Privacy policy

Last updated: 1 September 2026

1. Who is responsible for your personal data?

Scandivv Group B.V. (“Scandivv”, “we”, “us” or “our”) is the controller of the personal data described in this policy.

• Registered in: Amsterdam, the Netherlands
• Dutch Chamber of Commerce (KvK) number: 99126605
• Privacy and customer-support contact: support@scandivv.com

This policy applies when you visit or shop through our online store, contact us, create or use an account, request a return or warranty service, join a promotion, submit content, or otherwise interact with us. It does not apply to a third party’s own website or service merely because we link to it.

2. The data we use, why we use it, and our legal bases

We do not treat your general use of the store as consent to all processing. Where consent is the legal basis, we ask for it separately and you may withdraw it at any time without affecting earlier lawful processing.

Activity and purpose	Main categories of data	Legal basis
Display the store, remember a basket, select a market, keep the service stable, and provide functions you request	Device and browser data, IP address, cookie or similar identifiers, session data, basket contents, language, market and accessibility choices	Performing steps at your request or our contract; our legitimate interests in operating a secure, usable store; consent where required for a non-essential technology
Process and deliver orders, take payment, provide order updates, prevent duplicate transactions, and handle returns or refunds	Name, contact details, delivery and billing details, order contents, order and transaction identifiers, payment status, shipment and return data	Contract; legal obligations; legitimate interests in accurate fulfilment and recordkeeping
Provide customer accounts and authentication	Name, email address, account identifiers, authentication status and account activity	Contract; legitimate interests in account security and customer service
Answer questions and provide return, withdrawal, complaint, repair or warranty support	Contact details, order identifiers, correspondence, photographs or other evidence you choose to provide, and the outcome of the request	Contract; legal obligations, including consumer-law duties; legitimate interests in resolving and documenting requests
Detect fraud, misuse and security incidents, protect customers and our systems, and establish or defend legal claims	Contact, order, transaction, device, network, authentication, risk-signal and incident data	Legal obligations; legitimate interests in fraud prevention, network and information security, and legal claims
Keep tax, accounting, corporate and compliance records	Order, invoice, refund, payment-status and business-record data	Legal obligations
Measure store performance and understand how visitors use the store	Device, browser, interaction, approximate location derived from IP address, page, campaign and cookie or similar identifier data	Consent where required; otherwise our legitimate interests in measuring and improving the store
Personalise advertising, measure campaigns and build audiences	Cookie or similar identifiers, device, interaction, campaign, purchase-event and audience data	Consent where required. We do not activate non-essential advertising technologies before consent where applicable
Send requested or permitted marketing and manage preferences	Name, email address, marketing preferences, sign-up source and engagement data	Consent where required; otherwise our legitimate interests where direct-marketing law permits. You can unsubscribe at any time
Run reviews, competitions, photo rewards and other promotions	Contact details, entry and eligibility details, public handle, submitted content, permissions, reward and related correspondence	Contract or steps at your request; consent where appropriate; legitimate interests in administering the programme and, where a licence is granted, using content as agreed
Improve products, services and business reporting	Aggregated or minimised order, product, support and interaction data	Legitimate interests in understanding and improving our business, balanced against your rights

Where we rely on legitimate interests, we assess the purpose, necessity and impact of the processing. You may object as described below.

3. Shopify accounts, authentication and payments

Our store is hosted on Shopify. Shopify provides store, checkout, account and related infrastructure and processes personal data in accordance with its role and terms.

For Shopify-managed customer authentication, authentication secrets are handled by Shopify and its authentication providers. Scandivv does not receive or store your plaintext password, and we do not use security questions for store authentication.

Payments are processed by Shopify’s payment services and/or the payment method provider you choose. Scandivv generally receives payment confirmation, status, limited payment-method details such as brand and last digits where supplied, transaction identifiers, billing details and fraud or risk signals. We do not receive or store your full card number or online-banking credentials.

Your bank, wallet provider, payment provider or delivery carrier may act as a separate controller for parts of its service. Its own privacy notice applies to that processing.

4. Where data comes from

We collect data:

• directly from you, including at checkout, through an account, a form, email or a promotion;
• automatically from your browser or device when you use the store;
• from Shopify and service providers supporting payments, fraud prevention, fulfilment, delivery, customer support, analytics, advertising, reviews and promotions;
• from public sources or another person where you submit public content, tag us, or someone contacts us on your behalf; and
• from business partners where permitted and appropriately disclosed.

If another person’s data is included in an order, message or content submission, please ensure you are permitted to provide it.

5. Cookies and similar technologies

We use cookies, pixels, local storage and similar technologies in these stable categories:

• Strictly necessary: checkout, basket, security, fraud prevention, consent choices, load balancing and functions you request.
• Preferences: language, market, display and other remembered choices.
• Analytics: audience measurement, diagnostics and improvement.
• Advertising: campaign measurement, personalisation and audience building.

Where required, preference, analytics and advertising technologies remain off until you choose them. You can change or withdraw a choice through the store’s cookie-preference control. Blocking strictly necessary technologies may prevent requested store functions from working.

Specific providers and technologies can change as our systems develop. We maintain a current internal processing register and configure the consent interface to identify the technologies actually in use, their purposes and available durations. Browser controls may also delete or block cookies. Where applicable, we respond to legally recognised opt-out preference signals such as Global Privacy Control.

6. When we disclose data

We disclose only what is reasonably necessary to:

• Shopify and providers of hosting, checkout, authentication and store infrastructure;
• payment, fraud-prevention and financial-service providers;
• warehouse, fulfilment, delivery, return and logistics providers;
• customer-support, communications, email, review and promotion providers;
• analytics, consent-management and advertising providers, subject to your choices and applicable law;
• professional advisers, auditors, insurers and authorities;
• a buyer, investor or successor in a genuine corporate transaction, subject to appropriate safeguards; or
• other parties where you direct us, consent, or disclosure is required by law.

These are categories rather than a promise that every category is used at all times. We do not disclose personal data merely because a party requests it; we require a valid legal basis.

7. International transfers

We and our providers may process data outside your country, including outside the European Economic Area, United Kingdom or Switzerland. Where transfer law requires a safeguard, we use an applicable adequacy decision, approved standard contractual clauses (including the UK addendum or equivalent where relevant), binding corporate rules, another lawful transfer mechanism, or a permitted derogation for a specific situation. We also assess supplementary technical and organisational measures where required.

You may contact us for information about the safeguard relevant to your data and, where available, a copy of it with confidential information removed.

8. Retention

We keep personal data only for as long as needed for the purpose collected, legal compliance, disputes and enforcement. We apply a documented retention schedule and consider the data’s nature, sensitivity, volume, risk and the relevant limitation periods.

In particular:

• Dutch tax and accounting records are generally retained for seven years where the law requires it;
• order, return, warranty, complaint and support records are kept for the service period and an appropriate legal-claims period;
• account data is kept while the account remains active and then deleted or anonymised after applicable operational and legal retention needs;
• marketing contact data is kept until you unsubscribe or the permission is no longer valid; minimal suppression data may be retained to respect your opt-out;
• promotion and content records are kept for administration and for the duration of any valid licence or claim; and
• cookie and similar identifier durations are disclosed through the consent interface where required.

At the end of the applicable period, we delete or anonymise data unless a lawful hold applies.

9. Security and data breaches

We use proportionate technical and organisational measures designed to protect personal data, including access controls, authentication controls, data minimisation, service-provider review, secure transmission where appropriate, monitoring, backup and incident-response procedures. No internet service can guarantee absolute security.

We assess suspected personal-data breaches promptly. Where the GDPR applies, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware when the breach is likely to risk people’s rights and freedoms. We notify affected people without undue delay where the breach is likely to create a high risk, unless a lawful exception applies. Other applicable breach-notification rules may impose different requirements.

10. Your rights and choices

Depending on where you live and the circumstances, you may have rights to:

• obtain information and access a copy of your data;
• correct inaccurate or incomplete data;
• request deletion;
• restrict processing;
• receive portable data you provided in a structured, commonly used, machine-readable format;
• object to processing based on legitimate interests or to direct marketing;
• withdraw consent at any time;
• opt out of certain targeted advertising, sharing or sale concepts where local law applies;
• request review of a decision made solely by automated means where it has a legal or similarly significant effect; and
• lodge a complaint with a privacy regulator.

To exercise a right, email support@scandivv.com. We may ask for information reasonably necessary to verify identity and authority, but will not request more than needed. An authorised agent may submit a request where local law permits. We will not discriminate against you for exercising a privacy right.

You may unsubscribe from marketing through the message’s link or by contacting us. Withdrawal of consent does not affect processing already carried out lawfully.

11. Regional information

EEA. You may complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority where you live or work. Mandatory rights under your local law remain available.

United Kingdom and Switzerland. You may complain to the UK Information Commissioner’s Office or the competent Swiss data-protection authority, as applicable. Local mandatory rights remain available.

United States. Residents of states with applicable privacy laws may have access, correction, deletion, portability and opt-out rights, subject to legal exceptions. Depending on the advertising services enabled and the legal definition in your state, advertising-cookie activity may be considered targeted advertising, “sharing” or a “sale”. Use our cookie-preference control or contact us to exercise an applicable opt-out. We honour qualifying opt-out preference signals where required. We do not knowingly sell or share personal data of consumers under 16.

Canada. You may request access and correction, withdraw consent subject to legal or contractual limits, and complain to the Office of the Privacy Commissioner of Canada or a competent provincial regulator.

Australia. You may request access and correction and complain to us. If we do not resolve the complaint, you may contact the Office of the Australian Information Commissioner.

These summaries do not limit stronger mandatory protections that apply where you live.

12. Children

The store is not directed to children who cannot lawfully enter the relevant transaction or consent to the relevant processing. We do not knowingly collect personal data from a child contrary to applicable law. A parent or guardian who believes a child provided data unlawfully may contact us.

13. Changes to this policy

We may update this policy to reflect legal, technical or business changes. We will publish the revised version with a new “Last updated” date and provide additional notice where required. Material changes do not turn an earlier consent into consent for a new purpose where fresh consent is legally required.

14. Contact and complaints

Questions, requests and complaints may be sent to support@scandivv.com. Please write “Privacy” in the subject line. We will investigate and respond within the period required by applicable law.