Privacy & Security Policy

Last updated: August 6, 2026

Schwartz & von Halen respects your privacy and handles your personal data with care.

In this Privacy and Cookie Policy, we explain which personal data we collect, how we use it, with whom we share it, how long we retain it, and which rights you have.

This policy applies when you:

• Visit our website;
• Place an order;
• Create or use a customer account;
• Subscribe to our newsletter;
• Contact us by email or live chat;
• Return a product or submit a warranty claim;
• Submit a review, rating, photograph, or other contribution; or
• Otherwise use our products and services.

This Privacy and Cookie Policy should be read together with our Terms and Conditions, Returns and Exchanges Policy, Shipping Policy, and other applicable information available on our website.

1. Who is responsible for your personal data?

Schwartz & von Halen B.V. is responsible for processing personal data as described in this Privacy and Cookie Policy.

Our company details are:

Schwartz & von Halen B.V.
Keizersgracht 482
1017 EG Amsterdam
The Netherlands

Dutch Chamber of Commerce number: 77403398
VAT identification number: NL860997406B01

Email address:
info@schwartz-vonhalen.com

Chat:
Live chat with our team through the website

For questions about this policy or to exercise your privacy rights, you can contact us at:

info@schwartz-vonhalen.com

The address above is our registered business address. It is not automatically a return address, collection point, store, or showroom.

2. Scope of this policy

2.1 This Privacy and Cookie Policy applies to the Dutch website and online store operated by Schwartz & von Halen.

2.2 This policy applies to personal data that we process in connection with:

• Offering and selling our products;
• Processing and delivering orders;
• Managing returns, refunds, and warranties;
• Providing customer service;
• Managing customer accounts;
• Sending newsletters and other marketing communications;
• Collecting and publishing reviews;
• Analyzing and improving our website;
• Displaying and measuring advertisements;
• Protecting our website and transactions; and
• Complying with legal obligations.

2.3 Our website may contain links to third-party websites, platforms, or services.

When you use an external website or service, that third party’s privacy policy may apply. We are not responsible for the way independent third parties process personal data outside our services.

2.4 Certain service providers may be independently responsible for some processing activities. This may apply, for example, to payment providers, social media platforms, and advertising platforms.

2.5 This policy does not apply to our internal privacy practices relating to employees, job applicants, suppliers, or other business relationships unless expressly stated otherwise.

3. Which personal data do we collect?

3.1 The personal data we collect depends on how you use our website and services.

3.2 We may process the following categories of personal data:

Identification and contact information

• First and last name;
• Email address;
• Telephone number;
• Billing address;
• Delivery address; and
• Country or region.

Order and transaction information

• Order number;
• Products ordered;
• Size, color, quantity, and product variant;
• Order and delivery dates;
• Amounts paid;
• Applied discounts and promotions;
• Selected payment method;
• Payment status;
• Shipping method;
• Tracking information; and
• Invoice and administrative information.

Return, refund, and warranty information

• Products returned;
• Reason for the return;
• Requested return or refund solution;
• Return label and shipping information;
• Refund status;
• Information about defects or damage;
• Photographs and videos of a product or its packaging; and
• Correspondence concerning returns, complaints, and warranties.

Customer account information

• Account name;
• Email address;
• Encrypted account credentials;
• Saved addresses;
• Order history;
• Return history; and
• Account preferences.

Customer service information

• Emails and chat messages;
• Date and time of contact;
• Content of questions and complaints;
• Notes made by our customer service team;
• Attachments, photographs, and videos;
• Order information required to assist you; and
• The outcome of the communication.

Marketing and preference information

• Newsletter subscription;
• Date and method of subscription;
• Marketing preferences;
• Language and country preference;
• Emails opened;
• Links clicked;
• Products viewed;
• Abandoned shopping carts; and
• Responses to marketing campaigns.

Reviews and user-generated content

• Product ratings;
• Written reviews;
• Photographs and videos you submit;
• Your name or chosen public display name;
• Review status;
• Information relating to a verified purchase; and
• Responses to review requests.

Technical and usage information

• IP address;
• Browser type and version;
• Device type;
• Operating system;
• Screen settings;
• Unique device and cookie identifiers;
• Pages visited;
• Clicking and navigation behavior;
• Date and time of your visit;
• Referring website or advertisement;
• Session information;
• Approximate location based on your IP address; and
• Cookie and consent preferences.

Security and fraud-prevention information

• IP address and device information;
• Login and account activity;
• Payment status;
• Failed payment attempts;
• Indicators of possible misuse;
• Unusual ordering patterns; and
• Information required to protect our website and customers.

3.3 We do not ask you to provide special-category personal data, such as information about your health, religion, political opinions, sexual orientation, or biometric characteristics.

Please do not share such information with us unless it is strictly necessary and we have expressly asked you to provide it.

3.4 When you provide personal data relating to another person, for example when arranging delivery of a gift, you must ensure that you are legally permitted to share that information with us.

4. How do we collect personal data?

4.1 We collect personal data in several ways.

Information you provide directly to us

You provide personal data directly to us when you:

• Place an order;
• Create a customer account;
• Subscribe to our newsletter;
• Contact our customer service team;
• Submit a return or warranty claim;
• Submit a review or rating;
• Participate in a promotion or offer; or
• Complete a form on our website.

Information collected automatically

When you visit our website, we may automatically collect technical and usage information through:

• Cookies;
• Pixels;
• Tags;
• Local storage;
• Log files;
• Software Development Kits;
• Similar tracking and analytics technologies; and
• The technical systems used by Shopify and other service providers.

Non-essential cookies and similar technologies are only used after you have provided consent through our cookie settings.

Information received from service providers and partners

We may receive personal data from parties that help us provide our services, including:

• Shopify;
• Payment service providers;
• Warehouse and fulfillment partners;
• Carriers;
• Returns partners;
• Customer service providers;
• Email-marketing providers;
• Review providers;
• Analytics and advertising platforms; and
• Security and IT service providers.

4.2 We may combine information received from different sources when this is necessary for the purposes described in this policy.

We only do this when a valid legal basis applies.

5. Why do we process personal data?

5.1 We process personal data only for specific and legitimate purposes.

5.2 We may use personal data to:

• Process and deliver orders;
• Process payments and verify payment status;
• Send order confirmations and shipping updates;
• Process returns, refunds, and exchanges;
• Handle complaints and warranty claims;
• Create and manage customer accounts;
• Respond to questions by email and live chat;
• Send newsletters and marketing communications;
• Follow up on abandoned shopping carts and viewed products;
• Collect and publish reviews and ratings;
• Improve our website, products, and customer service;
• Analyze website use and campaign performance;
• Display and measure relevant advertisements;
• Create advertising audiences;
• Suggest the appropriate language or market version of the website;
• Prevent fraud, misuse, and security incidents;
• Protect our rights and those of our customers;
• Maintain our administrative records; and
• Comply with legal obligations.

5.3 We do not use personal data for purposes that are incompatible with the original purpose for which the information was collected unless:

• We inform you in advance;
• You provide your consent; or
• The processing is permitted under another valid legal basis.

6. What legal bases do we rely on?

6.1 We rely on at least one valid legal basis for each processing activity.

Depending on the purpose, we rely on one of the following legal bases:

Performance of a contract

We process personal data when this is necessary to:

• Process your order;
• Facilitate a payment;
• Deliver your products;
• Process a return or refund;
• Provide a customer account;
• Handle a warranty claim; or
• Provide other agreed services.

This legal basis also applies when you ask us to take certain steps before entering into a contract.

Legal obligation

We process personal data when this is necessary to comply with legal obligations, including obligations relating to:

• Taxation and financial administration;
• Consumer law;
• Product safety;
• Accounting;
• Fraud investigations;
• Requests from competent authorities; and
• Handling privacy requests.

Legitimate interests

We may process personal data when this is necessary for a legitimate interest pursued by Schwartz & von Halen or a third party, provided that your privacy interests and fundamental rights do not outweigh those interests.

Our legitimate interests may include:

• Protecting our website and systems;
• Preventing and investigating fraud and misuse;
• Improving our products and services;
• Responding to questions and complaints;
• Managing and protecting our business;
• Establishing, exercising, or defending legal claims;
• Conducting limited, privacy-conscious analytics; and
• Sending relevant communications to existing customers where legally permitted.

When we rely on legitimate interests, we assess our interests against the potential impact on your privacy where necessary.

Consent

We request your consent when legally required, including for:

• Placing non-essential cookies;
• Using advertising and tracking technologies;
• Sending certain marketing communications;
• Measuring email interactions where consent is required;
• Creating advertising audiences; and
• Other processing activities for which consent is required.

You can withdraw your consent at any time.

Withdrawing your consent does not affect the lawfulness of processing carried out before your consent was withdrawn.

You can withdraw your consent for cookies through the cookie settings on our website.

7. Orders, payments, and delivery

7.1 When you place an order, we process the information required to perform the purchase agreement.

This may include:

• Your name and contact information;
• Your billing and delivery addresses;
• The contents of your order;
• Your selected payment method;
• Payment status;
• Shipping method;
• Tracking information;
• Any discount codes used; and
• Correspondence relating to the order.

7.2 We use this information to:

• Confirm the order;
• Process the payment;
• Pick and pack the products;
• Ship the order;
• Send delivery updates;
• Answer questions about the order;
• Process returns and refunds;
• Maintain our financial administration; and
• Comply with legal obligations.

7.3 Our online store is provided through Shopify. Shopify processes personal data and technical information required to operate the online store, shopping cart, checkout process, customer accounts, and orders.

7.4 Payments are processed through the payment service providers we engage.

Depending on the payment method selected, the payment provider may collect additional personal data and may be independently responsible for certain processing activities.

7.5 We generally receive only the information required to determine:

• Which payment method was selected;
• Whether the payment was authorized;
• Whether the payment was completed;
• Whether an amount must be refunded; and
• Whether a payment was declined, reversed, or disputed.

7.6 To fulfill your order, we share only the personal data necessary for this purpose with parties such as:

• Shopify;
• The selected payment service provider;
• Our warehouse or fulfillment partner;
• The carrier;
• A returns partner when you return a product; and
• Service providers required for security, administration, and technical support.

7.7 We share only the information that the relevant party reasonably requires to perform its services.

For example, a carrier may receive your name, delivery address, contact information, and shipment details.

7.8 When you nominate another person as the recipient, we use that person’s information only to deliver the order and resolve any delivery issues.

7.9 We do not make solely automated decisions to definitively reject or cancel an order.

If an order requires further review, the final assessment is performed by a member of our team.

8. Customer accounts and customer service

Customer accounts

8.1 When this feature is available, you may create or activate a customer account.

We process account information to:

• Provide access to your account;
• Display your order history;
• Save your address information;
• Manage your returns and orders;
• Remember your account preferences; and
• Protect your identity and account.

8.2 You are responsible for keeping the information used to access your account confidential.

Contact us if you believe that someone has accessed your account without authorization.

8.3 You may ask us to delete your customer account.

Certain information may be retained after the account has been deleted when necessary for:

• Our legal record-keeping obligations;
• Fulfilling existing orders;
• Returns and warranties;
• Fraud prevention;
• Handling complaints; or
• Establishing, exercising, or defending legal claims.

Customer service and Gorgias

8.4 When you contact us by email or live chat, we process the information required to respond to your question.

8.5 Our customer service team uses Gorgias to manage emails, chat conversations, and related customer information.

Depending on your question, the following information may be stored in Gorgias:

• Your name;
• Your email address;
• The contents of your message;
• The date and time of the communication;
• Your order number;
• Relevant order and return information;
• Internal notes made by our customer service team;
• Photographs and other attachments; and
• The resolution or outcome of the communication.

8.6 We use this information to:

• Locate your identity and order;
• Respond to your question;
• Handle a complaint, return, or warranty claim;
• Retrieve previous communications;
• Improve our customer service; and
• Protect our rights and those of our customers.

8.7 Please do not send sensitive or unnecessary personal data through live chat or email.

Do not share full payment-card details, passwords, or other confidential login credentials with our customer service team.

8.8 When you contact us about an order, we may ask you to confirm your order number and the email address used to place the order.

This helps us verify your identity and protect your personal data.

9. Newsletters and email marketing

9.1 We may contact you by email about products, collections, offers, promotions, inspiration, and other commercial developments from Schwartz & von Halen.

9.2 We use services including Shopify Email and Klaviyo to send newsletters and marketing communications.

These services help us with:

• Managing subscriptions;
• Creating and sending newsletters;
• Personalizing email content;
• Sending product recommendations;
• Following up on abandoned shopping carts;
• Sending reminders about viewed products;
• Managing unsubscribes; and
• Measuring and improving email campaigns.

9.3 If you are not yet a customer, we will only send you commercial emails after you have given your prior consent.

9.4 Your consent must be freely given, specific, informed, and unambiguous.

We do not use preselected checkboxes to subscribe you to marketing communications.

9.5 If you are already a customer, we may inform you without separate consent about our own products that are similar to products you previously purchased from us, where legally permitted.

You will be given a clear and free opportunity to opt out both when we collect your email address and in every marketing communication.

9.6 We may use the following information for email marketing:

• Your name;
• Your email address;
• Your language and country preferences;
• Your subscription date;
• Your marketing preferences;
• Your order history;
• Products you have viewed;
• Products you have added to your shopping cart;
• Previous interactions with our emails; and
• Information about discount codes and promotions used.

9.7 We may measure email interactions, including:

• Whether a message was delivered;
• Whether an email was opened;
• Which links were clicked;
• Whether a purchase was made after an email was sent; and
• Whether someone unsubscribed.

We only use this measurement information when a valid legal basis applies and, where required, after you have provided consent.

9.8 Emails relating to an abandoned shopping cart or recently viewed product may be sent when:

• You have given consent;
• This is permitted within an existing customer relationship; or
• Another valid legal basis applies.

9.9 You can unsubscribe at any time by:

• Clicking the unsubscribe link at the bottom of a marketing communication;
• Changing your marketing preferences, where this feature is available; or
• Contacting us at info@schwartz-vonhalen.com.

9.10 After you unsubscribe, we will no longer send you new marketing communications unless you subscribe again at a later date.

It may take a short time for your unsubscribe request to be fully processed across all our systems.

9.11 Unsubscribing from marketing does not affect necessary service communications.

We may still contact you about:

• An order you have placed;
• A payment;
• A shipment or delivery;
• A return or refund;
• A complaint or warranty claim;
• A security issue; or
• An important change relating to an ongoing agreement.

9.12 We do not send marketing communications by SMS or WhatsApp.

10. Reviews, loyalty programs, and referrals

10.1 We use Yotpo to collect, manage, and publish product reviews and ratings.

Where these features are available, Yotpo may also be used for loyalty programs, rewards, and referrals.

10.2 After a purchase, we may invite you to leave a product review or rating.

For a review request, we may share the following information with Yotpo:

• Your name;
• Your email address;
• Your order number;
• The products ordered;
• The purchase date;
• Your language and country preferences; and
• Information required to confirm that the review relates to a verified purchase.

10.3 You are not required to submit a review.

Whether or not you submit a review does not affect your statutory rights.

10.4 When you submit a review, rating, photograph, or video, we may process:

• The content of your review;
• The rating you provided;
• Your name or chosen display name;
• Photographs or videos submitted;
• The relevant product;
• The date of submission;
• The status of the review; and
• Whether the review is linked to a verified purchase.

10.5 Reviews may be published publicly on our website.

You should therefore not include information that you do not want to make public, such as:

• Your full address;
• Your telephone number;
• Your email address;
• Payment information;
• Login credentials;
• Special-category personal data; or
• Personal data relating to other individuals.

10.6 We may moderate, reject, or remove a review when it:

• Is unlawful or misleading;
• Does not relate to the product or service;
• Contains personal data that should not be made public;
• Contains offensive, threatening, or discriminatory material;
• Contains spam or unauthorized advertising;
• Infringes the rights of a third party; or
• Violates our terms of use or the review provider’s terms.

10.7 We do not remove a negative review solely because it is negative.

We may, however, verify whether a review is based on a genuine experience and complies with our publication requirements.

10.8 If we offer a loyalty or rewards program, we may process information relating to:

• Your account or email address;
• Points collected;
• Rewards earned;
• Discounts redeemed;
• Participation in promotions;
• Referrals; and
• The status and validity of a reward.

10.9 When you refer another person, you may only provide that person’s details if you have their permission or if the referral is otherwise made lawfully.

10.10 Additional terms for loyalty, reward, or referral programs will be provided with the relevant program.

11. Website analytics and improvements

11.1 We use analytics and measurement services to understand how visitors use our website.

For this purpose, we may use Google Analytics 4 and similar analytics technologies.

11.2 Depending on your cookie preferences, analytics information may include:

• The number of visits to our website;
• Pages and product pages visited;
• The duration of a visit;
• Clicking and navigation behavior;
• The page on which a visit begins and ends;
• The website, search engine, or advertisement from which you arrived;
• The device and operating system used;
• Browser type and screen settings;
• General location information;
• Technical errors and performance information;
• Products added and shopping-cart activity; and
• Aggregated information about orders and conversions.

11.3 We use analytics information to:

• Improve the operation and speed of our website;
• Resolve technical issues;
• Understand which pages and products are relevant;
• Improve navigation and search functionality;
• Test ease of use;
• Measure campaign performance;
• Improve our collections and services; and
• Conduct aggregated business analysis.

11.4 Analytics cookies and similar technologies that have more than a minimal impact on your privacy are only used after you have provided consent.

11.5 Where possible, we limit analytics information by:

• Collecting only necessary information;
• Pseudonymizing or aggregating information;
• Limiting retention periods;
• Restricting access to information; and
• Using privacy-conscious settings.

11.6 Analytics information is not used to make decisions without human involvement that have legal or similarly significant effects on you.

12. Online advertising and advertising audiences

12.1 We may use advertising and measurement services to promote our products and measure advertising performance.

Depending on our campaigns and your cookie preferences, we may use:

• Google Ads;
• Meta Pixel and Meta advertising services;
• TikTok Pixel and TikTok Ads;
• Microsoft Advertising;
• Pinterest Ads and Pinterest Tag; and
• Other similar advertising and measurement platforms.

12.2 After you have provided consent, these services may process information about:

• Pages visited;
• Products viewed;
• Searches performed within the website;
• Products in the shopping cart;
• Purchases and order value;
• Clicks on advertisements;
• Device and browser information;
• IP address;
• Cookie and advertising identifiers; and
• The campaign or advertisement that preceded a visit or purchase.

12.3 We may use this information for:

• Measuring advertising performance;
• Attributing purchases to campaigns;
• Reducing irrelevant advertisements;
• Reaching previous website visitors again;
• Displaying advertisements for viewed or similar products;
• Creating advertising audiences;
• Finding audiences with similar characteristics; and
• Improving our advertising campaigns.

12.4 If you have provided consent and this is legally permitted, we may share certain customer information with advertising platforms to create an audience.

This may include:

• An encrypted or hashed email address;
• An encrypted telephone number;
• Country or regional information;
• Information about a previous purchase; and
• Technical identifiers.

12.5 Hashing or encrypting information reduces its direct identifiability, but the information may still be considered personal data.

We therefore handle this information in accordance with applicable privacy laws.

12.6 Advertising platforms may process personal data as independent controllers for certain purposes.

In that case, the privacy terms of the relevant platform will also apply.

12.7 We do not sell your personal data.

12.8 You can withdraw consent for advertising and marketing cookies at any time through the cookie settings on our website.

Withdrawing consent prevents future processing based on that consent but does not make earlier processing unlawful retroactively.

12.9 Refusing advertising cookies does not necessarily mean that you will no longer see advertisements.

The advertisements may simply be less tailored to your website use or interests.

13. Country, language, and market suggestions through Orbe

13.1 We use Orbe to give visitors the option to move to a version of the website that better matches their country, language, or market.

13.2 For this purpose, Orbe may use limited technical information, including:

• Your IP address;
• An approximate location at country or regional level;
• Your browser language;
• The current version of the website;
• The selected market or language; and
• A cookie or local preference used to remember your choice.

13.3 We use this information only to suggest an appropriate language, country, or market version and to remember your selected preference.

13.4 We do not automatically redirect you to another version of the website.

You will always be able to:

• Open the suggested version of the website;
• Remain on the current version of the website;
• Select another country or language; and
• Change your choice again later.

13.5 When you choose a country or language, that selection may be stored on your device so that you do not have to make the same choice during every visit.

13.6 An approximate location based on an IP address may not always be completely accurate.

Your own selection therefore remains decisive for the version of the website you use.

13.7 We do not use Orbe to enter into an agreement without your choice, automatically determine prices for you, or block your access to the online store.

14. Cookies and similar technologies

14.1 Our website uses cookies and similar technologies.

A cookie is a small text file stored on your computer, telephone, tablet, or other device when you visit a website.

14.2 In addition to cookies, we may use:

• Pixels;
• Tags;
• Local storage;
• Log files;
• Software Development Kits;
• Tracking links; and
• Other similar technologies.

14.3 We use the following main categories of cookies:

Essential cookies

These cookies are required for the website and online store to function.

They may be used for:

• The shopping cart;
• The checkout process;
• Security and fraud prevention;
• Remembering cookie preferences;
• Logging into a customer account;
• Distributing website traffic; and
• Displaying pages correctly.

We do not request consent for strictly essential cookies where consent is not legally required.

These cookies cannot be disabled through our cookie banner when the website cannot function properly without them.

Preference and functional cookies

These cookies help us remember choices and settings, including:

• Your language;
• Your country or market;
• Your selected currency;
• Your login status;
• Previously selected settings; and
• Other personal website preferences.

We request consent for functional cookies where required under applicable law.

Analytics cookies

These cookies help us understand how visitors use the website and how the website performs.

They may be used to:

• Measure visits and page views;
• Analyze navigation behavior;
• Identify technical errors;
• Improve ease of use; and
• Measure campaign performance.

We request prior consent for analytics cookies that have more than a minimal impact on your privacy.

Marketing and advertising cookies

These cookies and similar technologies may be used to:

• Track your use of pages and websites;
• Display more relevant advertisements;
• Reach website visitors again;
• Create advertising audiences;
• Measure advertising campaigns; and
• Determine whether an advertisement resulted in a purchase.

Marketing and advertising cookies are only placed after you have provided consent.

14.4 When you first visit our website, we display a cookie banner or similar consent function.

This allows you to choose separately between:

• Essential cookies;
• Preference and functional cookies;
• Analytics cookies; and
• Marketing and advertising cookies.

14.5 Non-essential cookies and tracking technologies are not activated before you have provided consent.

14.6 You can refuse non-essential cookies without losing access to the essential functions of the online store.

Certain additional features may not function as effectively if you refuse particular cookies.

14.7 You can review and change your cookie preferences at any time through the cookie settings on our website.

Withdrawing consent must be as easy as giving it.

14.8 When you withdraw consent:

• We stop future processing based on that consent;
• We block the relevant technologies where possible;
• Existing cookies are deleted or no longer read where technically possible; and
• Earlier lawful processing remains valid.

14.9 You can also delete or block cookies through your browser.

The available settings differ by browser and device.

Blocking all cookies may prevent certain parts of the website from functioning properly.

14.10 The cookies, providers, purposes, and retention periods we use may change from time to time.

Current information will, where possible, be made available through the cookie banner or cookie settings.

15. With whom do we share personal data?

15.1 We share personal data only when this is necessary for the purposes described in this policy, when you have provided consent, or when we are legally required to do so.

15.2 We may share personal data with the following categories of recipients:

E-commerce and hosting service providers

We use Shopify to provide our website and online store.

Shopify may process information for:

• Hosting and technical operation;
• The shopping cart;
• The checkout process;
• Orders and customer accounts;
• Security;
• Reporting; and
• Other necessary online-store functions.

Payment service providers

We share the necessary payment and order information with the provider of your selected payment method.

Payment service providers may be independently responsible for certain processing activities.

Warehouses, fulfillment partners, and carriers

We share necessary information with our warehouse, fulfillment partners, and carriers to process, pack, ship, and deliver orders.

This may include:

• Your name;
• Your delivery address;
• Your telephone number or email address;
• Your order number;
• The contents of the shipment;
• The selected delivery service; and
• Tracking information.

Returns and repair partners

When you return a product or request a repair, we may share the necessary information with:

• A returns platform;
• A returns carrier;
• Our warehouse;
• A repair provider;
• A supplier; or
• An expert assessing the product.

Customer service and communication providers

We use Gorgias for customer service and live chat.

Shopify Email and Klaviyo may be used for email communications and marketing.

Reviews, loyalty, and referrals

We use Yotpo for reviews and, where offered, loyalty and referral features.

Localization and market selection

We use Orbe to suggest an appropriate language, country, or market version and to remember your selection.

Analytics and advertising services

After you have provided consent, information may be shared with or collected by services such as:

• Google Analytics;
• Google Ads;
• Meta;
• TikTok;
• Microsoft Advertising;
• Pinterest; and
• Other similar analytics and advertising partners.

IT, security, and administrative service providers

We may share personal data with parties that support us with:

• Cloud storage;
• Website management;
• Software maintenance;
• Cybersecurity;
• Fraud prevention;
• Accounting and administration;
• Backups; and
• Technical support.

Professional advisers

Where necessary, we may share information with:

• Accountants;
• Tax advisers;
• Lawyers;
• Insurers;
• Debt-collection providers; and
• Other professional advisers.

Government bodies and competent authorities

We may disclose personal data when necessary to:

• Comply with a legal obligation;
• Respond to a valid request from a competent authority;
• Investigate fraud or criminal conduct;
• Protect our legal rights; or
• Protect the safety of customers, employees, or others.

15.3 We share only the personal data reasonably necessary for the relevant task.

15.4 Where a service provider processes personal data solely on our behalf, we enter into a data-processing agreement or similar data-protection agreement where required.

15.5 Service providers may not use personal data for their own purposes unless:

• This is necessary for their own legal obligations;
• They are independently responsible for the relevant processing;
• You have provided consent; or
• Another valid legal basis applies.

15.6 In connection with a merger, acquisition, reorganization, financing, or sale of the business, personal data may be shared with relevant advisers and potential legal successors.

This will only take place where appropriate confidentiality and security measures are applied.

16. International transfers of personal data

16.1 Some service providers, group companies, or technical systems may process personal data outside the Netherlands or outside the European Economic Area.

This may occur with international providers of:

• E-commerce and hosting services;
• Cloud storage;
• Customer service software;
• Email marketing;
• Reviews and loyalty programs;
• Analytics;
• Advertising;
• Security; and
• Technical support.

16.2 When personal data is transferred outside the European Economic Area, we ensure that a valid transfer mechanism is in place.

Depending on the country and service provider, this may include:

• An adequacy decision issued by the European Commission;
• Standard Contractual Clauses approved by the European Commission;
• Binding Corporate Rules;
• An approved certification mechanism;
• An applicable international data-protection framework; or
• Another legally permitted transfer mechanism.

16.3 Where we use Standard Contractual Clauses, additional measures may be applied to protect personal data.

These measures may include:

• Encryption during storage and transfer;
• Pseudonymization;
• Access restrictions;
• Security controls;
• Contractual obligations;
• Restrictions on onward transfers; and
• An assessment of the laws and risks in the receiving country.

16.4 A transfer outside the European Economic Area does not mean that your statutory privacy rights no longer apply.

16.5 You may contact us for more information about the safeguards that apply to a specific international transfer.

Where legally required, we may provide a copy or summary of the relevant safeguards.

17. How long do we retain personal data?

17.1 We do not retain personal data for longer than necessary for the purposes for which it was collected.

When determining a retention period, we consider:

• The purpose of the processing;
• The nature and sensitivity of the information;
• The duration of the customer relationship;
• Applicable warranty and return periods;
• Statutory administrative and retention obligations;
• Potential complaints and legal claims;
• Fraud and security risks; and
• The technical ability to delete or anonymize information.

17.2 We generally apply the following principles:

Order, invoice, and payment information

Information forming part of our tax or financial administration is generally retained for seven years.

Where a specific legal requirement prescribes a longer retention period, the relevant information may be retained for longer.

Customer accounts

Account information is retained while your account remains active and for a reasonable period afterward.

Information still required for orders, returns, warranties, administration, or legal claims may be retained separately after the account has been deleted.

Customer service, complaints, and warranty claims

Correspondence and related information are retained for as long as necessary to handle the question, complaint, return, or warranty claim.

The information may then be retained for as long as reasonably necessary for quality control, preventing repeated disputes, and establishing or defending legal claims.

Newsletter and marketing information

We retain your marketing information until:

• You unsubscribe;
• You withdraw your consent;
• The marketing purpose no longer applies;
• The information is no longer current; or
• An applicable maximum retention period is reached.

After you unsubscribe, we may retain your email address on a limited suppression list to ensure that you do not unintentionally receive marketing communications again.

Evidence of consent

Information demonstrating that you gave or withdrew consent may be retained for as long as necessary to comply with our legal accountability obligations.

Reviews and user-generated content

A published review may be retained for as long as it remains relevant to the product and its publication remains lawful.

If you request deletion, we will assess whether the review and related personal data can or must be removed.

Cookies and online identifiers

The retention period varies by cookie or technology.

Some cookies are deleted when you close your browser. Other cookies remain on your device for a limited period.

Current retention periods are displayed through the cookie settings where possible.

Analytics and advertising information

This information is retained in accordance with our settings, your consent, and the retention periods applied by the relevant service providers.

We limit these periods where reasonably possible.

Security and fraud-prevention information

This information is retained for as long as necessary to:

• Investigate an incident;
• Prevent repeated misuse;
• Protect our systems and customers;
• Comply with legal obligations; and
• Establish or defend legal claims.

17.3 When personal data is no longer required, it will be:

• Deleted;
• Anonymized;
• Restricted; or
• Otherwise appropriately taken out of use.

17.4 Fully anonymized information that can no longer be linked to an individual may be used for longer for statistical and business analysis.

17.5 Deleted information may remain in secure backups for a limited period.

These backups are not used for ordinary business activities and are overwritten or deleted in accordance with our backup schedule.

17.6 Where information is relevant to an ongoing dispute, investigation, request from an authority, or legal proceeding, we may postpone deletion until the relevant matter has been concluded.

18. Security of personal data

18.1 We take appropriate technical and organizational measures to protect personal data against:

• Unauthorized access;
• Unlawful use;
• Accidental loss;
• Unauthorized alteration;
• Unauthorized disclosure;
• Destruction; and
• Other forms of misuse.

18.2 The security measures we apply depend on:

• The nature of the personal data;
• The amount of data processed;
• The purposes of the processing;
• The systems used;
• The potential consequences of a security incident; and
• The available technical capabilities.

18.3 Where appropriate, our security measures may include:

• Encrypted connections;
• Secure hosting and cloud environments;
• Restricted access to personal data;
• Individual user accounts and access permissions;
• Strong passwords and additional access controls;
• Secure payment processing;
• Software and security updates;
• Backups and recovery procedures;
• Security controls and log files;
• Internal confidentiality arrangements;
• Limiting the amount of data collected; and
• Data-protection agreements with service providers.

18.4 Only employees and service providers who require personal data for their work are given access to it.

Where possible, access is limited to the information necessary for the relevant task.

18.5 Employees and service providers with access to personal data are required to handle it carefully and confidentially.

18.6 When we engage an external service provider to process personal data on our behalf, we assess its security where appropriate and make arrangements concerning:

• Confidentiality;
• Security measures;
• Access management;
• Personal data breaches;
• Retention periods;
• International transfers; and
• The deletion or return of personal data.

18.7 Despite our measures, no website, internet connection, cloud environment, or electronic storage method can guarantee complete security.

We therefore cannot guarantee that personal data will be fully protected against every possible security risk under all circumstances.

18.8 You are responsible for carefully protecting:

• Your passwords;
• Your email account;
• Your customer account;
• Your devices; and
• Other information that can be used to access your account.

18.9 Do not share passwords, full payment-card details, or other confidential login information with our customer service team.

18.10 Please contact us as soon as possible if you suspect that:

• Someone has accessed your account without authorization;
• Your password or email address has been misused;
• An order has been placed without your authorization; or
• Your personal data has otherwise been leaked or misused.

19. Your privacy rights

19.1 Under applicable privacy laws, you have various rights relating to your personal data.

These rights do not apply without limitation in every circumstance. In certain cases, we may or must refuse a request in whole or in part.

Right to information

19.2 You have the right to receive clear information about:

• Which personal data we process;
• Why we process this data;
• The legal basis on which we process it;
• With whom we share the data;
• How long we retain the data; and
• Which privacy rights you have.

This Privacy and Cookie Policy is intended to satisfy this right to information.

Right of access

19.3 You may ask us whether we process personal data relating to you.

If we do, you may receive information about:

• The personal data we process about you;
• The purposes of the processing;
• The categories of personal data;
• The recipients or categories of recipients;
• The applicable retention periods;
• The source of the data, when we did not receive it directly from you;
• Your other privacy rights; and
• The existence of relevant automated decision-making, where applicable.

19.4 You may also request a copy of your personal data.

The right to receive a copy must not adversely affect the rights and freedoms of other people.

Right to rectification

19.5 You may ask us to correct inaccurate personal data.

You may also ask us to complete incomplete information where this is relevant to the purpose for which we process it.

Right to erasure

19.6 In certain circumstances, you may ask us to delete personal data, for example when:

• The data is no longer required for its original purpose;
• You withdraw your consent and no other legal basis applies;
• You validly object to the processing;
• The data has been processed unlawfully; or
• Deletion is required to comply with a legal obligation.

19.7 The right to erasure is not absolute.

We may continue to retain information when this is necessary for:

• Compliance with a legal obligation;
• Our tax or financial administration;
• The performance of an ongoing order;
• A return, complaint, or warranty claim;
• A fraud or security investigation;
• Establishing, exercising, or defending legal claims; or
• Another legally permitted reason.

Right to restriction of processing

19.8 In certain circumstances, you may ask us to temporarily restrict our use of your personal data, for example when:

• You dispute the accuracy of the data;
• The processing is unlawful, but you do not want the data to be deleted;
• We no longer require the data, but you need it for a legal claim; or
• You have objected and it has not yet been determined whose interests take priority.

During a valid restriction, the data will generally only be:

• Retained;
• Used with your consent;
• Used in connection with legal claims;
• Used to protect the rights of another person; or
• Used for reasons of important public interest.

Right to data portability

19.9 Where processing is based on consent or a contract and is carried out by automated means, you may in certain cases ask for personal data you provided to us:

• To be provided in a structured format;
• To be provided in a commonly used and machine-readable format; or
• To be transferred directly to another organization where technically possible.

The right to data portability does not automatically apply to all personal data we process.

Right to object

19.10 Where we process personal data based on legitimate interests, you may object to that processing for reasons relating to your particular situation.

19.11 Following a valid objection, we will stop the relevant processing unless:

• We can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms; or
• The processing is necessary to establish, exercise, or defend legal claims.

19.12 You may object at any time to the use of your personal data for direct marketing.

When you object to direct marketing, we will no longer use your personal data for that purpose.

Right to withdraw consent

19.13 Where processing is based on your consent, you may withdraw that consent at any time.

You can, for example:

• Unsubscribe from marketing emails;
• Change your cookie preferences;
• Withdraw consent for advertising cookies; or
• Contact us.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Right to human review

19.14 Subject to the applicable legal conditions, you have the right not to be subject to a solely automated decision that has legal or similarly significant effects on you.

Further information is provided in Section 21.

20. Submitting privacy requests and identity verification

20.1 You may submit a privacy request by contacting:

info@schwartz-vonhalen.com

20.2 Please clearly state:

• Which privacy right you wish to exercise;
• Which personal data your request relates to;
• Your order number, if you placed an order; and
• The email address used for your order or account.

20.3 Before carrying out a privacy request, we must verify that it genuinely comes from the person to whom the data relates.

20.4 We initially try to verify your identity using information we already hold, such as:

• Your order number;
• The email address used for the order;
• Confirmation from the email account known to us; and
• Other limited information relating to your order or account.

20.5 If we cannot sufficiently verify your identity, we may request additional information.

We will not request more information than is reasonably necessary to verify your identity.

20.6 We do not routinely ask for a full copy of an identity document.

We may only request additional identification where your identity cannot be established in a less intrusive way and doing so is necessary and legally permitted.

We may ask you to obscure any information that is not required.

20.7 If you submit a request on behalf of another person, we may ask for:

• Valid authorization;
• Evidence of legal representation; and
• Appropriate verification of the identities of both the person concerned and the representative.

20.8 We generally respond within one month after receiving the request.

20.9 If a request is complex or we receive several requests from the same person, we may extend the response period by up to two additional months where legally permitted.

If we require more time, we will inform you within the first month about:

• The extension;
• The reason for the extension; and
• The expected further handling of your request.

20.10 Privacy requests are generally handled free of charge.

20.11 Where a request is manifestly unfounded or excessive, particularly because of its repetitive nature, we may, where legally permitted:

• Charge a reasonable administrative fee; or
• Refuse to act on the request.

In that case, we must be able to explain why the request is manifestly unfounded or excessive.

20.12 If we refuse a request in whole or in part, we will inform you about:

• The reason for the refusal;
• Your ability to file a complaint with the Dutch Data Protection Authority; and
• Your ability to bring proceedings before the competent court.

20.13 If you submit a request electronically, we will generally provide our response electronically as well, unless:

• You request another format;
• This is not technically possible; or
• Another format is necessary to provide your personal data securely.

20.14 Where we correct, delete, or restrict personal data at your request, we will also inform the relevant recipients to whom the data was previously disclosed where legally required.

This does not apply where doing so proves impossible or would involve disproportionate effort.

21. Profiling and automated decision-making

21.1 We may use limited forms of automated processing and profiling to:

• Display product recommendations;
• Personalize newsletters;
• Follow up on abandoned shopping carts;
• Create advertising audiences;
• Measure campaign performance;
• Analyze website use;
• Make language or market suggestions; and
• Identify possible security risks.

21.2 Profiling means that certain personal data is used through automated processing to analyze or predict personal preferences, interests, or behavior.

21.3 Where consent is legally required, we only use profiling for marketing and advertising after you have provided consent.

21.4 We do not make solely automated decisions that have legal effects on you or affect you in a similarly significant way.

21.5 An order is not definitively rejected or canceled solely by an automated system.

If an order requires further investigation, the final assessment is performed by a member of our team.

21.6 Automated personalization may influence:

• Which products are recommended to you;
• Which marketing content you see;
• Which advertisements may be shown to you; and
• Which language or market version is suggested.

This personalization does not have legal or similarly significant effects on you.

21.7 You can stop profiling for direct marketing by:

• Unsubscribing from marketing emails;
• Refusing marketing and advertising cookies;
• Changing your cookie preferences; or
• Objecting by contacting info@schwartz-vonhalen.com.

22. Personal data relating to minors

22.1 Our website and products are not specifically directed at children.

22.2 Minors may only place an order with the permission of a parent, guardian, or other legal representative.

22.3 Where the processing of a minor’s personal data is based on consent and the law requires the permission of a parent or legal representative, we will request that permission.

22.4 We do not knowingly collect personal data from children in a manner that violates applicable privacy laws.

22.5 A parent, guardian, or legal representative who believes that a minor has provided personal data to us without the required permission may contact:

info@schwartz-vonhalen.com

22.6 Following such a report, we may:

• Investigate the circumstances;
• Verify identity and legal representation;
• Restrict the processing;
• Correct the data; or
• Delete the data where a valid basis for deletion exists.

22.7 Certain personal data may be retained where this is necessary for:

• The performance of a valid order;
• A statutory record-keeping obligation;
• A return, complaint, or warranty claim;
• Fraud prevention; or
• Establishing or defending legal claims.

23. Personal data breaches and security incidents

23.1 A personal data breach is a security incident in which personal data is accidentally or unlawfully:

• Destroyed;
• Lost;
• Altered;
• Disclosed;
• Accessed; or
• Otherwise made available to unauthorized persons.

23.2 If we discover a possible personal data breach, we will take appropriate steps as soon as possible to:

• Investigate the incident;
• Determine its scope and cause;
• Prevent further access or disclosure;
• Limit the consequences;
• Restore affected systems;
• Prevent recurrence; and
• Comply with our legal obligations.

23.3 We document personal data breaches in accordance with applicable law.

Our internal records may include:

• The nature of the incident;
• The categories of personal data involved;
• The suspected cause;
• The potential consequences;
• The measures taken; and
• The assessment of whether notification was required.

23.4 Where a personal data breach is likely to result in a risk to the rights and freedoms of affected individuals, we will report the incident to the Dutch Data Protection Authority within the applicable legal period where required.

23.5 Where a personal data breach is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay unless a legal exception applies.

23.6 A notification to affected individuals may include information about:

• The nature of the personal data breach;
• The personal data that may be involved;
• The potential consequences;
• The measures we have taken;
• Steps you can take yourself; and
• How you can contact us.

23.7 If you believe that a security incident relates to your personal data, you can report it to:

info@schwartz-vonhalen.com

24. Complaints and supervisory authority

24.1 If you have a question or complaint about how we process your personal data, we ask you to contact us first.

You can reach us at:

info@schwartz-vonhalen.com

24.2 Where possible, please include:

• Your name;
• Your email address;
• Your order number, where applicable;
• A clear description of the complaint;
• The relevant personal data or processing activity; and
• The solution you expect from us.

24.3 We carefully investigate privacy complaints and aim to provide an appropriate solution within a reasonable period.

24.4 If you are not satisfied with our response, you have the right to file a complaint with the Dutch supervisory authority:

Dutch Data Protection Authority
Autoriteit Persoonsgegevens

Further information about filing a complaint is available on the website of the Dutch Data Protection Authority.

24.5 You may also file a complaint with another competent European data-protection authority, for example in the country where you:

• Usually reside;
• Work; or
• Believe that an infringement of your privacy rights took place.

24.6 Filing a complaint with a supervisory authority does not limit your right to begin legal proceedings.

24.7 You are not required to file a complaint with us before contacting a competent supervisory authority.

25. Changes to this Privacy and Cookie Policy

25.1 We may amend this Privacy and Cookie Policy from time to time.

This may be necessary because of:

• Changes in laws or regulations;
• New guidance from supervisory authorities;
• New products or services;
• New technical systems;
• Changes to our service providers;
• New cookies or analytics technologies;
• Changes to our advertising activities;
• Changes to retention periods; or
• Improvements to the clarity of this policy.

25.2 The most current version will be published on our website.

The date on which the policy was last updated is stated at the beginning of the policy.

25.3 We recommend reviewing this policy regularly.

25.4 Where a change has important consequences for how we process your personal data, we may provide additional notice through:

• A notice on our website;
• A message in your customer account;
• An email; or
• A new consent request.

25.5 Where we need your consent for a new processing activity, we will request it before that processing begins.

25.6 A change to this policy does not make any previous unlawful processing lawful.

26. Contact details

For questions about this Privacy and Cookie Policy, the processing of your personal data, or the exercise of your privacy rights, you can contact:

Schwartz & von Halen B.V.
Keizersgracht 482
1017 EG Amsterdam
The Netherlands

Dutch Chamber of Commerce number: 77403398
VAT identification number: NL860997406B01

Email address:
info@schwartz-vonhalen.com

Chat:
Live chat with our team through the website

When you contact us regarding an order or privacy request, we may ask you to confirm your order number and the email address used for the order.

The address above is our registered business address. It is not automatically a return address, collection point, store, or showroom.