Privacy Policy
Privacy Policy
Last updated: [date]
This policy explains what personal data we collect, why we collect it, who we share it with, and what rights you have.
Who is responsible for your data
[Registered business name], trading as Havelle & Co, is the data controller.
Chamber of Commerce (KVK): [97998362] VAT number: [NL...] Registered address: [Business address] Email: [email]
What we collect
When you place an order Name, email address, delivery address, billing address, phone number (if provided), order contents, and order history.
When you pay Payment method and the last four digits of your card. We never see, receive or store your full card number, expiry date or security code — these go directly to our payment providers.
When you contact us Your name, email address, and the content of your message.
When you sign up for marketing Your email address, and whether you open or click our emails.
When you browse the store IP address, device and browser type, pages viewed, referring site, and time spent. See our Cookie Policy for how this is collected and how to control it.
When you submit a review Your name or chosen display name, your review, and any photographs you upload.
Why we use it, and on what basis
| What we use it for | Legal basis |
|---|---|
| Processing, packing and delivering your order | Performance of our contract with you |
| Handling returns, refunds and warranty claims | Performance of our contract with you |
| Answering your questions | Performance of our contract, or our legitimate interest in helping you |
| Preventing fraud and chargebacks | Our legitimate interest in protecting the business |
| Keeping accounting and tax records | Legal obligation |
| Sending marketing emails | Your consent |
| Analytics and advertising | Your consent, given via our cookie banner |
| Improving our products and store | Our legitimate interest in running the business well |
Who we share it with
We share your data only with parties who need it to deliver your order or run the store:
- Shopify — our store and checkout platform
- Our payment providers — Shopify Payments, PayPal, Klarna
- Our fulfilment partner and shipping carriers — to pack and deliver your order
- Email marketing platform — if you have opted in
- Analytics and advertising providers — Google, Meta, TikTok, where you have consented
- Our accountant and, where required, tax authorities
Each acts under a contract that requires them to protect your data and use it only for the purposes we specify.
We do not sell your personal data.
International transfers
Some of our providers process data outside the European Economic Area, including in the United States and China (for order fulfilment). Where this happens, we rely on adequacy decisions or on Standard Contractual Clauses approved by the European Commission to ensure your data remains protected.
How long we keep it
- Order and transaction records: 7 years, as required by Dutch tax law
- Customer service correspondence: 2 years
- Marketing consent and email data: until you unsubscribe, then a suppression record so we do not contact you again
- Analytics data: up to 26 months
- Reviews: until you ask us to remove them
Your rights
You have the right to:
- Access — ask for a copy of the data we hold about you
- Rectification — ask us to correct data that is wrong or incomplete
- Erasure — ask us to delete your data, where we have no legal reason to keep it
- Restriction — ask us to limit how we use your data
- Portability — receive your data in a machine-readable format
- Object — object to processing based on our legitimate interests
- Withdraw consent — at any time, for marketing or cookies, without affecting processing that happened before
To exercise any of these, email [email]. We respond within one month.
If you are unhappy with how we have handled your data, you may complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or to the supervisory authority in your own country.
Marketing emails
We send marketing emails only if you have opted in. Every email contains an unsubscribe link, and you can also email us to be removed. Unsubscribing does not affect transactional emails about orders you have placed.
Security
We use encrypted connections (HTTPS) throughout the store, and our payment providers are PCI-DSS compliant. Access to customer data is limited to those who need it.
No system is completely secure. If a breach affects your rights, we will notify you and the relevant authority as required by law.
Children
Our store is not intended for children. We do not knowingly collect data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.
Automated decision-making
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Our payment providers may use automated fraud checks; if a payment is declined on that basis, you can contact us for a manual review.
Changes to this policy
We may update this policy as the store changes. The date at the top shows when it was last revised. Where changes are significant, we will tell you by email or a notice on the store.
Contact
[Registered business name] trading as Havelle & Co KVK [97998362] · VAT [NL...] [Business address] Email: [email]