Privacy policy

Last updated: 17 September 2026

This Privacy Policy states exactly which personal data Sunves collects, why we collect it, who receives it, how long we keep it and which rights you have. It applies to every visit to sunves.com and to every order placed there.

1. Who is responsible for your data

The controller of your personal data is Sunves, a sole proprietorship established in the Netherlands, Netwerklaan 115, 3821 AC Amersfoort, the Netherlands. All privacy questions and requests go to help@sunves.com.

2. The personal data we collect

We collect the data listed below and no other data.

When you visit the website, the following is recorded automatically:

  • your IP address and the country and city derived from it;
  • your browser type and version, operating system, device type and language setting;
  • your time zone;
  • the website that referred you to sunves.com;
  • the pages and products you view, the date and time of each view, and the search terms you enter in our site search;
  • the products you add to or remove from your cart;
  • the currency and country you select;
  • the identifiers stored in the cookies described in section 7.

When you place an order, or begin checkout and enter your details, we collect:

  • your first and last name;
  • your email address;
  • your phone number;
  • your shipping address and billing address;
  • the products ordered, the price paid, the discount code used and the shipping option chosen;
  • the payment method used, the card brand and the last four digits of the card number;
  • the IP address from which the order was placed;
  • whether you ticked the box to receive marketing emails.

We never receive or store your full card number, its expiry date or its security code. Those are processed only by the payment provider named in section 4.

When you create a customer account, which is optional, we store your name, email address, saved addresses and order history.

When you subscribe to our emails through the welcome pop-up, the footer form or the checkout box, we collect:

  • your email address;
  • the date, time and form through which you subscribed;
  • whether each email we send you was delivered, opened and clicked;
  • the pages and products you view on sunves.com after you have subscribed, linked to your email address.

When you email us, we keep your name, your email address, the content of your message, the attachments you send and your order number.

When you use the Track Your Order page, the order number, email address or tracking number you enter is processed to show you the status of your parcel.

The welcome pop-up stores one entry in the local storage of your browser that records whether you closed the pop-up or subscribed. This entry stays on your device and is not sent to us.

We do not collect special categories of personal data, and we do not buy personal data from third parties.

3. Why we use your data and on which legal basis

  • To accept, process, ship and deliver your order, to send order and shipping confirmations, and to handle returns, refunds and complaints. Legal basis: performance of the contract with you.
  • To answer your emails. Legal basis: performance of the contract, or our legitimate interest in answering questions from visitors.
  • To keep invoices and order records for the Dutch tax authorities. Legal basis: legal obligation.
  • To detect and prevent fraud, payment abuse and chargebacks, and to establish, exercise or defend legal claims. Legal basis: our legitimate interest in protecting our business.
  • To keep the website secure, to show it correctly on your device and to remember your cart, currency and country. Legal basis: our legitimate interest in operating a working webshop.
  • To measure how the website is used and to improve it. Legal basis: your consent through the cookie banner where the law requires consent, and our legitimate interest in all other cases.
  • To send you marketing emails and to tailor them to the products you viewed. Legal basis: your consent. You withdraw consent at any moment through the unsubscribe link in every email or by emailing us.

We do not use your data for any other purpose. We do not make decisions about you that are based solely on automated processing and that have legal effects for you. Shopify's fraud analysis gives each order a risk indication; a person at Sunves decides what happens with the order.

4. Who receives your data

We do not sell your personal data. We share it only with the recipients listed here, and only for the stated purpose.

  • Shopify International Limited (Ireland) and its group companies. Shopify hosts our webshop, runs the checkout, processes payments through Shopify Payments and Shop Pay, performs the fraud analysis, stores our customer and order records, shows the cookie banner and sends our order emails. Shopify's privacy policy: https://www.shopify.com/legal/privacy.
  • PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), only when you pay with PayPal. PayPal receives your name, email address, addresses and the order amount.
  • Klarna Bank AB (Sweden), only when you pay with Klarna. Klarna receives your name, email address, phone number, addresses and the order contents and amount, and carries out its own credit assessment under its own privacy policy.
  • BuckyDrop, our fulfilment partner in China, which packs and dispatches your order. BuckyDrop receives your name, shipping address, phone number and the products ordered.
  • The parcel carriers that transport and deliver your order. The carrier named in your shipping confirmation receives your name, shipping address, phone number and email address to deliver the parcel and to send delivery notifications.
  • Klaviyo, Inc. (United States), which stores our email subscriber list and sends our marketing emails. Klaviyo receives the data listed under email subscription in section 2, and the name and order history of subscribers who have ordered.
  • CWILL Inc. (Parcel Panel), which runs the Track Your Order page. It receives your order number, email address, shipping address, tracking number and the products in the shipment.
  • Our accountant and the Dutch tax authorities, who receive invoices and order records where the law requires it.
  • Courts, police and other public authorities, only when we are legally obliged to hand over data, and our legal advisers when we have to defend a legal claim.

5. Transfers outside the European Economic Area

Your delivery details are sent to our fulfilment partner and carriers in China. This transfer is necessary to perform the contract with you, because your order is dispatched from there. It is limited to the data listed for BuckyDrop and the carriers in section 4.

Shopify, Klaviyo and CWILL process data in the United States and Canada. These transfers take place under the EU–US Data Privacy Framework, an adequacy decision of the European Commission, or the European Commission's Standard Contractual Clauses.

6. How long we keep your data

  • Order, invoice and payment records: 7 years after the end of the year in which you ordered, as required by Dutch tax law.
  • Customer account: until you ask us to delete it. Order records inside the account follow the 7-year period above.
  • Details entered in a checkout that was not completed: 3 months.
  • Emails between you and our customer service: 2 years after the last message, or until a dispute has been fully resolved if that is later.
  • Email subscription data: until you unsubscribe. After that we keep only your email address on a suppression list so that we do not email you again.
  • Website usage data: 26 months at most.

After these periods the data is deleted or made anonymous.

7. Cookies

sunves.com uses three categories of cookies:

  • Necessary cookies, placed by Shopify. They keep your cart, your currency and country, your login and your cookie choice, and they secure the checkout. The website does not work without them, so they are always active.
  • Analytics cookies, placed by Shopify. They measure visits, pages viewed and the path to an order.
  • Marketing cookies, placed by Klaviyo and by Shopify. They link the products you view to your email subscription and measure the result of our emails.

Visitors from the European Economic Area, the United Kingdom and Switzerland see a cookie banner on their first visit. Analytics and marketing cookies are placed only after you accept them in that banner. You change or withdraw your choice at any moment through the cookie preferences link on the website, and you delete cookies through your browser settings. Shopify publishes the name, purpose and lifetime of every cookie it places at https://www.shopify.com/legal/cookies.

Residents of US states with an opt-out right use the Your Privacy Choices page.

8. Your rights

Under the General Data Protection Regulation you have the right to:

  • access the personal data we hold about you;
  • have incorrect data corrected;
  • have your data erased;
  • have the processing of your data restricted;
  • receive the data you gave us in a machine-readable format;
  • object to processing that is based on our legitimate interest;
  • withdraw a consent you gave, without effect on processing that took place before the withdrawal.

To use a right, email help@sunves.com from the email address you used for your order or subscription, and state which right you want to use. We verify your identity before we act, and we answer within one month. We refuse or charge a reasonable fee for requests that are manifestly unfounded or excessive, as the law allows.

The right to erasure does not cover data we are legally required to keep. Order and invoice records therefore stay stored for the 7-year tax period, and data needed for a pending dispute or chargeback stays stored until it is resolved.

You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with the authority in your own country.

9. Minors

sunves.com is not directed at persons under 16. We do not knowingly collect their data. A parent or guardian who finds that a child has given us data emails us, and we delete it.

10. Security

All traffic to sunves.com is encrypted with TLS. Payments run through Shopify's PCI DSS Level 1 certified checkout. Access to our Shopify, Klaviyo and email accounts is limited to Sunves staff and protected with two-step verification.

11. Changes to this policy

We update this policy when our processing changes, which is the case when we start working with a new service provider. The date at the top shows the latest version, and the version published on this page at the time of your visit or order applies.