Privacy Policy

Last updated: 6 October 2026

1. Controller

The controller responsible for the processing of personal data in connection with this website and our online store is:

Puppington B.V.
Hoge Zand 39, Unit 1.01
2512 EL ’s-Gravenhage
The Netherlands

Telephone: +31 6 2643 4171
Email: info@puppington.nl

In this Privacy Policy, Puppington B.V. is also referred to as “Puppington”, “we”, “us” or “our”, and visitors to and customers of our website as “you” or “your”.

2. General Information About Data Processing

We process personal data only where necessary to operate our website and online store, process orders and enquiries, comply with legal obligations, protect our business and customers, or for the other purposes described in this Privacy Policy.

Personal data means any information relating to an identified or identifiable natural person. This may include, in particular:

• name;

• postal address;

• email address;

• telephone number;

• order information;

• payment information;

• IP address;

• device information; and

• information about how you use our website.

We process personal data under one or more of the following legal bases under the General Data Protection Regulation (“GDPR”):

• Article 6(1)(a) GDPR where you have given us consent;

• Article 6(1)(b) GDPR where processing is necessary to take steps at your request before entering into a contract or to perform a contract with you;

• Article 6(1)(c) GDPR where processing is necessary to comply with a legal obligation; and

• Article 6(1)(f) GDPR where processing is necessary for our legitimate interests or those of a third party and those interests are not overridden by your interests, rights or freedoms.

Where Dutch rules concerning cookies, electronic communications or direct marketing also apply, we process data in accordance with the applicable provisions of the Dutch Telecommunications Act (Telecommunicatiewet).

3. Hosting and Shopify

Our online store is operated using Shopify.

For merchants in the European Economic Area, the principal Shopify contracting entity is:

Shopify International Limited
2nd Floor, Victoria Buildings
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland

Shopify may process technical usage data and information you provide when using our store, creating a customer account or placing an order.

This may include:

• IP address;

• device and browser information;

• cookie and usage information;

• contact details;

• customer account information;

• shopping-cart contents;

• order and payment information;

• delivery information; and

• communications data.

We use Shopify to provide, secure and operate our online store and to process customer orders.

Where processing is necessary to perform a contract or take steps before entering into a contract, the legal basis is Article 6(1)(b) GDPR.

Other processing may be based on our legitimate interest in securely and efficiently operating our online store under Article 6(1)(f) GDPR.

Shopify may also process personal data through affiliated companies and service providers located outside the European Economic Area. Where applicable, international transfers are protected by an adequacy decision of the European Commission, the European Commission's Standard Contractual Clauses or other legally recognised safeguards.

Shopify may process certain information as an independent controller for its own purposes, including platform security, fraud prevention, provision of Shopify services and improvement of its services.

Further information is available in Shopify's privacy documentation.

4. Website Access and Server Log Data

When you access our website, certain information may automatically be collected by our technical systems or by Shopify.

This may include:

• IP address;

• date and time of access;

• pages or files accessed;

• previously visited page;

• browser type and version;

• operating system;

• device information;

• language settings;

• referrer URL; and

• technical error and security information.

We process this information to make the website available, maintain the stability and security of the store, identify technical problems and prevent misuse, fraud or unauthorised activity.

The legal basis is Article 6(1)(f) GDPR.

Our legitimate interest is the secure, stable and effective operation of our website.

5. Customer Accounts

Where we offer customer accounts, we process the information you provide to create and manage your account.

This may include:

• name;

• email address;

• telephone number;

• billing and delivery addresses;

• order history;

• account settings; and

• saved preferences.

The legal basis is Article 6(1)(b) GDPR.

You may request deletion of your customer account at any time by contacting us using the details in Section 1.

Order, invoice, accounting and other records that we are legally required to retain will not be deleted until the applicable statutory retention period has expired.

6. Orders and Performance of Contracts

When you place an order, we may process:

• first and last name;

• billing address;

• delivery address;

• email address;

• telephone number, where provided or required for delivery;

• products ordered;

• order number;

• order, payment and delivery status;

• information concerning cancellations, returns, complaints or refunds; and

• communications with us.

We process this information to accept and fulfil your order, deliver products, process payments, provide customer service and handle warranty, cancellation, return, complaint or refund requests.

The legal basis is Article 6(1)(b) GDPR.

Where we retain information to comply with tax, accounting, commercial or other legal requirements, the legal basis is Article 6(1)(c) GDPR.

7. Payment Processing

To process payments, we provide the information necessary for the transaction to the payment method or payment service provider you select at checkout.

This may include:

• name;

• billing address;

• email address;

• order number;

• order amount;

• currency;

• payment method;

• payment status;

• device and transaction information; and

• authentication and fraud-prevention information.

Depending on your country, device and the payment options available at checkout, we may use the following payment services.

Shopify Payments

Shopify International Limited
The Sidings, 4th Floor
Grand Canal Quay
Dublin D02 E7K8
Ireland

Shopify Payments facilitates payment methods that may include credit and debit cards and supported local or digital payment methods such as iDEAL, depending on availability.

PayPal

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg
Luxembourg

If you select PayPal, the information required to process your payment is transmitted to PayPal.

Klarna

Klarna Bank AB (publ)
Sveavägen 46
111 34 Stockholm
Sweden

If Klarna is offered at checkout and you select it, the information required to process your payment is transmitted to Klarna.

Apple Pay

Apple Distribution International Limited
Hollyhill Industrial Estate
Hollyhill, Cork
Ireland

If you use Apple Pay, payment authorisation takes place using your Apple device and Apple's payment functionality.

Google Pay

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

If you use Google Pay, payment authorisation takes place using Google's payment functionality.

Our processing for payment purposes is based on Article 6(1)(b) GDPR.

Payment service providers may also process personal data as independent controllers where necessary to comply with their own legal obligations, conduct identity or credit checks, prevent fraud, assess payment risk or comply with financial-services regulation.

Complete credit-card or bank-account information is generally processed directly by the relevant payment service provider. We ordinarily receive only payment, authorisation, transaction or status information.

8. Fulfilment, Shipping and Returns

For warehousing, picking, packing, shipping and returns, we provide the necessary order and delivery information to our fulfilment provider:

MKB Fulfilment
Cobaltstraat 17
2718 RM Zoetermeer
The Netherlands

This information may include:

• name;

• delivery address;

• email address;

• telephone number, where required for delivery;

• order number;

• products ordered;

• parcel information; and

• returns information.

Depending on the delivery destination, package and shipping method, we may also provide necessary data to shipping providers and their local delivery partners, including:

• DHL;

• PostNL;

• FedEx; and

• bpost.

The legal basis is Article 6(1)(b) GDPR because the processing is necessary to fulfil your order.

9. Contact, Shopify Inbox and Customer Service

If you contact us by email, telephone, contact form, chat, social media or another communication service, we process the information you provide in order to respond to your enquiry.

This may include:

• name;

• email address;

• telephone number;

• order number;

• content of your communication;

• attachments;

• information about your enquiry; and

• technical information relating to the communication.

We use Shopify Inbox for certain chat and customer-service functions.

Shopify Inbox is provided by Shopify International Limited. Chat messages, contact information, customer-account information, shopping-cart and order information and technical usage information may be processed through the service.

If your enquiry relates to an order or potential contract, the legal basis is Article 6(1)(b) GDPR.

For other enquiries, the legal basis is our legitimate interest in efficient communication and customer service under Article 6(1)(f) GDPR.

10. Newsletter and Shopify Email

If you subscribe to our newsletter, we process your email address and, where provided, your name in order to send you information about our products, promotions and news.

We use Shopify Email, provided by:

Shopify International Limited
2nd Floor, Victoria Buildings
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland

Information processed in connection with email marketing may include:

• name;

• email address;

• subscription and consent information;

• date and time of subscription or confirmation;

• email delivery information;

• email opens and clicks;

• order and product interests; and

• technical device and browser information.

Where consent is required, marketing emails are sent on the basis of your consent under Article 6(1)(a) GDPR and in accordance with applicable Dutch electronic-communications rules.

Where required, we may use a double opt-in process and retain information necessary to demonstrate when and how consent was provided.

You may withdraw your consent at any time for the future by using the unsubscribe link contained in our marketing emails or by contacting info@puppington.nl.

11. Marketing to Existing Customers

Where permitted by law, we may use an email address obtained in connection with a previous purchase to inform you about our own similar products or services.

We provide you with an opportunity to object when the email address is collected and in every subsequent marketing message.

You may object to this use of your email address at any time without incurring any cost other than ordinary communication charges.

Where applicable, this processing is based on our legitimate interest in marketing our own similar products under Article 6(1)(f) GDPR and is carried out in accordance with the applicable provisions of the Dutch Telecommunications Act (Telecommunicatiewet).

12. Cookies and Similar Technologies

Our website uses cookies and similar technologies.

Necessary technologies

Necessary technologies are used to provide essential functions of our store, including:

• shopping cart;

• checkout;

• payment processing;

• customer accounts;

• security;

• fraud prevention;

• language settings;

• session management; and

• storing your privacy choices.

Under Article 11.7a of the Dutch Telecommunications Act, consent is not required where the storage of or access to information is strictly necessary to provide a service expressly requested by you.

Limited analytics

Certain analytics technologies that have no or only a minor impact on your privacy may also be used without consent where permitted under Article 11.7a of the Dutch Telecommunications Act.

Optional analytics and advertising technologies

Other cookies and similar technologies, particularly those used for analytics, personalisation, conversion measurement, remarketing and advertising, are used only where legally permitted and, where required, after you have given prior consent.

Where personal data is processed on the basis of consent, the legal basis is Article 6(1)(a) GDPR.

You may change or withdraw your cookie choices at any time using the Cookie Settings link in the footer of our website.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

13. Shopify Analytics

We use Shopify's analytics and reporting functions to understand the technical performance and use of our online store and to analyse orders, sales and product interest.

Information processed may include:

• IP address;

• cookie and device identifiers;

• device and browser information;

• pages visited;

• search queries;

• referrer information;

• product interactions;

• cart, checkout and purchase events;

• order value; and

• campaign information.

Where the processing involves optional cookies or similar technologies that require consent, we carry out the processing only after consent has been given.

The legal basis for consent-based processing is Article 6(1)(a) GDPR in conjunction with the applicable Dutch cookie rules.

14. Google Analytics 4

Subject to your consent where required, we use Google Analytics 4.

Provider:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Analytics helps us understand how our website is used.

Information processed may include:

• IP address;

• device and browser information;

• cookie and device identifiers;

• approximate location information;

• pages visited;

• time spent on pages;

• referrer URL;

• search queries;

• interactions;

• cart, checkout and purchase events; and

• campaign and traffic-source information.

The retention period we configure for user- and event-level Google Analytics data is generally 14 months.

Where consent is required, the legal basis is Article 6(1)(a) GDPR together with Article 11.7a of the Dutch Telecommunications Act.

Google may process information in the United States and other countries outside the European Economic Area. International transfers are subject to the safeguards described in Section 25.

15. Google Ads, Conversion Tracking and Remarketing

Subject to your consent where required, we may use Google Ads, Google Ads Conversion Tracking, remarketing functions and enhanced conversions.

Provider:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

These services allow us to measure advertising performance, create audiences, show advertising to previous visitors and optimise advertising campaigns.

Information processed may include:

• IP address;

• cookie and advertising identifiers;

• device and browser information;

• pages and products viewed;

• cart, checkout and purchase events;

• order value and currency;

• referrer and campaign information; and

• hashed email addresses or other hashed contact information.

Where consent is required, the legal basis is Article 6(1)(a) GDPR together with Article 11.7a of the Dutch Telecommunications Act.

16. Google Merchant Center and Google & YouTube Sales Channel

We use Shopify's Google & YouTube sales channel and Google Merchant Center to make product information available through Google services and to manage advertising campaigns.

Product, store, campaign, order and conversion information may be exchanged between Shopify and Google.

Where personal usage or conversion data is processed and consent is required, processing takes place on the basis of Article 6(1)(a) GDPR.

17. Meta Pixel, Conversions API and Facebook & Instagram Sales Channel

Subject to your consent where required, we use the Meta Pixel, Meta Conversions API and Facebook & Instagram sales channel.

Provider:

Meta Platforms Ireland Limited
Merrion Road
Dublin 4
D04 X2K5
Ireland

These services help us measure the effectiveness of advertising on Facebook and Instagram, create audiences, show advertising to previous visitors and record conversion events.

Information processed may include:

• IP address;

• cookie, device and advertising identifiers;

• browser and device information;

• pages visited;

• products viewed;

• cart, checkout and purchase events;

• order value and currency;

• hashed email address;

• hashed telephone number;

• other hashed contact information; and

• campaign information.

The Conversions API may transmit certain event and transaction information to Meta from our server or through Shopify's server-side integrations.

Where consent is required, the legal basis is Article 6(1)(a) GDPR together with Article 11.7a of the Dutch Telecommunications Act.

18. TikTok Pixel, Events API and TikTok Sales Channel

Subject to your consent where required, we may use the TikTok Pixel, TikTok Events API and TikTok sales channel.

Provider:

TikTok Technology Limited
10 Earlsfort Terrace
Dublin, D02 T380
Ireland

These services help us measure TikTok advertising performance, record conversion events, create audiences and optimise advertising campaigns.

Information processed may include:

• IP address;

• cookie, device and advertising identifiers;

• browser and device information;

• pages visited;

• products viewed;

• cart, checkout and purchase events;

• order value and currency;

• campaign information; and

• hashed contact information.

Where consent is required, the legal basis is Article 6(1)(a) GDPR together with Article 11.7a of the Dutch Telecommunications Act.

19. Pinterest Tag

Subject to your consent where required, we may use the Pinterest Tag and Pinterest enhanced conversion functionality.

Provider:

Pinterest Europe Ltd.
Palmerston House, 2nd Floor
Fenian Street
Dublin 2
Ireland

The Pinterest Tag helps us measure advertising performance, create audiences and record conversion events.

Information processed may include IP address, cookie and device identifiers, pages and products viewed, cart, checkout and purchase events and hashed contact information.

Where consent is required, the legal basis is Article 6(1)(a) GDPR together with Article 11.7a of the Dutch Telecommunications Act.

20. Microsoft Advertising and UET Tag

Subject to your consent where required, we may use Microsoft Advertising and its Universal Event Tracking (“UET”) Tag.

Provider:

Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18
Ireland

The UET Tag helps us measure advertising performance, record conversion events, create remarketing audiences and optimise campaigns.

Information processed may include IP address, cookie and device identifiers, pages visited, cart, checkout and purchase events and referrer and campaign information.

Where consent is required, the legal basis is Article 6(1)(a) GDPR together with Article 11.7a of the Dutch Telecommunications Act.

21. Judge.me Product Reviews

We use Judge.me to provide product-review functionality and send review requests.

Provider:

Judge.me Ltd.
c/o Buckworths, 2nd Floor
1–3 Worship Street
London EC2A 2AB
United Kingdom

Information processed in connection with reviews may include:

• name or displayed reviewer name;

• email address;

• order and product information;

• review content;

• rating;

• photographs or other voluntarily submitted content;

• IP address;

• device and browser information; and

• information indicating whether a purchase has been verified.

Your email address is not published as part of your review.

Depending on the relevant processing activity, the legal basis may be Article 6(1)(a), Article 6(1)(b) or Article 6(1)(f) GDPR.

22. Social Media

We maintain business profiles on platforms including:

• Instagram;

• Facebook;

• TikTok;

• Pinterest;

• YouTube; and

• LinkedIn.

If you visit one of our profiles or communicate with us through a social-media platform, both we and the relevant platform operator may process personal data.

This may include:

• profile name;

• publicly available profile information;

• messages;

• comments;

• reactions;

• interactions; and

• device and usage information.

Depending on the circumstances, the legal basis for our processing may be Article 6(1)(a), Article 6(1)(b) or Article 6(1)(f) GDPR.

The relevant social-media platform's own privacy policy also applies to processing carried out by that platform.

23. Fraud Prevention and Security

We and our service providers may process order, payment, device, address and usage information to detect and prevent:

• fraud;

• misuse;

• security incidents;

• payment risks; and

• unauthorised access.

The legal basis is our legitimate interest in maintaining the security of our store, protecting our customers and preventing financial loss under Article 6(1)(f) GDPR.

24. Recipients of Personal Data

Recipients or categories of recipients of personal data may include:

• Shopify and Shopify-affiliated companies;

• hosting, cloud, security and IT providers;

• payment providers, banks and financial-service providers;

• fulfilment, warehouse, returns and shipping providers;

• newsletter, chat, customer-service and communications providers;

• product-review providers;

• analytics and statistics providers;

• advertising platforms and social-media providers;

• tax advisers, accountants, auditors, lawyers and other professional advisers;

• government authorities, regulators, courts and public bodies where legally required; and

• affiliated companies within the Puppington group where necessary for legitimate business purposes and permitted by law.

We disclose personal data only where necessary for the relevant purpose or where disclosure is otherwise permitted or required by law.

25. International Transfers of Personal Data

Some of our service providers, affiliated companies and their subprocessors may process personal data outside the European Economic Area.

Where personal data is transferred to a country outside the EEA, we ensure that a lawful transfer mechanism is in place where required.

Depending on the destination and circumstances, this may include:

• an adequacy decision adopted by the European Commission;

• the European Commission's Standard Contractual Clauses;

• the EU-U.S. Data Privacy Framework where applicable to an eligible and participating recipient; or

• another lawful transfer mechanism or appropriate safeguard recognised under applicable data-protection law.

26. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

In particular:

• order, invoice, payment and accounting records are retained for the periods required under applicable Dutch tax and accounting laws;

• customer-account information is generally retained until the account is deleted, subject to legal retention obligations;

• communications are retained for as long as reasonably necessary to deal with an enquiry, dispute or related documentation requirement;

• newsletter information is retained until you unsubscribe or withdraw consent, subject to retention of necessary suppression or consent records;

• evidence of consent may be retained for as long as necessary to demonstrate compliance with our legal obligations;

• Google Analytics event-level data is generally configured for a retention period of 14 months; and

• cookie, advertising and analytics information is retained in accordance with the settings and retention periods of the relevant service and our