Privacy Policy
Version 1.0 · 30 May 2026
Who We Are and How to Contact Us
Epic Decks NL (Robert Kochplaats 67, 3068 JC Rotterdam, The Netherlands; KvK 98341413) is the data controller for this website. You can reach us at welcome@epic-decks.com for any privacy-related questions or requests. Epic Decks NL is not required to appoint a Data Protection Officer given the nature and limited scale of its data processing activities.
What Data We Collect, Why, and on What Legal Basis
This website is a collection showcase with no registration, checkout, or contact forms. We collect a minimal amount of data when you visit:
- Server logs — your IP address, browser type, pages visited, referrer URL, and timestamp. These are retained for up to 30 days and then automatically deleted. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Our legitimate interest is to maintain the security, performance, and technical integrity of our website and to diagnose faults. We have assessed that this interest does not override your rights and freedoms, given the limited nature of the data collected, the short retention period, and the absence of any profiling or automated decision-making.
- Cookie consent record — when you interact with our cookie banner, your consent preferences are stored locally in your browser via a Cookiebot cookie. This is a strictly necessary function and does not require separate consent. See our Cookie Policy for details.
We do not currently use analytics, advertising, or any other third-party tracking tools on this website. We do not collect your name, email address, or payment information through this website. If you purchase via WhatNot, your data is processed by WhatNot under their own privacy policy.
Data Processors and Recipients
We share data with the following third-party processors, each acting under a data processing agreement:
- Vercel Inc. (hosting provider) — our website is hosted on Vercel's infrastructure. Vercel processes server log data on our behalf. Vercel is headquartered in the United States. Transfers are governed by the EU Standard Contractual Clauses (Commission Decision 2021/914), incorporated into Vercel's Data Processing Addendum. Vercel is additionally certified under the EU–US Data Privacy Framework. Further details: vercel.com/legal/privacy-policy.
- Cybot A/S (Cookiebot) — consent management — our cookie consent banner is provided by Cookiebot. Cookiebot processes your consent record on our behalf. Cybot A/S is headquartered in Denmark (EEA) and processes data within the EEA. Further details: cookiebot.com/en/privacy-policy.
We do not sell, rent, or share your personal data with any third parties for their own marketing purposes. We may disclose data to competent authorities if required by law.
International Data Transfers
Vercel Inc. is based in the United States, which is outside the European Economic Area. Transfers to Vercel are governed primarily by the EU Standard Contractual Clauses (Commission Decision 2021/914). Vercel is additionally certified under the EU–US Data Privacy Framework. Cookiebot processes all consent data within the EEA — no international transfer applies.
Retention
Server logs are automatically deleted after 30 days. Cookie consent records are stored in your browser for 12 months, after which the cookie banner is re-presented. We do not retain personal data beyond what is necessary for the purposes described in this policy.
Your Rights
Under GDPR, you have the following rights in relation to your personal data:
- Right of access (Art. 15) — to receive a copy of the personal data we hold about you.
- Right to rectification (Art. 16) — to have inaccurate data corrected.
- Right to erasure (Art. 17) — to request deletion of your data in certain circumstances.
- Right to restriction (Art. 18) — to restrict how we use your data in certain circumstances.
- Right to data portability (Art. 20) — to receive your data in a structured, machine-readable format.
- Right to object (Art. 21) — where we process your data on the basis of legitimate interest, you have the right to object at any time on grounds relating to your particular situation. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, email us at info@epic-decks.com. We will respond within one calendar month of receipt, in accordance with Art. 12 GDPR. For complex or multiple requests this period may be extended by a further two months, in which case we will notify you within the first month.
You also have the right to lodge a complaint with the Dutch supervisory authority: Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl, +31 (0)70 888 8500.
Changes to This Policy
We will update this policy before introducing any new data-collection features — including analytics tools, newsletter sign-ups, contact forms, or social media embeds — and will re-present the cookie consent banner where required. The version number and date at the top of this page indicate when it was last updated.