Privacy statement

RetaEU is responsible for the processing of personal data through this shop. RetaEU is registered with the Dutch Chamber of Commerce under number 98986406. Privacy questions: info@retaeu.nl or +31 6 38576539.

Ordering, also as a guest

Your name, e-mail address, delivery address (and, if given, the name of another recipient), the products and batches ordered, the amounts, your payment reference and any note with your order. Purpose: carrying out your order, matching your payment, shipping and contact about your order. Legal basis: performance of the contract, and the statutory retention duty for our records.

When you order we also record when you accepted the terms (which version) and confirmed your age and research declaration. Purpose: being able to show under which terms we sold. Legal basis: legitimate interest.

Optionally your gender and age group, only if you choose them yourself. We use them only for statistics about our customer base. Legal basis: consent; you can leave them empty and have them deleted.

Account

Your e-mail address, name, password (stored only in hashed form), saved addresses, language preference and your orders, and when you accepted which version of the terms at registration. Purpose: your account and order history. Legal basis: performance of the contract.

Newsletter and offers

Only if you give separate consent (a box that is unticked by default, or a newsletter sign-up you confirm by e-mail): your e-mail address and the source and moment of your consent. Legal basis: consent. You can unsubscribe at any time via the link in every newsletter or in your account; we also record the moment you unsubscribe.

Contact and notifications

What you send us via the contact or bulk form, e-mail or WhatsApp, and your e-mail address if you ask to be notified when a product becomes available. Purpose: answering your question or sending that notification. Legal basis: legitimate interest, or your own request.

Security

To limit abuse and log-in attempts we briefly use your IP address for a limit on the number of attempts (in memory only), and we keep a log of important actions concerning your account and orders. Legal basis: legitimate interest.

We only use functional storage: your log-in session, your cart, your language choice and the fact that you confirmed the entry declaration (that confirmation is stored only in your browser, not by us). We use no advertising or tracking cookies. If we use visitor statistics, they are cookie-free and only aggregated. See also the cookie policy.

• Resend: sending e-mails about your order and account (and the newsletter if you want it), with your name, e-mail address and the content of the e-mail.
• MyParcel and the carrier (PostNL): the shipping label and delivery, with the recipient's name, address and e-mail address for track & trace messages.
• Our bank: for a bank transfer we receive your name and account number through our bank. Other payment service providers only if you choose another payment method at checkout.
• Our hosting provider: the shop and its database run on a server we rent.
• Our accountant and the Dutch tax authorities, where required by law.

Service providers that process data for us do so on our instructions and only for the purpose for which we engage them. We do not sell personal data and do not share it with advertising networks.

If data is processed outside the European Economic Area, for example by a provider whose parent company is in the United States, this only happens with appropriate safeguards such as the European Commission's standard contractual clauses.

• Order and payment data: 7 years, because of the statutory tax retention duty. This also applies if you delete your account.
• Account data: as long as your account exists. You can delete your account yourself in your account (Preferences); your orders are then kept as long as the law requires. An account that has not been used for 24 months is deleted by us after notice by e-mail. We do this manually, not automatically.
• Newsletter consent: until you unsubscribe. After that we only keep your e-mail address with the moment of unsubscribing, so that we do not contact you again.
• Availability notifications: until the notification has been sent; sent notifications are cleaned up manually in the same review as unused accounts.
• Contact messages: as long as needed to handle your question and any follow-up.
• The action log: as long as needed for security and accountability, and no longer than the order data it belongs to.
• Backups: deleted data may remain in backups for a while until they are replaced.

You have the right to access your data, to have it corrected or deleted, to have its processing restricted, to object to processing based on legitimate interest and to receive your data in a common format. You can withdraw a consent at any time; this applies to the future.

You can change or delete much of your data yourself in your account. For other requests: e-mail info@retaeu.nl. We respond within one month. Data we must keep by law is deleted once that period has ended.

If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your country.

Connections to the shop are encrypted (https), passwords are stored only as a hash and only authorised staff can access the back office, with rights per role. Shipping labels with address data are accessible to the back office only.

We do not take decisions about you based solely on automated processing, and we do not build profiles for advertising.

The shop is intended only for persons aged 18 or older. We do not knowingly process data of minors.

If this privacy statement changes, you can see it from the date at the top. In case of a significant change we inform you if you have an account.