Privacy Statement

The Scents of Amsterdam B.V., Reguliersbreestraat 35, 1017 CM Amsterdam, The Netherlands.

Chamber of Commerce (KvK) no. 86918087 — VAT no. NL864146280B01.

Contact: contact@thescentsofamsterdam.com.

This statement applies to www.thescentsofamsterdam.com and all related services operated by The Scents of Amsterdam B.V. The website itself is hosted on the Lovable platform (Cloudflare infrastructure, EU edge). The checkout, payment and order fulfilment flow is operated through Shopify; when you proceed to checkout, parts of your data are processed by Shopify as an independent processor under their own privacy terms.

Depending on how you use the maison, we may process:

• Order data — name, billing & shipping address, email, phone, order contents, order amount, payment status.
• Account / invitation data — email, invitation token, atelier session information when you redeem a key or invite.
• Communication data — the content of any email or contact-form message you send us.
• Technical data — IP address, device/browser type, referrer, pages visited, timestamps.
• Analytics & marketing data — pseudonymous identifiers and event data collected through Google Analytics 4, Google Tag Manager and Meta Pixel, only after you accept the corresponding cookies.

• Executing your order (creating, shipping, returning, refunding) — performance of a contract (Art. 6(1)(b)).
• Customer service & complaints — performance of a contract and our legitimate interest in handling your request (Art. 6(1)(b)/(f)).
• Fiscal and accounting obligations (invoices, VAT records) — compliance with a legal obligation (Art. 6(1)(c)).
• Atelier invitations & account management — performance of a contract and our legitimate interest in maintaining a curated maison (Art. 6(1)(b)/(f)).
• Analytics, advertising and remarketing via GA4, GTM and Meta Pixel — your consent (Art. 6(1)(a)), withdrawable at any time.
• Marketing email — your consent, or our legitimate interest where permitted under Art. 7 ePrivacy (existing-customer soft opt-in), always with an opt-out in every message.
• Security & fraud prevention — our legitimate interest in protecting the maison and its clients (Art. 6(1)(f)).

• Order, invoice and fiscal records: 7 years after the end of the financial year (Dutch fiscal retention obligation).
• Account / atelier session data: for as long as your account is active, plus 2 years.
• Customer-service correspondence: up to 2 years after the case is closed.
• Marketing consent and contact data: until you unsubscribe, plus 2 years for evidence of consent.
• Analytics data (GA4): up to 14 months (GA4 default).
• Server / security logs: up to 12 months.

We share data only with processors who help us run the maison, under data processing agreements where required:

• Shopify — checkout, payment processing and order fulfilment.
• Lovable / Cloudflare — website hosting and edge delivery.
• Lovable Cloud (Supabase, EU) — database for atelier invitations, session data and media management.
• Google Analytics 4 & Google Tag Manager — anonymised usage analytics (consent-based).
• Meta Pixel — advertising performance and remarketing (consent-based).
• Carriers (e.g. PostNL, DHL) — for shipping and delivery of your order.
• Tax advisors, accountants and authorities — where required by law.

Where a recipient is located outside the EEA (e.g. Shopify, Google, Meta in the United States), transfers are based on the European Commission's Standard Contractual Clauses and, where applicable, supplementary safeguards.

Cookies and similar technologies for analytics (GA4, GTM) and advertising (Meta Pixel) are placed only after you give consent via our cookie banner. Strictly necessary cookies (session, checkout, security) are always set. You can change or withdraw your consent at any time via the "Change preferences" button on our Cookie Statement.

Under the GDPR you have the right to:

• access your personal data;
• rectify inaccurate data;
• erase your data ("right to be forgotten");
• restrict or object to processing;
• data portability;
• withdraw consent at any time, without affecting prior processing.

To exercise these rights, contact us at contact@thescentsofamsterdam.com. We will respond within one month.

We apply appropriate technical and organisational measures to protect your personal data: TLS encryption in transit, access controls, the principle of least privilege, and EU-based hosting for our database. No method of transmission over the internet is, however, fully secure.

If you believe your data is processed unlawfully, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

We may update this Privacy Statement from time to time. Material changes will be announced on this page; the "Last updated" date above always reflects the current version.