Privacy policy

This policy explains how Restock Room handles your personal data when you visit restockroom.store or place an order. Restock Room is the controller of your personal data. Our business details are listed in our Legal Notice.

What we collect
- Account and contact details: name, email address and phone number (if you give it).
- Order details: shipping and billing address, the products you ordered, order amounts and order history.
- Payment details: payments are handled by our payment providers. We do not see or store your full card details.
- Access details: which categories your account has access to, and how you got access (for example through a partner creator).
- Messages you send us through the contact page or email.
- Technical data: IP address, browser and device type, and pages visited, collected through cookies and similar technologies.

Why we use it and on what legal basis
- To create your account, process your order, ship your bundle and handle returns (performance of a contract).
- To give your account access to members-only categories (performance of a contract).
- To answer your questions and complaints (performance of a contract and our legitimate interest in good customer service).
- To keep our administration and meet tax obligations (legal obligation).
- To prevent fraud and misuse of our shop (legitimate interest).
- To send you marketing emails, only if you agreed to this (consent). You can unsubscribe at any time.
- For non-essential cookies, such as analytics or marketing cookies, only if you agreed to them in the cookie banner (consent).

Who we share it with
We only share your data with parties that help us run the shop, such as:
- Shopify, our webshop platform, which hosts our website and order data;
- payment providers, to process your payment;
- shipping carriers, to deliver your bundle;
- our suppliers, only where needed to fulfil your order;
- email service providers, to send order and service emails.
Some of these parties are located outside the European Economic Area, for example in the United States. In that case your data is protected by appropriate safeguards, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. We never sell your personal data.

How long we keep it
- Order and payment records: 7 years, because Dutch tax law requires this.
- Account details: as long as your account exists. You can ask us to delete it at any time.
- Messages: up to 2 years after the matter has been resolved.
- Marketing consent: until you unsubscribe.

Your rights
You have the right to access, correct or delete your personal data, to restrict or object to its use, and to receive your data in a portable format. Where we rely on your consent, you can withdraw it at any time. To use your rights, contact us through our contact page. We respond within one month.

You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or with the data protection authority in your own country.

Cookies
We use necessary cookies to make the shop work, such as the shopping cart and login. Other cookies are only placed with your permission. You can change your cookie choices at any time through "Cookie preferences" at the bottom of our website.

Security
We take appropriate technical and organisational measures to protect your data against loss and unauthorised access.

Changes
We may update this policy. The latest version is always available on this page.