Klantenservice

Privacybeleid

Contact FAQ Betalen Verzending Retourneren & ruilen Aftercare Pakketclaims Gebruiksvoorwaarden Privacybeleid Colofon

Privacy Policy – Paul Zeist

1. Who is responsible

This Privacy Policy explains how Paul Kinderkleding V.O.F. (also registered as Paul Zeist V.O.F.), trading as Paul Zeist, Slotlaan 296, 3701 GW Zeist, the Netherlands, KvK 24306272 ("Paul Zeist", "we"), processes personal data when you visit paulzeist.com, place an order, create an account, subscribe to our newsletter or contact us. We are the controller within the meaning of the General Data Protection Regulation (GDPR).

Questions or requests: info@paulzeist.com. We have not appointed a data protection officer, as we are not required to.

2. What we process, why, and on what legal basis

Purpose	Data	Legal basis (GDPR art. 6(1))	Retention
Processing and delivering your order, payments, returns and complaints	Name, address, email, telephone, order and payment details, communication with us	Performance of the contract (b)	7 years after the order (tax retention obligation)
Customer account	Name, email, addresses, order history, wishlist	Performance of the contract (b)	Until you delete your account; order data as above
Accounting and tax obligations	Invoices and order data	Legal obligation (c)	7 years
Customer service (email, WhatsApp, phone)	Contact details and content of your messages	Performance of the contract (b) or legitimate interest (f): answering your questions	2 years after the last contact, unless part of an order file
Newsletter and personalised emails (including abandoned-cart and back-in-stock emails)	Email, name, preferences (Men/Kids), click and purchase behaviour in relation to emails	Consent (a). For existing customers: legitimate interest (f) for emails about similar products, with an opt-out in every email	Until you unsubscribe
Investigating lost or incomplete parcels, preventing and detecting fraud	Order and delivery data, carrier data, declarations, photos, identity verification data (name, date of birth, document number and expiry date)	Legitimate interest (f): preventing fraud and recovering losses	Identity data: deleted when the claim is closed (max. 3 months). Claim file: 2 years, longer if needed for legal proceedings or a police report
Fraud screening of orders	Order, payment, device and IP data	Legitimate interest (f): preventing payment fraud	As per order data
Monitoring return behaviour (see Terms, art. 6.11)	Order and return history	Legitimate interest (f): preventing abuse of returns	Rolling 12 months
Reviews	Name, email, order number	Legitimate interest (f): asking for a review after purchase	Until the review invitation is sent, plus the review itself as long as it is published
Website analytics and improvement	Pseudonymised usage data, device and browser data, IP address	Consent (a) via the cookie banner	Per tool, max. 14 months
Advertising and retargeting (Meta, Google)	Cookie IDs, page visits, purchase events, hashed email for matching	Consent (a) via the cookie banner	Per tool, max. 13 months
Legal claims and compliance	All relevant data	Legal obligation (c) or legitimate interest (f)	As long as necessary

Providing your name, address and email is necessary to conclude and perform the purchase agreement; without these we cannot deliver your order. All other information is optional.

We do not process special categories of personal data. Our website is not aimed at children; please do not provide personal data of children (other than, for example, a name for a gift message).

3. Automated decisions

Our platform and payment providers automatically screen orders for fraud risk. If an order is flagged, a member of our team reviews it before it is cancelled. If you choose a payment method like Klarna, Klarna may carry out a credit assessment under its own privacy policy. You can contact us to ask for human review of any decision and to express your point of view.

4. Cookies

We use necessary cookies for the shop to function (shopping bag, checkout, language and market, security). We only place analytics, marketing and other non-necessary cookies with your consent, which you can give or withdraw at any time via the cookie settings link at the bottom of every page. Details are shown in the cookie banner.

5. Who receives your data

We do not sell your personal data. We share it only with parties that help us run the shop, and only to the extent needed:

Processors (they process data on our instructions under a data processing agreement): Shopify (shop platform and payments), Sendcloud (shipping), Klaviyo (email), Microsoft (Clarity), Google (Analytics), Trustpilot (review invitations), our wishlist and invoice apps, SW-Retail/Poslink (shop inventory and order system), IT service providers and developers who maintain the shop, including AI-based tools we use to manage our store data.
Independent controllers (they decide themselves how they use data, under their own privacy policies): our carriers (delivery), payment providers (such as PayPal, Klarna and card issuers), Meta (Facebook/Instagram advertising and WhatsApp), Google (advertising), our accountant, and authorities such as the police or tax authorities when required by law.

6. Transfers outside the EEA

Some of these parties process data outside the European Economic Area, for example in Canada (Shopify, which benefits from an EU adequacy decision) or the United States (for example Klaviyo, Google, Meta and Microsoft). We only allow this if there is an adequacy decision (including the EU-U.S. Data Privacy Framework for certified companies) or if the EU Standard Contractual Clauses apply. Contact us for more information.

7. Your rights

You have the right to access, rectify and erase your personal data, to restrict processing, to data portability, and to object to processing based on legitimate interest. You may always object to direct marketing; we will then stop. Where processing is based on consent, you can withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

Send your request to info@paulzeist.com. We respond within one month. If we cannot establish that the request comes from you, we may ask for additional information; we will not ask for a copy of an identity document unless there is no other way.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. Our lead authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl). We would appreciate the chance to resolve your concern first.

8. Security

We take appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), access controls and payment processing by certified payment providers. We never see or store your full card details.

9. Customers outside the EEA

This Privacy Policy applies to all visitors and customers. If you live outside the EEA, your data are processed in accordance with this policy and Dutch and EU law. Rights under the law of your country apply only to the extent that law is mandatory for us.