Privacy Policy

Last updated: [DATE]

This policy explains how [LEGAL BUSINESS NAME], trading as [STORE NAME] (“we”, “us” or “our”), handles personal data when you visit our webshop, create an account, order products or contact us.

1. Data controller

Legal name: [LEGAL BUSINESS NAME]
Address: [REGISTERED ADDRESS]
Chamber of Commerce: [KVK NUMBER]
VAT number: [VAT NUMBER]
Email: [PRIVACY EMAIL]
Telephone: [PHONE NUMBER]

2. Data we process

We may process:

  • Account and contact details, including your name, email address, telephone number, password hash and preferences.
  • Order, billing, delivery, return and correspondence details.
  • Payment status, payment method and transaction reference. Full payment credentials are normally handled by our payment provider.
  • Customer-service messages, complaints and information you choose to provide.
  • Technical and security data, such as your IP address, device and browser information, security logs and necessary identifiers.
  • Analytics and marketing data where legally required consent has been obtained.

3. Purposes and lawful bases

We process personal data on the following grounds:

  • Contract: To manage accounts, process checkout and payment, deliver orders, handle returns and provide order support.
  • Legal obligation: To maintain tax and accounting records and respond to lawful requests from authorities.
  • Legitimate interests: To secure our webshop, prevent fraud, diagnose faults, provide ordinary customer service and protect legal claims. We balance these interests against your rights.
  • Consent: For optional newsletters, non-essential analytics such as Google Analytics and personalised advertising where consent is required.

You can withdraw consent at any time. Withdrawal does not affect processing performed lawfully before withdrawal.

If information is necessary to fulfil an order or meet a legal obligation, not providing it may mean that we cannot supply the requested service.

4. Cookies and analytics

Necessary cookies and browser storage support functions such as security, login, shopping cart and checkout.

Non-essential analytics and advertising technologies remain blocked until you make an affirmative choice through our cookie controls. Before enabling these technologies, we provide information about their purposes and offer accessible accept, reject and preference options.

You can change or withdraw your cookie choices at any time through [COOKIE SETTINGS LINK].

5. Recipients and processors

We disclose only necessary personal data to relevant service providers, including:

  • Hosting and IT providers
  • Payment providers
  • Delivery carriers
  • Email and customer-support providers
  • Accountants and professional advisers
  • Fraud-prevention and security providers
  • Public authorities where required by law

Our current provider list is available here: [PROVIDER LIST OR LINK].

We do not sell personal data.

6. International transfers

Some service providers may process personal data outside the European Economic Area.

Where this occurs, we use a lawful transfer safeguard, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where appropriate.

Details of relevant providers, destinations and safeguards are available here: [TRANSFER DETAILS].

You may contact us to request information about applicable safeguards.

7. Retention

We retain personal data only as long as necessary:

  • Order, invoice and tax records: [PERIOD REQUIRED BY TAX LAW]
  • Account data: While the account is active and for [PERIOD] afterwards
  • Customer-service messages and claims: [PERIOD]
  • Security logs: [PERIOD]
  • Newsletter data: Until consent is withdrawn, plus a minimal suppression record where necessary
  • Analytics data: [CONFIGURED ANALYTICS RETENTION PERIOD]

We securely delete or anonymise data when it is no longer required, unless the law or an ongoing dispute requires longer retention.

8. Security

We use appropriate technical and organisational safeguards, including access controls, encrypted connections, secure password hashing, backups, software updates and restricted staff access.

No internet service is completely risk-free. Contact us promptly if you suspect that your account or personal data has been misused.

9. Your rights

Depending on the circumstances, you may have the right to:

  • Access your personal data
  • Correct inaccurate or incomplete data
  • Request deletion
  • Restrict processing
  • Receive portable data
  • Object to processing
  • Withdraw consent
  • Object to direct marketing

Send requests to [PRIVACY EMAIL]. We may request reasonable information to verify your identity. We normally respond within one month.

You may also submit a complaint to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or the supervisory authority where you live or work. We appreciate the opportunity to resolve your concern first.

10. Automated decisions and children

We do not make decisions producing legal or similarly significant effects based solely on automated processing unless described here: [DETAILS OR “NOT APPLICABLE”].

Our webshop is not directed at children who cannot independently provide valid consent under applicable law. Contact us if you believe a child has improperly provided personal data.

11. Third-party links

Our webshop may contain links to third-party websites. Those websites are responsible for their own privacy practices and policies.

12. Changes to this policy

We may update this policy when our services, providers or legal obligations change. The latest version and update date will remain available on this page.

13. Contact

Send privacy questions or requests to:

Email: [PRIVACY EMAIL]
Postal address: [POSTAL ADDRESS]