Privacy Policy

Your privacy matters to us. This notice explains what personal data we collect when you use The Waffle, why we process it, how long we keep it, with whom it may be shared and what rights you can exercise.

We process personal data in accordance with the Regulation (EU) 2016/679 (GDPR) and applicable data protection legislation.

Data controller

The data controller is The Waffle.

Email: info@thewaffle.eu

What data we collect

The data we process depends on how you use the website and may include:

• first name and surname;
• email address;
• information relating to your account;
• information about orders and purchased products;
• information needed to manage and verify payments;
• information provided in contact and support forms;
• technical data required for the website's operation and security;
• statistical data relating to website usage.

Please do not enter special categories of personal data in our forms unless strictly necessary to handle your request.

Accounts and purchases

To make a purchase on The Waffle, you must create an account. To create and manage your account, we collect your first name, surname and email address.

We use this information to create and manage your account, process orders, make purchased products available, retain your purchase history, give you access to new available versions and send necessary service communications.

The main legal basis for this processing is theperformance of a contract and the measures necessary to provide the requested products and services. Where certain data must be retained for tax, accounting or other legal requirements, processing is also based oncompliance with legal obligations.

Payments

Payments made on The Waffle are handled through WooPayments, developed in partnership with Stripe. Depending on the device, country and available options, payment methods may include Visa and Mastercard cards and Google Pay.

To process and manage transactions, certain customer, order and payment information is shared with the providers involved in the payment service.

Sensitive card details, such as the full card number and security code, are collected through the payment service’s secure infrastructure and are not stored in our website database. The Waffle instead retains order information and other data needed to link and manage the transaction correctly.

The legal basis for processing is theperformance of a contract and, where applicable, compliance with legal obligations relating to the transaction.

Contact forms

When you use the contact form, we collect the information you voluntarily provide, including your name, email address, subject and message.

The form is managed through WPForms. Requests are stored in the WordPress database and sent to our email inbox so that we can respond.

WPForms is configured not to use user-tracking cookies or store IP addresses and User Agent information through forms.

We use this information to handle your enquiry and any related subsequent communications.

The legal basis may betaking steps prior to entering into a contract at your request, when you contact us about a potential purchase, or our legitimate interest in receiving and responding to enquiries sent to us.

Support requests and tickets

If you are a customer, you can submit a support request from your account area. The request is forwarded to our email inbox and the subsequent conversation is handled by email.

An essential record of the initial request also remains available in your account area. It may include the request ID, relevant product or order, date, subject, message and status.

The record in your account area is not a messaging system: replies and subsequent communications are handled by email.

We use this data to support you with purchased products, orders and your account. The legal basis is theperformance of the contractual relationship and, where applicable, our legitimate interest in documenting and properly managing support requests.

Service emails

We use the email address associated with your account to send communications necessary for the service, such as account and order confirmations, password recovery messages and support-related communications.

Website emails are sent through WP Mail SMTP using the email infrastructure provided by Aruba.

These communications are necessary to provide the service and do not constitute a newsletter or promotional messages.

Newsletters and promotional communications

At present, The Waffle does not operate a newsletter and does not collect email addresses through the website for periodic promotional communications.

If we introduce a newsletter or other direct marketing activities in the future, this notice will be updated and, where required by applicable law, we will ask for your specific consent.

Website analytics

We use Independent Analytics to understand how The Waffle is used and obtain statistics on traffic and page performance.

Independent Analytics runs directly on our website, stores statistical data in the WordPress database and does not use tracking cookies. Data collected by the plugin is not sent to Independent Analytics' servers.

The system temporarily uses technical information such as IP addresses and User Agent data to generate an identifier using a hash function. The IP address used for this process is not stored in the database. Independent Analytics may also derive and store approximate geographic information, such as country, region or city, based on the IP address.

Independent Analytics collects browsing statistics even when you use the website after signing in to your account. The system does not use tracking cookies for this purpose.

Independent Analytics data is configured to be automatically deleted after 2 years.

Hosting and technical infrastructure

The website and its data are hosted using services provided by Aruba. In providing hosting, email, security and technical infrastructure services, the provider may process technical data needed to operate and protect its systems.

We adopt technical and organisational measures appropriate to the risk to protect personal data against unauthorised access, loss, alteration, destruction or improper disclosure.

Social networks

The Waffle includes links to its profiles on Facebook and Instagram.

These are simply links to external platforms. When you choose to open one, you leave our website and any subsequent data processing is governed by the relevant social network's terms and privacy notices.

Cookies and necessary technologies

The website uses cookies and technical technologies necessary for WordPress, WooCommerce, accounts, baskets, checkout, payments and security features to function.

Independent Analytics does not use tracking cookies, and The Waffle does not use Google Analytics.

For more information about cookies and the technologies used by the website, please see our Cookie Policy.

Who we may share data with

We do not sell your personal data. However, to the extent necessary for the purposes described in this notice, we may disclose it to parties that help us provide and manage the service, including:

• hosting, infrastructure and email providers;
• payment service providers;
• technical providers used to operate the website and online shop;
• professionals and advisers where necessary for administrative, accounting, tax or legal requirements;
• public authorities or other parties where disclosure is required by law or necessary to establish, exercise or defend legal rights.

Parties processing data on our behalf are engaged only to the extent necessary to perform their services and in accordance with their roles under applicable law.

International data transfers

Some technology providers used to deliver our services may also process personal data outside the European Economic Area.

Where an international transfer of personal data is subject to the GDPR, it is carried out using the mechanisms and safeguards provided by applicable law, such as an adequacy decision by the European Commission or, where necessary, standard contractual clauses and other statutory safeguards.

How long we retain data

We retain personal data for as long as necessary for the purposes for which it was collected and to comply with applicable legal obligations.

• Accounts and purchases: data needed to maintain your account and purchase history is retained for the duration of your relationship with The Waffle and for as long as necessary to ensure access to products and updates under the purchase terms. Customer accounts are not automatically deleted merely due to inactivity.
• Orders and administrative records: data is retained for the periods required by applicable tax, accounting and civil law. Completed orders needed to document purchases and ensure ongoing product access are not currently subject to automatic deletion solely because time has passed.
• Contact form: requests stored through WPForms are retained for 730 days and then automatically deleted from the website database, unless longer retention is necessary to comply with a legal obligation or to establish, exercise or defend legal rights.
• Support requests through WPForms: the relevant entries are retained in the database for 365 days and then automatically deleted, unless further retention is required by law or to protect legal rights.
• Request history in the account area: the summary of the initial request is retained for 365 days from the submission date and then automatically removed from the relevant history.
• Contact and support emails: messages received and related conversations are retained in the email inbox for as long as necessary to handle the request. We periodically review retained emails and use the following as reference periods: 24 months for contact enquiries e 12 months for support requests, unless further retention is necessary for legal obligations, managing the contractual relationship or protecting legal rights.
• Statistical data: data collected through Independent Analytics is retained for a maximum of 2 years and then automatically deleted according to the system's configuration.

Your rights

If the processing of your data is subject to the GDPR, you may exercise the data protection rights provided for by law, where applicable.

In particular, you may request:

• access to your personal data;
• rectification of inaccurate or incomplete data;
• erasure of data where the relevant conditions are met;
• restriction of processing;
• data portability where provided for by law;
• to object to processing where applicable;
• to withdraw any consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

Erasure of certain data may not be possible where retention is necessary to comply with legal obligations, perform the contract or establish, exercise or defend legal rights.

How to exercise your rights

For requests relating to your personal data or this Privacy Policy, you can contact us at info@thewaffle.eu.

You also have the right to lodge a complaint with the competent data protection supervisory authority, as provided by applicable law.

International users

The Waffle is accessible to users in different countries and may offer them its products. Data processing is organised in compliance with the GDPR and other data protection provisions applicable to The Waffle's activities.

Where applicable law grants you additional rights concerning the processing of your personal data, you can contact us to exercise them.

Changes to the Privacy Policy

We may update this Privacy Policy when the services offered, tools used or applicable legal obligations change.

The updated version is published on this page with the date of the last change. We recommend reviewing it periodically, particularly when we introduce new features or services.

Last updated: 1 October 2026