PRIVACY POLICY – SILLY SHEPHERDS
Last updated: October 2026
1. About this policy
Silly Shepherds handles personal information with care. This policy explains what information we process, why we use it, how long we retain it, who we may share it with, and your privacy rights.
It covers sillyshepherds.com, our direct shop, contact forms, newsletter, and other services provided directly by Silly Shepherds.
We do not sell your personal information.
Purchases and interactions on Amazon or another external service are also subject to that service’s privacy policy.
2. Who is responsible for your information?
The data controller is:
Silly Shepherds
Paul Berendsen
Vredesstraat 9
6467 LG Kerkrade
The Netherlands
Email: info@sillyshepherds.com
Website: sillyshepherds.com
Dutch Chamber of Commerce registration: 67199313
VAT identification number: NL001821363B30
3. Information we process
Depending on how you use our services, we may process:
-
Your name.
-
Billing and delivery addresses.
-
Country.
-
Email address.
-
Phone number, if provided.
-
Order and purchase details.
-
Information about purchased products and downloads.
-
Payment status and transaction references.
-
Account information, if you create an account.
-
Newsletter subscriptions, preferences, and consent records.
-
Messages you send through email or forms.
-
Materials you supply for personalized products.
-
IP address.
-
Browser, device, and technical information.
-
Cookie choices and consent records.
-
Information needed for security and fraud prevention.
We receive information directly from you, automatically through your use of the website, or from providers involved in processing your payment or delivering your order.
Payment providers handle payment credentials. We do not normally receive full card details or online banking login information. For manual bank transfers, account-holder details or bank information may appear in our banking records.
Please avoid sending sensitive personal information unless we specifically request it for a lawful and necessary purpose.
4. Why we use your information
We process personal information only where we have a valid legal basis.
Orders and contracts
We use relevant information to:
-
Process orders.
-
Deliver physical products.
-
Supply EPUB files and other digital products.
-
Manage payments.
-
Send order confirmations and service messages.
-
Handle cancellations, returns, and refunds.
-
Provide customer support.
The legal basis is generally performance of a contract, including steps you request before entering into one.
Without the information necessary to fulfill an order, we may be unable to provide the requested service.
Legal obligations
We retain certain order, invoice, and payment records to meet tax, accounting, and other legal requirements.
The legal basis is compliance with a legal obligation.
Security and fraud prevention
We may use technical and transaction information to protect the website, customer accounts, payments, and our business against fraud or misuse.
Where appropriate, we rely on our legitimate interests, balanced against your rights and interests.
Inquiries and complaints
We use your contact details and messages to answer questions and resolve complaints.
Depending on the inquiry, the legal basis may be performance of a contract, compliance with a legal obligation, or our legitimate interest in responding to correspondence.
Newsletter
If you subscribe, we use your email address and any optional information you provide to send the newsletter you requested.
We rely on consent. You can withdraw it at any time using the unsubscribe link in each newsletter.
Cookies and website measurement
Where required, we rely on consent for optional cookies and similar technologies.
Strictly necessary technologies may be used without consent where an applicable legal exemption permits this. Other lawful exemptions may apply to limited measurement tools, depending on their configuration and applicable law.
See our Cookie Policy for more information.
5. WordPress and WooCommerce
Our website uses WordPress, and our direct shop uses WooCommerce.
Where shopping features are available, these systems process information needed for:
-
Shopping carts and checkout.
-
Order management.
-
Customer accounts.
-
Digital downloads.
-
Inventory management.
-
Invoicing.
-
Returns and customer support.
WordPress and WooCommerce are software. Using them does not, by itself, mean that all customer information is sent to their developers.
Hosting, security, maintenance, or connected service providers may process information where necessary for the services they provide.
6. Payments
We use Mollie to process online payments for direct purchases.
Mollie processes information needed to complete transactions, prevent fraud, and meet its legal obligations.
Depending on the payment method, another financial provider may also process information under its own privacy notice and legal responsibilities.
We receive transaction information needed to confirm payment, manage orders, reconcile our records, and handle refunds.
If you choose manual bank transfer, your bank and ours process the information needed to complete that transfer.
7. Shipping
For physical orders, we may share necessary information with delivery providers, such as PostNL or DHL.
This may include:
-
Your name.
-
Delivery address.
-
Email address.
-
Phone number, where needed for delivery.
We share only the information reasonably needed to deliver and support your shipment. Carriers may also have their own legal obligations and privacy policies.
8. EPUB files and digital products
For direct digital purchases, we may process:
-
Purchase date.
-
The digital product ordered.
-
Download permissions.
-
Download links or access identifiers.
-
Download counts, where recorded.
-
Technical information needed to deliver files securely.
We use this information to fulfill your purchase, provide access, investigate technical problems, and prevent misuse.
A Kindle purchase made through Amazon is handled through Amazon’s systems rather than our direct download system.
9. Newsletter
When you subscribe, we process your email address and any optional name or language preference you provide.
We may use an external email service to manage subscriptions and deliver newsletters.
You can unsubscribe at any time using the link at the bottom of each newsletter.
After you unsubscribe, we may retain a minimal suppression record to respect your choice and prevent you from being unintentionally added again. We may also retain necessary consent records for accountability.
Newsletter subscription is optional and is not required to purchase a product.
10. Reviews
If we offer review invitations, we use the contact and order information needed to request feedback.
Where we use CusRev / Customer Reviews for WooCommerce to send invitations, relevant information may include your name, email address, and details of the products purchased.
Where consent is required, we request it before sending an invitation or sharing information for that purpose.
If you submit a public review, the review text, chosen display name, and any images you submit for publication may be visible to other visitors. Please avoid including private information you do not want published.
11. Hosting, email, and technical support
External providers may process information to support:
-
Website hosting.
-
Backups.
-
Security.
-
Email delivery and storage.
-
Troubleshooting.
-
Technical maintenance.
Where a provider acts as our processor, we put appropriate data protection arrangements in place as required by law.
Some providers act as independent controllers for particular activities, such as meeting their own financial or legal obligations.
12. Cookies and similar technologies
Our website may use technologies for essential functions, preferences, measurement, and embedded content.
Essential functions may include shopping sessions, checkout, account access, security, and remembering cookie choices.
Language preferences and analytics are assessed separately. They are not automatically exempt from consent merely because they are useful.
Where consent is required for analytics, marketing, or tracking, those technologies must remain inactive until you agree.
You can reject optional technologies and change your choices through our cookie settings.
Information collected through cookies, IP addresses, or device identifiers may be personal information. We do not automatically describe analytics information as anonymous.
See our Cookie Policy and cookie details for the technologies used, their purposes, providers, and durations.
13. Social media and embedded content
We may use platforms such as YouTube, Instagram, TikTok, Pinterest, Facebook, or other social services.
When you visit an external platform, its privacy policy applies.
Embedded videos, posts, and social features may transmit information to their providers. This can include your IP address, device information, and information about your interaction with the content.
Where consent is required, the relevant embedded feature must remain blocked until you agree. Declining may prevent that particular feature from loading.
14. Who we share information with
Depending on the services used, necessary information may be shared with:
-
Hosting and email providers.
-
Payment providers.
-
Delivery companies.
-
Accounting and administration providers.
-
Newsletter services.
-
Review services.
-
Security and fraud prevention providers.
-
IT and maintenance providers.
-
Professional advisers where necessary.
-
Public authorities where disclosure is legally required.
We share only the information reasonably necessary for the relevant purpose.
Amazon and other external sellers
Following a link to Amazon does not give us access to your Amazon account or the seller’s customer records.
If you buy from another seller, that seller and the platform handle your purchase information under their own privacy notices.
If you contact us about such a purchase, we process the information you choose to send us. We may separately receive sales or royalty reports, which do not give us access to your full order or payment details.
15. International data transfers
We are based in the Netherlands. Some providers may process information outside the European Economic Area (EEA).
Where GDPR transfer rules apply, we use an applicable lawful transfer mechanism. This may include:
-
An applicable adequacy decision.
-
Approved Standard Contractual Clauses, together with any necessary assessments and additional safeguards.
-
Another mechanism permitted by law.
You can contact us for information about safeguards relevant to your information and, where applicable, request a copy, subject to appropriate redactions.
Visiting from another country does not waive your applicable privacy rights.
16. How long we retain information
We retain personal information only as long as reasonably necessary for its purpose, unless legal obligations require longer retention.
Retention depends on the following criteria:
Accounting, invoices, and relevant order records
For the period required by applicable tax, accounting, and other legal obligations.
Customer accounts
While the account remains in use and for any further period necessary to manage outstanding orders, legal obligations, or claims. Closing an account does not automatically delete records we must legally retain.
Newsletter subscriptions
Until you unsubscribe or the subscription is otherwise ended, with limited consent or suppression records retained where necessary.
Customer support and correspondence
For the time needed to resolve the matter and manage related warranty issues, complaints, or legal claims.
Technical and security logs
For a limited period appropriate to troubleshooting, security, and fraud prevention.
Materials supplied for personalized products
For the time needed to produce the order, resolve related issues, and meet applicable recordkeeping or legal requirements.
When information is no longer needed, we delete it or anonymize it as appropriate. Backup copies may remain until they are removed through the backup retention cycle.
17. Security
We use appropriate technical and organizational measures to protect personal information against loss, unauthorized access, misuse, alteration, and disclosure.
Our website uses HTTPS to protect information in transit.
Access to personal information is limited to those who need it for their work or services.
No system can guarantee absolute security. We review our measures as appropriate and respond to security incidents in accordance with applicable law.
18. Your privacy rights
Under the GDPR, depending on the circumstances, you may have rights to:
-
Access your personal information.
-
Correct inaccurate or incomplete information.
-
Request deletion.
-
Restrict processing.
-
Object to certain processing.
-
Receive or transfer information through data portability.
-
Withdraw consent.
You can object to direct marketing at any time.
These rights are subject to legal conditions and exceptions. For example, we may need to retain invoices despite a deletion request.
Other applicable privacy laws may provide additional rights depending on your location and the processing involved. Nothing in this policy limits those rights.
To make a request, email:
We may ask for proportionate information to verify your identity. Please do not send identity documents unless we specifically request them.
For GDPR requests, we normally respond within one month. If a permitted extension is necessary, we will explain why within the initial period. Other applicable legal deadlines will be respected.
Requests are generally free of charge, subject to exceptions permitted by law.
19. Withdrawing consent
Where we rely on consent, you can withdraw it at any time.
Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent.
For newsletters, use the unsubscribe link in any newsletter.
For cookies, use our cookie settings. If you cannot access the controls, contact us.
Withdrawing consent does not prevent processing necessary under another valid legal basis, such as retaining legally required accounting records.
20. Privacy complaints
If you have a concern about how we handle personal information, you can contact:
You also have the right to complain to a competent supervisory authority without contacting us first.
Our Dutch supervisory authority is the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority.
Depending on applicable law, you may also contact the relevant authority in your country or region.
21. Automated decision-making
We do not ourselves make decisions based solely on automated processing that produce legal or similarly significant effects on you.
Payment and financial providers may perform their own fraud checks, eligibility assessments, or automated processing under their privacy notices.
If our own practices change, we will provide any required information and safeguards before introducing the relevant processing.
22. Changes to this policy
We may update this policy when our website, services, providers, or legal obligations change.
The current version will be published on sillyshepherds.com with its update date.
For significant changes, we will provide additional notice where appropriate or legally required. If new processing requires consent, we will request it.
23. Contact
For privacy questions or requests:
Silly Shepherds
Paul Berendsen
Vredesstraat 9
6467 LG Kerkrade
The Netherlands
sillyshepherds.com
© Silly Shepherds — Paul Berendsen
Last updated: October 2026