Privacy Policy

Who is responsible for your information?

The store operator identified in the business details on this website is responsible for personal data processed through ZOYA Hair & Cosmetics. Complete legal name, postal address, KVK number, VAT identification number and privacy contact must be published in the company settings before launch. Contact us if those details are not visible.

Information we process

• Contact, delivery and billing details you provide when you contact us, order or manage an account.
• Order lines, prices, payment status, shipment and return/refund records needed to fulfil and support a transaction.
• Account credentials and profile/address information for registered customers.
• Messages, customer-service notes and privacy requests.
• Consent preferences and limited technical data such as session identifiers, security logs, IP address or browser information where recorded for the relevant function.
• Newsletter email address and consent status when you subscribe.

We do not ask for full payment-card credentials in our forms. Payment details are handled by the payment provider; we receive transaction status and references needed to manage the order.

Why we use it

• To take and fulfil orders, arrange delivery, process payment status, returns, refunds and invoices.
• To answer product, order and complaint questions and keep an appropriate service history.
• To operate accounts, addresses, wishlists, checkout security and fraud prevention.
• To comply with tax, accounting and other legal record-keeping duties.
• To send marketing only where you have given the required consent; you can unsubscribe or withdraw that consent.
• To store optional cookie preferences and, only where enabled and consented to, optional analytics or marketing technologies.

Legal basis and sharing

Depending on the purpose, processing is based on taking steps to enter into or perform a contract, compliance with a legal obligation, our legitimate interests in securing and supporting the shop, or your consent. We share only the information needed with service providers such as payment, delivery, hosting, email and support providers. The actual providers depend on the configuration used for the transaction. We do not sell customer contact details.

Retention and security

Order, invoice, payment and tax records may need to be kept for statutory accounting periods. Other information is retained only for as long as needed for its purpose, to resolve a dispute or to meet a legal obligation. Access controls, encryption for configured secrets and operational safeguards are used to protect data; no online transmission or storage can be guaranteed risk-free.

Your rights and requests

Depending on the circumstances, you may request access, correction, erasure, restriction, portability or object to processing, and you may withdraw consent without affecting processing already carried out. Some records cannot be erased while a legal retention duty or other lawful basis applies. Submit an access, deletion or marketing-withdrawal request through contact us or the privacy request form. We may need to verify your identity before disclosing or changing personal information.

Complaints and changes

If you believe we have handled your information incorrectly, contact us first so we can review it. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). We may update this statement when our processing or legal obligations change; the latest version is published here with its review date.