Privacy Policy
DRAFT — pending legal review. This document is a carefully prepared draft and has not yet been reviewed by a lawyer. No rights may be derived from this version until the final version is published.
Version 1 (draft) — 13 July 2026
Picked B.V. ("Picked", "we") provides a software-as-a-service warehouse management system via picked.nl and the accompanying mobile apps. This privacy policy explains which personal data we process, why, for how long, and what rights you have.
Registration with the Dutch Chamber of Commerce (KVK) is in progress; the KVK and VAT numbers will be published here as soon as registration is completed.
Contact: privacy@picked.nl
1. Two roles: controller and processor
Under the GDPR, Picked acts in two distinct roles, each with its own regime:
- Picked as controller. For the data we manage ourselves: your account, workspace settings, billing, support conversations, and (only with consent or on the basis of legitimate interest) marketing communication. This policy applies to those directly.
- Picked as processor. For the warehouse data our customers (the "tenant") put into Picked: products, stock, orders, and the data of their customers on orders and shipping labels. The tenant is the controller for that data; we process it exclusively on the tenant's instructions, under the Data Processing Agreement.
If you appear on a shipping label of a webshop that uses Picked, that webshop is your first point of contact for privacy requests; we support the webshop in handling them as its processor.
2. What data we process
As controller
| Category | Examples | Legal basis |
|---|---|---|
| Account data | Name, email address, password (hashed), language preference, two-factor settings | Performance of contract (art. 6(1)(b) GDPR) |
| Workspace and billing data | Company name, subdomain, subscription details, payment status (payment details themselves are held by Stripe) | Performance of contract; statutory (tax) retention duty |
| Usage data | Login events, active sessions, audit-log entries of administrative actions, and floor-device identifiers (install id, platform, model, owner-given label) linked to a workspace and, through a session, to the operator who used the device | Legitimate interest (security, accountability) |
| Support data | Messages to support (incl. the AI chat), email correspondence | Performance of contract |
| Waitlist and marketing data | Email address, moment of consent and the disclosure text shown | Consent (art. 6(1)(a)); you can unsubscribe at any time |
| Error reports | Technical error reports with personal data removed (PII scrubbing before transmission) | Legitimate interest (stability) |
As processor (tenant warehouse data)
Products, locations, stock levels and movements, orders and order lines (including name and address data of the tenant's customers), shipping labels, and the operational activity of warehouse operators (picks, sessions, time per action). The tenant decides which data is entered; the arrangements are set out in the Data Processing Agreement.
3. Where your data lives: the Netherlands
Warehouse data stays in the Netherlands by default: the database, cache and file storage run on Dutch infrastructure (TransIP), under Dutch and European law. This is a deliberate design choice, not an afterthought. Database backups are encrypted and remain within the EU; the chosen storage provider is listed on the sub-processor list.
A limited number of sub-processors process specific data outside that core. The complete, current list — with purpose and region per sub-processor — is published at picked.nl/legal/sub-processors and forms part of this policy. In summary:
- TransIP (NL) — hosting, database, storage, backups, transactional email.
- Stripe (EU/US, with SCCs) — payments and billing.
- Sentry (EU, Frankfurt) — error reporting; personal data is removed before transmission.
- Anthropic (US) — only for the AI features: the text you give the AI and the process/catalog structure needed for it. No stock data, no end-customer data. Our data is not used for training.
- CM.com (EU) — SMS notifications, only when a tenant enables them.
- Sendcloud / PostNL (NL) — shipping labels, only for tenants that use shipping (the recipient's name and address are necessary for this).
- BetterStack (EU) — uptime monitoring and the public status page (no tenant data).
- Cloudflare (EU/US) — content delivery (CDN) and bot protection on our sign-up and login forms. It does not store your files.
4. Cookies
Picked uses functional cookies only: session and security cookies (login, CSRF protection) and preference settings (such as theme and sidebar state). We use no tracking or advertising cookies and no third-party analytics cookies. That is why there is no cookie consent wall; we only inform you.
5. Retention periods
- Account and workspace data: for as long as the account is active. After cancellation or an erasure request, a 30-day recovery window applies, after which all tenant data is permanently deleted, including files and exports; event records are irreversibly anonymised. Erased data may persist in encrypted backups for up to 90 days, after which it expires automatically; backups are never used to restore erased data to live systems.
- Billing data: 7 years (statutory tax retention).
- Audit and security logs: for as long as the tenant is active.
- Waitlist/marketing: until unsubscribe or at most 2 years after the last contact.
6. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. For accounts and workspaces this is largely self-service: view and edit data in the portal, request a full data export via Settings → Data & privacy, and start workspace deletion there as well. For everything else: email privacy@picked.nl. We respond within 30 days.
You can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).
7. Security
Encrypted connections (TLS), encrypted storage of integration credentials, strict tenant isolation (enforced in the application layer and covered by the automated test suite), role-based access control, and logging of administrative actions. In the event of a data breach that poses a risk, we notify the Autoriteit Persoonsgegevens within 72 hours and inform affected tenants without undue delay.
8. Changes
For any substantive change we increment this document's version number and ask tenants to confirm the new version at their next login. The current version is always available at picked.nl/privacy.