What we do and don't keep.

INQ22 Tattoo Supply, based in Groningen, KvK 42036532, is the data controller for the personal data collected via inq22.com.

Questions about your privacy? Email info@inq22.com with "GDPR" as the subject.

When you order: name, email address, (billing and delivery) address, phone number, KvK and VAT number (business), the contents of your order, and the amount.

When you create an account: also a hashed password and your order history. We never see your password itself.

When you contact us: the content of your message and anything you share with us in it.

Automatically: IP address, browser type, and pages you visit, only to the extent technically necessary, or via analytics cookies when you've explicitly consented to them (see Cookies).

To perform the contract: processing your order, invoicing, delivery, customer service. For our legal obligations: tax administration, fraud prevention. For marketing (newsletter): only with your explicit consent, and you can unsubscribe again with one click.

We only share what's necessary with the parties that help us:

• Mollie: for payment (they receive your name, email, and amount, not the contents of your cart).
• PostNL: for delivery (name, address, phone number for delivery notifications).
• Resend: for sending transactional emails (email address + message).
• Vercel & Neon: for hosting and database management (everything, but encrypted and only for storage/processing under our instruction).

We never sell your data to third parties.

Order data and invoices: 7 years (statutory tax retention period).

Account data: for as long as your account is active. If you request deletion, it's removed within 30 days (except data we're legally required to retain, see above).

Contact messages: 2 years.

Newsletter subscription: until you unsubscribe.

You have the right to access, correct, erase, restrict, and port your data, and to object to its processing. Send an email to info@inq22.com and we'll respond within 30 days.

Not satisfied with how we handle it? You can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Traffic over HTTPS, passwords hashed (bcrypt/scrypt), databases encrypted at rest, access limited to team members who strictly need it for their work. Security incidents are reported within 72 hours as required by the GDPR.