Privacy at Schaap’s Vishandel

Who is responsible?

Schaap's Vishandel, Herenstraat 48, 2313 AL Leiden, Netherlands. Submit a privacy request by calling 071 512 4810 or by post to this address.

What information do we use?

For an account: first name, last name, personal email, school email if supplied, verification status and a securely hashed password. For a student application: educational institution, study level, study city and review decision. For account security: a random installation identifier stored only as a hash, broad device type, operating system, browser, browser or PWA use, first and last use, session status and limited security events. For email offers: email address, your separate choice, consent text version and time, broad area preference and any unsubscribe request. We do not ask for your date of birth or create a browser fingerprint.

How do we use it?

• Create, secure and manage an account at your request.
• Verify your personal email and your chosen proof of enrolment, review your application manually and manage a discount pass.
• Save your newsletter subscription immediately when you choose ‘Sign me up’ and save your area if you choose one afterwards. We do not send a verification email for this.
• Send offers and news only after separate, voluntary consent; every email includes an unsubscribe link.
• Prevent abuse with explainable security signals. A signal never blocks a student automatically; an authorized administrator reviews the context.

Proof of enrolment

Verify your school email or, if you have none, upload current proof from your institution or DUO through your account. Access to the private file is limited to authorised reviewers. We delete it after approval or rejection and retry deletion if it fails.

Show only your name, institution and academic year or enrolment period. Hide your BSN, address, financial details and other information. Use the upload in your account.

Device recognition and pass security

After a successful sign-in we set a necessary cookie with a random installation identifier. The server stores only its HMAC hash, together with broad technical details supplied by the browser. We do not store a full IP address in the device profile or combine properties into a browser fingerprint. A new device, several devices used close together or a revoked session may create a warning. Only authorized administrators on the approved network can view these warnings, devices and sessions and take manual action. The student pass's changing QR code contains no name, email address or permanent access token and expires after two minutes.

We do not collect a face, identity document or pass photo for this security feature. Such a check would be considered only after a separate privacy and lawfulness review and with an equivalent no-photo alternative.

Consent and email offers

When applying for your pass, you can choose to receive occasional vouchers from Schaap’s at your personal email address, at most once a week. It becomes active after verification. A school email is used to verify enrolment. Your marketing choice does not affect the discount. The discount signup also asks for consent. We record which form you used, when you gave consent and the wording shown. For the footer form, we also record the public page if it is available. Every offers email has an unsubscribe link. On the locations and VÅRLAKS pages, choosing ‘Yes, email me discounts’ signs you up for news, offers and discount emails from Schaap’s Vis. We email when we have news or an offer to share.

Sharing your visit when you sign up

In Cookie settings → Choose settings, you can separately allow us to share your visit with the shop when you sign up. Without that choice we do not create a visit record linked to your email address. Your tab remembers up to twenty public pages after you opt in. On a new discount email signup we link these pages to the email you enter, your signup IP address and the approximate city provided by our host Cloudflare. Mobile networks and VPNs may show another city. We use this to understand product interest and where signups come from. Public pages may be added during this visit for up to thirty minutes after signup. Only authorised administrators can view the record. It expires within thirty days of your choice. Reject in this browser’s cookie settings, or turn off this choice and save, to erase it. You may also request erasure or unsubscribe from offers. Sharing is optional.

Storage and service providers

Cloudflare hosts the website and account service and delivers verification emails. Account and signup details are stored in a Cloudflare D1 database. Enrolment documents are kept in restricted EU storage. Knoth provides our business mailbox.

Retention and your rights

There is currently no fixed retention period for account details and application decisions. For discount emails we keep your subscription and, if you unsubscribe, your opt-out status. Expired verification requests are cleaned up daily, resolved security events after no more than 395 days and protected administrator audit records after no more than two years. Expired QR checks are removed daily. Device and session records belong to the account and are removed following a valid deletion request, unless a legal obligation or necessary ongoing security investigation temporarily requires otherwise. You can request access, correction or deletion by phone or post; we first verify your identity. You may also complain to the Dutch Data Protection Authority.

Dutch Data Protection Authority ↗

Visit statistics and newsletter steps

With your cookie consent we measure the public pages opened, their order, link clicks and how long the tab is visible, keeping up to fifty pages per visit. Traffic source is stored only as a category such as Facebook, Google or direct/unknown. It comes from the referring website or a recognised utm_source label; full referrer URLs and query parameters are not stored in this report.

For newsletter forms we record only whether a valid email was entered, a draft was saved, an area was selected, signup succeeded or an error occurred. The values entered, name, email and IP address are not in this visit report. Contact clicks count as actions without message content. Account, administration and order pages are excluded. These statistics are not linked to an account or email. The separate visit record linked to a signup requires the additional choice described above.

A random number in your tab’s session storage groups the measurements. It resets after thirty minutes without measured activity or after four hours at most. The server stores only a keyed hash with the measurements for up to thirty days. Expired records stop appearing immediately and are cleaned up daily. Only authorised administrators can view them. We use this to understand which sources, pages and forms work. Visible time is an estimate, not evidence of attention.

You may decline without affecting the site. Withdraw through Cookie settings to stop measurement and erase this tab’s visit record when the server is reachable. If erasure fails, the browser temporarily keeps a retry request. This expanded measurement asks for fresh consent if you previously accepted only the older statistics. Previous refusals remain in force.

The account service uses a necessary secure session cookie when you are signed in. Marketing cookies are not needed for accounts or discounts. Your browser remembers which pages have shown you a discounts popup. After you sign up through the discount form, it also remembers to skip these offers. These flags contain no email address.

Aggregate website statistics

Only if you explicitly choose ‘Accept’ do we measure page views and link clicks. We store daily totals per public page and click destination. For the popup tests on the locations and VÅRLAKS pages, we also count the version shown, whether a valid address was entered and whether it became a new subscription. A random number is used for that popup alone and is removed after 90 days. The test data contains no email addresses. URL query strings, account/admin pages and personal form data are excluded. Cloudflare temporarily processes the IP address to limit abuse; a rate-limit key hashed with a secret is retained for no more than 30 days. Daily totals are deleted after 13 months. Measurement only takes place with your consent. You can change your choice at any time via Cookie settings. You can decline without affecting the site.

Contact

Schaap's Vishandel · Herenstraat 48 · 2313 AL Leiden · 071 512 4810