Privacy Statement

Version: June 2024

Your privacy is very important to us. Therefore we want to be transparent about the data we collect about you, how we use it and make sure you understand your rights. As a member of ON THAT ASS you can be ensured your personal data is protected according to the standards of the European General Data Protection Regulation (the GDPR).

We handle your data with care! You can rely on this. We protect your data with our secure systems and have never sold and will never sell your personal information to third parties. Everything about how we handle your personal data is explained below. If there is anything that isn’t clear, feel free to contact us.

Topics

We use your personal data for various reasons and purposes. To process your data, we must first have a valid reason to do so (a so-called "legal basis"). We only use your data for the purposes that we have included in this Privacy Statement and purposes consistent therewith. We process your data for the following reasons and purposes.

To perform the agreement we have with you
By placing an order and creating an account on our website, you enter into an agreement with us. This agreement allows us to provide you with your monthly subscription for our boxers and/or other items. This also includes the use of our Loyalty Program, where you can exchange ON THAT ASS store credit for merchandise items. To perform the agreement, we must be able to contact you about your subscription and to be able to send you the monthly order. For this, we process your name, address, phone number, and e-mail address. We must also verify your age to ensure that you meet our age requirement to sign up for a membership. For this, we process your date of birth.

We must also be able to collect payment for the subscription, therefore we process your payment details (such as an IBAN number or PayPal details).

Changes you make to your account are saved. This way we can see when you changed your size or changed your address, etc. We use this data to serve you as best as possible. For example, if you have not received your boxers at your new address after an address change, it is possible that you submitted your change just a little too late. By saving the logs, we can go through them with you and offer you an appropriate solution.

If you contact us via our Customer Service channels (such as our website and our social media channels), we process the data in these conversations to help you and answer your questions. We also like to see your reactions on and about ON THAT ASS on social media and try to respond to these. For actual help with your subscription, however, we refer you to our official Customer Service channel. Messages sent on a social media platform remain in the social media channels.
If you do not want to provide personal data, we cannot perform the agreement with you. In that case, we cannot provide our services to you.
We do not use this data for other purposes, unless we have asked for your specific consent, have a legitimate interest, or a legal obligation to do so.

For our legitimate interest to promote our services to our existing members
If you are an existing member, we would like to send promotional offers and newsletters from time to time. For this, we process your name and e-mail address. If you do not want to receive these messages, you can always unsubscribe from them at the bottom of one of the promotional messages.
If you are not registered as a member, we only process your name and e-mail address and we will send you promotional offers and newsletters if you have given consent for this. You can withdraw this consent at any time by unsubscribing at the bottom of one of the messages.

To provide you with services for which you have specifically given consent
We want to place tracking cookies on your device, which we use to register your preferences for our website and to show you personalized advertisements. These cookies are only placed on your device if you give consent for this in the cookie banner on our website. You have the option to withdraw your consent for our cookies at any time. You can withdraw your consent for tracking cookies by clicking on the “reject all” button. This cookie banner can also be found at the bottom of every page on our website under “Cookie Statement”.
If you have an account that also includes a subscription to our Boys Collection, we process the name of your child(ren), so that they receive their own product, which makes it more fun! You can always let us know when you no longer want to use the name/names.

For our legitimate interest to improve our products and services
We process analytical data that allows us to understand how we can improve our tools and services for you. This analytical data is collected from your visits to our website and/or social media channels. If we process this data for this purpose, we ensure that it cannot be traced back to you as an individual.

For our legitimate interest to prevent fraud or abuse of our services
If you are a new member of our subscription services, you are entitled to a free ON THAT ASS item. This only applies to new members. To prevent fraud and/or abuse of our services, we process your payment details and use them to verify whether you have been a member in the past when you create a new account. Please keep in mind that you are no longer entitled to a free item if you have left us. But especially keep yourself informed, we always have great promotions!

To comply with our legal obligations
As an organization, we are legally obliged to keep our administration for seven years.

We have never sold your data to third parties and will not do so in the future.
We do share your data with a number of third parties in order to provide and improve our services to you. Before we share our data, we assess which data we need to share with our partners in order to work with them, so that we ensure that no unnecessary personal data is shared.
If we share your data with third parties outside the European Economic Area, we take measures to ensure that appropriate security technical and organizational measures are taken to ensure that your data is processed in accordance with the GDPR. These measures may include:
- Ensuring that the third party is located in a country that provides data protection laws that offer sufficient protection;
- Imposing contractual obligations on the third party using provisions formally issued by data protection authorities;
- Ensuring that the third party is part of international frameworks for data protection that aim to ensure protection.

ING.
We share your first name, last name, and IBAN with our bank, ING, so that the monthly payment can be set up. Naturally, this is handled with care and ING will not use your data for third parties. It is therefore only possible to change your bank details online, so that we can be sure that the new bank details are yours. Should you experience any problems with this, please contact us and we will personally help you find a safe and secure solution. We also share this data with our mail service Customer.IO, so that emails, such as a payment notification, can be sent to you.

Customer.io
We share your first name, last name, and email address with Customer.IO, so that we can send personalized emails to the correct email address and send you promotional campaigns about our personal and latest offers. You can unsubscribe from these campaigns at any time or object to this email service. Customer.IO has assured us that they will not share your data. We refer to their privacy policy https://customer.io/legal/privacy-policy to understand how they process your data.

PostNL or a local postal service
We share your data with our Dutch partner PostNL, so that your items end up in your mailbox as quickly as possible. We share your first name, last name, and address details with PostNL, so that they know at which address your items should be delivered. We refer to the privacy policy of PostNL (https://www.postnl.nl/en/privacy-statement/) to understand how they process your data. If you receive your product in another country, PostNL will hand over your package to the local postal and parcel service.

The GDPR grants certain rights regarding the protection of your personal data. We inform you about these rights in the list below. If you wish to exercise (one of) these rights, you can do so via your personal account page, by contacting our Customer Service, or by sending an email to our Data Protection Officer at dpo@onthatass.com.

Unsubscribing from your subscription
You can unsubscribe from your subscription at any time from your account. You will then no longer receive new orders, but you will remain a member. Please note that a notice period of one month may apply.

Access to the data we process about you
Information about most of the data we process about you is accessible by logging into your account. You can request us for a complete copy of all the data we process about you.

Rectification of the data we have processed about you
If you have determined that we process incorrect or incomplete data about you, you can request us to supplement or correct this data. You can also correct or supplement most of your personal data in your account yourself.

Requesting us to delete your data
You have the right to request us to delete your data. You can do this via the "delete personal data" button in your profile or by contacting our Customer Service or Data Protection Officer.

We may refuse your request to delete your data, if for example (one of) the following situations applies:
- If you have an active subscription, which means there are planned deliveries. We can only delete your data if you unsubscribe from the monthly subscription and the notice period has expired;
- If you have outstanding payments. We can only delete your data if there are no outstanding payments;
- If we need to keep data for reasons of public interest or in the area of public health;
- If we need to keep the data for the establishment, exercise, or defense of legal claims;
- If we are legally required to keep your data by an official authority.

If we refuse to delete your data, you will be contacted by one of our employees about the reasons for refusal and informed about the right to file a complaint with the local data protection authority.

If we comply with your request to delete your data, your account will be terminated. This cannot be undone. You must subscribe again if you want to return as a member. Apart from exceptions, we do not delete your payment details. Your payment details are stored separately, pseudonymized, and encrypted, so that we can verify whether you have already received a free ON THAT ASS item if you choose to register as a member again. We will not use these payment details for other purposes.

Withdrawing your consent for marketing purposes and tracking cookies
You have the right to withdraw your consent for the processing of your data for marketing purposes (if you are not an existing member) and tracking cookies
You can unsubscribe from marketing emails and our email service Customer.IO via the last email you received. Click on "unsubscribe" at the bottom of the last email you received or change your newsletter preference in your account. You will then only receive emails regarding important account information or payments, unless you request us to delete your account.

You can withdraw your consent for tracking cookies by clicking on the "reject all" button. This cookie banner is also to be found at the bottom of every page on our website under "Cookie Statement"

Requesting a portable copy of your data
You have the right to request us to provide an electronic copy of the data we process about you for portable use and, if possible, transfer it to another organization.

Requesting restriction of the processing of your data
You can request restriction of the processing of your data in the following situations:
- If you dispute the accuracy of your personal data, for the period in which we have not yet verified the accuracy of the personal data;
- If we process your data unlawfully, but you do not want us to delete your data; - If we no longer need your data for one of our purposes, but you want us to keep your data for the establishment, exercise, or substantiation of a legal claim;
- If you have objected to the processing of your data based on (one of) our legitimate interests and we have not yet responded to your objection.

Right to object
You have the right to object to the processing of your personal data by us.
Note: if you do not use the buttons in your account, but make a request about your personal data via the contact option of the Customer Service, the Customer Service will verify your identity and account details via email. If we cannot verify your identity, we will inform you that your request could not be executed. You always have the opportunity to contact our Data Protection Officer about this, file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP), and start a procedure at the competent court.

Every request for data from a member will be confirmed and/or answered within a month. This period can be extended by two months if your request is complex or if you have submitted several requests. We will inform you about this extension if we need to make use of it.

Last update: June 2024