Who is responsible
1605 Publishers B.V., trading as 1605 Collective, Hazenkoog 9, 1822 BS Alkmaar, the Netherlands, is responsible for personal data processed through our store. For privacy questions or requests about your data, email shop@1605collective.com.
How we use data
- Orders and delivery. We process your name, contact and address details, order, payment and information needed for delivery and customer service to perform the purchase contract. Shopify processes store, order, payment and account data. We share the necessary order and address details for physical deliveries with our fulfilment and shipping partners, including MTS via ChannelDock.
- Customer account. If you sign in, Shopify Customer Accounts and a private session let you access your orders and addresses. Your browser receives a session identifier; account tokens are encrypted in our Supabase database. Under the current refresh flow, a session expires within seven days, or sooner if you sign out.
- Enquiries and withdrawal. We use what you send us to handle your question, return or complaint. The contact form sends email through Resend to our configured contact inbox; the withdrawal form sends it to shop@1605collective.com. Abuse prevention uses a derived, hashed IP identifier; this does not rule out IP addresses in hosting logs.
- Newsletter and stock alerts. We use your email and subscription status in Klaviyo for a newsletter with your consent. You can withdraw consent through the unsubscribe link. A stock alert, if active, is used for the item you requested.
- Product reviews. When product reviews are displayed on this website, our server retrieves published reviews from Stamped. We display the author, rating, text, date and any reply. The review display does not load a Stamped widget in your browser or make a direct browser connection to Stamped for this purpose. We do not display a review block when fewer than three published reviews are available. Stamped also processes data for the existing review service; its account-specific retention and transfer arrangements are still being verified.
- External videos. YouTube and Vimeo players on the new site load only after you click to load them. The provider then receives technical connection data and may use its own storage. Closing the player does not erase data already received by the provider. Self-hosted video banners are separate.
- Security and operation. Vercel hosts the website; Supabase supports private sessions, abuse prevention and some technical functions. We process technical data needed for operation and security. The basis for security processing is our legitimate interest in protecting the store and customer data, where that interest outweighs the affected privacy interests following an assessment.
Browser storage and measurement
The new site's cart cookie lasts up to 30 days. Country and language preferences last up to 365 days. Analytics and marketing choices are valid for 180 days; an expired choice does not permit measurement. The stored choice record is not automatically erased when it expires. You can remove it in your browser's website-data settings. Only after you choose 'Remember recently viewed' does your browser keep up to eight recently viewed products on this device. Your browser saves that choice separately. Each product expires 30 days after you last viewed it; expired items are removed from browser storage when you next use this feature. You can withdraw this choice on a product page using 'Turn off and clear list'; this immediately removes the list and stops further recording. Old lists without this choice are removed when you next use the feature. Certain dismissed notices have no automatic expiry. You can also remove these records in your browser's website-data settings. Not all this storage is necessarily essential or exempt from consent. A newsletter subscription is not consent to behavioural measurement.
Retention, recipients and transfers
We retain personal data only as long as needed for its purpose, unless a legal record-keeping duty or an ongoing dispute requires longer. Applicable statutory periods govern store and payment records; resolving an enquiry or complaint and a reasonable evidence period govern correspondence.
The named providers receive data for their respective roles. Their data processing terms, subprocessors, regions and any transfers outside the European Economic Area still require account-specific verification. We do not confirm that all data remains within the EEA.
Your rights
You may request access, rectification, erasure, restriction or portability of your data. Where applicable, you may object to processing based on legitimate interests and withdraw consent; withdrawing consent does not affect earlier lawful processing. Email shop@1605collective.com. You may also complain to the Dutch Data Protection Authority. We may need to keep some data despite an erasure request where the law requires it.