The data controller for the processing described in this privacy statement is:

Hereinafter: “Amardjoti”, “we”, “us”, or “our”.

For questions about privacy or to exercise your privacy rights, you can contact us via webshopamardjoti@gmail.com.

This privacy statement applies to, among others:

• visitors to online.amardjoti.com
• customers who place an order via the webshop
• individuals using a customer account
• individuals who contact us
• individuals who sign up for marketing communications
• individuals who use other functionalities of our webshop where personal data is processed

The data we process depends on how you use our webshop.

Identification and contact data

We may process, among others:

• first and last name
• email address
• phone number
• billing address
• delivery address
• customer number
• order number
• account details

Order and transaction data

We may process, among others:

• products ordered and quantities
• date of purchase
• order history
• returns and refunds
• payment status
• selected payment method
• shipping method
• discount codes used, if applicable

Payment data

We use the payment services available at checkout to process payments.

Depending on the chosen payment method, personal data necessary for executing, securing, and administering the payment may be processed.

Amardjoti does not necessarily receive all financial data processed by the relevant payment service provider. Certain payment details may be processed directly by Shopify, Shopify Payments, banks, card networks, or other involved financial service providers.

Account details

When you use a customer account, we may process, among others, your name, email address, contact details, order history, account preferences, and data necessary for authentication and account management.

Customer service data

When you contact us, we may process, among others:

• your name
• email address
• phone number
• order number
• content of your message
• photos or other attachments provided by you
• correspondence regarding your question, complaint, or order

Technical and usage data

Depending on the technology used and your cookie and privacy preferences, data such as the following may be processed:

• IP address
• browser and device data
• operating system
• pages visited
• date and time of visit
• click and navigation behavior
• referring website or URL
• cookie identifiers
• information about webshop usage
• data about interactions with advertisements or marketing campaigns

Marketing and profile data

When there is a valid legal basis, we may process, among others:

• newsletter preferences
• marketing consents
• purchase history
• product interests
• interactions with marketing communications
• browsing and clicking behavior
• derived interest categories
• data regarding abandoned shopping carts or checkouts

We do not process more personal data than is reasonably necessary for the respective purposes.

Fulfilling orders

We use personal data to:

• receive and process orders
• facilitate payments
• ship products
• inform customers about orders
• process returns and refunds
• resolve issues with orders

The main legal basis for this is the performance of the contract with you or taking measures at your request prior to concluding such a contract.

Managing customer accounts

When you use a customer account, we process personal data to provide account functionality and, for example, to link your order details to your account.

Depending on the processing in question, the legal basis is the performance of the contract or our legitimate interest in offering a secure and user-friendly webshop.

Customer service

We process personal data to answer questions, handle complaints, and provide support.

Depending on the situation, this is done for the performance of a contract, to comply with a legal obligation, or based on our legitimate interest in providing good customer service and correctly handling complaints and disputes.

Administration and legal obligations

We process certain order, invoice, and transaction data to maintain our financial records and comply with tax and other legal obligations.

The legal basis for this is a legal obligation.

Fraud and security

We may process personal data to prevent, detect, and investigate fraud, abuse, unauthorized access, payment fraud, and security incidents.

Insofar as no legal obligation applies, this processing can take place based on our legitimate interest in the security of our webshop, customers, and business.

Analysis and improvement of the webshop

We may use data to gain insight into the functioning and use of our webshop and to improve it.

When personal data is processed for this purpose, we use an appropriate legal basis. When consent is required for cookies or similar technology, the relevant processing only takes place after consent has been obtained.

Our webshop runs on Shopify.

Shopify provides the technical infrastructure that we use to, among other things, manage our webshop, offer products, process orders, support customer accounts, and manage webshop and customer data.

For certain processing activities, Shopify processes personal data on behalf of Amardjoti. For certain separate Shopify services, Shopify may have a different privacy role.

More information about how Shopify processes personal data can be found in the Shopify Privacy Policy.

For payments, we use Shopify Payments and/or other payment service providers offered during checkout.

To execute a payment, necessary personal data may be processed by Shopify, banks, card networks, and other involved financial service providers.

This data may be used for:

• executing and securing payments
• fraud prevention
• refunds
• disputes and chargebacks
• compliance with legal and financial obligations

Some involved financial service providers may be independent controllers for their own processing.

For processing shipments, Amardjoti uses Sendcloud and the carrier chosen or available for the specific order.

Insofar as necessary for delivery, we may provide, among others:

• name
• delivery address
• email address
• phone number, if necessary or available
• order and shipping details

This data may be used for, among other things, creating shipping labels, executing the delivery, track-and-trace, and delivery communication.

The specific carrier may vary per order.

For our financial administration, we may use Twinfield and our accountant or administrative service provider.

Insofar as necessary, relevant data from orders and invoices may be processed in our financial administration, including:

• name
• billing details
• order details
• amounts
• VAT details
• payment information insofar as necessary for administration

For this purpose, we process and share only personal data that is necessary for the respective administrative and legal purposes.

You can contact us via our webshop.

In doing so, we may ask for your name, email address, phone number, order number, and message, among other things.

We use this data to handle your question, request, or complaint.

We ask that you do not include sensitive or other special personal data in free text fields or messages if this is not necessary for the handling of your request.

Amardjoti may use email to inform customers and interested parties about, for example:

• new products
• offers and promotions
• relevant products
• news about Amardjoti

We send electronic direct marketing only when there is a valid legal basis for doing so and in compliance with applicable rules for electronic communication.

When consent is required, we only send such marketing after valid consent has been obtained.

When the law, under certain conditions, allows sending marketing about our own similar products or services to existing customers, we provide the legally required opportunity to object.

Every marketing email contains a simple option to unsubscribe.

Furthermore, you can object to the use of your personal data for direct marketing at any time.

When Amardjoti uses functionality to send reminders about an abandoned shopping cart or checkout, data such as your email address, shopping cart content, checkout details, and the time at which the checkout was abandoned may be processed for this purpose.

This functionality is only used when there is a valid legal basis and the applicable rules for electronic communication are observed.

Where applicable, you can unsubscribe from such marketing communications.

When Amardjoti activates a review service, personal data may be processed to invite customers to rate a product or purchase experience and to manage or publish reviews.

In this context, for example, name, email address, order details, and review data may be processed.

If personal data is displayed publicly with a review, information will be provided accordingly.

The review service actually used and relevant privacy information will be disclosed in this statement or another appropriate place when this functionality is used.

Amardjoti may use analytics technology to gain insight into the functioning and use of the webshop.

Depending on the service and settings used, technical data and information about the use of the webshop may be processed.

When consent is required for analytical cookies or similar technology, these are only activated after valid consent has been obtained.

Where possible, we limit processing to what is necessary for the relevant analytical purpose.

Amardjoti may use advertising and marketing services from, for example, Meta, TikTok, and Google.

When tracking pixels, tracking cookies, remarketing, conversion measurement, audience building, or personalized advertising are used for which consent is required, these technologies are not activated before valid consent has been obtained.

Depending on the technology used and your consent, data may be processed regarding, for example:

• visited pages
• viewed products
• interactions with the webshop
• shopping carts and checkouts
• purchases
• interactions with advertisements
• technical identifiers

This information may be used to measure advertising performance, build target audiences, make advertisements more relevant, and analyze marketing campaigns.

The actually active marketing and tracking services are also displayed via the cookie policy and/or the webshop’s cookie settings.

Our webshop may link to social media platforms such as Instagram, Facebook, and TikTok and may integrate external content.

When external content is integrated, personal data may be processed by the relevant external provider.

We attempt to design such integrations in a way that personal data is not provided to external social media platforms without necessity before the visitor has made a valid choice to do so.

When consent is required, the relevant processing is only activated after valid consent.

When you click on an external social media link yourself, you leave our webshop. The privacy policy of that external party applies to any further processing by the relevant platform.

Amardjoti may use personal data to, where permitted, better tailor product recommendations, webshop experiences, and marketing to interests.

In doing so, account may be taken of, for example, previous purchases, viewed products, and interactions with the webshop.

When this profiling depends on tracking technology for which consent is required, it only takes place after valid consent has been obtained.

Amardjoti does not make solely automated decisions based on this profiling that have legal consequences for you or otherwise significantly affect you, unless there is a valid legal basis for doing so and the additional legal conditions are met.

Our webshop uses cookies and similar technologies.

A distinction can be made between:

• strictly necessary or functional cookies
• limited analytical cookies
• preference cookies
• marketing and tracking cookies and similar technologies

No consent is required for strictly necessary cookies. For other cookies and similar technologies, we request prior consent when required by law.

Tracking cookies, tracking pixels, and other non-essential tracking technologies for which consent is required are not activated before you have provided consent.

You can refuse consent without losing the normal basic functionality of the webshop.

When you have provided consent, you can withdraw it later via the available cookie or privacy settings.

More detailed information about the cookies and similar technologies actually used, their providers, purposes, and retention periods is provided via our cookie policy and/or the webshop’s cookie settings.

Depending on the processing, we use one or more of the following bases under the GDPR.

Performance of a contract

For example, for processing and delivering your order, payments, returns, and certain account functionalities.

Legal obligation

For example, for our tax records and other legal obligations.

Consent

For example, when consent is legally required for tracking cookies, advertising pixels, certain marketing activities, personalization, or other non-essential tracking technologies.

You can withdraw given consent at any time. The withdrawal does not have retroactive effect on processing that took place lawfully before the withdrawal.

Legitimate interest

In certain cases, we process personal data based on a legitimate interest of ours or a third party.

This may, for example, relate to security, fraud prevention, customer service, the establishment, exercise, or defense of legal claims, and certain privacy-friendly analyses.

Before using this basis, we assess whether our interests outweigh your interests, fundamental rights, and fundamental freedoms.

We do not use legitimate interest as a substitute for consent when consent is legally required.

To the extent necessary, we may share personal data with categories of recipients such as:

• Shopify
• Shopify Payments and other involved financial service providers
• Sendcloud
• carriers
• Twinfield
• our accountant or administrative service provider
• IT, hosting, and security service providers
• email and communication service providers
• analysis and marketing service providers when these are actually used and processing is permitted
• review service providers when such a service is actually used
• government agencies or other parties when we are legally required to provide data

We do not sell personal data as an independent trade product.

When an external party processes personal data on our behalf, we make appropriate agreements regarding the processing where legally required.

An external party may also be an independent controller for certain processing activities.

Some service providers we use operate internationally. As a result, personal data may in certain cases be processed outside the European Economic Area or be accessible from there.

When personal data is transferred to a country outside the EEA, this takes place in accordance with applicable privacy legislation.

Depending on the country and the relevant processing, this may involve, among other things:

• an adequacy decision by the European Commission
• approved standard contractual clauses
• binding corporate rules
• other legally permitted transfer mechanisms

Where legally required, additional appropriate safeguards are applied.

You can request information via webshopamardjoti@gmail.com about the safeguards that apply to a specific transfer, insofar as we can provide this information without harming the rights of third parties.

We store personal data no longer than necessary for the purpose for which it was collected, unless a legal retention obligation or other legitimate necessity requires longer storage.

Financial and tax administration

We store data that forms part of our legal administration for the duration of the applicable legal retention period. For important parts of the business administration in the Netherlands, this is in principle seven years. A longer legal term may apply to certain data.

Order data

Order data that forms part of our tax administration is kept for the duration of the applicable legal retention period.

Other order data is deleted or anonymized when it is no longer necessary for, for example, customer service, warranty, disputes, fraud prevention, or other legitimate purposes.

Customer accounts

We keep account data for as long as the account is active and thereafter only for as long as is necessary for the applicable purposes or legal obligations.

When an account is terminated, data that we are legally required to keep may be retained.

Customer service

We store correspondence with customers for no longer than necessary for the handling of the query and any follow-up questions, complaints, or disputes.

As a general starting point, we aim to delete routine customer service correspondence no later than two years after completion, unless a longer retention period is necessary.

Marketing data

We store marketing data for as long as you are subscribed to the relevant marketing or as long as there is another valid legal basis for doing so.

After unsubscribing, we may retain limited data to ensure that your unsubscribe request is respected.

Consent data

Proof of given, refused, or withdrawn consent can be kept for as long as reasonably necessary to be able to demonstrate compliance with legal obligations.

Cookies and tracking

The retention period for cookies and similar technologies varies per technology.

The specific retention periods are displayed in the cookie policy and/or the webshop’s cookie settings.

We periodically assess retention periods and limit them to what is reasonably necessary for the relevant purpose.

We take appropriate technical and organizational measures to protect personal data against, among other things, loss, unauthorized access, unauthorized modification, unauthorized disclosure, destruction, and misuse.

We assess our security measures and the security of the services we use where appropriate.

However, no method of electronic storage or transmission can guarantee an absolute level of security.

Our webshop and marketing are not specifically aimed at children.

We do not knowingly process personal data of children for purposes for which consent from a parent or legal guardian is required under applicable law without such consent.

When we discover that personal data of a minor has been processed without a valid basis, we take appropriate measures to delete this data or otherwise handle the processing lawfully.

Depending on the circumstances, you have the right under the GDPR to, among other things:

• receive information about the processing of your personal data
• access your personal data
• have incorrect personal data corrected
• have incomplete personal data supplemented
• in certain cases, have personal data deleted
• in certain cases, have the processing restricted
• object to certain processing
• in certain cases, transfer your personal data or have it transferred
• withdraw given consent
• in certain cases, exercise rights regarding automated decision-making

These rights are not unlimited in every situation. We may, for example, be legally required to continue storing certain personal data.

You have the right at any time to object to the processing of your personal data for direct marketing purposes, including profiling insofar as it is related to direct marketing.

When you object to direct marketing, we will stop the relevant processing for that purpose.

You can also unsubscribe via the unsubscribe option in our marketing emails.

Would you like to exercise a privacy right?

Then please contact us via:

Clearly state which privacy right you wish to exercise.

When reasonably necessary to establish your identity, we may request additional information. We will not ask for more personal data than necessary.

We will respond without undue delay and in principle within one month of receiving your request.

When the GDPR permits this due to the complexity or number of requests, this period may be extended by a maximum of two months. In that case, we will inform you within the first month about the extension and the reason for it.

Do you have a complaint about how we handle your personal data? Then please contact us first so that we can investigate the complaint.

You also have the right to submit a complaint to a competent supervisory authority.

Because Amardjoti is based in the Netherlands, you can, among other options, contact the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

If you live in Belgium, you can also turn to the Data Protection Authority (GBA), insofar as it is competent.

Your right to file a complaint with a competent supervisory authority is not limited by our request that you contact us first.

Our webshop may contain links to websites or services of third parties.

When you click on an external link, the privacy policy of that external party may apply.

Amardjoti is not responsible for the privacy practices of an external website solely because that website is linked to from our webshop.

We advise you to read the privacy information of the relevant external party.

We may modify this privacy statement when, for example:

• our webshop changes
• we use new services or apps
• our data processing changes
• laws or regulations change
• adjustment is necessary for another legitimate reason

The current version is published at online.amardjoti.com.

In the event of material changes, we will additionally inform the parties involved when legally required or appropriate.

The version date at the top of this privacy statement indicates which version applies.

Do you have any questions about this privacy statement or the processing of your personal data?

Please contact us: