Legal
Privacy policy
How Ombra Outdoor Systems handles personal data — what we collect when you request an order, a quote or our newsletter, why we are allowed to, how long we keep it, and what you can ask us to do with it at any time.
1. Who is responsible for your data
Ombra Outdoor Systems ("Ombra", "we", "us") is the controller for the personal data described in this policy. We design and build louvered pergolas and retractable sun shades in Best, the Netherlands, and have done so since 2008.
Ombra Outdoor SystemsDe Maas 14
5684 PL Best
The Netherlands
Chamber of Commerce (KVK): [KVK-NUMMER]
VAT number (BTW): [BTW-NUMMER]
For any question about privacy or personal data — including a request to see, correct or delete your data — write to studio@ombraoutdoor.nl or call +31 499 55 01 20. We have not appointed a data protection officer; privacy questions are handled directly by the studio.
2. What data we process, and why
We only collect data that we need for a specific purpose, and we always have a legal basis under the GDPR (in Dutch, the AVG) for doing so. The table below lists everything we process through this website.
| What we process | Why | Legal basis |
|---|---|---|
| Order request: name, email address, phone number, postcode and address, your message, and the systems and options you selected | To confirm your request by email, price and plan the delivery, and carry out the sale | Performance of a contract, and steps taken at your request before entering into one |
| Quote requests: name, email address, phone number, location and the details of your terrace or project | To prepare a quotation and advise on sizing and mounting | Steps taken at your request before entering into a contract |
| Newsletter: email address | To send occasional notes on new systems and projects, and the welcome discount code | Consent, which you may withdraw at any time |
| Analytics and marketing cookies, and comparable techniques placed through our consent manager | To measure how the site is used and, where you allow it, to measure and target advertising | Consent, given or refused through the Cookiebot banner |
| Server logs: IP address, date and time, pages requested, browser and operating system | To keep the site available and secure, and to investigate errors and abuse | Legitimate interest in a secure, working website |
What we do not collect
Checkout on this site is an order request, not a payment: you submit your request and we confirm it by email within one working day. No online payment is taken at that moment, so we do not collect or store card numbers or bank details through this website. Payment details are exchanged separately once your order is confirmed.
We do not make any decision about you by automated means alone, and we do not build profiles of visitors beyond the aggregated statistics described above.
Our site is intended for adults buying outdoor systems and is not directed at children.
3. How long we keep it
We do not keep personal data longer than we need it. In practice we apply the following periods.
| Order and invoice data | 7 years — the statutory retention period for company records under Dutch tax law |
| Requests that did not lead to an order | 12 months after our last contact, then deleted |
| Newsletter subscription | Until you unsubscribe; your email address is then removed from the mailing list |
| Warranty administration | For the duration of the applicable warranty — 5 years structural on the aluminium frame, 2–5 years on motors and electrical components — as part of the order record |
| Server logs | Kept only as long as the web server retains them, and used for nothing else |
| Cookies | For the lifetime stated per cookie in the Cookiebot consent banner |
4. Who we share it with
We do not sell personal data, and we do not trade or rent it to third parties. We do share it with the suppliers we need in order to run the shop and deliver your system. Each of them acts as a processor on our instructions, may only use the data for the work we give them, and is bound by a processing agreement.
- Hosting provider — stores and serves this website and the messages sent through it.
- Cookiebot — our consent manager, which records whether you accepted or refused cookies.
- Transport partner — receives the name, address and phone number needed to deliver your kit.
- Accountant — processes our invoices and bookkeeping, which include order data.
Beyond these, we only share data where the law requires it, for example with the tax authorities or on a valid request from a competent authority.
The services this website itself depends on are Hostinger (the server it runs on), Microsoft 365 (the mailbox your messages arrive in), Cookiebot, operated by Usercentrics (the consent record), and GoDaddy (the domain name). A transport partner and an accountant are involved once an order is placed.
5. Where your data is stored
We aim to keep personal data within the European Economic Area (EEA). Where a supplier processes data outside the EEA, that transfer must rest on a valid legal mechanism under the GDPR, such as the European Commission's standard contractual clauses or an adequacy decision.
The server that runs this website stands in Frankfurt, Germany, so the site and everything it stores stay inside the EEA. Your messages are delivered to a Microsoft 365 mailbox; Microsoft states where it stores mail for European customers in its own documentation. Where a supplier processes data outside the EEA, that transfer rests on one of the safeguards named above. This paragraph is kept accurate as the setup changes. those facts have been confirmed with each supplier.
6. Your rights
Under the GDPR you have the following rights in respect of the personal data we hold about you.
- Access — to be told whether we process your data and to receive a copy of it.
- Rectification — to have inaccurate or incomplete data corrected.
- Erasure — to have your data deleted, where we have no overriding obligation to keep it, such as the 7-year tax retention period for invoices.
- Restriction — to have our processing limited while a dispute about accuracy or lawfulness is resolved.
- Objection — to object to processing based on our legitimate interest, and to object at any time to the use of your data for direct marketing.
- Portability — to receive the data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller.
- Withdrawal of consent — to withdraw consent at any time, for the newsletter or for cookies. Withdrawing consent does not affect the lawfulness of what we did before you withdrew it.
How to exercise them
Send your request to studio@ombraoutdoor.nl, or write to the address in section 1. We answer within one month of receiving your request; if a request is complex we may extend that period by a further two months and will tell you if we do. To protect your data we may ask you for information that lets us confirm your identity, and we will only ask for what is necessary. Exercising these rights is free of charge.
You can unsubscribe from the newsletter through the unsubscribe link in every mailing, or by emailing us. You can change or withdraw your cookie consent at any time through the Cookiebot consent banner.
If you are not satisfied
We would rather hear from you first, so that we can put things right. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl, or with the supervisory authority in the EU country where you live or work.
7. What this website stores in your browser
Separately from the cookies managed through Cookiebot, the site itself uses your browser's local storage to remember a few things between visits. These entries stay on your own device. They are not sent to us, they are not readable by other websites, and they contain no name, address or contact details.
| ombra-cart | The systems, sizes and options in your cart, so it survives a page reload |
| ombra-lang | The language you selected, so the site opens in it next time |
| ombra-welcome | A marker that the welcome message has been shown, so you only see it once |
| ombra-viewed | The products you recently looked at, used to show "recently viewed" |
| ombra-promo | A discount code you entered, so it still applies when you return to your cart |
You can remove these at any time by clearing the site data for ombraoutdoor.nl in your browser settings. Doing so empties your cart and resets your language choice.
8. How we protect your data
We take appropriate technical and organisational measures to protect personal data against loss and against unlawful access. This site is served over an encrypted HTTPS connection, access to order data is limited to the people in our team who need it for their work, and our suppliers are bound by processing agreements.
No system is entirely without risk. If a data breach occurs that is likely to result in a high risk to your rights and freedoms, we will inform you and the Autoriteit Persoonsgegevens as the law requires. If you believe your data is not secure with us, or you see a weakness in our site, please tell us at studio@ombraoutdoor.nl.
Concretely, and claiming nothing beyond it: the whole site is served over HTTPS with a certificate that renews itself, the server accepts administrative logins by key only and refuses passwords, its firewall leaves only the web and administrative ports open, and no card or payment details are ever entered on or stored by this website. Ombra holds no security certification and does not claim one.
9. Changes to this policy
We may update this policy when our services, our suppliers or the law change. The current version always stands on this page, with the date below. Where a change materially affects how we use data you have already given us, we will draw your attention to it — by email where we have your address for that purpose.
Last updated: 21 August 2026
