Privacy policy
This policy explains what we do with your personal data. We have tried to write it in plain language rather than legal boilerplate, because a policy you cannot read protects nobody.
Who is responsible
Crossfashions is the data controller. We are registered in the Netherlands under KVK number 98091379, VAT number NL823807071B01.
Contact for privacy questions: info@crossfashions.nl · Ton Albertsstraat 82, 2662 EC Bergschenhoek, Netherlands
What we collect and why
| Data | Why | Lawful basis |
|---|---|---|
| Name, email, delivery and billing address, phone | To take payment, deliver your order and handle returns | Performance of a contract |
| Order history | To provide account access, process returns, and meet tax obligations | Contract, and legal obligation |
| Email address for our newsletter | To send you marketing you asked for | Consent, withdrawable at any time |
| Account login details | To let you sign in and see your orders | Performance of a contract |
| Analytics and advertising identifiers | To understand how the site is used and measure advertising | Consent, given through the cookie banner |
We do not sell your personal data, and we never have. We do not use automated decision-making or profiling that produces legal effects for you.
Payment details
We never see or store your card number. Payments are handled by Mollie, a regulated Dutch payment institution. We receive only the result of the payment and the last digits needed to identify it.
Who else processes your data
We use a small number of suppliers to run the shop. Each acts on our instructions under a data processing agreement.
| Supplier | What they do | Where |
|---|---|---|
| Supabase | Database and account hosting | EU (confirm region at project creation) |
| Vercel | Website hosting and delivery | Global CDN, EU function region |
| Mollie | Payment processing | Netherlands |
| Resend | Order and account emails | EU/US — verify transfer basis |
Where a supplier processes data outside the European Economic Area, we rely on the European Commission's standard contractual clauses or an adequacy decision.
How long we keep it
- Order records: seven years, which Dutch tax law requires.
- Your account: until you delete it, or after three years of inactivity.
- Newsletter subscription: until you unsubscribe.
- Analytics data: up to 14 months.
- Support emails: two years after the matter is closed.
Your rights
You can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that is wrong;
- delete your data, where we do not have to keep it by law;
- restrict or object to how we use it;
- send your data to another provider in a portable format;
- withdraw consent, at any time, where consent is what we rely on.
Withdrawing consent does not affect anything we did before you withdrew it. We respond within one month.
Complaints
If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.
Changes
If we change this policy in a way that affects you, we will say so on this page and, where the change is significant, tell you directly.