Privacy Statement

In this privacy statement, you will find our information, an explanation of what personal data is, the meaning of processing personal data, the purposes for which we process your personal data, your rights, what we do to ensure the secure processing of your personal data, and how long we retain your personal data. This privacy statement applies when you visit our website, place an order, or enter into an agreement with us.

We may update this Privacy Statement from time to time. When we make material changes, we will notify you by updating the "Last Updated" date at the top of this page and, where required by law, by posting a prominent notice on our website.

Our Information:

Personal Data

Personal data refers to all information that provides details about you and by which you can be directly or indirectly identified.

Processing of Personal Data

Processing of personal data includes collecting, recording, organizing, storing, updating, modifying, retrieving, consulting, using, providing by means of transmission, dissemination, or any other form of making available, combining, linking, as well as shielding, erasing, or destroying your personal data.

Purposes and Legal Bases

We process your personal data for various purposes. The legal basis for each purpose is set out below.

Performance of a contract (Article 6(1)(b)):

• Handling orders, creating quotes and agreements, delivering products and services
• Creating and managing your account
• Processing payments
• Communicating with you about your orders or account

Consent (Article 6(1)(a)):

• Sending newsletters, SMS messages, general or targeted offers, and customer survey invitations
• Placing advertising cookies and similar tracking technologies on your device
• Delivering targeted advertising based on your browsing behaviour
• Analytics tracking to understand how you use our website, where you have consented

You may withdraw consent at any time using the privacy controls in our website footer, or by contacting us at [email protected]. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Legitimate interests (Article 6(1)(f)):

• Preventing fraud and protecting the security of our website and systems
• Responding to your questions or complaints
• Understanding aggregated patterns of website usage to improve our services, where this does not override your interests or fundamental rights

Where we rely on legitimate interests, you have the right to object. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Legal obligation (Article 6(1)(c)):

• Retaining records required by applicable tax and accounting law

Third-Party Processors and Recipients

We use service providers and other third parties to support our business operations. Where a third party processes personal data on our behalf as a processor, we enter into appropriate data processing agreements as required by law.

We also process your data using cookies if you use our website. You can manage your cookie preferences and withdraw consent at any time using the privacy controls available in our website footer.

We never sell your personal data to third parties.

Providing your personal data is a necessary condition to enter into an agreement with us. While you are not obligated to provide your personal data, choosing not to do so may result in us being unable to deliver the products or services you have ordered or contact you.

Recipients of Personal Data

We disclose personal data to the following categories of recipients:

Joint controllers — Meta. For processing carried out using the Meta Pixel and Meta Conversions API, LIFEAID and Meta Platforms Ireland Limited act as joint controllers in accordance with Meta's Controller Addendum. Meta is responsible for providing the legal basis for its own subsequent processing of the data. The essence of the joint-controller arrangement is available at facebook.com/legal/controller_addendum.

International Data Transfers

Some of the recipients listed above are located in the United States or the United Kingdom. The following sets out the safeguards we rely on for each transfer.

Transfers from the EU to the United States

DPF certifications may be verified at dataprivacyframework.gov.

Transfers from the EU to the United Kingdom

The United Kingdom benefits from an EU adequacy decision (Commission Decision of 28 June 2021). Transfers to UK-based recipients, including CookieYes Ltd, are made on the basis of that adequacy decision.

UK Residents

UK residents who use this website benefit from the same protections described in this Privacy Statement. Transfers of personal data from the United Kingdom to recipients in the United States are made on the basis of appropriate safeguards, including Standard Contractual Clauses and, where applicable, certification under the UK Extension to the EU-US Data Privacy Framework. You may obtain further information about the safeguards in place by contacting us at [email protected].

You may obtain a copy of the Standard Contractual Clauses or other applicable safeguards by contacting us at [email protected].

Processed Personal Data

• First and last name
• Address details
• Phone number
• Email address
• Account credentials and account activity
• Order history and transaction details
• IP address and approximate location derived from it
• Device and browser information
• Cookie and similar identifiers
• Website usage data, including pages viewed and referring URLs
• Correspondence with our customer service team

Payment transactions are handled by our payment provider. We do not store your payment card details.

Retention of Personal Data

We do not retain your personal data longer than strictly necessary for the purposes for which it is processed. Where legal retention requirements apply, personal data will be retained for the period required by applicable law.

Subscriptions

If you subscribe to a recurring product delivery, your order will be fulfilled and your payment method charged automatically at the frequency you selected. You may modify or cancel your subscription at any time by logging into your account, by emailing [email protected], or by contacting our customer service team. Cancellation must be received prior to the next scheduled shipment to avoid that shipment being processed.

Your Privacy Rights

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

• Right of access — obtain confirmation of whether we process your personal data and receive a copy, together with information about the purposes, categories of data, recipients, and retention periods.
• Right to rectification — have inaccurate personal data corrected and incomplete data completed.
• Right to erasure — request deletion of your personal data where the applicable conditions are met.
• Right to restriction of processing — request that we limit how we process your data in certain circumstances.
• Right to data portability — receive the personal data you provided in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
• Right to object — object to processing based on our legitimate interests and object at any time to processing for direct marketing purposes.
• Right to withdraw consent — where processing is based on your consent, withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Rights related to automated decision-making — where applicable, you have rights in relation to decisions based solely on automated processing that produce legal or similarly significant effects.

How to Exercise Your Rights

Submit a request using our Submit a Privacy Request form.
You may also email [email protected].
After submitting a request through our Privacy Request Form, you will receive a confirmation email containing a reference number that you can use to reference your request.

Our Response Time

We respond within one month of receiving your request. Where a request is complex or where we receive a number of requests, we may extend this period by up to two further months. We will inform you of any extension and the reasons for it within one month of receiving your request.

Verification

We may need to verify your identity before acting on your request. We will request only information reasonably necessary for this purpose.

Requests Made on Your Behalf

If someone submits a request on your behalf, we require written authorization, and we may ask you to confirm your identity directly.

No Charge

Exercising your rights is free of charge. Where a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act, and we will explain why.

If You Are Not Satisfied

If we refuse your request in whole or in part, we will explain our reasons. You may ask us to review that decision using our Request a Review form. We respond to review requests within one month.

Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority at any time, regardless of whether you contact us first. Our lead supervisory authority is the Dutch Data Protection Authority:
Autoriteit Persoonsgegevens
Postbus 93374
2509 AJ Den Haag
The Netherlands
autoriteitpersoonsgegevens.nl
You may also complain to the supervisory authority in the EU member state where you live or work.

Security

We implement appropriate technical and organizational measures designed to provide a level of security appropriate to the risks associated with the processing of personal data.