Data controller - Banana Bross (eenmanszaak / sole proprietorship), KvK: 99433656, address: Poolsestraat 26, 5142 RC Waalwijk, Noord-Brabant, the Netherlands. Contact: bananabross.marcin@gmail.com, tel. +31 657 684 041.
User - any person visiting the Website or getting in touch via the contact form.
GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
Supervisory authority - the Dutch data protection authority Autoriteit Persoonsgegevens (AP), available at autoriteitpersoonsgegevens.nl.
Article 2 - Personal data we process
We only process data that the User voluntarily submits via the contact form, together with technical data generated automatically by the server:
Full name
Email address
Phone number
Location of the planned event
Description of the enquiry (event type, details)
IP address and technical metadata (SeoHost server logs)
We do not process payment data, special category data (GDPR Art. 9), or data for marketing purposes.
Article 3 - Personal data of minors
The Website and the services offered are not directed at persons under the age of 16. We do not knowingly collect personal data from children.
If you are a parent or legal guardian and believe your child has provided us with personal data, please contact us at bananabross.marcin@gmail.com. We will delete such data without undue delay.
We do not verify the age of Users who submit the contact form.
Article 4 - Purposes of processing
We process personal data solely for the following purposes:
Responding to a business enquiry - follow-up contact, sending a quote, discussing the details of a planned event.
Fulfilling contractual obligations - performing the agreement if a contract is concluded with the User.
Security and diagnostics - server logs used to detect security incidents and diagnose technical errors.
We do not engage in direct marketing, user profiling, newsletters, or retargeting.
Article 5 - Legal basis
Processing is based on:
GDPR Art. 6(1)(b) - processing is necessary for steps taken at the request of the data subject prior to entering into a contract (handling an event enquiry).
GDPR Art. 6(1)(f) - processing is necessary for the purposes of the legitimate interests pursued by the controller (contact form security, server log maintenance).
Article 6 - Retention periods
Contact form submissions and correspondence - 12 months from the date of last contact, then permanently deleted.
Server logs - in accordance with SeoHost Sp. z o.o. policy (typically 30–90 days).
Active client data - for the duration of the collaboration and for the limitation period under Dutch law (5 years from the end of the collaboration).
After the applicable retention period, data is permanently deleted or anonymised.
Article 7 - Data processors
The following processors handle data on our behalf as part of the Website's operation:
Processor
Purpose
Data processed
Location
Cloudflare Inc.
Turnstile - bot protection for the contact form
IP address, browser fingerprint
EU / USA (Standard Contractual Clauses)
Google LLC (Gmail)
SMTP delivery, administrator inbox
All data submitted via the contact form
EU / USA (SCC)
SeoHost Sp. z o.o.
Website hosting and server logs
All data transmitted through the Website
Poland (EU)
Meta Platforms Inc.
Displaying a Facebook review - only if the User clicks "Show review"
Data passed by the Facebook iframe after a deliberate click
USA (Data Privacy Framework)
Google LLC (YouTube)
Playing a video - only after the User clicks play
Technical data passed by youtube-nocookie.com
USA (Data Privacy Framework)
Embedded content (Facebook, YouTube) only loads after a deliberate User interaction - until that point no data is passed to those parties.
Article 8 - Cookies
A cookie is a small text file stored by the browser on the User's device. The Website uses only essential cookies.
Name
Type
Purpose
Retention
cf_clearance, _cfuvid
Essential (security)
Cloudflare Turnstile - verifies that the form is submitted by a human, not a bot
30 minutes – session
bb_cookies_ack
Functional (preferences)
Remembers that the User has seen the cookie notice. Stored in browser localStorage, not technically a cookie.
Until browser data is cleared
The Website does not use analytics cookies (e.g. Google Analytics), marketing cookies, tracking cookies, or social media pixels (e.g. Facebook Pixel). Cookies can be managed via browser settings - removing them does not affect browsing the Website.
Article 9 - Your rights
Under GDPR (Art. 15–22) you have the following rights:
Right of access - obtain information about the data we hold and a copy of it.
Right to rectification - correct inaccurate or incomplete data.
Right to erasure - request deletion of your data ("right to be forgotten").
Right to restriction of processing - block processing in certain circumstances.
Right to data portability - receive your data in a structured, machine-readable format.
Right to object - object to processing based on the controller's legitimate interest.
Right to withdraw consent - where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Right to lodge a complaint - submit a complaint to the supervisory authority.
We apply appropriate technical and organisational measures to protect personal data:
TLS encryption (HTTPS) for all traffic on the Website.
Configuration data (SMTP credentials, API keys) stored outside the public server directory.
Restricted access to data - only personnel required to handle enquiries.
Regular updates to server software and dependencies.
Despite these measures, no IT system can guarantee complete protection. In the event of a security incident affecting your data, we will notify you in accordance with GDPR requirements.
Article 11 - Contact
For any questions regarding personal data protection, please contact us: