Privacy
Policy.

INFLATA B.V., registered in the Netherlands (KVK number available on request), operates the online store at inflata.eu. We are the data controller for any personal data you share with us when browsing the site, placing an order, contacting us, or signing up for updates.

Questions about this policy: info@inflata.eu.

We collect only what we need to run the store and communicate with you:

• Order data: name, email, shipping address, phone (if provided), order contents and value.
• Payment data: processed entirely by Shopify Payments / Stripe. We never see or store your full card number.
• Account data (optional): email and password hash if you create a customer account.
• Contact data: email, name, and message content when you use our contact form.
• Newsletter data: email address if you sign up for updates.
• Analytics: anonymised page views, device type, and referrer via Shopify Analytics. We do not use Google Analytics or Facebook Pixel by default.

We process personal data under the following lawful bases:

• Contract performance — to process and fulfil your order, issue invoices, and handle returns.
• Legitimate interest — to prevent fraud, improve our store, and answer your support questions.
• Consent — for marketing emails (newsletter). You can withdraw consent at any time.
• Legal obligation — to retain transaction records for Dutch tax and accounting law (7 years).

• Fulfil, ship, and confirm your order.
• Send transactional emails (order confirmation, tracking, refund confirmation).
• Respond to support and contact enquiries.
• Send newsletters (only if you opted in; unsubscribe link in every email).
• Detect and prevent fraud.
• Comply with legal obligations.

We share the minimum necessary data with:

• Shopify Inc. (platform & payments infrastructure) — EU data stored in Frankfurt; DPA in place.
• Shipping carriers (DHL, DPD, PostNL) — name and delivery address only, to print the label.
• Email providers (Klaviyo or Shopify Email for newsletters) — email address only.

We do not sell, rent, or trade your personal data with any third party for their own marketing purposes. Ever.

• Order records: 7 years (Dutch statutory accounting requirement).
• Contact messages: 12 months, then deleted.
• Newsletter subscribers: until you unsubscribe, then deleted within 30 days.
• Analytics (anonymised): 26 months rolling.

Under GDPR you have the right to:

• Access — request a copy of all data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — request deletion (subject to legal retention obligations above).
• Portability — receive your data in a machine-readable format.
• Objection / restriction — object to processing or ask us to restrict it.
• Withdraw consent — for marketing emails, click Unsubscribe in any email.

To exercise any of these rights, email info@inflata.eu. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch DPA (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

We use strictly necessary cookies (session, cart, checkout security) and, with your consent via the cookie banner, functional analytics cookies. We do not set advertising or tracking cookies by default. You can manage or withdraw cookie consent at any time via the banner or your browser settings.

We may update this policy as the store evolves or regulations change. Material changes will be announced via email to active customers. The ‘Last updated’ date at the top of this page always reflects the current version.