift with your email address, your browser remembers your name and email address (local storage, kk_afstreper) so you don’t have to type them again next time. This stays on your own device; you can clear it with “Not your details? Clear” in the tick-off window or by clearing your browser data.
• The steamboat (/aan-boord): your browser remembers which places on the boat you have already visited (local storage, kk_boot), so the guide doesn’t repeat its explanation every time. It contains no personal data and stays on your own device.
• How long do we keep that? What you save or create without an account is kept for up to 100 days after your last visit. If you visit within that period, the term starts again. After that it is deleted. If you create an account, everything moves with you and the normal retention periods of your account apply.
• Analytical cookies (with consent): our hosting provider collects anonymised visit and performance statistics, and Microsoft Clarity makes heatmaps and session recordings that show us how visitors use our pages. Sensitive content is masked automatically and the data cannot be traced back to individual visitors.

We do not place advertising cookies ourselves and we don’t sell advertising space. If you click a link to an online shop, that click goes through an affiliate network that places a cookie to register that you reached the shop through us — that is how we earn a small commission. This only happens at the moment you leave our site.

On your first visit you can choose whether to accept analytical cookies. You can change your choice at any time by clearing your browser data.

6. Shared wishlists and drawing names

When you share a wishlist through a link, anyone with that link can view the list. You are responsible for who you share the link with. You can make a shared list private again at any time in your account settings.

When drawing names, the names, email addresses and any phone numbers of participants are used only to carry out the draw and to send invitations and results. Participant data is not used for any other purpose.

Viewing a shared list can be done anonymously. You don’t need to log in, and you leave no trace that can be traced back to you. We do not store any IP address, name or email address of visitors. And we never record who viewed which gift — we can’t, because that data isn’t stored anywhere.

What we do record is a tally mark when a list is opened: at what time, from which country, and whether it was an ordinary browser or an automated service — such as the preview WhatsApp or Facebook makes of a shared link. Those last two are only there to tell a real visitor apart from a computer program. We use these tally marks to see whether sharing lists works as it should. They are stored on our own server, are not passed on to anyone else, and no cookie is involved.

7. How long do we keep data?

We keep your data for as long as you have an account. If you delete your account, all your data (including wishlists and family data) is permanently deleted.

What you type into the search fields of the site (when browsing, in the Big Book and when adding a gift) is stored anonymously, without an IP address and not linked to an account, together with the number of results, the time and the country. This shows us which gifts people look for that we do not have yet. It is deleted after 12 months.

8. Your rights

Under the GDPR (in Dutch: AVG) you have the following rights:

• Access — you can ask which data we hold about you
• Rectification — you can have your data corrected
• Erasure — you can have your account and all data deleted
• Objection — you can object to the processing of your data
• Data portability — you can request your data in a readable format

Contact us at info@kindkado.nl to exercise your rights. We respond within 30 days.

9. Security

We take appropriate measures to protect your data, including encrypted connections (HTTPS), secure password storage (bcrypt) and restricted access to the database.

10. Complaints

If you have a complaint about how we handle your data, you can contact us at info@kindkado.nl. You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

11. Changes

We may update this privacy policy from time to time. The most recent version is always available on this page.