Privacy Policy

Privacy Policy

Last updated: 25 July 2026

1. Who We Are

This Privacy Policy explains how personal data is processed in connection with the SheetShark website, online store, Microsoft Excel products, Google Sheets templates, customer support and marketing activities. SheetShark is operated by Creative Design and Business V.O.F., also operating under the brands CDB Creative Design and Business and cdb-solutions.

The data controller is:

  • Creative Design and Business V.O.F.
  • Bosstraat 90a, 6071 PZ Swalmen, The Netherlands
  • KVK number: 95234853
  • VAT identification number: NL867052247B01
  • Email: info@cdb-solutions.com
  • Telephone: +31 (0)475 219733

2. Scope

This Privacy Policy applies when you visit our website, create or use a customer account, purchase or download a digital product, use our store chat, contact us, subscribe to marketing communications or otherwise interact with SheetShark. It does not apply to third-party websites, software or services that have their own privacy policies.

3. Personal Data We May Collect

Depending on how you interact with us, we may process the following categories of data:

  • Identity and contact data: name, company name, billing address, country, email address, telephone number and communication preferences.
  • Account data: username, account settings, purchase history, download history and support history.
  • Order and transaction data: ordered products, price, currency, tax information, transaction status, invoice details, order number and payment-provider reference. We do not normally receive or store complete payment-card or bank-account credentials.
  • Communication and chat data: messages, emails, contact-form submissions, chat conversations, support requests, reviews and information you voluntarily provide to us.
  • Technical and usage data: IP address, browser type, operating system, device information, date and time of access, referring URL, pages viewed, downloads, cookie identifiers and similar online identifiers.
  • Marketing data: newsletter subscription status, consent records, campaign interactions and advertising preferences.
  • Compliance and security data: fraud indicators, access logs, consent records, legal requests and information required to establish, exercise or defend legal claims.

4. How We Obtain Personal Data

We may obtain personal data:

  • directly from you when you place an order, create an account, use the store chat or contact us;
  • automatically through the website, cookies, pixels and server logs;
  • from payment, ecommerce, hosting, analytics, advertising and email-service providers;
  • from publicly available business sources where legally permitted; and
  • from another person or business where they lawfully purchase a licence or contact us on your behalf.

5. Purposes and Legal Bases

We process personal data for the following purposes:

  • To take steps before entering into a contract and to perform our contract: processing orders, accepting payment, providing download or copy access, issuing invoices, managing licences, providing customer support and handling complaints.
  • To comply with legal obligations: accounting, tax administration, fraud prevention, consumer-law obligations, record keeping and responding to lawful requests.
  • For our legitimate interests: securing and improving the website, preventing misuse, managing our business, maintaining customer relationships, providing efficient customer service, establishing legal claims and sending permitted marketing to existing customers. We balance these interests against your rights and interests.
  • Based on consent: non-essential cookies, advertising pixels, optional analytics, newsletter subscriptions and any other processing for which consent is legally required. You may withdraw consent at any time with future effect.

6. Website Access and Server Logs

When you access the website, our hosting and security systems may automatically process technical information such as your IP address, requested page, date and time, data volume, referrer, browser and operating system. We use this information to deliver the website, maintain stability, detect attacks, investigate misuse and protect our systems. Server logs are not used to identify you unless this is necessary for security, fraud prevention or legal enforcement.

7. Cookies and Similar Technologies

We use essential cookies and similar technologies to provide the website, remember privacy choices, secure checkout and enable downloads or copy access. With your consent, we may also use analytics, personalisation and advertising technologies. Non-essential technologies are not activated for visitors in regions where prior consent is required unless valid consent has been obtained.

You can manage or withdraw your choices through the cookie settings on our website. You can also restrict cookies through your browser, although some functions may then be unavailable. We use Complianz to record and manage cookie choices.

8. Contact by Email, Contact Form and WhatsApp

When you contact us by email, contact form or WhatsApp Business, we process your contact details, message content and any order or account information needed to answer your request. The processing is based on the performance of a contract or steps requested before entering into a contract, or on our legitimate interest in providing efficient customer service.

WhatsApp is provided by Meta Platforms Ireland Limited and related companies. When you use WhatsApp, that provider also processes data under its own privacy terms. Do not send sensitive personal data, payment credentials or confidential spreadsheet data through WhatsApp unless specifically requested through a secure process.

9. Shopify Inbox and AI-Assisted Customer Service

We use Shopify Inbox to provide customer support through the chat function available on our online store. When you use the chat, we may process your name, contact details, message content, conversation history, account information, order-related information, device information and any other information that you voluntarily provide during the conversation.

Shopify Inbox may use an artificial-intelligence-based customer-service agent to analyse customer enquiries and generate or automatically send responses. The AI agent may use information from our product catalogue, store content, shipping information, return and refund policies, frequently asked questions, store policies and the current conversation to answer questions about our products and services.

Where necessary to handle your request, the AI agent may also process information relating to your customer account, order or previous support interactions. Please do not provide payment-card details, passwords, confidential spreadsheet content, health information or other sensitive personal data through the chat.

AI-generated responses may be incomplete, inaccurate or unsuitable for an individual situation. You may request that your enquiry be reviewed or handled by a human member of our team at any time.

The processing is carried out to respond to customer enquiries, provide customer support, manage orders, improve service efficiency and protect the store against misuse. Depending on the nature of the enquiry, the legal basis is the performance of a contract, taking steps at your request before entering into a contract, compliance with a legal obligation or our legitimate interest in providing efficient customer service.

Shopify International Limited and its affiliated companies provide the Shopify Inbox and related artificial-intelligence infrastructure and may process personal data in connection with these services. Shopify may also process certain information under its own privacy terms where it acts independently as a data controller.

10. Customer Accounts

If you create a customer account, we process the information required to create, secure and manage the account, display purchases and provide access to downloads or template-copy links. You may request deletion of your account. We may retain order, invoice, fraud-prevention and legal records where required or permitted by law after the account itself has been closed.

11. Orders, Digital Delivery and Payments

To process an order, we use identity, contact, billing, order and transaction data. We may disclose the necessary information to our ecommerce platform, hosting provider, payment provider, tax or invoicing service, fraud-prevention provider and professional advisers.

Available payment methods may include services provided by PayPal (Europe) S.à r.l. et Cie, S.C.A. If you select a PayPal payment method, PayPal receives the information required to process the transaction and may carry out fraud, identity or credit-risk checks under its own terms and privacy policy. We do not control PayPal's independent processing.

12. Shopify Ecommerce Platform

Our online store is hosted and operated using the ecommerce platform provided by Shopify. Shopify provides the technical infrastructure required to display and operate the store, manage customer accounts, process orders, operate the checkout, provide digital products, manage communications and protect the store against fraud, misuse and security threats.

In connection with these services, Shopify may process personal data such as your name, contact details, billing and delivery information, IP address, device and browser information, customer account information, order details, payment-related information, cookie identifiers and information about your interactions with the store.

Depending on the Shopify services and features used, Shopify may process personal data on our behalf as a service provider or processor. In certain circumstances, Shopify may also process personal data for its own purposes as an independent controller, as described in Shopify's own privacy documentation.

Shopify International Limited generally provides Shopify services to merchants located in the European Economic Area, the United Kingdom and Switzerland. Shopify may use affiliated companies and service providers located in other countries, including Canada and the United States. International transfers are protected using legally recognised safeguards where required.

13. Google Sheets and Third-Party Platform Access

Some SheetShark products may be supplied through a Google Sheets template or a link that allows the customer to create a copy in their own Google account. Google processes account, device and usage information independently under its own terms and privacy documentation. Unless a separate support or customisation service is expressly agreed, we do not receive access to the customer's private copy or to the operational data entered into it.

Customers should not grant us editing access to a spreadsheet containing personal, confidential, financial, medical or other sensitive information unless this is necessary for an agreed service and an appropriate secure process has been arranged.

14. Email Marketing and Brevo

If you subscribe to our newsletter, we process your email address and consent record to send SheetShark news, product updates and offers. We may use a double-opt-in process. You can unsubscribe at any time using the link in an email or by contacting us.

Where permitted by applicable law, we may send existing customers marketing about our own similar products. You can object at any time. We use Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, to manage email communications. Campaign analytics such as opens and clicks are used only where permitted and, where required, with consent.

15. Analytics and Advertising

With your consent, we may use Brevo Tracker and Meta Pixel, including advanced matching where enabled, to measure website use, evaluate advertising, attribute purchases and show more relevant advertisements. These tools may process identifiers, IP address, browser and device information, page visits, interactions and order-event data. Where advanced matching is used, identifiers are generally transformed before transmission.

Meta Platforms Ireland Limited and related companies may process received data for their own purposes under their privacy terms. You can withdraw consent through our cookie settings. Rejecting advertising cookies does not affect access to purchased downloads.

16. Recipients and Service Providers

We may share personal data, only as necessary, with:

  • Shopify and other website hosting, security, ecommerce and cloud-service providers;
  • payment, invoicing, accounting and tax-service providers;
  • email, customer-support, chat, artificial-intelligence, analytics and advertising providers;
  • professional advisers, insurers, auditors and debt-collection providers;
  • public authorities, regulators, courts and law-enforcement bodies when legally required; and
  • a buyer, investor or successor in connection with a genuine corporate transaction, subject to appropriate safeguards.

Service providers that process personal data on our behalf are contractually required to protect it and use it only for authorised purposes.

17. International Data Transfers

We are established in the Netherlands, but some service providers may process data outside the European Economic Area, including in Canada and the United States. Where European data-protection law applies, we use a legally recognised transfer mechanism, such as an adequacy decision, valid participation in an approved data-privacy framework, standard contractual clauses or another lawful safeguard. Additional safeguards are applied where required.

18. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, including providing downloads, copy access, chat services and support, maintaining licence and transaction records, complying with tax and accounting obligations, preventing fraud and resolving disputes. Retention periods vary by data type and legal requirement.

  • Order, invoice and accounting records are retained for the legally required period.
  • Account data is generally retained while the account remains active and then deleted or limited, subject to mandatory retention.
  • Support and chat communications are retained as long as reasonably necessary to resolve the request, improve customer service and protect legal interests.
  • Marketing data is retained until you unsubscribe, object or withdraw consent, subject to retaining a minimal suppression record.
  • Cookie and consent records are retained for the period necessary to demonstrate and respect your choices.

19. Security

We use reasonable technical and organisational safeguards designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures may include encrypted connections, access controls, backups, updates and service-provider assessments. No internet transmission or storage system can be guaranteed to be completely secure.

20. Your European Data-Protection Rights

Where the General Data Protection Regulation or equivalent law applies, you may have the right to:

  • request access to your personal data;
  • request correction of inaccurate or incomplete data;
  • request deletion of personal data;
  • request restriction of processing;
  • receive data in a portable format where the legal conditions are met;
  • object to processing based on legitimate interests, including direct marketing;
  • withdraw consent at any time with future effect; and
  • lodge a complaint with a supervisory authority.

In the Netherlands, the competent supervisory authority is the Autoriteit Persoonsgegevens. To exercise a right, contact info@cdb-solutions.com. We may request information reasonably necessary to verify your identity.

21. United States State Privacy Rights

Depending on your state of residence, the nature and scale of our activities and whether an applicable state privacy law covers us, you may have rights to request access, correction, deletion or a portable copy of personal information, and to opt out of certain targeted advertising, sales, sharing or profiling. You may also have the right to appeal a denied request.

We do not sell personal information in exchange for money. If advertising cookies or pixels are enabled, some disclosures to advertising partners may be treated as a “sale,” “sharing” or targeted advertising under certain state laws. You can opt out by rejecting advertising cookies in our cookie settings and, where applicable, by using a legally recognised universal opt-out signal supported by our systems.

We do not knowingly use or disclose sensitive personal information for purposes that require a separate right to limit under applicable U.S. state law. We will not discriminate against you for exercising an applicable privacy right.

22. Children

The website and products are intended for adults and business users. We do not knowingly collect personal data from children under 13. If you believe a child has provided personal data to us without appropriate authorisation, contact us so that we can investigate and delete it where required.

23. Automated Decision-Making and Artificial Intelligence

We may use artificial-intelligence-based tools to support customer service, generate suggested responses, categorise enquiries and provide automated answers through Shopify Inbox. These tools are used to assist communication and customer support.

We do not use solely automated decision-making that produces legal or similarly significant effects concerning customers. You may request human review of an AI-generated response. Payment, fraud-prevention and security providers may use automated tools under their own responsibility and privacy terms.

24. Changes to This Privacy Policy

We may update this Privacy Policy when our products, website, service providers or legal obligations change. The current version will be published on this page with a revised “Last updated” date. Where required, we will provide additional notice or request renewed consent.

25. Contact

Questions, privacy requests and complaints can be sent to info@cdb-solutions.com or by post to: Creative Design and Business V.O.F., Bosstraat 90a, 6071 PZ Swalmen, The Netherlands.