Privacy Policy
In this privacy policy, we explain which personal data XtremeOffice® processes, why we do so, with whom we share data (only where necessary), and what rights you have. We act in accordance with the General Data Protection Regulation (GDPR, known in Dutch as the AVG).
This privacy policy applies to your use of our website and webshop, and to all communication with us (for example via e-mail or chat).
Who is responsible for the processing of your data?
Merken Distributie, trading under the name XtremeOffice® (data controller).
Contact: https://xtremeoffice.nl/contact
E-mail: dex@xtremeoffice.nl
What personal data do we process?
Depending on how you use our website, we may process the following data:
- Name and address details (for delivery and invoicing)
- E-mail address and, where applicable, telephone number (for order confirmations, updates, enquiries, and returns)
- Order details (products, quantities, order number, status, invoice details)
- Payment status and payment references (via our payment service provider; we do not receive full card details)
- Communication data (e-mails, chat conversations with Dex, service requests)
- Business details such as company name and VAT number (BTW-nummer) (if you are placing a business order; we verify any VAT number provided via the European VIES system)
- Date of birth (solely when using "Pay After Delivery", for the register check described under "Automated decision-making")
Why do we process your data?
We only process personal data for clearly defined purposes, such as:
- Processing and delivering your order
- Sending order and dispatch updates
- Handling returns, complaints, warranty claims, and service enquiries
- Complying with legal obligations (for example, record-keeping and retention requirements)
- Preventing fraud and misuse of our services
What "legal bases" do we use?
Under the GDPR (AVG), we may only process personal data if there is a valid legal basis for doing so. For XtremeOffice, the main bases are:
- Performance of a contract (to fulfil and deliver your order)
- Legal obligation (for example, statutory record-keeping requirements)
- Legitimate interests (for example, customer service, fraud prevention, and security)
- Consent (only where we explicitly request it; you may withdraw your consent at any time)
With whom do we share data?
We do not sell your data. We only share data with parties that are necessary for delivering our service. These include:
- Go Parcel (QLS): for dispatch and (where applicable) return labels, and dispatch status updates by e-mail
- DHL: for transporting and delivering parcels (including tracking)
- Payment service provider: to process payments (iDEAL, Mastercard, Visa)
- IT/hosting (where applicable): for running the webshop and e-mail services
- Anthropic: the AI technology behind Dex (chat conversations, WhatsApp messages, and automatically generated texts such as order confirmations) runs on Anthropic's Claude language model
- Google: for product images generated by Dex (Gemini model)
- CCBR (Curatele- en Bewindregister — the Dutch Register of Guardianship and Administration): only when using "Pay After Delivery" — see "Automated decision-making" below
- European Commission (VIES): for verifying a VAT number (BTW-nummer) provided with business orders
We have data processing agreements in place with parties that process personal data on our behalf, as required by the GDPR (AVG).
Dispatch & tracking
For dispatch purposes, we share your name, address details, and sometimes your e-mail address or telephone number with our carriers and label partners, so that they can deliver your order and send you status updates. You can read more about this at:
https://xtremeoffice.nl/verzending
Chatting with Dex
When you chat with Dex, we may save the conversation in order to handle your query properly and to improve our service. Please avoid sharing sensitive personal data in the chat. If you would like a chat log to be deleted, please get in touch via:
https://xtremeoffice.nl/contact
Automated decision-making
If you choose "Pay After Delivery" at checkout, we automatically carry out a register check with the Curatele- en Bewindregister (CCBR — the Dutch Register of Guardianship and Administration) based on your name and date of birth. If there is a match with that register, or if the check is unavailable, this payment method will automatically be declined for that order — you can simply complete your purchase using a different payment method. This check is fully automated and has no consequences beyond the choice of payment method for that individual order. If you disagree with this or would like a human review, please contact us via https://xtremeoffice.nl/contact.
How long do we retain data?
We do not retain personal data for longer than is necessary for the purpose for which it was collected, unless we are required to retain it for longer due to a legal obligation (such as accounting requirements). Specifically, we apply the following retention periods:
- Order and invoice details: 7 years (statutory record-keeping requirement)
- Chat conversations with Dex: 12 months after the last message
- Website visit data (technical, anonymised for statistical purposes): 90 days
- Login attempts (security log): 90 days
Data that exceeds these retention periods is deleted automatically.
Security
We take appropriate technical and organisational measures to protect personal data against loss and unlawful processing. These include access controls, secure connections, and minimal data processing.
Cookies and tracking
We do not use cookies for tracking purposes, and we do not follow you across the internet. We only use functional sessions to ensure the website works properly. You can read more about this at:
https://xtremeoffice.nl/cookies
Your privacy rights
Under the GDPR (AVG), you have the following rights, amongst others:
- The right to access your data
- The right to rectification of inaccurate data
- The right to erasure (in certain circumstances)
- The right to restriction of processing (in certain circumstances)
- The right to object to processing (in certain circumstances)
- The right to data portability (in certain circumstances)
- The right to withdraw consent (where processing is based on consent)
You can exercise these rights by contacting us via:
https://xtremeoffice.nl/contact
Filing a complaint
If you are unable to resolve a matter with us directly, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Transfers outside the EU
The vast majority of our data processing takes place within the European Economic Area (EEA). Our AI processors Anthropic and Google are American companies; for data processed through them (chat conversations, generated texts, and images), they apply the EU Standard Contractual Clauses as a safeguard, as required by the GDPR (AVG).
Changes to this policy
We may update this privacy policy if our services or applicable legislation change. The most current version will always be available on this page.
Minimal Data Processing
We apply the principle of data minimisation. This means we only request the data that is strictly necessary to deliver your parcel and to comply with our statutory record-keeping obligations. Because we do not use external analytics tools such as Google Analytics, your browsing data is never linked to your identity or shared with advertising networks.
Privacy-First Architecture
Our website is built on a privacy-friendly architecture. We do not track IP addresses for marketing purposes, and we do not use fingerprinting techniques to identify visitors. This makes XtremeOffice a safe environment for both private and business customers.
Privacy Officer: Maurice Gosselaar, maurice@xtremeoffice.nl
Related pages
- Terms and Conditions
- Delivery Information
- Returns
- Contact