Privacy Policy

1. Introduction & Controller Identity

This Privacy Policy explains how Carton Bottles B.V. ("we," "us," "our") collects, uses, and protects your personal data when you visit brolvatek.site (the "Website"). Carton Bottles B.V. is the data controller responsible for your personal data as defined under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming).

• Data Controller: Carton Bottles B.V.
• Registered Address: Churchill-laan 74 H, 1078 EK Amsterdam, Netherlands
• Contact Email: [email protected]
• Telephone: +31 20 794 3186

This Privacy Policy is effective as of 14 February 2026 and applies to all personal data processed through the Website.

2. Personal Data We Collect

We collect the following categories of personal data:

• Identity & Contact Data: Name and email address provided through our contact form.
• Form Content: The subject selection and message body you submit via the contact form.
• Technical Data: IP address, browser type and version, operating system, device type, preferred language, and screen resolution — collected automatically via server logs.
• Usage Data: Pages visited, time spent on pages, referring URL, click paths, and timestamps.
• Cookies & Identifiers: Cookie data as described in Section 4 below and in our Cookie Policy.
• Conversion Events: Form submission events and page-interaction signals used to measure the effectiveness of any advertising.

We do not collect special-category data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or sexual orientation), financial account details, or government-issued identification numbers.

3. Why We Process & Legal Basis

We process your personal data for the following purposes, each tied to a specific legal basis under GDPR Article 6:

• Responding to contact form submissions: Art. 6(1)(b) — necessary for the performance of a contract or to take steps at your request prior to entering into a contract; and Art. 6(1)(a) — your explicit consent via the consent checkbox.
• Website analytics: Art. 6(1)(a) — your consent, obtained through our cookie consent mechanism before any analytics cookies are placed.
• Marketing and remarketing: Art. 6(1)(a) — your consent, obtained through our cookie consent mechanism before any marketing cookies are placed.
• Website security and fraud prevention: Art. 6(1)(f) — our legitimate interest in maintaining a secure, functional website and protecting against malicious activity.
• Legal and tax obligations: Art. 6(1)(c) — compliance with applicable Dutch and EU legal requirements.

Automated Decision-Making (Art. 22): We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on you.

4. Cookies & Tracking Technologies

We use cookies and similar technologies in three categories, consistent with our Cookie Policy:

Essential Cookies (no consent required, always active)

• _site_session: Maintains your browsing session. First-party, session duration.
• cookie_consent: Records your cookie preference choice. First-party, 12 months.

Analytics Cookies (consent required)

• _ga: Google Analytics 4 user identifier, with IP anonymisation enabled. Third-party, 2 years.
• _ga_XXXXXXXXXX: GA4 session state (10-character GA4 measurement ID). Third-party, 2 years.

Analytics data retention is set to 14 months.

Marketing Cookies (consent required)

• _gcl_au: Google Ads conversion linker. Third-party, 90 days.
• _fbp: Meta Pixel browser identifier. Third-party, 90 days.
• _fbc: Meta Pixel click identifier (set when a click ID is present). Third-party, 90 days.

Marketing cookies are used for remarketing, custom and lookalike audience building, and conversion attribution. Beyond cookies, we may use pixel tags (gtag.js, Meta Pixel), server-side event processing via Meta Conversion API or Google Server-Side Tag Manager (with hashed identifiers), and device identifiers derived from IP address and User-Agent string.

5. Consent (EEA/UK)

Users in the European Economic Area (EEA) and the United Kingdom receive a consent notice under the GDPR and UK GDPR respectively. Marketing and analytics cookies are activated only after you provide explicit, informed, and freely given consent in accordance with Article 6(1)(a) GDPR. Your consent choice is recorded in the cookie_consent browser cookie, which is retained for 12 months.

You may withdraw your consent at any time by clicking "Manage cookie preferences" in the website footer or by clearing your browser cookies. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6. Sharing With Advertising & Service Partners

We may share personal data with the following categories of third-party service providers, solely for the purposes described in this Privacy Policy:

• Google LLC (Google Analytics 4, Google Ads, Google Tag Manager, Remarketing): cookie identifiers, usage data, conversion events, and remarketing lists. Google's privacy policy: policies.google.com/privacy.
• Meta Platforms, Inc. (Meta Pixel, Custom Audiences, Lookalike Audiences, Conversion API): page view events, conversion events, audience membership, and hashed identifiers. Meta's privacy policy: facebook.com/privacy/policy.
• Cloudflare, Inc. (CDN and security services): IP-based threat detection and traffic routing. Cloudflare's privacy policy: cloudflare.com/privacypolicy.

We do not sell personal data. These providers may not use data collected from our Website for their own independent commercial purposes beyond providing the services described.

7. International Transfers

Some of our service providers (notably Google LLC and Meta Platforms, Inc.) are based in the United States. When personal data is transferred outside the EEA or the UK, we rely on the following safeguards:

• EU-US Data Privacy Framework (primary mechanism, effective since July 2023)
• UK Extension to the Data Privacy Framework
• Swiss-US Data Privacy Framework
• Standard Contractual Clauses (EU Commission Decision 2021/914) as a fallback mechanism
• UK International Data Transfer Agreement (IDTA) as a fallback for UK transfers

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Contact form submissions: 2 years from your last interaction with us.
• Analytics data: 14 months (as configured in Google Analytics 4).
• Marketing cookies: per individual cookie lifetime (see Section 4).
• Email correspondence: duration of the relationship plus 1 year.
• Server logs: 90 days, then automatically purged.
• Cookie consent records: 3 years for audit and compliance purposes.
• Legal and tax records: as required by applicable Dutch law (typically 7 years for fiscal records under the Algemene wet inzake rijksbelastingen).

9. Your Rights Under the GDPR & UK GDPR

You have the following rights regarding your personal data:

• Right of Access (Art. 15): Obtain confirmation of whether we process your data and request a copy.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
• Right to Erasure (Art. 17): Request deletion of your personal data, subject to applicable legal retention obligations.
• Right to Restriction of Processing (Art. 18): Request that we restrict the processing of your data in certain circumstances.
• Right to Data Portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests.
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint (Art. 77): File a complaint with the relevant supervisory authority.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days, extendable by 60 days for complex requests. We may need to verify your identity before processing your request.

Lead Supervisory Authority: Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Bezuidenhoutseweg 30, 2594 AV Den Haag, Netherlands. Website: www.autoriteitpersoonsgegevens.nl.

10. Children

This Website is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a person under 16 without verifiable parental consent, we will delete that data promptly. If you believe a child has provided us with personal data, please contact us at [email protected].

11. Do Not Track

This Website does not respond to "Do Not Track" (DNT) browser signals. There is currently no uniform standard for interpreting DNT signals, and we rely on our cookie consent mechanism as the primary means of honouring your tracking preferences. Third-party providers listed in Section 6 may have their own DNT handling practices, which are governed by their respective privacy policies.

12. Account & Data Deletion

To request deletion of all personal data we hold about you, send an email to [email protected] with the subject line "Data Deletion Request." We will complete the deletion within 30 days of verifying your identity. Limited data may be retained beyond this period only where required by Dutch law (for example, fiscal record-keeping obligations under the Algemene wet inzake rijksbelastingen).

13. Business Transfers

In the event of a merger, acquisition, asset sale, financing, or insolvency involving Carton Bottles B.V., personal data may be transferred to a successor entity as part of the transaction. If such a transfer materially changes how your data is used, we will notify you via a prominent notice on the Website before the transfer takes effect, and you will have the opportunity to exercise your rights as described in Section 9.

14. California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information.

Categories disclosed in the past 12 months:

• Identifiers (name, email address, IP address, device identifiers) → disclosed to service providers and advertising partners.
• Internet/network activity (browsing history, page interactions) → disclosed to analytics and advertising providers.
• Inferences (interests and preferences derived from usage data) → disclosed to advertising partners.

We do not sell personal information as defined by the CCPA. We do share personal information for cross-context behavioural advertising. California residents may opt out of this sharing via our cookie preferences panel accessible through the "Manage cookie preferences" link in the website footer.

Your California Rights: Right to Know, Right to Delete, Right to Correct, Right to Opt-Out of sale or sharing, and Right to Non-Discrimination. To submit a request, email [email protected] with the subject line "California Privacy Request." Identity verification is required. Authorised agents must provide written proof of authorisation.

15. Virginia Residents (VCDPA)

If you are a Virginia resident, the Virginia Consumer Data Protection Act (VCDPA) grants you the following rights: Access, Correction, Deletion, Data Portability, and the right to Opt-Out of targeted advertising.

To submit a request, email [email protected] with the subject line "Virginia Privacy Request." We do not sell personal data or engage in profiling that produces legal or similarly significant effects.

If we decline your request, you may appeal by emailing us with the subject line "Appeal of Refusal — Privacy Request." We will respond to your appeal within 60 days. If the appeal is not resolved to your satisfaction, you may contact the Virginia Attorney General.

16. Nevada Residents

Nevada residents may submit a verified opt-out request by emailing [email protected] with the subject line "Nevada Do Not Sell Request." We do not currently sell personal information as defined under Nevada Revised Statutes Chapter 603A.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Material changes will be announced via a prominent notice on the Website homepage at least 14 days before taking effect. The "Last Updated" date at the top of this page will be revised with each update. We encourage you to review this page periodically.

18. Contact

For any questions, concerns, or requests related to this Privacy Policy or our data processing practices, please contact us:

• Carton Bottles B.V.
• Churchill-laan 74 H, 1078 EK Amsterdam, Netherlands
• Email: [email protected]
• Phone: +31 20 794 3186