Privacy statement
Last updated on August 26, 2026.
[TO BE CONFIRMED] The legal name and postal address of the data controller are still missing here, as are the names of the mail provider and the host. Without those details this statement is incomplete, and that should be said rather than invented.
Who is responsible
My Wish List is a small Belgian platform. For questions about your data, or a complaint about how we handle it, write to info@javastart.be. A human being reads it.
What we keep, and why
- Your first name, your surname, your e-mail address and your language. Needed to recognise you, to address you, and to tell you apart from someone with the same first name in the same family. We ask for nothing more: no date of birth, no postal address, no phone number on your account.
- What you put on your lists yourself: titles, links, prices, notes and photos.
- The names and addresses of the people you invite. You give them to us, and we use them only to show them your list and to send their invitation.
- A session cookie and a language cookie. There are no others, so there is no cookie banner. Server logs contain IP addresses and timestamps; they serve to counter abuse and are erased after thirty days.
On what basis
Performance of the contract you enter into with us when you create an account, and our legitimate interest in countering abuse. For the e-mails that come with using the service, such as the confirmation, the invitation and your draw, no separate consent is needed. We send commercial messages only if you consent to them yourself at sign-up or on your profile, and you can withdraw that consent at any time. We record when you gave or withdrew it, because otherwise we could not show that we kept to it.
For how long
- As long as your account exists. An account that was never confirmed disappears after thirty days.
- From a draw, the pairings and the questions disappear after a year. That there was a draw, and who took part, remains: otherwise "not the same as last year" no longer works.
- Server logs: thirty days.
Your rights
You can view and download your data, have it corrected, and have your account deleted. The first and the last are buttons on your account page and work immediately. If you disagree with how we handle your data, you can lodge a complaint with the Belgian Data Protection Authority.
??account.instellingen.titel_en??
Who else sees it
The mail provider that sends our messages, and the host where the servers stand. Both inside the EU, both with a processing agreement. Nobody else: there are no analytics services, no ad networks and no share buttons that watch along.
Children
In Belgium a minor can consent to an online service from the age of thirteen. Below that, no account is needed: a parent keeps the list inside their own account, and the child can become a co-manager later. That way we collect nothing about children.
Security
Passwords are stored as an Argon2id hash, never readable. Keys from e-mails are kept as a hash only. All traffic runs over https. There is a daily backup, and it is restored regularly to check that it works.
Questions? Write to info@javastart.be. info@javastart.be