This privacy policy explains how Nanikas Beauty handles your personal data when you visit nanikasbeauty.com, create an account, place an order or contact us. It sets out which data we process, for what purposes and on which legal basis, who we share it with, how long we keep it and which rights you have. We process your data in accordance with the General Data Protection Regulation (GDPR).

1. Who we are

Nanikas Beauty is a beauty brand based in Utrecht. Our online shop sells only products from our own brand. Nanikas Beauty is the data controller within the meaning of the GDPR for the personal data processed through this online shop.

• Trade name: Nanikas Beauty
• Address: Kanaalstraat 108, 3531 CN Utrecht, the Netherlands
• Chamber of Commerce (KvK) number: 95277447
• VAT identification number: NL005142400B83
• Email: info@nanikasbeauty.com
• Website: nanikasbeauty.com

If you have any questions about this privacy policy or your personal data, email us at the address above.

2. The personal data we process

We process data that you provide to us and data generated when you use our online shop. Exactly which data we process depends on how you use the shop.

Customer account

If you create an account with your email address and a password, we process your name, email address and password. Your password is never stored in readable form. If you add a phone number or addresses to your address book, we keep them so that you can check out faster. Your account also shows your order history.

Signing in with Google

If you choose to sign in with Google, Google shares with us the basic profile details we need to create or link your account, such as your name and email address. We never see your Google password. Google also processes data itself when you sign in; that processing is governed by Google’s own privacy policy.

Orders and delivery

For every order, we process:

• your first and last name;
• your billing and delivery addresses;
• your email address and phone number;
• the products you order, the amounts charged and the delivery method you choose: shipping, local pickup or local delivery in selected towns and cities;
• any comments you add to your order;
• details of any return or refund if you exercise your 14-day right of withdrawal (see our terms and conditions).

Payments

You pay via Mollie, using iDEAL, credit card or another payment method offered at checkout. You enter your payment details with Mollie or your bank, not with us, so we never see your full card details. Mollie passes on to us only what we need to process your order: the payment method, the amount, a transaction reference, the payment status and, for some payment methods, the payer’s name and account number.

Newsletter

If you sign up for our newsletter, we process your email address and the date and time you signed up. Our email marketing service provider manages the mailing list and sends the newsletter, and processes this data solely on our behalf. We send you the newsletter only with your consent. You can unsubscribe at any time via the link in every newsletter or by emailing info@nanikasbeauty.com.

Basket reminders, back-in-stock alerts and review requests

In addition to emails about your order, you may receive the following emails from us:

• Basket reminder: if you are signed in and do not complete your order, we may email you a reminder about the products in your basket. For this, we use your first name, email address, language preference and the contents of your basket. If you shop without signing in, you will not receive a reminder.
• Back-in-stock alert: if you request an alert on a product page, we process your email address, the product concerned, your language preference and, if you are signed in, your account. We email you as soon as the product is available again. Every alert contains an unsubscribe link.
• Review request: once your order has been completed, we may ask you to review the products you bought. For this, we use your name, email address and the products in your order. If you ordered as a guest, the email contains a personal, secure link that lets you post a review without an account.

You can object to basket reminders and review requests at any time by emailing info@nanikasbeauty.com. We will then stop sending you these emails.

Product reviews

Only customers who bought a product from us can review it; we verify this against the order. When you write a review, we process the name you enter, your rating, your review text and the link to your order. Your review is published in our online shop under that name, so you decide whether to use your full name, your first name or a nickname. The link to your order is never made public.

Contacting us

If you email us or use our contact form, we process your name, your email address, the subject and content of your message, and any other details you choose to share. Messages sent via the contact form reach us by email.

Visiting our online shop

Each time you visit, our server processes technical data such as your IP address, browser and device type, the time of your visit and the pages you request. We need this data to run the online shop, keep it secure and resolve technical faults. Beyond this, we use only functional cookies (see section 8).

Third-party services on our pages

To display the shop quickly and consistently, our pages load certain components from external providers. Your browser connects directly to their servers, so these providers receive your IP address and technical data about your browser:

• Google Fonts: the shop’s typefaces are loaded from Google’s servers on every page.
• Cloudflare (cdnjs): the icon stylesheet is loaded from Cloudflare’s servers on every page.
• Google Maps Places: at checkout and in your account’s address book, Google suggests addresses as you type in the address field. What you type is sent to Google for this purpose.

We do not use these services for analytics or advertising.

Children under 16

Our online shop is not intended for children under 16. If you are under 16, you need the permission of a parent or guardian before you create an account, place an order, request a back-in-stock alert or sign up for our newsletter.

3. Purposes and legal bases

We use your data only for the purposes listed below, each of which rests on a legal basis under Article 6 of the GDPR.

• Fulfilling your order: processing your payment, shipping your order or preparing it for local pickup or local delivery, keeping you informed of its status, and handling returns and refunds. Legal basis: performance of a contract.
• Your customer account: signing in with your email address and password or with Google, and managing your details, address book and order history. Legal basis: performance of a contract.
• Address suggestions: helping you enter your address quickly and accurately with Google Maps Places. Legal basis: our legitimate interest in accurate address details and a smooth checkout.
• Displaying the shop: loading typefaces and icons via Google Fonts and Cloudflare cdnjs. Legal basis: our legitimate interest in a fast, consistent and legible online shop.
• Customer service: answering questions and handling complaints. Legal basis: performance of a contract or, where your question does not relate to an order, our legitimate interest in helping you properly.
• Newsletter: keeping you informed of news and offers by email. Legal basis: your consent.
• Basket reminders and review requests: helping you complete your order and asking about your experience with the products you bought. Legal basis: our legitimate interest. You can object at any time.
• Back-in-stock alerts: letting you know when a product is available again. Legal basis: your consent, given when you request the alert.
• Reviews: publishing your review. Legal basis: your consent. We verify that you bought the product from us on the basis of our legitimate interest in reliable reviews.
• Legal obligations: keeping our accounts and complying with the statutory tax retention obligation. Legal basis: legal obligation.
• Security: protecting the online shop, preventing fraud and misuse, and resolving technical faults. Legal basis: our legitimate interest.

Where we rely on our legitimate interest, we have balanced that interest against your right to privacy. You can object to such processing at any time (see section 9). We do not take decisions about you based solely on automated processing, and we do not use your data to build advertising profiles.

4. Retention periods

We keep your data no longer than necessary for the purpose for which we process it, unless the law requires us to keep it for longer.

• Orders and invoices: 7 years, in line with the statutory tax retention obligation.
• Customer account and address book: for as long as your account exists. If you ask us to delete your account, we erase your account details; we then keep order data only to the extent required by the tax retention obligation.
• Newsletter: until you unsubscribe or withdraw your consent.
• Basket and reminders: for as long as needed to keep your basket and send a reminder.
• Back-in-stock alerts: until you unsubscribe via the link in the alert or ask us to delete your data.
• Review requests: we record in your order that we have sent you a review request and keep that record for as long as we keep your order data.
• Reviews: for as long as your review is published, or until you ask us to remove it.
• Customer service (email and contact form): for as long as needed to handle your question, and then for up to 2 years in case of follow-up questions, unless the message relates to an order whose records we must keep for longer.
• Cookies: the session cookie and the security cookie expire after 2 hours of inactivity; for the other cookies, see our cookie statement.
• Server logs and technical data: for as long as needed to keep the online shop secure, or longer if we need them to investigate a security incident.

5. Who we share your data with

We never sell your data. We share it only with parties we need to run our online shop and fulfil your order, or where the law requires us to do so:

• Mollie – to process your online payment.
• Sendcloud and the carrier – to process and deliver your shipment. They receive your name and delivery address and, where needed for delivery, your email address and phone number.
• Our hosting provider – to provide the servers on which the online shop and its data are stored.
• Our email provider – to send emails about your order, reminders, back-in-stock alerts, review requests and replies to your questions.
• Our email marketing service provider – to manage the mailing list and send the newsletter, if you have signed up.
• Google – for typefaces (Google Fonts) on every page, address suggestions (Google Maps Places) at checkout and in your address book, and signing in with Google if you choose to.
• Cloudflare – for the icon stylesheet (cdnjs) on every page.
• Government authorities – such as the Dutch Tax and Customs Administration, and only where we are legally required to share data.

Parties that process data solely on our behalf, such as our hosting provider, email provider, email marketing service provider and Sendcloud, act as our processors. Our data processing agreements require them to keep your data confidential and secure and to use it only for our purposes. Mollie, the carriers, Google and Cloudflare process certain data under their own responsibility (Mollie, for example, as a regulated payment institution); their own privacy policies and retention periods apply to that processing.

6. Transfers outside the European Economic Area

Wherever possible, we process your data within the European Economic Area (EEA). Some service providers, such as Google, Cloudflare and our email marketing service provider, may also process data such as your IP address outside the EEA, for example in the United States. Such transfers take place only with appropriate safeguards in place: an adequacy decision by the European Commission, such as the EU-US Data Privacy Framework for certified companies, or the standard contractual clauses adopted by the European Commission.

7. Security

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. These include:

• all traffic to and from the online shop is encrypted over HTTPS;
• passwords are never stored in readable form;
• forms are protected against misuse by other websites, and sessions expire after 2 hours of inactivity;
• review links sent to guests are personal and digitally signed;
• only people who need your data for their work have access to it;
• payments are handled in Mollie’s secure payment environment.

If a data breach occurs despite these measures, we act as the GDPR requires: where mandatory, we report it to the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority) within 72 hours and inform you without undue delay. If you suspect that your data is not properly secured or is being misused, email us immediately at info@nanikasbeauty.com.

8. Cookies

We use only functional cookies from our own online shop:

• a session cookie that remembers your visit, your sign-in session and your basket;
• a security cookie (XSRF token) that protects forms against misuse by other websites;
• a ‘Remember me’ cookie that keeps you signed in, only if you tick that option when signing in;
• a cookie that remembers your choice in the cookie bar;
• a cookie and local storage in your browser that remember your preference for the newsletter pop-up.

The session cookie and the security cookie expire after 2 hours of inactivity. We do not place analytics, advertising or tracking cookies. Google Fonts, Cloudflare cdnjs and Google Maps Places do not place cookies for us, but they do receive your IP address (see section 2). When you pay via Mollie or sign in with Google, those parties may place their own cookies on their own pages. Should we ever wish to use cookies that require consent, we will first update this policy and our cookie statement and ask for your consent in advance. Read more in our cookie statement.

9. Your rights

Under the GDPR, you have the following rights:

• Right of access: to find out which data we hold about you and how we use it.
• Right to rectification: to have inaccurate data corrected or incomplete data completed. You can also update many details yourself in your account.
• Right to erasure: to have your data deleted, unless we are legally required to keep it.
• Right to restriction of processing: to have the use of your data temporarily restricted, for example while we assess a request for rectification.
• Right to data portability: to receive the data you provided to us in a structured, commonly used and machine-readable format, or to have it transferred to another party.
• Right to object: to object to processing based on our legitimate interest. You can object to direct marketing at any time.
• Right to withdraw consent: to withdraw your consent at any time, for example for the newsletter or back-in-stock alerts. Withdrawal does not affect the lawfulness of processing carried out before it.

10. How to exercise your rights

Email your request to info@nanikasbeauty.com and state which right you wish to exercise. To make sure we do not disclose your data to anyone else, we may ask you to verify your identity, for example by emailing us from the address we have on file.

We respond as quickly as possible and within one month at the latest. If your request is complex, or if we receive a large number of requests, we may extend this period by up to two further months; we will let you know within the first month. Exercising your rights is, in principle, free of charge.

11. Complaints

If you are not satisfied with how we handle your data, please let us know first at info@nanikasbeauty.com so that we can put it right. You also have the right to lodge a complaint at any time with the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl). If you live in another EU country, such as Belgium, Germany or France, you can also contact the data protection authority in your country.

12. Changes to this privacy policy

We update this privacy policy when our online shop, our service providers or the law change. The current version is always available on this page. We will announce material changes clearly on our website.

Last updated: September 2026