What we collect when you order, why we need it, who else sees it, and how to get it back or removed.
Last updated 9 August 2026
The controller of your personal data is:
Echelons (eenmanszaak)
Melis Stokelaan 19, 1948 DA Beverwijk, Netherlands
KvK 84317663
kirsten.vansteenberge1@gmail.com
We are a one-person business selling a single book. We do not have a data protection officer, and we are not required to appoint one.
We collect only what an order needs. There is no account, no newsletter, no profiling and no advertising.
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Name | To address the parcel and the certificate | Art. 6(1)(b) — performance of a contract |
| Email address | Order confirmation, delivery updates, questions about your order | Art. 6(1)(b) |
| Phone number | So the courier can reach you about delivery | Art. 6(1)(b) |
| Delivery address | To send the book | Art. 6(1)(b) |
| Dedication text, if you provide one | So the author can write it into your copy | Art. 6(1)(b) |
| Quantity, order reference, language, payment details | To process and record the sale | Art. 6(1)(b) |
| Which link brought you here (for example a code on a card in a shop) | To understand which channels work, in aggregate | Art. 6(1)(f) — legitimate interest |
| Invoice and transaction records | Tax and accounting obligations | Art. 6(1)(c) — legal obligation |
We never see your card or bank details. Payment is handled entirely by Mollie on their own pages. We receive only whether the payment succeeded, the amount, and the method used.
Providing this data is necessary to buy the book. Without it we cannot conclude or perform the contract. You may object at any time to the source-tracking described above, and it will not affect your order.
If you only look at the site and do not order, we do not collect anything that identifies you. Our host processes standard server request data — IP address, time, page requested, browser type — which is technically unavoidable in serving a web page and is used only to deliver the site and protect it from abuse. That processing rests on Art. 6(1)(f).
We do not use Google Fonts, Google Analytics, Meta pixels, advertising networks or session recording. Typefaces are served from our own domain, so no third party learns you were here.
This website stores nothing. It passes your order to Mollie and forgets it. But the order itself has to live somewhere, and we would rather be specific than reassuring:
| Where | What | How long |
|---|---|---|
| Mollie's systems | The payment and the order details attached to it | Seven years, per Dutch tax law |
| Our email account | The order notification we receive, and any correspondence with you | Order emails seven years; other correspondence up to two years |
| Our accounting records | Invoice data | Seven years, per Dutch tax law |
| Occasional exports | A spreadsheet of orders, used to write shipping labels | Deleted once the parcels are sent |
Access to all of these is protected by two-factor authentication. Order exports are deleted after use rather than kept.
We use a small number of processors, each under a data processing agreement, each strictly for the purpose stated:
| Processor | Role | What they receive |
|---|---|---|
| Mollie B.V. (Netherlands) | Payments | Name, email, address, order details, payment data |
| Cloudflare, Inc. | Hosting and delivery of the site | Request data; order data in transit |
| Resend (email delivery) | Sending your confirmation | Name, email, order details |
| Postal carrier | Delivering the parcel | Name, address, phone number |
We do not sell personal data, we do not share it for anyone else's marketing, and we do not pass it to anyone beyond the parties above except where the law obliges us to.
Mollie is a Dutch company and processes within the EU. Cloudflare and Resend are US companies that may process data outside the EEA. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses together with the technical measures those providers apply. You may ask us for details of these safeguards.
After those periods the data is deleted.
Under the GDPR you may ask us to:
Email kirsten.vansteenberge1@gmail.com and we will respond within one month. There is no charge. We may ask a question to confirm it is really you, so that we do not hand your data to someone else.
If you are unhappy with how we have handled your data, you can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority where you live.
We do not carry out automated decision-making or profiling that produces legal effects for you.
This site sets no tracking cookies. Nothing is stored on your device for advertising, profiling or cross-site tracking.
We store one thing locally, and only after you have answered the notice: your choice about optional measurement. That preference stays in your browser, is never sent to us, and exists purely so we do not ask again. Under Art. 5(3) of the ePrivacy Directive, storing a preference you have just expressed is strictly necessary and needs no separate consent.
If optional measurement is switched on, we use Cloudflare Web Analytics, which is cookieless and produces aggregate counts only — pages viewed, roughly where visitors came from. It does not fingerprint you, follow you across sites, or build a profile. You can change your answer at any time from the link in the footer.
The site is served only over HTTPS and stores no personal data of its own. Payment happens on Mollie's own systems. Our view of orders is behind a password with rate limiting against guessing, and content security and framing protections are applied at the server.
Every account that can reach your data — payments, email, hosting — is protected by two-factor authentication. We keep the data set deliberately small, because the safest data is the data you never collected.
If a breach occurs that is likely to risk your rights and freedoms, we will report it to the Autoriteit Persoonsgegevens within 72 hours of becoming aware of it, and tell you directly without undue delay where the risk to you is high.
This shop is not aimed at children and we do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, write to us and we will delete it.
If we change this policy we will update the date at the top. Material changes affecting your rights will be communicated by email to anyone with an order in progress.
See also our terms of sale and accessibility statement.
Icons of Cycling is published by teNeues. The copies sold here are ordinary trade copies from the author's own stock, signed and numbered by him personally. They are not a separate teNeues edition, and this site is not affiliated with or endorsed by the publisher.
← Back to the book