Privacy Policy
This privacy policy describes which personal data DreamGlow processes, for what purposes, for how long, and what rights you have in relation to it. It covers the webshop, My account, the newsletter, and the contact and withdrawal forms. This version is dated 10 August 2026.
Article 1 — Who is responsible for your data
The controller is:
- DreamGlow, trade name of [STATUTAIRE NAAM ZOALS IN HET HANDELSREGISTER]
- [VESTIGINGSADRES — straat en huisnummer, geen postbus], [POSTCODE EN PLAATS], Nederland
- Email: service@dreamglow.nl
If you have a question about this policy or about your data, this address is the place to start.
Article 2 — What data we process, for what purposes and for how long
The table below goes through the places on the site where you leave data. Legal basis refers to article 6(1) of the GDPR: point (a) is consent, point (b) performance of the contract, point (c) a legal obligation, point (f) a legitimate interest.
| Where | Which data | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Order | Name, address, email address, phone number, order overview, payment status. We do not see your full payment details (card number etc.) — these go through [BETAALDIENSTVERLENER — bijv. Mollie B.V.] or the payment method itself. | Processing the order, delivering it, handling payment and providing customer service. Before acceptance, we also assess whether an order is justified, for instance to prevent fraud or non-payment (see article 6 of the terms and conditions) — this is a manual review of the order, not an automated credit score from an external party. | Performance of the contract (point (b)); the order review on the basis of legitimate interest (point (f)) | Seven years for the data shown on the invoice (tax retention obligation, art. 52 AWR (the Dutch General Tax Act)); other order data no longer than necessary for customer service |
| Customer account (My account) | Name, address, email address, password (hashed), order history | Logging in, viewing orders, reordering more quickly | Performance of the contract (point (b)) | For as long as the account exists; if you delete the account, we delete the data except for what the tax retention obligation requires |
| Newsletter | Email address | Sending offers and news | Consent (point (a)) | Until you unsubscribe |
| Contact form | Name, email address, your message | Answering your question | Legitimate interest (point (f)): handling customer contact | Until the question has been dealt with, plus a reasonable period afterwards to be able to follow up |
| Withdrawal form | Name, email address, order number, items selected, any reason given | Recording and processing your withdrawal; proving when you withdrew | Legal obligation (point (c)): the right of withdrawal under afdeling 6.5.2B BW requires us to be able to prove this | Seven years, as part of the order administration (tax retention obligation, art. 52 AWR) |
| Log files and security | IP address, time, page requested | Keeping the site safe and working, detecting misuse | Legitimate interest (point (f)) | Short, usually a few weeks |
If you sign up for the newsletter, this works with double opt-in. Your registration first comes in as a draft subscription; only when you click the link in the confirmation email do you become a confirmed contact. Without that click, nothing happens with your address. A purchase never automatically leads to a newsletter subscription — the two lists (customers and newsletter) are kept separate with us, and an order does not affect the newsletter list. If you unsubscribe, we record that as an opt-out; a later purchase does not silently resubscribe you.
Article 3 — Recipients of your data
We only pass on data to parties that need it to be able to provide our service.
| Party | Role | What they receive | Capacity |
|---|---|---|---|
| Hostinger International Ltd. | Hosting provider | All data entered or processed on or through the site — the site runs on their infrastructure | Processor |
| [BETAALDIENSTVERLENER — bijv. Mollie B.V.] | Payment service provider (iDEAL, credit card) | Payment and order data needed to process the payment | Processor |
| Klarna | Payment method (pay later) | Name, address, order data, and the data Klarna itself collects for its own credit assessment | For this own assessment, Klarna is an independent controller: Klarna decides for itself, and not on our instructions, how it uses that data. Klarna’s own privacy policy applies to this, not ours |
| PayPal | Payment method | Name, email address and order data needed to process the payment | Independent controller for the processing within its own service |
| PostNL | Carrier | Name, address and phone number, for delivery and track & trace | Processor |
| FluentCRM | Customer and newsletter management | Name, email address, and tags based on your purchase history (see article 6) | Runs on our own server at Hostinger International Ltd.. The data therefore does not leave our own infrastructure; there is no separate transfer to a third party |
| [BACKUPBESTEMMING VAN UPDRAFTPLUS] | Backup destination | A copy of the full database, including customer and order data | Processor |
| [BOEKHOUDPAKKET OF ACCOUNTANT] | Bookkeeping | Invoice data | Processor |
With each processor listed above, we have entered into or will enter into a data processing agreement as required by art. 28 GDPR. We never sell your data to third parties and do not use it for advertising purposes with other parties.
Article 4 — Transfers outside the EEA
Where a party from the table above processes data outside the European Economic Area, this only happens with a safeguard permitted by the GDPR: an adequacy decision of the European Commission, or standard contractual clauses on data protection (art. 44 et seq. GDPR). Which party this concretely concerns depends on the suppliers still to be filled in — in particular [BACKUPBESTEMMING VAN UPDRAFTPLUS], where the destination of the backup determines whether this article applies. Once that token has been filled in, this paragraph should be checked again to see whether, and if so with which safeguard, that destination lies outside the EEA.
Article 5 — Cookies
Which cookies we place, for what purposes, and how you set your preference, is set out in our cookie policy (currently only available in Dutch: cookiebeleid). This privacy policy covers the processing of your data; the cookie policy covers what is placed on your device.
Article 6 — Customer segmentation
As soon as an order has been paid, we assign a label in FluentCRM based on the number of paid orders linked to your email address: customer on the first paid order, and returning customer once there are two or more. This is profiling within the meaning of art. 4(4) GDPR: we evaluate a personal aspect — your purchasing behaviour — based on your data.
What this is not: an automated decision with legal effects on you. The label does not determine whether you can order, which price you see, whether an order is refused, or anything else that affects you directly. It only helps us make customer communication more relevant. The threshold of art. 22 GDPR — decision-making based solely on automated processing with legal effect — is not met by this.
The legal basis for this segmentation is our legitimate interest (art. 6(1)(f) GDPR) in relevant customer communication. We have weighed that interest against your interest in not being categorised: the label only affects how we address you, not what you receive from us or on what terms, and you can object to this processing at any time via service@dreamglow.nl.
Article 7 — How we secure your data
We take appropriate technical and organisational measures to protect your data against loss and unauthorised access: an encrypted connection (https) across the entire site, passwords that are stored hashed and are never readable — not even by us —, and regular backups at [BACKUPBESTEMMING VAN UPDRAFTPLUS]. Only employees who need it for their work have access to your data.
Article 8 — Your rights
You have the right to access your data (art. 15 GDPR), have it corrected (art. 16), have it erased (art. 17), have the processing restricted (art. 18), receive your data in a portable format (art. 20), and object to processing based on our legitimate interest, including the segmentation described in article 6 (art. 21). If you have given consent — for the newsletter, for example — you can withdraw it at any time, without this affecting the lawfulness of what was already done before that.
A request relating to any of these rights should be sent to service@dreamglow.nl. We respond within a month.
Article 9 — Complaints
If you and we cannot resolve something together, you have the right to file a complaint with the supervisory authority (art. 77 GDPR). In the Netherlands, this is the Autoriteit Persoonsgegevens: www.autoriteitpersoonsgegevens.nl.
Article 10 — Children
Our webshop is not specifically aimed at children. If you are under 16, please only order with the consent of a parent or guardian.
Article 11 — Changes to this privacy policy
We may amend this policy, for example if we engage a new processor or if the law changes. The date at the top of this page shows when that last happened. If a change is significant to you, we will inform you in an appropriate way.