Privacy Policy

Last updated: 18 July 2026

This Privacy Policy explains how Emma Catharina collects, uses, stores, shares and protects personal data when you:

  • visit www.emmacatharina.com;

  • place or attempt to place an order;

  • create or use a customer account;

  • contact our customer service team;

  • use our Return Portal;

  • subscribe to marketing communications;

  • interact with our advertisements or social-media accounts; or

  • otherwise interact with Emma Catharina.

This Privacy Policy should be read together with our Cookie Policy, Terms and Conditions and Shipping and Returns Policy.

1. About Emma Catharina

Emma Catharina is responsible for determining how and why your personal data is processed in connection with our business and website.

Our business details are:

Trading name: Emma Catharina
Chamber of Commerce number: 80826849
VAT identification number: NL003493473B08
Business address: Sint Servatiusstraat 3, Weert, The Netherlands
Email address: info@emmacatharina.com
Website: www.emmacatharina.com

In this Privacy Policy:

“Emma Catharina”, “we”, “us” and “our” refer to Emma Catharina.

“You” and “your” refer to the person whose personal data we process.

“Personal data” means information relating to an identified or identifiable natural person.

“Processing” means any operation performed on personal data, including collecting, recording, organising, storing, using, sharing, changing or deleting it.

2. Scope of this Privacy Policy

2.1. This Privacy Policy applies to personal data processed by Emma Catharina in connection with our website, online store, Products, customer service, Return Portal, marketing and other business activities.

2.2. This Privacy Policy does not apply to websites, platforms or services operated independently by third parties.

2.3. When you follow a link to a third-party website or use an independently operated service, the privacy policy of that third party will apply.

2.4. Certain service providers, including payment providers, Shopify Consumer Services, social-media platforms and advertising providers, may process personal data for their own purposes as independent controllers. Their own privacy policies may apply to that processing.

3. Personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data.

3.1. Identity information

This may include:

  • full name;

  • title;

  • date of birth, where genuinely necessary;

  • username or customer-account identifier; and

  • information required to verify your identity when you exercise a privacy right.

We will only request identity-verification information that is reasonably necessary. We will not normally require a complete copy of an identity document.

3.2. Contact information

This may include:

  • billing address;

  • delivery address;

  • return address;

  • email address;

  • telephone number; and

  • social-media username where you contact us through social media.

3.3. Order and transaction information

This may include:

  • order number;

  • Products ordered;

  • selected sizes, colours and quantities;

  • purchase price;

  • discounts or promotional codes used;

  • order date;

  • payment status;

  • delivery method;

  • delivery status;

  • tracking information;

  • returns, refunds and exchanges;

  • order history; and

  • correspondence relating to an order.

3.4. Payment information

Payments are processed by Shopify and the payment providers made available during checkout.

Depending on the payment method, payment data may include:

  • payment method;

  • payment status;

  • transaction reference;

  • billing address;

  • limited payment-card information, such as the card type and final digits;

  • information required for fraud prevention; and

  • refund information.

Emma Catharina does not normally receive or independently store your complete credit or debit card number, security code or full online-banking credentials.

Payment providers may process additional information in accordance with their own privacy policies and legal obligations.

3.5. Delivery information

This may include:

  • recipient name;

  • delivery address;

  • telephone number;

  • email address;

  • delivery instructions;

  • collection-point selection;

  • tracking information;

  • proof of delivery;

  • delivery attempts; and

  • information relating to lost, damaged, refused or unclaimed parcels.

3.6. Customer-account information

If customer accounts are available, we may process:

  • account name;

  • email address;

  • password or authentication status;

  • saved addresses;

  • order history;

  • saved preferences;

  • account activity; and

  • account-security information.

Passwords are generally processed and secured through Shopify or another authentication provider. Emma Catharina does not have access to your plain-text password.

3.7. Return Portal information

When you use our Return Portal, we may collect:

  • full name;

  • email address;

  • order number;

  • Product or Products concerned;

  • selected return request;

  • return status;

  • reason for return, where voluntarily provided;

  • photographs of a faulty, damaged or incorrect Product;

  • photographs of packaging or shipping labels;

  • comments or additional information; and

  • information required to process the return, refund or complaint.

You do not have to provide a reason when exercising a statutory right of withdrawal.

3.8. Customer-service and communication information

When you contact us, we may process:

  • your contact details;

  • the content of your message;

  • previous correspondence;

  • order information;

  • complaints;

  • questions;

  • requests;

  • photographs or documents you provide; and

  • notes relating to the handling of your enquiry.

This includes communications through email, contact forms, the Return Portal and social-media messaging services.

3.9. Marketing and preference information

This may include:

  • whether you subscribed to our newsletter;

  • date and method of consent;

  • marketing preferences;

  • consent status;

  • unsubscribe requests;

  • language preferences;

  • country or region;

  • products or collections that may interest you;

  • interactions with marketing emails;

  • interaction with advertisements; and

  • information about the campaign through which you reached our website.

3.10. Website, device and technical information

When you visit our website, we may collect:

  • IP address;

  • browser type;

  • device type;

  • operating system;

  • language;

  • approximate location;

  • screen or device settings;

  • cookie identifiers;

  • session identifiers;

  • date and time of visits;

  • pages and Products viewed;

  • links and buttons selected;

  • referring website;

  • shopping-basket activity;

  • checkout activity;

  • website errors;

  • consent preferences; and

  • other information collected through cookies or similar technologies.

More information is provided in our Cookie Policy.

3.11. Advertising and analytics information

Where you have provided any consent required by applicable law, we may collect or receive information relating to:

  • advertising impressions;

  • advertisement clicks;

  • website visits following an advertisement;

  • purchases and other conversions;

  • Products viewed;

  • Products added to a shopping basket;

  • abandoned checkouts;

  • audience membership;

  • campaign identifiers;

  • cookie or device identifiers; and

  • interaction with advertisements on platforms such as Meta or Google.

3.12. Social-media information

If you interact with Emma Catharina through a social-media platform, we may process:

  • your public profile information;

  • username;

  • messages;

  • comments;

  • likes;

  • mentions;

  • tagged content; and

  • other information you choose to make available to us.

The social-media platform may separately process your personal data in accordance with its own privacy policy.

3.13. Reviews and user-generated content

If you submit a review, photograph, testimonial or other content, we may process:

  • your name or chosen display name;

  • review or testimonial;

  • rating;

  • Product information;

  • photographs or videos;

  • date of submission;

  • order-verification status; and

  • consent or permission relating to publication.

We will not publish private correspondence as a review or testimonial without an appropriate legal basis.

3.14. Fraud, security and compliance information

This may include:

  • IP address;

  • device information;

  • payment and order patterns;

  • failed payment attempts;

  • risk indicators;

  • account activity;

  • delivery information;

  • suspected misuse;

  • chargeback information; and

  • information required to investigate fraud, abuse or security incidents.

3.15. Special categories of personal data

We do not intentionally request or collect special categories of personal data, such as information concerning health, ethnicity, religion, political opinions, trade-union membership, genetic data, biometric identification or sexual orientation.

Please do not provide such information unless it is genuinely necessary for your request.

If you voluntarily provide sensitive information, we will process it only where there is an appropriate legal basis and where necessary to handle your request or comply with the law.

4. How we collect personal data

We may collect personal data from the following sources.

4.1. Directly from you

For example, when you:

  • place an order;

  • create an account;

  • complete a checkout;

  • contact customer service;

  • use the Return Portal;

  • subscribe to our newsletter;

  • complete a form;

  • submit a review;

  • enter a promotion; or

  • communicate with us through social media.

4.2. Automatically through our website

Personal data may be collected automatically through:

  • cookies;

  • pixels;

  • tags;

  • local storage;

  • server logs;

  • analytics tools;

  • advertising technologies; and

  • other similar technologies.

These technologies are explained in our Cookie Policy.

4.3. From service providers

We may receive information from:

  • Shopify;

  • payment providers;

  • delivery providers;

  • fraud-prevention providers;

  • analytics providers;

  • marketing platforms;

  • Return Portal providers;

  • customer-service providers; and

  • Shopify apps used in our store.

4.4. From social-media and advertising platforms

We may receive information from platforms such as Meta and Google, including information about advertising interactions, campaign attribution and audience performance.

We only use this information in accordance with applicable law and your consent choices.

4.5. From publicly available sources

We may process information that you have deliberately made publicly available, for example when you publicly tag Emma Catharina or comment on our social-media content.

5. Why we process personal data

We process personal data for the purposes described below.

5.1. Operating our website

We process personal data to:

  • display and operate our website;

  • remember shopping-basket contents;

  • maintain website security;

  • provide customer-account functions;

  • remember country, currency or language preferences;

  • prevent technical errors; and

  • provide features requested by you.

5.2. Processing orders

We process personal data to:

  • receive and review orders;

  • confirm orders;

  • process payment;

  • prepare and package Products;

  • deliver orders;

  • provide tracking information;

  • communicate about an order;

  • process cancellations; and

  • issue refunds.

5.3. Processing payments

We process and share necessary information with payment providers to:

  • authorise payments;

  • complete transactions;

  • process refunds;

  • prevent payment fraud;

  • handle chargebacks; and

  • comply with financial and legal obligations.

5.4. Delivering orders

We process and share necessary information with delivery providers to:

  • create shipping labels;

  • arrange delivery;

  • provide tracking;

  • deliver to collection points;

  • investigate delayed or missing parcels;

  • obtain proof of delivery; and

  • handle damaged, refused or unclaimed shipments.

5.5. Operating the Return Portal

We process Return Portal information to:

  • register a statutory withdrawal;

  • process a voluntary international return;

  • identify the relevant order and Products;

  • provide return instructions;

  • investigate faults or delivery damage;

  • process refunds or replacements;

  • prevent return fraud; and

  • maintain evidence of the request and its handling.

5.6. Providing customer service

We process personal data to:

  • respond to questions;

  • resolve complaints;

  • provide sizing or Product advice;

  • assist with payments and deliveries;

  • investigate faults;

  • communicate about returns;

  • manage disputes; and

  • improve our service.

5.7. Managing customer accounts

Where customer accounts are offered, we process account information to:

  • create and maintain the account;

  • authenticate the user;

  • display order history;

  • save preferences;

  • facilitate future purchases; and

  • protect account security.

5.8. Sending marketing communications

Where permitted, we may use your contact details to send:

  • newsletters;

  • Product announcements;

  • collection launches;

  • invitations;

  • promotional offers;

  • archive-sale information;

  • brand updates; and

  • other marketing communications.

We will send electronic marketing where:

  • you have given consent; or

  • applicable law allows us to contact an existing customer about similar Products or services.

Every electronic marketing message will provide a free and clear way to unsubscribe.

5.9. Recovering abandoned checkouts

Where permitted by applicable law and our platform settings, we may send a reminder when you begin but do not complete checkout.

We use the checkout and contact information provided by you for this purpose.

You can opt out of such messages by using the unsubscribe option where available or contacting us.

5.10. Analytics and website improvement

Where required, subject to your consent, we process analytics information to:

  • measure website traffic;

  • understand how visitors use the website;

  • identify technical problems;

  • improve navigation;

  • improve Product presentation;

  • understand shopping behaviour;

  • analyse checkout performance; and

  • assess the effectiveness of campaigns.

5.11. Advertising

Where required, subject to your consent, we may use personal data to:

  • measure advertisements;

  • attribute purchases to campaigns;

  • create advertising audiences;

  • exclude existing customers from certain campaigns;

  • show advertisements that may be relevant to you;

  • retarget website visitors; and

  • improve advertising performance.

5.12. Preventing fraud and securing our business

We process personal data to:

  • verify transactions;

  • identify suspicious activity;

  • prevent fraud and abuse;

  • protect customer accounts;

  • secure our website;

  • investigate security incidents;

  • prevent unauthorised access; and

  • establish, exercise or defend legal claims.

5.13. Complying with legal obligations

We may process personal data to:

  • maintain financial and tax records;

  • comply with consumer law;

  • respond to lawful requests from authorities;

  • comply with court orders;

  • handle product-safety obligations;

  • investigate fraud or criminal activity;

  • maintain records of consent; and

  • comply with data-protection obligations.

5.14. Managing and improving our business

We may process personal data to:

  • plan inventory;

  • analyse sales;

  • develop Products and collections;

  • evaluate customer-service quality;

  • improve business processes;

  • maintain internal records;

  • conduct audits; and

  • obtain professional advice.

Where possible, we use aggregated or anonymised information for these purposes.

6. Legal bases for processing

Where the General Data Protection Regulation or similar legislation applies, we rely on one or more of the following legal bases.

6.1. Performance of a contract

We process personal data where this is necessary to:

  • process an order;

  • accept payment;

  • deliver Products;

  • operate a customer account;

  • process a return;

  • issue a refund; or

  • take steps requested by you before entering into an agreement.

6.2. Legal obligation

We process personal data where necessary to comply with legal obligations, including:

  • tax and accounting laws;

  • consumer-protection laws;

  • product-safety obligations;

  • fraud-prevention requirements;

  • court orders; and

  • data-protection laws.

6.3. Legitimate interests

We may process personal data where this is necessary for our legitimate interests or those of a third party, provided that those interests are not overridden by your rights and freedoms.

These interests may include:

  • operating and improving our business;

  • providing customer service;

  • preventing fraud;

  • securing our website;

  • managing legal claims;

  • analysing business performance;

  • protecting our Products and intellectual property;

  • communicating with existing customers where permitted; and

  • maintaining accurate business records.

We assess the necessity and impact of processing before relying on legitimate interests.

6.4. Consent

We rely on consent where required, including for certain:

  • marketing communications;

  • analytics cookies;

  • advertising cookies;

  • personalised advertising;

  • social-media tracking; and

  • publication of particular testimonials or customer content.

You may withdraw consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

6.5. Establishing, exercising or defending legal claims

We may process and retain information where reasonably necessary to establish, exercise or defend a legal claim.

7. When you must provide personal data

7.1. You are not generally required to provide personal data merely to browse our website.

7.2. Certain information is necessary to place and fulfil an order, including:

  • your name;

  • contact information;

  • billing information;

  • delivery information; and

  • payment information.

7.3. If you do not provide the information required for an order, we may be unable to accept, process or deliver it.

7.4. Certain information is also required to process a return, refund, complaint or privacy request.

7.5. Information marked as optional does not have to be provided.

8. Shopify

8.1. Our online store is hosted and operated through Shopify.

8.2. Shopify processes personal data to provide services including:

  • hosting;

  • storefront functionality;

  • shopping-basket functions;

  • checkout;

  • order administration;

  • customer accounts;

  • payment support;

  • fraud prevention;

  • analytics;

  • privacy controls; and

  • security.

8.3. In many circumstances, Shopify processes customer personal data as a processor or service provider acting on our instructions.

8.4. Shopify may also act as an independent controller for certain services, including Shopify Consumer Services such as Shop or Shop Pay.

8.5. When you independently use Shop, Shop Pay or another Shopify Consumer Service, Shopify’s own terms and privacy policy may apply.

8.6. More information is available in the Shopify Consumer Privacy Policy.

9. Shopify Network Intelligence and Enhanced Services

9.1. Where Shopify Network Intelligence or related Enhanced Services are enabled for our store, Shopify may securely use customer data together with data from other merchants to provide features such as:

  • improved fraud prevention;

  • store and Product personalisation;

  • improved store performance;

  • advertising measurement;

  • audience services; and

  • more relevant advertising.

9.2. Depending on the relevant service and applicable law, Shopify may act as a controller, business, processor or service provider.

9.3. Shopify states that other merchants cannot directly access our customer data.

9.4. Consent choices made through our cookie banner or Cookie Preferences are intended to be communicated to Shopify through Shopify’s privacy tools.

9.5. Where applicable, you may also use our Data Sharing Opt-Out Page or a recognised Global Privacy Control signal to opt out of certain advertising uses.

9.6. Additional information about Shopify’s processing is available in the Shopify Consumer Privacy Policy.

10. Payment providers

10.1. We share necessary information with the payment provider selected during checkout.

10.2. Payment providers may process information to:

  • authorise and complete payments;

  • verify identity;

  • prevent fraud;

  • process refunds;

  • handle chargebacks;

  • comply with financial laws; and

  • maintain transaction records.

10.3. Payment providers may act as independent controllers for certain processing required by financial, fraud-prevention, anti-money-laundering or other laws.

10.4. Their own privacy policies apply to processing performed for their independent purposes.

11. Delivery providers

11.1. We may share necessary delivery information with delivery and logistics providers, including, where applicable:

  • PostNL;

  • DHL;

  • UPS;

  • local delivery partners;

  • customs agents; and

  • collection-point operators.

11.2. Information shared may include:

  • recipient name;

  • delivery address;

  • email address;

  • telephone number;

  • order or parcel reference;

  • delivery instructions; and

  • customs information.

11.3. Delivery providers may process personal data independently where necessary to provide their services, comply with transport laws or handle customs requirements.

12. Other service providers

We may share personal data with trusted service providers that support our business.

These may include providers of:

  • website hosting;

  • Shopify apps;

  • customer accounts;

  • payment processing;

  • fraud prevention;

  • delivery and logistics;

  • the Return Portal;

  • customer service;

  • email communications;

  • newsletter distribution;

  • analytics;

  • advertising;

  • social-media integrations;

  • IT support;

  • cloud storage;

  • security;

  • accounting; and

  • legal or professional services.

We provide service providers only with the information reasonably necessary for their services.

Where required, we enter into appropriate data-processing or confidentiality agreements.

13. Google

13.1. Where enabled and subject to your consent where required, we may use Google services such as:

  • Google Analytics;

  • Google Ads;

  • Google Tag Manager; and

  • Google Search Console.

13.2. These services may process website, device, campaign and conversion information.

13.3. Google Analytics helps us understand how visitors use our website.

13.4. Google Ads may help us measure campaigns and display relevant advertisements.

13.5. Google Search Console provides information about the visibility and technical performance of our website in Google Search. It does not generally identify individual website visitors to us.

13.6. Google may process personal data for its own purposes in accordance with its privacy policies.

13.7. More information about cookies used by Google is included in our Cookie Policy.

14. Meta

14.1. Where enabled and subject to consent where required, we may use Meta advertising technologies, including the Meta Pixel and related measurement services.

14.2. Meta technologies may receive information about:

  • pages viewed;

  • Products viewed;

  • Products added to a shopping basket;

  • checkout activity;

  • purchases;

  • browser and device information;

  • IP address;

  • cookie identifiers; and

  • the campaign through which you reached our website.

14.3. We may use this information to:

  • measure Facebook and Instagram advertisements;

  • create advertising audiences;

  • retarget website visitors;

  • exclude certain customers from campaigns; and

  • improve campaign performance.

14.4. Meta may process personal data for its own purposes in accordance with its privacy policies.

15. Email marketing

15.1. We may use Shopify or another email-marketing provider to manage newsletters and marketing communications.

15.2. The provider may process:

  • email address;

  • name;

  • subscription status;

  • consent records;

  • language or region;

  • email delivery status;

  • email opens;

  • link selections;

  • unsubscribes; and

  • purchase or browsing information used for permitted segmentation.

15.3. We send marketing only where we have an appropriate legal basis.

15.4. You can unsubscribe at any time by:

  • selecting the unsubscribe link in a marketing email;

  • changing your account preferences where available; or

  • contacting info@emmacatharina.com.

15.5. After unsubscribing, we may retain limited information on a suppression list to ensure that we respect your request.

15.6. Unsubscribing from marketing does not prevent us from sending necessary service messages relating to an order, return, refund, account or legal notice.

15.7. If a product or size is temporarily unavailable, you can leave your email address to be notified when it becomes available again.

15.8. We collect your email address for this purpose only. Your request is stored in our customer system with a label identifying the product and size you are interested in, so that we can inform you when it returns.

15.9. The legal basis for this processing is your consent, which you give by submitting the form. You can withdraw your consent at any time by emailing info@emmacatharina.com, and we will remove your details.

15.10. Submitting a back in stock request also adds you to our customer list. If you do not wish to receive other marketing communications, you can let us know at info@emmacatharina.com or use the unsubscribe link in any marketing email.

16. Cookies and similar technologies

16.1. We use cookies and similar technologies to:

  • operate our website;

  • remember preferences;

  • maintain security;

  • provide shopping-basket and checkout functions;

  • analyse website use; and

  • measure or personalise advertising where permitted.

16.2. Where required, non-essential cookies will only be used after you have provided consent.

16.3. You can manage or withdraw cookie consent through Cookie Preferences.

16.4. Detailed information about cookies, providers, categories and durations is available in our Cookie Policy.

17. Sharing personal data

We may share personal data in the circumstances described below.

17.1. With service providers

We share data with providers that perform services on our behalf or support our business.

17.2. With authorities

We may disclose personal data to:

  • courts;

  • regulators;

  • tax authorities;

  • customs authorities;

  • law-enforcement authorities; or

  • other government bodies,

where required or permitted by law.

17.3. To protect rights and safety

We may share information where reasonably necessary to:

  • prevent fraud;

  • investigate criminal activity;

  • enforce our agreements;

  • protect our customers;

  • protect our website or business; or

  • establish, exercise or defend legal claims.

17.4. With professional advisers

We may share information with accountants, lawyers, insurers, auditors and other professional advisers where reasonably necessary.

17.5. In connection with a business transaction

If Emma Catharina is involved in a merger, financing, restructuring, sale, transfer or acquisition, personal data may be disclosed to relevant advisers and potential transaction parties.

We will take reasonable steps to protect personal data and comply with applicable law.

17.6. With your consent

We may share personal data with another party where you have specifically consented or asked us to do so.

18. Selling and sharing personal data

18.1. Emma Catharina does not sell personal data to third parties in exchange for money.

18.2. We may use analytics and advertising technologies that disclose identifiers or website activity to providers such as Shopify, Google or Meta.

18.3. Under certain United States privacy laws, these activities may be described as:

  • sharing;

  • targeted advertising;

  • cross-context behavioural advertising; or

  • a sale of personal data,

even when no money is exchanged.

18.4. Where applicable, you can opt out through:

  • Cookie Preferences;

  • our Data Sharing Opt-Out Page;

  • a recognised Global Privacy Control signal; or

  • by contacting us.

18.5. We do not knowingly sell or share the personal data of children for targeted advertising.

19. International data transfers

19.1. Emma Catharina is established in the Netherlands, but some service providers may process personal data in other countries.

19.2. Personal data may therefore be transferred to or accessed from countries outside:

  • the European Economic Area;

  • the United Kingdom;

  • Switzerland; or

  • your country of residence.

19.3. These countries may have different data-protection laws.

19.4. Where legally required, international transfers will be protected using an appropriate transfer mechanism, such as:

  • an adequacy decision;

  • approved standard contractual clauses;

  • contractual safeguards;

  • binding corporate rules; or

  • another legally recognised mechanism.

19.5. Shopify may process data through entities and infrastructure in countries including Ireland, Canada and other locations in which Shopify or its service providers operate.

19.6. Shopify states that it relies on recognised transfer mechanisms, including adequacy decisions and standard contractual clauses, where applicable.

19.7. You may contact us for further information about safeguards relevant to your personal data.

20. Data retention

20.1. We retain personal data only for as long as reasonably necessary for:

  • the purpose for which it was collected;

  • the performance of an agreement;

  • customer service;

  • legal and regulatory obligations;

  • fraud prevention;

  • dispute resolution; and

  • legal claims.

20.2. The applicable retention period depends on the category of data and the reason for processing.

20.3. Orders and financial administration

Order, invoice, payment, refund and tax information is generally retained for at least seven years where required by Dutch tax and accounting law.

20.4. Customer accounts

Customer-account information is generally retained while the account remains active.

After an account is closed or deletion is requested, information will be deleted or anonymised unless it must be retained for orders, legal obligations, fraud prevention or legal claims.

20.5. Customer-service communications

Customer-service correspondence is retained for as long as necessary to handle the request and for a reasonable period afterwards to:

  • provide consistent support;

  • handle follow-up questions;

  • resolve disputes; and

  • establish or defend legal claims.

20.6. Returns, refunds and complaints

Return Portal submissions, return records, complaints, photographs and refund information are retained for as long as necessary to process the matter and for a reasonable period afterwards.

Information forming part of financial, tax or legal records may be retained for longer.

20.7. Marketing data

Marketing contact details are retained until you:

  • unsubscribe;

  • withdraw consent;

  • object to marketing; or

  • we determine that the information is no longer accurate or useful.

We may retain limited suppression information for as long as necessary to ensure that we do not send further marketing.

20.8. Cookie and analytics data

Cookie and analytics information is retained according to the durations stated in our Cookie Policy and the settings of the relevant providers.

20.9. Fraud and security information

Fraud-prevention and security information may be retained for as long as reasonably necessary to:

  • investigate suspicious activity;

  • protect accounts and transactions;

  • prevent repeated abuse;

  • handle chargebacks; and

  • establish or defend legal claims.

20.10. Privacy requests

Records relating to privacy requests may be retained for a reasonable period to demonstrate that we handled the request correctly and complied with our legal obligations.

20.11. Deletion and anonymisation

When personal data is no longer required, we will delete or anonymise it, unless continued retention is required or permitted by law.

Backups may retain deleted information temporarily until the relevant backup is securely overwritten.

21. Data security

21.1. We use reasonable technical and organisational measures designed to protect personal data against:

  • unauthorised access;

  • unlawful use;

  • alteration;

  • disclosure;

  • loss;

  • destruction; and

  • accidental damage.

21.2. Measures may include:

  • access controls;

  • password protection;

  • secure connections;

  • platform security;

  • role-based access;

  • staff or contractor confidentiality;

  • secure service providers;

  • software updates; and

  • monitoring of suspicious activity.

21.3. No website, transmission method or storage system is completely secure.

21.4. If we become aware of a personal-data breach, we will investigate it and comply with applicable notification and documentation obligations.

22. Automated processing and fraud screening

22.1. Shopify, payment providers and fraud-prevention providers may use automated tools to assess transactions for fraud, security or payment risk.

22.2. Factors may include:

  • device information;

  • IP address;

  • payment information;

  • order value;

  • billing and delivery details;

  • transaction history; and

  • unusual activity patterns.

22.3. An order may be delayed, reviewed or refused where a provider identifies a significant risk.

22.4. Emma Catharina does not generally make decisions based solely on automated processing that produce legal or similarly significant effects without appropriate safeguards.

22.5. Where applicable law gives you rights regarding a solely automated decision, you may request:

  • human review;

  • an explanation;

  • correction of inaccurate information; or

  • an opportunity to challenge the decision.

23. Children

23.1. Our website and Products are not specifically directed at children.

23.2. We do not knowingly collect personal data directly from children under sixteen for marketing or behavioural advertising purposes.

23.3. A person under eighteen may only place an order with the consent and involvement of a parent or legal guardian.

23.4. If you believe that a child has provided personal data without appropriate permission, contact info@emmacatharina.com.

23.5. Where appropriate and legally required, we will delete the information.

24. Your privacy rights in the European Economic Area and United Kingdom

Depending on the circumstances, you may have the following rights.

24.1. Right of access

You may request confirmation of whether we process your personal data and request access to that data.

24.2. Right to rectification

You may request correction of inaccurate personal data and completion of incomplete personal data.

24.3. Right to erasure

You may request deletion of personal data in certain circumstances.

This right is not absolute. We may retain information where required for legal obligations, contracts, fraud prevention or legal claims.

24.4. Right to restriction

You may request that we temporarily restrict certain processing.

24.5. Right to data portability

Where processing is based on consent or contract and carried out by automated means, you may request certain personal data in a structured, commonly used and machine-readable format.

24.6. Right to object

You may object to processing based on legitimate interests.

We will stop the processing unless we demonstrate compelling legitimate grounds or the data is needed for legal claims.

24.7. Right to object to direct marketing

You may object to the use of your personal data for direct marketing at any time.

After receiving your objection, we will stop using your personal data for that purpose.

24.8. Right to withdraw consent

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal does not affect processing carried out before consent was withdrawn.

24.9. Rights regarding automated decisions

Where applicable, you may have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

24.10. Right to complain

You have the right to submit a complaint to a data-protection authority.

In the Netherlands, the relevant authority is the Autoriteit Persoonsgegevens.

If you live in another country, you may also contact the competent authority in your country of residence.

25. Privacy rights in other countries

25.1. Depending on where you live, you may have additional privacy rights.

25.2. These may include the right to:

  • know which categories of personal data we collect;

  • request access;

  • request correction;

  • request deletion;

  • receive a portable copy;

  • opt out of targeted advertising;

  • opt out of sale or sharing;

  • restrict certain processing;

  • withdraw consent;

  • appeal a decision relating to a privacy request; and

  • receive equal service without unlawful discrimination.

25.3. These rights are subject to applicable thresholds, definitions, conditions and exceptions.

25.4. We will not unlawfully discriminate against you because you exercise a privacy right.

26. How to exercise your privacy rights

26.1. To exercise a privacy right, contact:

info@emmacatharina.com

26.2. Please explain:

  • which right you wish to exercise;

  • which information or interaction the request concerns; and

  • which email address or order information can be used to identify your records.

26.3. We may request additional information where reasonably necessary to verify your identity and protect your personal data.

26.4. We will not normally request more information than necessary for verification.

26.5. We aim to respond without undue delay and generally within one month where the GDPR applies.

26.6. The response period may be extended where permitted for a complex request or multiple requests. We will inform you if an extension is required.

26.7. Privacy requests are generally handled free of charge.

26.8. We may charge a reasonable fee or refuse a request where it is manifestly unfounded, excessive or repetitive, to the extent permitted by law.

26.9. An authorised representative may submit a request where permitted by applicable law. We may request evidence of the representative’s authority.

27. Cookie choices and advertising opt-outs

27.1. You can manage non-essential cookies through Cookie Preferences.

27.2. Depending on your location, you may also be able to opt out of data sharing or targeted advertising through our Data Sharing Opt-Out Page.

27.3. Where supported, we may recognise a Global Privacy Control signal as an opt-out request.

27.4. Changing cookie preferences will normally apply to future tracking.

27.5. Cookies already placed may remain on your device until they expire or are deleted through your browser settings.

28. Third-party websites and social media

28.1. Our website may contain links to third-party websites or social-media platforms.

28.2. Emma Catharina is not responsible for the privacy practices, content or security of independently operated third-party services.

28.3. Review the relevant third party’s privacy policy before providing personal data.

29. Changes to this Privacy Policy

29.1. We may update this Privacy Policy from time to time to reflect changes in:

  • our business;

  • our website;

  • the personal data we process;

  • installed Shopify apps;

  • Shopify settings;

  • service providers;

  • advertising or analytics technologies; or

  • applicable laws and regulatory guidance.

29.2. The latest version will be published on our website.

29.3. The date at the top of this Privacy Policy indicates when it was last updated.

29.4. Where a change materially affects your rights or the way we use personal data, we may provide an additional notice or request new consent where required.

30. Contact

For questions about this Privacy Policy, our processing of personal data or your privacy rights, contact:

Emma Catharina
Email: info@emmacatharina.com
Website: www.emmacatharina.com