Privacy Policy

The data controller for all personal data collected via elunne.com is Elunne, registered in the Netherlands.

Our full registered details — legal entity name, business address, KVK and VAT numbers — are set out in clause 01 of our Terms & Conditions.

If you have any questions about how we handle your personal data, or wish to exercise any of the rights described below, contact us at info@elunne.com.

Depending on how you interact with our website and services, we may collect the following personal data:

When you place an order

• Name, email address, telephone number
• Billing and delivery address
• Payment information (processed directly by our payment provider — we do not store card details)
• Order history and purchase details

When you create an account

• Name, email address, password (stored in hashed form)
• Saved addresses and wishlist data

When you browse our website

• IP address, browser type, device type, operating system
• Pages visited, time on site, referral source
• Cookie identifiers (see section 08)

When you contact us

• Name, email address, and the content of your message

When you sign up for our newsletter

• Email address and, if provided, your name and preferences

We use the personal data we collect for the following purposes:

• To process and fulfil your orders, including payment, packaging, and delivery
• To send order confirmations, shipping updates, and delivery notifications
• To handle returns, refunds, and customer service requests
• To manage your account, if you have created one
• To send marketing communications, where you have given your consent
• To improve our website and understand how customers use it
• To comply with our legal and tax obligations
• To detect and prevent fraud or abuse

We do not use your data for automated decision-making or profiling that has significant legal or similar effects on you.

Under the GDPR, we rely on the following legal bases for processing your personal data:

Performance of a contract

When you place an order, processing your data is necessary to fulfil that order — including payment, fulfilment, and customer support.

Legitimate interests

We process browsing data and analytics to improve our website and detect fraud, where our legitimate interest does not override your rights and freedoms.

Consent

We send marketing emails only when you have explicitly opted in. You may withdraw your consent at any time by clicking "unsubscribe" in any email or contacting us directly.

Legal obligation

We retain certain financial and transactional records to comply with Dutch tax law and applicable EU regulations.

We share your personal data only where necessary to deliver our services. We do not sell your data to third parties.

Shopify Inc.

Our store is hosted on Shopify. Shopify processes order, customer, and payment data on our behalf as a data processor. Shopify is certified under the EU–US Data Privacy Framework. For more information, see Shopify's Privacy Policy.

Payment processors

Payments are processed by Shopify Payments (powered by Stripe). Card data is handled directly by the processor and is never stored on our systems. Stripe is PCI-DSS compliant.

Shipping carriers

Your name, delivery address, and contact details are passed to our logistics partners to fulfil and deliver your order. PostNL (Netherlands) and FedEx (rest of the European Union).

Email service providers

Transactional and marketing emails are sent via Klaviyo and Shopify Email. These providers act as data processors under a data processing agreement.

Analytics

We use Shopify Analytics to understand how visitors use our website, and Contentsquare (formerly Hotjar). Contentsquare records anonymised session replays and heatmaps — how pages are scrolled, where visitors click, and where they leave. Recordings are pseudonymised and keystrokes in form fields are suppressed. It runs only after you accept analytics cookies. We do not use Google Analytics.

All third-party processors are bound by data processing agreements and are required to handle your data in accordance with GDPR.

We retain your personal data only for as long as necessary for the purposes described in this policy, or as required by law.

• Order and transaction records: 7 years (Dutch tax law requirement)
• Customer account data: for the duration of your account, plus 2 years after last activity
• Marketing consent records: until you unsubscribe, plus 1 year thereafter
• Customer service correspondence: 2 years from resolution
• Website analytics data: retained by Shopify for as long as the store is active. Contentsquare session recordings are retained for the retention period of our Contentsquare plan, and in no case longer than 12 months, after which they are deleted.

When data is no longer needed, it is securely deleted or anonymised.

As a resident of the EU/EEA, you have the following rights in relation to your personal data:

• Right of access — you may request a copy of the personal data we hold about you
• Right to rectification — you may ask us to correct inaccurate or incomplete data
• Right to erasure — you may ask us to delete your data, subject to legal retention obligations
• Right to restriction — you may ask us to limit how we use your data in certain circumstances
• Right to portability — you may request your data in a structured, machine-readable format
• Right to object — you may object to processing based on legitimate interests, including direct marketing
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at info@elunne.com. We will respond within 30 days. We may ask you to verify your identity before processing a request.

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): autoriteitpersoonsgegevens.nl

We use cookies and similar technologies to operate our website and understand how it is used. Cookies are small text files stored in your browser.

Strictly necessary

These cookies are required for the website to function — for example, to keep items in your cart and maintain your session. They cannot be disabled.

Performance & analytics

These cookies help us understand how visitors use our website — which pages are most visited, where people drop off, and how they arrived. We use Shopify Analytics and Contentsquare. Both set analytics cookies, and neither runs until you have accepted analytics cookies via the banner. You can withdraw consent at any time through the cookie preferences link.

Marketing

We do not currently run advertising or remarketing pixels. If that changes, this policy will be updated and consent obtained before any such cookies are set. We do not share cookie data with third parties for advertising without your consent.

You can manage or withdraw your cookie preferences at any time via the cookie banner on our website, or through your browser settings. Note that disabling certain cookies may affect site functionality.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• SSL/TLS encryption for all data transmitted via our website
• Access controls restricting who can view customer data internally
• Use of trusted, GDPR-compliant service providers
• Secure, hashed storage of passwords

While we take reasonable precautions, no method of transmission over the internet is completely secure. If you suspect your account has been compromised, please contact us immediately.

Some of our service providers, including Shopify and Stripe, operate infrastructure outside the European Economic Area (EEA), including in the United States.

Where personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions (where applicable)
• Certification under the EU–US Data Privacy Framework (where applicable)

You may request more information about the specific safeguards in place by contacting us at info@elunne.com.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we do, we will update the "Last updated" date at the top of this page.

For significant changes that affect your rights, we will notify you by email (if you have an account) or by displaying a notice on our website. We encourage you to review this page periodically.

For any privacy-related questions, requests, or concerns, please contact us:

Email: info@elunne.com
Address: Zijtaartseweg 28, Sint-Oedenrode, 5491 SG, The Netherlands
Response time: within 30 days (GDPR requirement)

You also have the right to contact the Dutch supervisory authority directly:

Autoriteit Persoonsgegevens
Postbus 93374, 2509 AJ Den Haag
autoriteitpersoonsgegevens.nl