Privacy Policy

Qrest respects your privacy and processes personal data carefully, in accordance with the General Data Protection Regulation (GDPR). In this privacy policy, you can read which data we collect, what we use it for, how long we retain it and what rights you have.

Last updated: August 2026

Who is responsible for your data?

Qrest Hot Tubs & Saunas is the data controller for the processing of your personal data:

• Qrest, Luchtenhorst 10, 7207 BV Zutphen
• Email: [email protected]
• Chamber of Commerce number: 77208692

What personal data do we process?

Depending on how you use our services, we process:

• For a webshop order: name, address, email address, phone number, order details and payment details.
• For a quote request or showroom appointment: name, contact details and the content of your request.
• When you contact us via email, contact form, phone or WhatsApp: your contact details and the content of the message.
• When signing up for the newsletter: your email address.
• When visiting the website: data via cookies and similar technologies, depending on your cookie preferences (see the Cookies section).

What do we use your data for and on what legal basis?

We process your personal data solely for the following purposes:

1. Processing your order or agreement (delivery, invoicing, customer service) — legal basis: performance of the agreement. Retention period: 7 years (statutory retention period for administration).
2. Preparing quotes and scheduling appointments — legal basis: performance of the agreement or pre-contractual phase. Retention period: 2 years after the last contact; if the quote leads to an agreement, the statutory 7-year retention period applies.
3. Answering questions and customer service — legal basis: legitimate interest. Retention period: 2 years after handling.
4. Sending the newsletter — legal basis: your consent. Retention period: until you unsubscribe; you can unsubscribe at the bottom of every mailing.
5. Inviting you for a review after purchase — legal basis: legitimate interest. You can always object to this.
6. Analysing and improving the website — legal basis: your consent (statistics cookies).
7. Showing relevant advertisements — legal basis: your consent (marketing cookies).
8. Complying with legal obligations, such as the statutory retention duty — legal basis: legal obligation.

We do not collect more data than necessary and do not use it for purposes other than those described above.

Who do we share your data with?

We never sell your data to third parties. We only share data with service providers who help us with our business operations, and only to the extent necessary:

• hosting and IT service providers (website, email, security and CDN);
• payment providers (for processing webshop payments);
• delivery and transport services (such as PostNL and pallet carriers);
• email delivery services (for newsletters and service emails);
• review platforms (such as Trustpilot and Google);
• advertising and analytics platforms (such as Google, Meta and TikTok) — only if you have given consent via the cookie banner;
• our accountant, insofar as necessary for administration purposes.

We enter into a data processing agreement with parties that process personal data on our behalf. Our employees are required to handle your data confidentially.

Transfer outside the EEA

Some of our service providers (such as Google, Meta and TikTok) process data outside the European Economic Area, including in the United States. In these cases, we ensure appropriate safeguards, such as certification under the EU-US Data Privacy Framework or the European Standard Contractual Clauses (SCCs).

Cookies

Our website uses cookies and similar technologies. Functional cookies are always active; cookies for preferences, statistics and marketing are only placed with your consent via the cookie banner.

You can adjust or withdraw your choice at any time via “Manage Cookie Preferences” at the bottom of the website. You can also refuse or delete cookies via your browser settings; please note that some website features may not work properly if you do so.

How do we secure your data?

We take appropriate technical and organizational measures to protect your personal data against loss, misuse and unauthorized access. This includes a secure connection (SSL), secure servers and limited access to data within our organization.

Your rights

Under the GDPR, you have the following rights:

• Access to the personal data we process about you;
• Rectification of inaccurate or incomplete data;
• Erasure of your data (“right to be forgotten”);
• Restriction of processing;
• Objection to processing, including for direct marketing purposes;
• Data portability: receiving your data in a commonly used format;
• Withdrawing your consent, when processing is based on consent.

Would you like to exercise any of these rights? Send an email to [email protected]. We will respond within one month. To make sure the request was made by you, we may ask you to verify your identity.

Do you disagree with how we handle your data? Then you have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.

Changes to this privacy policy

We may update this privacy policy, for example due to changes in our services or legislation. The most current version can always be found on this page; the date at the top indicates when the policy was last updated.

Questions?

Do you have any questions about this privacy policy or about how we handle your data? Please contact us at [email protected].