Privacy Statement Attractedtoblack

Version: 13 July 2026

Article 1. Introduction

Attractedtoblack respects the privacy of every visitor, customer, and user of its website and services.

We process personal data only when this is necessary to provide our products and services, perform agreements, improve our webshop, comply with legal obligations, and for marketing purposes, insofar as legally permitted.

In this privacy statement, we explain which personal data we collect, the purposes for which we process it, the legal basis on which this is done, how long we retain the data, with which parties we share it, and which rights you have.

We process personal data in accordance with the General Data Protection Regulation (GDPR), the Dutch GDPR Implementation Act (UAVG), the Telecommunications Act, Dutch tax legislation, and other applicable laws and regulations.

This privacy statement applies to all visitors to our website, customers, business customers, newsletter subscribers, SMS subscribers, and other persons whose personal data Attractedtoblack processes.

Article 2. Data controller

The data controller responsible for processing personal data is:

Attractedtoblack

Owner: Max Marsen
Business structure: Sole proprietorship
Registered address: Rozenlaan 88
Chamber of Commerce number: 76317064
VAT number: NL003073979B20
Email address: info@attractedtoblack.nl
Website: www.attractedtoblack.nl

Attractedtoblack determines which personal data are processed, the purposes for which they are used, and how the processing takes place.

Article 3. To whom does this privacy statement apply?

This privacy statement applies to all persons whose personal data Attractedtoblack processes, including but not limited to:

webshop visitors;
private customers;
business customers;
people who place an order;
people who request a quote;
people who contact customer service;
people who sign up for the newsletter;
people who sign up for SMS marketing;
people who participate in promotions or prize draws;
people who create an account;
people who respond to advertisements or social media posts.

Article 4. Which personal data do we process?

Depending on how you use our services, we may process the following personal data.

Identification details

first name;
last name;
date of birth, if necessary;
company name.

Contact details

email address;
telephone number;
address;
postal code;
city of residence;
country.

Business details

Chamber of Commerce number;
VAT number;
contact person;
billing information.

Order details

order number;
ordered products;
payment status;
shipping status;
return information;
warranty information;
complaints.

Payment data

Payments are made through secure payment providers. We do not receive full credit card details or comparable payment information.

Account data

When you create an account, we process, among other things:

email address;
encrypted password;
order history;
addresses;
preferences;
wish lists.

Customer service

When you contact us, we may process:

emails;
chat messages;
photos;
videos;
attachments;
correspondence;
order numbers.

Technical data

IP address;
browser type;
device data;
operating system;
cookie ID;
session data;
log files;
click behavior;
pages visited;
referring websites.

Marketing data

We may process, among other things:

advertising IDs;
campaign data;
interactions with advertisements;
purchase history;
preferences;
cart data;
abandoned carts.

Location data

We process location data only when consent has been given or when this is technically necessary, for example, for shipping options, language settings, or currency.

As a rule, we do not process special categories of personal data as referred to in Article 9 GDPR.

Article 5. Purposes of processing

We process personal data exclusively for the following purposes:

performing contracts;
processing orders;
providing products;
customer service;
returns;
warranty;
billing;
administration;
payments;
shipping;
quote requests;
account management;
fraud prevention;
security;
complying with legal obligations;
newsletters;
SMS marketing;
product updates;
abandoned carts;
personalized advertisements;
remarketing;
statistical analyses;
improving our online store;
optimizing marketing campaigns;
protecting our rights;
handling disputes;
collection of outstanding debts.

Article 6. Legal bases

We process personal data only when there is a legal basis for doing so, as referred to in Article 6 GDPR.

Performance of a contract (Article 6(1)(b) GDPR)

For:

orders;
payments;
shipping;
returns;
customer service;
quotes;
business orders.

Legal obligation (Article 6(1)(c) GDPR)

For, among other things:

tax records;
accounting;
statutory retention obligations;
fraud investigations;
legal information obligations.

Consent (Article 6(1)(a) GDPR)

For, among other things:

newsletters;
SMS marketing;
marketing cookies;
personalized advertisements;
location data;
certain forms of profiling.

Consent may be withdrawn at any time. This does not affect the lawfulness of processing carried out previously.

Legitimate interest (Article 6(1)(f) GDPR)

For, among other things:

security;
fraud prevention;
improving the online store;
direct marketing to existing customers;
legal protection;
evidence;
network security;
debt collection;
business operations.

Article 7. Shopify

Our online store is hosted by Shopify.

Shopify processes personal data on behalf of Attractedtoblack to make the online store available, process orders, manage carts, support payments, implement security measures, and enable analytics.

Shopify may process, among other things:

name;
address;
email address;
telephone number;
order data;
payment status;
IP address;
browser data;
device data;
cookie data;
cart information.

Shopify may process personal data within and outside the European Economic Area.

When personal data is processed outside the European Economic Area, Shopify ensures appropriate safeguards in accordance with Chapter V of the GDPR, including Standard Contractual Clauses (SCCs), adequacy decisions, or other legally permitted transfer mechanisms.

For certain processing activities, Shopify acts as an independent data controller. Shopify's privacy policy also applies to those processing activities.

Article 8. Orders and delivery

When you place an order, we process only the data necessary for:

order confirmation;
payment;
shipping;
delivery;
returns;
customer service;
warranty;
administration.

For this purpose, personal data may be shared with, among others:

Shopify;
payment providers;
carriers;
fulfilment partners;
IT service providers;
hosting providers;
accountants;
logistics partners.

For international shipments, personal data may also be provided to customs authorities and local carriers, insofar as necessary.

Article 9. Payments

Payments are processed by Shopify Payments and other payment methods available in our webshop.

Depending on the payment method selected, personal data may be shared with the relevant payment service provider.

This includes, among other things:

name;
billing address;
order amount;
payment method;
payment status;
transaction references;
fraud prevention data.

Attractedtoblack does not receive complete payment card details.

Article 10. Invoices, quotations, and business orders

For quotations, business orders, administration, and invoicing, we process only the data necessary for:

performance of the agreement;
administration;
accounting;
tax legislation;
payment;
delivery;
customer service.

Invoice data is retained for at least seven years in accordance with tax retention requirements.

Article 11. Customer service

When you contact us, we process only the information necessary to answer your question or handle your request.

This may include:

name;
email address;
telephone number;
order number;
photos;
videos;
correspondence;
attachments.

Communications may be retained for as long as necessary for customer service, evidentiary purposes, warranty claims, legal protection, or legal obligations.

Article 12. Accounts

When you create an account, we process, among other things:

name;
email address;
encrypted password;
addresses;
order history;
preferences;
wish lists.

You are responsible for keeping your login credentials confidential.

In cases of misuse, fraud, or violation of our terms, we may temporarily block or delete an account.

Article 13. Newsletters and email marketing

We may send emails regarding:

orders;
shipments;
service announcements;
product updates;
offers;
abandoned carts.

Commercial emails are sent only when consent has been given or when this is permitted by law.

Every marketing email includes an unsubscribe option.

After unsubscribing, we may still send necessary service emails relating to your order or legal obligations.

Article 14. SMS marketing

When you have expressly given your consent for this, we may send you SMS or MMS messages with information about our products, services, offers, and other commercial or service-related messages.

This consent may be obtained, among other things, through:

checkout in the online store;

a registration form on our website;

a separate opt-in;

other legally permitted methods.

SMS messages may relate, among other things, to:

offers;

product updates;

abandoned carts;

order statuses;

shipping information;

promotions;

reminders.

You can unsubscribe free of charge at any time by replying STOP to a received message or by contacting us at info@attractedtoblack.nl.

After unsubscribing, you will no longer receive commercial SMS messages. Messages necessary for the performance of an agreement, such as information about an order or delivery, may still be sent if necessary.

We are not liable for delays, disruptions, or the failure to deliver messages when these are caused by telecommunications providers, network problems, or other external parties beyond our control.

Article 15. Cookies and similar technologies

Our website uses cookies, pixels, scripts, and similar technologies. These technologies ensure that the online store functions properly, help us gain insight into website usage, and enable us to improve our services and marketing.

We use, among other things:

functional cookies;

analytical cookies;

marketing cookies;

tracking cookies;

pixels;

local storage.

We use, among other things:

Shopify Cookies;

Google Analytics;

Meta Pixel;

TikTok Pixel;

Klaviyo;

Google Tag Manager.

These technologies are used, among other things, for:

the functioning of the online store;

website security;

analyzing website usage;

conversion measurement;

remarketing;

personalizing the user experience;

advertising optimization;

improving marketing campaigns.

For all cookies and similar technologies that are not strictly necessary for the website to function, we request your prior consent via our cookie banner.

You can change or withdraw your consent at any time via the cookie banner or your browser settings.

Retention periods vary by cookie. Functional cookies are only retained for as long as necessary for the website to function. Analytical cookies are generally retained for a maximum of 26 months. Marketing cookies are generally retained for a maximum of 24 months, unless a shorter retention period applies. Session cookies are automatically deleted when you close the browser.

For a complete overview of the cookies used, their purposes, and the corresponding retention periods, please refer to the cookie overview available through our cookie banner.

Article 16. Location data

We only process location data when you have given your consent or when this is necessary for the proper functioning of the online store, for example to display the correct language, currency, shipping options, or delivery times.

You can withdraw your consent to the processing of location data at any time via your browser or device settings.

Article 17. Marketing, advertising, and social media

Attractedtoblack uses various marketing channels to show visitors and customers relevant information, offers, and advertisements.

For this purpose, we may use, among other things:

Google Analytics;

Google Tag Manager;

Meta Pixel;

TikTok Pixel;

Klaviyo;

Shopify Analytics;

Meta Ads;

TikTok Ads;

Google Ads;

email marketing;

SMS marketing.

These technologies may be used for:

analyzing website traffic;

measuring conversions;

remarketing;

personalized advertisements;

audience segmentation;

statistical analyses;

website optimization;

improving our services;

optimizing marketing campaigns.

Where legally required, we process personal data for these purposes only after consent has been given via our cookie banner.

Email marketing and SMS marketing are only sent when consent has been given or when permitted by law.

You can unsubscribe at any time via the unsubscribe link in an email, by replying STOP to an SMS, or by contacting us via info@attractedtoblack.nl.

Article 18. Sharing personal data with third parties

We never sell your personal data to third parties.

We only share personal data when this is necessary to perform our agreement, comply with a legal obligation, pursue a legitimate interest, or when you have given your consent.

Depending on the services provided, personal data may be shared with, among others:

Shopify;

Shopify Payments;

payment providers;

carriers;

fulfilment partners;

Meta;

TikTok;

Google;

Klaviyo;

IT service providers;

hosting providers;

email providers;

SMS providers;

accountants;

administrative service providers;

debt collection agencies;

legal advisers;

government agencies;

supervisory authorities;

law enforcement authorities when legally required to do so.

With parties that process personal data on our behalf, we enter into a data processing agreement where legally required or use other appropriate contractual arrangements in accordance with the GDPR.

Article 19. International transfers

Some of our service providers process personal data outside the European Economic Area.

When personal data is processed outside the European Economic Area, we ensure that this processing takes place in accordance with Chapter V of the General Data Protection Regulation (GDPR).

For this purpose, where necessary, we use, among other things:

Standard Contractual Clauses (SCCs);

adequacy decisions by the European Commission;

additional technical and organizational security measures;

other legally permitted transfer mechanisms.

This ensures an appropriate level of protection for your personal data.

Article 20. Retention periods

We do not retain personal data longer than necessary for the purposes for which it was collected, unless a longer retention period is legally required or permitted.

As a general rule, we apply the following retention periods:

Orders, invoices, records, and payment data

At least 7 years pursuant to tax legislation.

Quotes

A maximum of 2 years after the last correspondence, unless an agreement is concluded.

Account data

As long as the account is active. After termination, for a maximum of 2 years, unless a statutory retention obligation applies.

Newsletter data

Until you unsubscribe.

SMS marketing data

Until you unsubscribe or for as long as necessary to demonstrate consent and comply with legal obligations.

Customer service

For as long as necessary to process your request, warranty claim, provide evidence, or protect your legal rights.

Cookie data

According to the retention periods stated in the cookie banner and cookie overview.

Fraud investigations and legal case files

For as long as necessary to handle the relevant case file.

After the applicable retention period has expired, personal data will be deleted or anonymized, unless a legal obligation requires a longer retention period.

Article 21. Security

We take appropriate technical and organizational measures to protect personal data against loss, unauthorized access, alteration, disclosure, destruction, or any other form of unlawful processing.

These measures include, among other things:

secure SSL/TLS connections;

encrypted storage where appropriate;

access restrictions;

strong password protection;

two-factor authentication where appropriate and available;

logging;

monitoring;

periodic security updates;

secure servers;

limited access for employees and authorized service providers.

Despite all measures taken, no security method can guarantee complete security.

If a personal data security breach (data breach) occurs, we will act in accordance with the General Data Protection Regulation (GDPR). Where legally required, we will report a data breach to the Dutch Data Protection Authority and inform the data subjects when the breach is likely to result in a high risk to their rights and freedoms.

Article 22. Your rights

Under the General Data Protection Regulation (GDPR), you have the following rights:

the right of access;

the right to rectification;

the right to erasure;

the right to restriction of processing;

the right to data portability;

the right to object;

the right to withdraw consent;

the right to object to direct marketing;

the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you.

You can submit a request via info@attractedtoblack.nl.

We will generally respond within one month of receiving your request. If a request is particularly complex or multiple requests are submitted simultaneously, we may extend this period in accordance with the GDPR.

We may request additional information to verify your identity before fulfilling a request.

Article 23. Objection to direct marketing

You have the right to object at any time to the use of your personal data for direct marketing.

After receiving your objection, we will no longer process your personal data for that purpose.

You can unsubscribe:

via the unsubscribe link in our emails;

by replying STOP to an SMS;

by sending an email to info@attractedtoblack.nl.

Article 24. Complaints

If you believe that Attractedtoblack is not processing your personal data carefully, we ask you to contact us first so that we can work together to find an appropriate solution.

You also have the right to lodge a complaint with the competent supervisory authority.

For the Netherlands, this is:

Dutch Data Protection Authority

Website: https://autoriteitpersoonsgegevens.nl

When you live in another member state of the European Union, you can also lodge a complaint with the data protection authority in your country of residence or employment.

Article 25. Minors

Our online store and services are not aimed at persons under 16 years of age.

We do not knowingly collect personal data from minors without the consent of a parent or legal representative.

If it becomes apparent that we have unintentionally processed a minor's personal data without valid consent, we will delete this data as soon as possible, unless we are legally required to retain it.

Article 26. Automated decision-making and profiling

Attractedtoblack does not make decisions based solely on automated processing that produce legal effects concerning data subjects or similarly significantly affect them, as referred to in Article 22 GDPR.

However, we may use profiling for, among other things:

personalized advertisements;

product recommendations;

marketing segmentation;

statistical analyses;

fraud prevention;

website optimization.

Where legally required, this processing takes place solely on the basis of consent.

You have the right to object to profiling for direct marketing.

Article 27. Links to third-party websites

Our website may contain links to third-party websites, applications, or services.

This privacy statement applies exclusively to the Attractedtoblack website.

We are not responsible for the content, security, or privacy practices of third-party websites.

We always advise you to consult the privacy policy of the relevant party before providing personal data.

Article 28. Changes to this privacy statement

Attractedtoblack reserves the right to amend this privacy statement at any time.

The most recent version is always available via www.attractedtoblack.nl.

In the event of significant changes, we may inform visitors and customers via the website, by email, or through another appropriate communication method.

The date on which this document was last updated is shown at the top of this privacy statement.

Article 29. Contact

For questions about this privacy statement or the processing of your personal data, you can contact us via:

Attractedtoblack

Owner: Max Marsen

Business structure: Sole proprietorship

Registered address: Rozenlaan 88, 1424 CH De Kwakel, Netherlands

Chamber of Commerce number: 76317064

VAT number: NL003073979B20

Email address: info@attractedtoblack.nl

Website: www.attractedtoblack.nl

Attractedtoblack is the data controller as referred to in Article 4 of the General Data Protection Regulation (GDPR).

We handle requests relating to personal data in accordance with applicable privacy legislation and strive to process them carefully, transparently, and within the statutory time limits.