Privacy statement

On bartine.co you can sign up for the panettone email and order panettone when a sale is on. This page lists the data we use for that, what for and for how long.

Who we are

Bartine Bakery is a trade name of Bartine PH B.V. (KvK 82843112), Piet Heinstraat 72, 2518 CK Den Haag, the Netherlands. Questions about your data: [email protected].

What we use and why

The panettone email. Your email address, the weeks you pick, and the language and address of the page. Also the consent wording you saw, when you last signed up, confirmed or unsubscribed, and which emails we sent you. We email you only about those weeks, with your own link to order. Until you confirm, you get only the first email, with the confirm link. Once you've confirmed, weeks later added with your address count at once, and we email you which ones. Every list email has a link to unsubscribe. Legal basis: your consent (GDPR art. 6(1)(a)).

Ordering. Your name, email address, language, the week, quantity and amount. Also your order code and pickup code, when you ordered and paid, any refund, and when and by whom the panettone was handed over. We use them for the confirmation, the limit per person, the pickup list, handing over and refunds. We can't take an order without a name and email address. Legal basis: our contract with you (GDPR art. 6(1)(b)).

A fair sale. So that one script can't hold all the panettone, we count per network how often your browser contacts our order system. That includes simply opening a panettone page or a link from our emails. For this we keep your IP address (for IPv6 only the network part), the time window, the count and, for an order, the week. We also count the sign-up emails to one address per day, so nobody can flood your inbox through our form. For this we keep a hashed (scrambled) form of your address.

On panettone pages with a form, Cloudflare Turnstile checks that a person is at the screen. Cloudflare gets your IP address and browser details when the page opens, even if you send nothing, and again when you send the form. Cloudflare also uses these details itself, as a separate controller, to improve the check (cloudflare.com/turnstile-privacy-policy). Legal basis: our legitimate interest in a fair sale and a working system (GDPR art. 6(1)(f)).

We don't sell your data, and we share it with no one but the services named below.

How long we keep it

• A sign-up you don't confirm: the link works for 7 days, and 30 days later we erase the sign-up.
• A confirmed sign-up: erased 30 days after your last week, or 30 days after you unsubscribe if that is sooner.
• An order that wasn't paid: name and email address erased after 30 days.
• A paid order: name and email address erased 6 months after the pickup week. We keep the rest (date, amount, order code, payment number) for 7 years, as the law requires for our accounts.
• IP addresses and hashed addresses for the fair sale: erased after 1 day.
• Technical logs at our services, which can hold your IP or email address: erased within 30 days.

Who sees your data

Within Bartine, only the people who run the orders and the list or hand over the panettone. They can see your sign-up and whether you ordered with the same address.

These services process your data for us, under a data processing agreement. Cloudflare's own use of Turnstile details, above, is the one exception.

• Lovable and Supabase: the order system, its database and the tools we manage it with.
• Cloudflare: the bartine.co website, the network in front of our order system, and Turnstile.
• Resend: sends our emails.
• Google Workspace: our mailbox [email protected].

Mollie. You pay on Mollie's own page, and for that payment Mollie is a separate controller, with its own privacy statement (mollie.com/legal/privacy). We give Mollie the amount, quantity, order code and page language, not your name or email address. Mollie tells us whether you paid, and we keep only its payment number. Our Mollie account shows the payer details Mollie gives shops, such as name and bank account.

Outside the EU

Our database is in Ireland, and our emails are sent from Ireland. Some services above are based outside the EU, mainly in the United States, and can process your data there. Resend, for example, stores the emails it sends in the US. These transfers rest on the European Commission's standard contractual clauses or, for certified companies, the EU-US Data Privacy Framework.

Cookies and storage in your browser

We use no analytics tools and no advertising cookies.

• Language: if you choose a language, a cookie (`lang`) remembers it for a year.
• Panettone pages: your browser keeps the weeks you signed up for and the orders you started or paid on this device, so the page can show them. We never receive this. Clearing your browser data removes it.
• Turnstile: sets no cookie on bartine.co. Inside its own frame, Cloudflare may use a security cookie.
• Cloudflare's bot check (`__cf_bm`): if you open a link to our order system directly, such as an unsubscribe link, Cloudflare may set this cookie for 30 minutes.

These are needed for the site to work, so we don't ask for consent.

Your rights

You can see, correct or erase your data, restrict its use, object to the fair-sale check, and take your data elsewhere. You can withdraw your consent at any time. What we did before that stays valid. We must keep the record of a paid order for 7 years for tax purposes.

Email [email protected], and we'll answer within a month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Changes

If we change this statement, the new version goes here, with its date.

Last updated: 8 November 2026.