Your information deserves care.
How we use your information to deliver your kit, help with your order and keep access secure.
Who is responsible?
The GotThisKit operator below is responsible for the shop’s product delivery, support and related records. Contact hallo@gotthiskit.com about your personal information. Stripe and Link handle their payment and merchant-of-record processing under their own privacy notice.
- GotThisKit operator
- Bart Deblock, trading as GotThisKit
- Business registration
- 0672.948.386
- VAT number
- BE0672948386
- Postal address
- Blijde-Inkomststraat 16, 9000 Gent, Belgium
These details identify the creator of the kits and your product and delivery support contact. Managed Payments purchases are sold through Link; the payment seller’s details appear at checkout and on its invoice.
Information used for your order
We use your purchase email, order and payment references, kit and version, order amounts, payment status and recorded terms or delivery choices to provide downloads, send access emails and handle support. Payment and required billing information are entered on Stripe’s hosted page. GotThisKit has no card-entry form and does not store your full card number. Our order database holds order and tax summaries rather than a separate copy of your full billing address.
We also use access permissions, email delivery records and limited request information to operate and protect the service. Security rate limits use derived request and email identifiers. The access recovery page sends eligible links to the original purchase address without revealing publicly whether an order exists.
Why we use it
Our legal bases are performance of the product-delivery agreement for delivery and related support, legal obligations for records we must keep, and legitimate interests in securing the service and resolving claims. Consent to immediate digital delivery is separate from consent to marketing or optional analytics. We use consent as the legal basis for Google Analytics. There is no newsletter signup in this shop.
Services involved
The delivery system uses Neon for the order database, Vercel for hosting and private file storage, and Resend for transactional email. Resend receives the recipient address and message, including the private access link. Stripe and Link handle payments and payment receipts.
Our Neon database and private Vercel file store are configured in Frankfurt, Germany. Hosting, delivery, email and provider support can also involve processing outside the European Economic Area. Resend stores email data in the United States. Our providers describe their contractual safeguards, including Standard Contractual Clauses and applicable adequacy frameworks, in the Vercel data processing addendum, Neon data processing addendum and Resend data processing addendum. Contact us to request information about the safeguards relevant to your data. We do not promise that all processing remains in the EU.
Essential browser storage
The secure gtk_checkout cookie connects your checkout return with the browser that started it and expires after one day. Access links also expire for security. Stripe and Link describe the storage used on their hosted payment pages in their own notices.
Optional analytics
With your permission, Google Analytics helps us understand visits to public pages and interest in our kits. It processes cookie identifiers, browser and device information, approximate location and interactions such as viewing a kit or opening a sample. Google processes your IP address to provide the service. Advertising features are disabled.
Analytics does not load before you choose “Accept analytics”. Declining does not affect shopping or downloads. We send only known public page paths, without search parameters or URL fragments. We do not send your email, payment details, order references or private download links. Analytics is excluded from checkout, order access and download recovery pages.
Your analytics choice is stored in this browser for 180 days. Analytics cookies are configured to expire after 180 days without an automatic renewal on each visit. Use “Cookie settings” in the footer to change your choice at any time. Withdrawing permission stops analytics and removes the analytics cookies from this browser; it does not undo processing that already took place.
Google may process analytics information outside the European Economic Area. See the Google privacy policy and Google data processing terms for its handling of data and transfer safeguards. Contact us using the details above for questions or requests about your analytics information.
How long information is kept
We retain order and access records while needed to deliver and recover the purchased files, resolve an open support issue or dispute, meet applicable record-keeping obligations, or establish or defend legal claims. We review requests to delete information against these purposes and any legal requirement to retain it. Information no longer needed is deleted or anonymized; a specific legal hold can delay deletion. Expiry of an access link does not itself delete an order or an email. Temporary rate-limit records are cleared by the email worker after they have been expired for one day.
Your rights
Depending on the circumstances, you may request access, correction, erasure, restriction, portability or object to processing based on legitimate interests. Use the contact details; we may need proportionate information to confirm your identity. Some rights have legal limits. You can also complain to the Belgian Data Protection Authority or another competent authority. For information held by Link in its own payment role, use the privacy contact in its notice.