Privacy Policy SchminkenGrime.nl

Last updated: 18 August 2026

At SchminkenGrime.nl, we handle your personal data with care. In this Privacy Policy, we explain what personal data we process, why we process it, the legal basis on which we do so, with whom we share data, how long we retain it and what rights you have.

This Privacy Policy applies when you visit our website, place an order, use a customer account, contact us or subscribe to our emails and newsletters.

Who is responsible for your personal data?

SchminkenGrime.nl is responsible for the processing of personal data as described in this Privacy Policy.

SchminkenGrime.nl
De Ring 28
5261 LM Vught
The Netherlands
Telephone: +31 (0)73 - 88 88 135
Email: info@schminkengrime.nl
Contact person for privacy matters: Linda Gloudemans

What personal data do we process?

The personal data we process depends on how you use our website and services. This may include:

your name;
billing and delivery address;
email address;
telephone number;
order and purchase information;
payment and invoice information;
information you provide when you contact us;
information required to create and use a customer account;
IP address and technical information about your device and browser;
information about your use of our website;
information about your interaction with our emails, insofar as we are permitted to process this information.

Why do we process your personal data and on what legal basis?

We only process personal data where there is a valid legal basis for doing so. Below, we explain for each important processing activity what information we use, why we use it and the legal basis for doing so.

Processing and delivering orders

When you place an order, we process information including your name, billing and delivery address, email address, relevant contact details, order information and information required to process your payment.

Purpose: to process, accept payment for and deliver your order and to handle any returns, refunds, complaints and warranty requests.

Legal basis: performance of our contract with you.

We need the information marked as mandatory during the ordering process in order to fulfil your order. Without, for example, your name, email address, necessary address details and payment information, we cannot correctly process or deliver your order.

Financial and tax administration

We process information including invoice details, order information and payment information for our administration.

Purpose: maintaining our financial and tax records.

Legal basis: compliance with our legal obligations.

Customer account

When you create a customer account, we process the information required to provide and manage your account.

Purpose: providing and managing your customer account.

Legal basis: performance of our contract with you.

Customer service and contact

When you contact us, we process your contact details and the information you provide to us.

Purpose: responding to and handling your question, complaint or request.

Legal basis: where your enquiry relates to an order or contract, the processing is necessary for the performance of that contract. For other enquiries, we rely on our legitimate interest in answering questions from customers and interested parties and providing good customer service.

Security and fraud prevention

We may process technical information, order information and other relevant information to protect our website, customers and business operations against fraud, misuse and security incidents.

Purpose: preventing and investigating fraud and misuse and protecting our website, systems and customer data.

Legal basis: our legitimate interest in protecting SchminkenGrime.nl, our customers, our systems and our business operations against fraud, misuse and unauthorised access.

Newsletters and marketing emails

When you subscribe to our newsletter, we use your email address and, where applicable, your name to send you newsletters and other marketing emails.

Purpose: informing you about products, tips, news and offers from SchminkenGrime.nl.

GDPR legal basis: when you subscribe to our newsletter yourself, we process your data on the basis of your consent.

When sending marketing emails, we also comply with the rules applicable to electronic communications. In certain circumstances, we may inform existing customers about our own similar products or services without requiring separate consent for each email. We only do this where the applicable legal requirements are met.

Every marketing email gives you an easy way to unsubscribe. If you unsubscribe, we will no longer use your email address for the relevant marketing communications.

Website analytics, conversion measurement and advertising

Depending on your cookie preferences, information about your use of our website may be processed for statistics, website analytics, conversion measurement and marketing.

Purpose: gaining insight into the use and performance of our website and measuring and improving the results of our advertising.

Legal basis: consent where consent is required for the cookies or similar technologies concerned.

Payments

MultiSafepay

We use MultiSafepay to process most online payments. If you select a payment method processed through MultiSafepay, we share the information required to process the payment. The exact information involved depends on the payment method you choose.

PayPal

If you choose PayPal, your payment is processed directly through PayPal. PayPal receives the information required to process your payment. PayPal's own privacy policy also applies to processing activities for which PayPal is independently responsible.

Bank transfer

If you choose to pay by bank transfer, you transfer the amount directly to our bank account. The information associated with this bank transaction is processed by our bank and the bank you use.

Payment service providers and banks may be independently responsible for certain processing of personal data.

Delivery of your order

When you have an order delivered, we share personal data required for shipping and delivery with carriers and logistics service providers involved in fulfilling your order.

This may include your name, delivery address and, where necessary for delivery, your email address or telephone number.

We only share the information necessary to process and deliver your order.

Online store and hosting

Shopware

Our online store runs on Shopware. Personal data required for the website to function and, for example, to process customer accounts and orders is processed within the online store.

Hypernode

We use Hypernode to host our online store. Personal data stored or transmitted through our online store may be processed when hosting and technically managing our website.

Where a service provider processes personal data solely on our behalf, we enter into agreements regarding the processing and security of this data where required.

Email marketing

Klaviyo

We use Klaviyo to send and manage newsletters and other marketing emails.

Depending on how you use our online store and emails and the settings for which consent has been given, Klaviyo may process information including your name, email address, order information and information about your interactions with our emails and website.

We may use this information to segment marketing communications. For example, we may create different groups based on previous purchases or interactions with our emails and, where permitted, our website.

You can unsubscribe from marketing emails at any time using the unsubscribe option in our emails.

Cookies and similar technologies

Our website uses cookies and similar technologies. Some of these are necessary for the online store to function properly. We may also use cookies and similar technologies for statistics, analytics and marketing.

For non-essential cookies and similar technologies for which consent is required, we ask for your consent before they are used.

Cookiebot by Usercentrics

We use Cookiebot by Usercentrics to manage and record your cookie preferences.

Our cookie banner allows you to indicate which categories of non-essential cookies and similar technologies you consent to.

You can review and change your cookie preferences at a later time. Withdrawing your consent does not affect the lawfulness of processing carried out on the basis of your consent before it was withdrawn.

Google Analytics and Google Ads

We use Google Analytics and Google Ads for website analytics, conversion measurement and measuring and improving our advertising.

Depending on your consent and our technical settings, information such as information about your device, browser, IP address and use of our website may be processed.

Non-essential cookies or similar technologies used by these services are only used where valid consent has been obtained, insofar as such consent is required by law.

You can find information about the specific cookies and similar technologies used on our website, their purpose, provider and retention period via our cookie banner and cookie settings. This information may change when we modify our website or the services we use.

Profiling and segmentation

We may use personal data to divide customers and newsletter subscribers into groups. This is known as segmentation and, depending on the information used and the purpose, may also constitute profiling.

For example, we may create segments based on previous purchases, interests or interactions with our emails and, where permitted, our website. This allows us to better tailor marketing communications to different groups of customers.

Where such segmentation uses information obtained through non-essential tracking technologies, we only use this information in accordance with your cookie preferences and the applicable rules.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 of the GDPR.

Who do we share your personal data with?

We do not sell your personal data to third parties.

We only share personal data where this is necessary for the purposes described in this Privacy Policy, where another valid legal basis exists or where we are legally required to provide the data.

Depending on the services you use, personal data may be shared with:

providers of our online store software and hosting services;
MultiSafepay and other parties involved in your chosen payment method;
PayPal when you use PayPal;
banks for payments, bank transfers and refunds;
carriers and logistics service providers for shipping and delivery;
Klaviyo for email marketing and marketing automation;
Cookiebot by Usercentrics for managing cookie preferences;
Google for website analytics, conversion measurement and advertising, depending on your cookie preferences;
accounting, administrative and financial service providers;
IT, hosting, security and technical service providers insofar as they require access to personal data for their work;
government authorities and supervisory authorities where we are legally required to provide information.

This list is not intended to be a technical list of every individual supplier or script used on our website. Our cookie banner and cookie settings provide up-to-date information about providers of cookies and similar technologies.

Transfers outside the European Economic Area

Some service providers we use are established outside the European Economic Area (EEA) or may process personal data there.

Where personal data is transferred outside the EEA, we ensure that there is a valid legal basis for the transfer. This may, for example, be an adequacy decision by the European Commission or appropriate safeguards such as the Standard Contractual Clauses approved by the European Commission.

Klaviyo

Klaviyo is established in the United States. According to Klaviyo's current privacy and data processing terms, Klaviyo relies on the EU-U.S. Data Privacy Framework for eligible transfers from the European Union to the United States. For transfers not covered by this framework, Klaviyo uses Standard Contractual Clauses.

Google

Google may process personal data in the United States. Google LLC has stated that it is certified under the EU-U.S. Data Privacy Framework. Other appropriate legal safeguards may also be used for certain transfers and services.

If you would like more information about the safeguards applicable to a specific transfer of your personal data, please contact us at info@schminkengrime.nl.

How long do we retain your personal data?

We do not retain personal data for longer than necessary for the purpose for which it was collected. We also take into account statutory retention requirements, possible warranty and complaint periods and the need to establish or defend legal claims.

We apply the following principles:

Financial and tax records: information forming part of our legally required administration is generally retained for 7 years after the end of the financial year to which the information relates, unless a different statutory retention period applies to specific information. ```
Order information: information forming part of our financial administration is retained for the applicable statutory retention period. Other order information is retained for as long as it is required for fulfilling the order, customer service, warranties, returns, complaints or possible legal claims.
General customer service correspondence: correspondence that is no longer required for an ongoing order, complaint, warranty claim or legal dispute is generally retained for no longer than 2 years after the question or request has been fully resolved.
Customer account: information required solely for your customer account is retained for as long as your account is in use. If there has been no relevant activity on the account for 5 years, we may delete or anonymise the account and information required solely for that account. Information subject to a statutory retention obligation may be retained for longer.
Newsletter and marketing: information we use for marketing on the basis of consent is retained for that purpose until you withdraw your consent or unsubscribe. We may subsequently retain your email address in a limited form on a suppression list to ensure that you do not unintentionally receive marketing communications again.
Security and technical logs: ordinary security and technical log information is generally retained for no longer than 12 months. Where information is required to investigate a specific security incident, fraud, misuse or legal dispute, relevant information may be retained for longer for as long as necessary for that purpose.
Cookies and similar technologies: retention periods vary depending on the cookie or technology. You can find the current retention periods via our cookie banner and cookie settings. ```

When personal data is no longer required and there is no legal or other valid reason to retain it, we delete or anonymise it.

How do we protect your personal data?

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure and alteration.

Among other measures, we use secure connections and access controls and restrict access to personal data to persons and parties that require the information for their work.

What privacy rights do you have?

Under the GDPR, depending on the circumstances, you have various rights in relation to your personal data. These include the right to:

ask what personal data we process about you and receive a copy of it;
have incorrect or incomplete personal data corrected or completed;
request the deletion of your personal data;
request restriction of the processing of your personal data;
object to certain processing of your personal data;
object to the use of your personal data for direct marketing;
withdraw previously given consent;
request the transfer of your personal data in certain circumstances.

Withdrawing your consent does not affect the lawfulness of processing carried out before you withdrew your consent.

If you wish to exercise any of these rights, please email info@schminkengrime.nl and tell us which right you wish to exercise.

To prevent another person from gaining access to your personal data, we may ask you to provide additional information to verify your identity. We will not request more information than is necessary for this purpose.

We will generally respond to your request within one month. Where permitted under the GDPR, this period may be extended. If this happens, we will inform you.

Personal data relating to children

Our website and online store are not specifically intended to collect personal data from children. If you believe that a child has provided personal data to us without the required consent, please contact us at info@schminkengrime.nl so that we can assess what measures are necessary.

Complaints about the processing of your personal data

If you have a question or complaint about how we handle your personal data, please contact us at info@schminkengrime.nl. We will do our best to resolve your question or complaint.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), the Dutch supervisory authority for data protection.

Changes to this Privacy Policy

We may amend this Privacy Policy when our services, website, systems or applicable laws and regulations change. The most recent version is always available on this page. The date at the top of this Privacy Policy shows when it was last updated.

Contact about privacy

If you have questions about this Privacy Policy, would like to know what personal data we process about you or wish to exercise one of your privacy rights, please contact us:

SchminkenGrime.nl
De Ring 28
5261 LM Vught
The Netherlands
Telephone: +31 (0)73 - 88 88 135
Email: info@schminkengrime.nl
Contact person for privacy matters: Linda Gloudemans