Privacy Policy

1. What Data We Collect

When placing an order or creating an account, we collect the following personal data:

• First and last name
• Email address
• Shipping address and billing address
• Phone number
• Order details and order history
• Payment details (processed by our payment provider)
• IP address (for security and fraud prevention)

2. Why We Collect Data (Legal Basis)

We process your data based on the following legal grounds under the GDPR:

• Contract performance processing and shipping your order, managing your account
• Legal obligation tax administration, bookkeeping requirements
• Legitimate interest fraud prevention, rate limiting, website security, improving our services

We never sell or share your data with third parties for marketing purposes.

3. How We Protect Your Data

We take the protection of your data seriously. Our website uses SSL/TLS encryption for all data transfers. Payments are securely processed through certified payment providers. Access to personal data is restricted to authorised personnel. We use rate limiting and timing-safe authentication to protect against brute force attacks.

4. Cookies & Local Storage

Our website uses functional cookies and local storage only. We do not use tracking, advertising, or analytical cookies. Specifically, we store:

• Shopping cart: your cart items are saved locally so they persist between visits
• Wishlist: your saved items are stored locally in your browser
• Authentication: a login token is stored locally to keep you signed in
• Cookie preference: we remember your cookie consent choice

You can clear this data at any time through your browser settings (clear site data / localStorage). No data is shared with advertising networks.

5. Third-Party Services

We share data with the following third parties, solely for the purposes described:

• WooCommerce (WordPress) our order management system; processes customer data, orders, and payments
• Payment provider handles payment processing securely; we do not store your payment card details
• ipapi.co used to detect your country for the checkout form; receives your IP address (no personal data stored)
• Instagram (Meta) we display our public Instagram feed on the homepage; no visitor data is shared with Instagram
• Vercel our website hosting provider; processes requests and may log IP addresses for security

6. Data Retention

• Account data: retained as long as your account is active; deleted upon request
• Order data: retained for 7 years as required by Dutch tax law (fiscale bewaarplicht)
• IP addresses: used temporarily for rate limiting and fraud prevention; not permanently stored
• Local storage data: stored in your browser until you clear it or sign out

7. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

• Right of access: request which data we hold about you
• Right to rectification have incorrect data corrected
• Right to erasure request deletion of your data (except where legal retention applies)
• Right to data portability receive your data in a structured, machine-readable format
• Right to object: object to certain processing activities
• Right to withdraw consent withdraw previously given consent at any time

We aim to respond to all rights requests within 30 days, as required by the GDPR. If you believe we have not handled your data correctly, you have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

8. International Transfers

Some of our service providers (such as Vercel and Instagram/Meta) may process data outside the European Economic Area. Where this occurs, we ensure that appropriate safeguards are in place, such as EU Standard Contractual Clauses, to protect your data.

9. Contact

For questions about this privacy policy or to exercise your rights, contact us:

• WhatsApp: +31 6 20 77 99 00
• Email: privacy@shoppedbynour.com
• Address: Gevers Deynootplein 193, 2586 CT Den Haag