Privacy policy

Last updated: 22 September 2026

BODYKAARS values your privacy and is committed to handling personal data carefully.

This Privacy Policy explains what personal data we process, why we process it, who we may share it with, how long we keep it and what rights you have.

1. Who is responsible for your personal data?

Data controller:

BODYKAARS
Legal business name: Bodykaars
Dutch Chamber of Commerce number: 86736086
VAT identification number: NL004301375B10
Registered business address: [REGISTERED BUSINESS ADDRESS]
The Netherlands
Email: info@bodykaars.nl
Telephone: [TELEPHONE NUMBER]

2. What personal data do we process?

Depending on how you use our website, we may process the following categories of personal data.

Orders and customers

name;
billing address;
delivery address;
email address;
telephone number, where provided;
products ordered;
order number;
order and transaction dates;
payment status;
return and refund information;
communications relating to your order.

Payments

Payments are processed through the payment provider or providers offered through our Shopify checkout.

BODYKAARS does not normally receive your full card or bank account details where these are processed directly by the relevant payment provider.

We may receive information necessary to confirm whether a payment has been completed and to process your order administratively.

Website and technical data

Depending on your cookie settings, we may process:

IP address;
browser type;
device and operating system information;
date, time and duration of website visits;
pages visited;
interactions with our website;
cookies and similar identifiers;
security and fraud prevention information.

Newsletter and marketing

When you subscribe to BODYKAARS emails, we may process:

email address;
date of subscription;
marketing preferences;
subscription and unsubscribe information;
interaction with emails, where permitted and enabled.

Scent Finder

When you use our Scent Finder, we may process your answers and the fragrance result generated from those answers.

If you use the Scent Finder without providing your email address, we do not necessarily link the result to a directly identifiable customer profile, apart from technical data required for operation of the website.

If you enter your email address to save your scent result or join the BODYKAARS mailing list, we may link your scent result to your email address in order to make our communications more relevant to you.

This does not involve automated decision-making that produces legal or similarly significant effects.

Birthday information

If you voluntarily provide your birthday, we request only the day and month together with the email address required for the selected birthday communication.

We do not need your year of birth for this purpose.

Birthday information is used to send you a BODYKAARS message or offer around your birthday where you have requested or consented to this communication.

Contact and customer service

When you contact us, we may process:

your name;
email address;
telephone number;
order number;
the contents of your message;
any photographs or documents you voluntarily provide.

3. Why do we process personal data?

We process personal data for purposes including:

processing and fulfilling orders;
processing payments and refunds;
arranging delivery;
providing customer service;
managing returns and complaints;
handling statutory guarantee claims;
accounting and tax administration;
preventing fraud and protecting our website;
maintaining and improving our webshop;
remembering preferences;
operating the Scent Finder;
sending marketing where legally permitted;
providing birthday communications where requested;
complying with legal obligations.

4. What are our legal bases for processing?

Depending on the processing activity, we rely on one or more of the following legal bases under the GDPR.

Performance of a contract

For example:

orders;
payments;
delivery;
returns;
customer service relating to your purchase.

Legal obligation

For example:

tax administration;
invoicing;
legally required record keeping.

Legitimate interests

For example:

securing our webshop;
preventing fraud;
establishing, exercising or defending legal claims;
limited analysis necessary and proportionate for operating our business.

Where we rely on legitimate interests, we balance those interests against your privacy rights and interests.

Consent

We request consent where legally required, including for:

certain marketing communications;
non-essential tracking or marketing cookies;
certain forms of personalisation;
birthday marketing where this relies on consent.

You may withdraw your consent at any time for the future.

5. Newsletter and commercial email

We send commercial emails where:

you have expressly consented to receive them; or
this is otherwise legally permitted, for example in certain cases involving similar products offered to existing customers where a simple opt-out has been provided.

Every marketing email contains an easy way to unsubscribe.

Once you unsubscribe, we will no longer send marketing email on the basis of that subscription. We may retain your email address in a suppression list where necessary to ensure that your unsubscribe request continues to be respected.

Transactional emails relating to an order, payment, return or customer service request are not marketing emails and may still be sent where necessary.

6. Who do we share personal data with?

We do not sell your personal data.

We may share data with service providers where they require it to perform services on our behalf.

These may include the following.

Shopify

Our webshop is operated using Shopify.

Shopify processes data required for hosting, webshop functionality, customer accounts, checkout, security and related services.

Payment providers

Payment providers offered through our checkout process data necessary to complete payments, prevent fraud and process refunds where required.

Carriers and logistics providers

We share the necessary address and contact details with the carrier responsible for delivering your order.

Email and communications providers

Where we use an external service for newsletters, transactional emails or marketing automation, that provider may process data required to send and manage those communications.

hCaptcha

Our website may use hCaptcha to protect forms and the website against abuse, spam and automated attacks.

hCaptcha may process technical information in accordance with its own privacy terms.

Analytics and marketing partners

Where analytics or marketing technologies are enabled and consent is required, these will only be used after you have provided the required consent.

The current categories and cookie options can be managed through the cookie settings on our website.

Professional service providers

Where necessary, data may be shared with professional advisers or service providers such as:

accountants or bookkeepers;
legal advisers;
IT or security providers.

Public authorities

We may disclose personal data where we are legally required to do so or where a competent authority makes a valid legal request.

7. Shopify and international transfers

BODYKAARS uses Shopify to operate the webshop.

When using Shopify and other international service providers, personal data may in certain circumstances be processed outside the European Economic Area.

Where an appropriate transfer mechanism is required, relevant service providers may rely on legally recognised safeguards such as an adequacy decision or approved Standard Contractual Clauses.

8. How long do we keep personal data?

We do not retain personal data for longer than necessary for the purpose for which it was collected, unless a longer retention period is required by law.

As a general rule:

Order and financial administration

Information forming part of our statutory tax and accounting records is retained for the legally required period, generally 7 years.

Customer service and complaints

Correspondence is retained for as long as reasonably necessary to resolve the enquiry or complaint and to establish or defend any relevant rights or obligations.

Marketing

Marketing information is retained for as long as you remain subscribed or another valid legal basis applies.

After unsubscribing, information may be deleted or retained in a limited form where necessary to respect your opt-out or demonstrate consent.

Scent Finder

Personally linked scent preferences are retained for as long as they remain relevant to the personalisation or marketing relationship, or until you request deletion, unless another legal retention obligation applies.

Birthday information

Birthday information is retained for as long as you wish to use the feature or receive marketing communications for which this information is used.

You may request deletion at any time.

Cookie data

Retention periods vary by cookie and, where applicable, are further explained in our cookie settings or Cookie Policy.

9. Security

BODYKAARS takes appropriate technical and organisational measures to protect personal data against:

loss;
unauthorised access;
unauthorised alteration;
misuse;
unauthorised disclosure.

No online system can provide an absolute guarantee of security.

10. Your privacy rights

Depending on the circumstances, you may have the following rights under the GDPR:

the right to information;
the right of access;
the right to rectification;
the right to erasure;
the right to restriction of processing;
the right to data portability;
the right to object to certain processing;
the right to withdraw consent;
the right to object to direct marketing.

To exercise your privacy rights, contact:

info@bodykaars.nl

We may request additional information where reasonably necessary to verify your identity.

11. Right to object to direct marketing

You may object at any time to the use of your personal data for direct marketing.

You can do this using the unsubscribe link in a marketing email or by contacting info@bodykaars.nl.

Following a valid objection, we will no longer process your personal data for those direct marketing purposes.

12. Complaints to the Dutch Data Protection Authority

If you are unhappy with how we handle your personal data, we encourage you to contact us first so that we have the opportunity to address your concern.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).