Privacy policy
Last updated: 3 October 2026
This policy explains how we process your personal data when you visit valvelle.com, place an order, contact us or subscribe to our newsletter.
1. Controller
The controller for the processing of your personal data is:
Valvelle
Ravelijn 40, 3905 NV Veenendaal, the Netherlands
Chamber of Commerce no. 91668549
E-mail for privacy questions: info@valvelle.com
Telephone: +31 (0)318 250 004
We have not appointed a data protection officer because we are not legally required to do so. You can contact us at the address above for all privacy matters.
2. Which data we process, why, and on which legal basis
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Processing and delivering your order, payment, returns and withdrawals | name, delivery and billing address, e-mail, telephone number, order details, payment status (not your full card data), communication about your order | performance of the contract, Art. 6(1)(b) | see section 7 |
| Customer account (optional) | as above plus password (encrypted) and order history | performance of the contract, Art. 6(1)(b) | until you delete your account |
| Customer service and complaints | your messages, order data, photos you send us | performance of the contract, Art. 6(1)(b); our legitimate interest in handling questions properly, Art. 6(1)(f) | 2 years after the question has been closed |
| Legal guarantee and product safety (e.g. recalls) | name, contact details, order and product data | legal obligation, Art. 6(1)(c); legitimate interest, Art. 6(1)(f) | for the duration of the guarantee/liability period |
| Accounting and tax obligations | invoices and order data | legal obligation, Art. 6(1)(c) | 7 years (Dutch tax law) |
| Fraud prevention and security of the shop and payments | IP address, device data, order and payment data | legitimate interest in preventing fraud, Art. 6(1)(f) | as long as necessary for this purpose, and no longer than the related order data (see section 7) |
| Newsletter | e-mail address, name (optional), opening and click data | your consent, Art. 6(1)(a) | until you unsubscribe |
| Statistics and marketing cookies, Meta pixel and Conversions API | see section 4 | your consent, Art. 6(1)(a) and the national rules implementing Art. 5(3) ePrivacy Directive | see section 4 |
| Strictly necessary cookies (shopping cart, checkout, security, storing your cookie choice) | technical data | legitimate interest / strictly necessary, Art. 6(1)(f) | see cookie overview |
Providing your name, address and e-mail is necessary to conclude and perform the contract; without this data we cannot process your order. We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you. Payment providers may perform automated fraud and credit checks; see section 3.
3. Recipients and service providers
We only share personal data where necessary for the purposes above:
Processors (they process data only on our instructions under a data processing agreement):
- Shopify (Shopify International Limited, Dublin, Ireland) — platform for our online shop, hosting, checkout, order administration, customer accounts and the cookie banner. Shopify may process data in Canada (adequacy decision) and in the United States (EU-US Data Privacy Framework and/or Standard Contractual Clauses).
- Sendcloud (Sendcloud B.V., Eindhoven, the Netherlands) — shipping software for creating shipping and return labels and tracking information.
- Shopify Email (part of Shopify, see above) — sending our newsletter.
- Our e-mail, IT and accounting service providers, where necessary — for example to handle the questions you send us by e-mail.
Independent controllers (they decide themselves how they process data, under their own privacy policies):
- DPD — the DPD company in the Netherlands and the DPD company in your country receive your name, address, telephone number and e-mail to deliver your parcel and inform you about the delivery.
- Payment service providers — depending on the payment method you choose: Shopify Payments (operated by Stripe Payments Europe Ltd., Ireland), PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) and Klarna Bank AB (publ) (Sweden). They process your payment data, and may carry out fraud prevention and, for "pay later" methods, credit checks.
- Meta Platforms Ireland Limited (Dublin, Ireland) — see section 4. For the collection and transmission of data via the Meta pixel and Conversions API we are joint controllers with Meta (Art. 26 GDPR); see section 4.3.
- Authorities, courts, advisers and insurers, where we are legally required or this is necessary to establish or defend legal claims.
We do not sell your personal data.
4. Cookies, Meta pixel and Conversions API
4.1 Cookie banner and your choice
When you first visit our website we show a cookie banner (Shopify's customer privacy banner). We only place cookies and similar technologies that are not strictly necessary — for statistics and marketing — after you have given your consent. You can accept all, reject all, or choose per category. Rejecting is as easy as accepting. You can change or withdraw your consent at any time via the link "Cookie settings" in the footer of every page. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.
We use the following categories of cookies:
| Category | Purpose | Cookies | Consent needed |
|---|---|---|---|
| Strictly necessary | shopping cart, checkout, customer account, security, language and region, storing your cookie choice | essential Shopify cookies, such as _shopify_essential, cart, keep_alive, localization and _tracking_consent
|
no |
| Statistics | measuring how the shop is used, in aggregated form | Shopify Analytics cookies | yes |
| Marketing | measuring and personalising adverts on Facebook and Instagram | Meta pixel (_fbp, _fbc) |
yes |
The exact cookies and their lifetimes are shown in the cookie settings. If we start using new cookies or similar technologies, we will update this overview and, where required, ask for your consent again.
4.2 Meta pixel and Conversions API
If you consent to marketing cookies, we use the Meta pixel and the Meta Conversions API of Meta Platforms Ireland Limited, via Shopify's "Facebook & Instagram" app:
- The pixel is a piece of code in your browser that sends information about your visit to Meta, such as pages viewed, products added to the cart, purchases, browser and device information, IP address and cookie identifiers.
- The Conversions API sends similar event information (for example "purchase", order value, products) directly from Shopify's servers to Meta. Contact details such as e-mail address and telephone number are sent only in hashed (encrypted, one-way) form, so that Meta can match the event to a Facebook or Instagram account.
- Purposes: measuring the effectiveness of our adverts, showing you relevant adverts on Facebook and Instagram (retargeting), and building audiences of people with similar interests.
- We only send pixel and Conversions API events about your visit if you have consented to marketing cookies.
- The advertising data from this shop may be combined with advertising data from other online shops that we operate as the same controller, for the measurement and targeting of our adverts.
- Meta may transfer data to the United States; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.
4.3 Joint controllership with Meta
For the collection of data on our website and its transmission to Meta, we and Meta Platforms Ireland Limited are joint controllers (Art. 26 GDPR). We have agreed with Meta, in the Meta Controller Addendum, on our respective responsibilities: Meta is responsible for enabling you to exercise your rights regarding the data stored by Meta after transmission. You can exercise your rights against both us and Meta. Meta's further processing is Meta's own responsibility; see Meta's privacy policy at https://www.facebook.com/privacy/policy and the information on joint controllership at https://www.facebook.com/legal/controller_addendum.
5. Newsletter
If you subscribe to our newsletter, we send you e-mails about our products, offers and interior inspiration. We use a double opt-in procedure: you will receive an e-mail asking you to confirm your subscription. We register your consent (date, time, IP address). We may measure whether you open the e-mails and click on links, to improve our newsletter. You can unsubscribe at any time via the link in every newsletter or by e-mailing info@valvelle.com. We only send you our newsletter if you have subscribed to it.
6. Transfers outside the EEA
Some service providers (or their sub-processors) process data outside the European Economic Area, in particular in Canada and the United States. Such transfers take place only on the basis of an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified companies) or Standard Contractual Clauses with additional safeguards where needed. You can request a copy of the safeguards from us.
7. Retention
We keep personal data no longer than necessary for the purposes for which it was collected:
- order and invoice data: 7 years after the end of the financial year (Dutch tax retention obligation);
- data needed to handle guarantee and liability claims: until the end of the applicable guarantee or limitation period;
- customer account: until you delete your account (order data is then kept only as far as required by law);
- customer service correspondence: 2 years after closing the case;
- newsletter: until you unsubscribe; proof of consent for up to 3 years thereafter;
- cookies: see the cookie banner; marketing cookies for a maximum of 13 months.
8. Your rights
You have the right to:
- access your personal data and receive a copy;
- rectification of incorrect data;
- erasure ("right to be forgotten"), unless we are legally required to keep the data;
- restriction of processing;
- data portability;
- object to processing based on our legitimate interests, and at any time to direct marketing;
- withdraw your consent at any time, without affecting processing before the withdrawal.
Send your request to info@valvelle.com. We will respond within one month; we may ask you to verify your identity.
You also have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Dutch Autoriteit Persoonsgegevens (www.autoriteitpersoonsgegevens.nl). You can also complain to the authority in your own country, for example: Austria — Datenschutzbehörde (www.dsb.gv.at); France — CNIL (www.cnil.fr); Luxembourg — CNPD (cnpd.public.lu); Italy — Garante per la protezione dei dati personali (www.garanteprivacy.it); Spain — AEPD (www.aepd.es); Portugal — CNPD (www.cnpd.pt); Ireland — Data Protection Commission (www.dataprotection.ie).
9. Security
We take appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), access restrictions and the security measures of our platform provider Shopify, which is certified under PCI DSS for payment data.
10. Children
Our shop is not intended for children under 16. We do not knowingly collect personal data from children.
11. Changes
We may amend this policy, for example when we use new service providers. The current version is always available on this page, with the date of the last update.
