Privacy Policy

Last updated: 19 June 2026

Letters from Mashi is operated by Mashi Peiris, a sole trader registered in the Netherlands. KvK: 90902351, BTW: NL865492530B01. This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website or place an order.

We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and Dutch data protection law (Uitvoeringswet AVG).

If you have any questions, contact us at: hello@mashipeiris.com

1. Who we are (data controller)

The data controller responsible for your personal information is:

Mashi Peiris, Letters from Mashi
Amsterdam, Netherlands
KvK: 90902351
BTW: NL865492530B01
Email: hello@mashipeiris.com

2. What personal data we collect

We collect the following personal data when you place an order or contact us:

  • Full name
  • Delivery address (street, city, postal code, country)
  • Email address
  • Payment information (processed securely via Shopify Payments, we do not store card details)
  • IP address and device/browser information (collected automatically by Shopify)
  • Any information you voluntarily provide when contacting us

3. Why we collect it and our legal basis

We process your personal data for the following purposes:

To fulfil your subscription (legal basis: contract)

  • Process your payment
  • Prepare and dispatch your monthly letter
  • Send you order confirmation and dispatch notifications

To comply with legal obligations (legal basis: legal obligation)

  • Retain transaction records as required under Dutch tax law
  • Respond to lawful requests from authorities

To communicate with you about your order (legal basis: legitimate interest)

  • Respond to customer service enquiries
  • Notify you of any delivery issues

Marketing (legal basis: consent)

  • If you opt in, we may send you occasional updates about Letters from Mashi
  • You can withdraw consent at any time by emailing us or clicking unsubscribe

4. How we share your data

We only share your data with trusted third parties who help us operate the service:

  • Shopify Inc. — our e-commerce platform (data may be processed outside the EEA under standard contractual clauses)
  • Shopify Payments — payment processing
  • PostNL — for physical letter delivery (name and address only)

We do not sell your personal data to any third party.

5. International data transfers

Shopify and Shopify Payments are based in the United States. When your data is transferred outside the EEA, we ensure appropriate safeguards are in place (Standard Contractual Clauses). For more information, see Shopify's Privacy Policy at shopify.com/legal/privacy.

6. How long we keep your data

We retain your personal data for as long as necessary:

  • Order and transaction records: 7 years (required under Dutch tax law)
  • Email correspondence: 2 years from last contact
  • Marketing consent records: until you withdraw consent

7. Your rights under GDPR

As a resident of the EU or EEA, you have the following rights:

  • Right to access — request a copy of your personal data
  • Right to rectification — ask us to correct inaccurate data
  • Right to erasure — ask us to delete your data, subject to legal obligations
  • Right to restriction — ask us to limit how we use your data
  • Right to data portability — receive your data in a portable format
  • Right to object — object to processing based on legitimate interests
  • Right to withdraw consent — for any processing based on consent

To exercise any of these rights, contact us at hello@mashipeiris.com. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

8. Cookies

Please refer to our Cookie Policy for details on how we use cookies on this website.

9. Children

Our service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on our website with a revised date. Your continued use of our service after the date of change constitutes acceptance of the updated policy.

11. Contact

For any questions or requests regarding this Privacy Policy:
Email: hello@mashipeiris.com
Letters from Mashi / Mashi Peiris, Amsterdam, Netherlands