1. Introduction & Data Controller
This Privacy Policy describes how Chroxxenavorbao.world (“we”, “us”, “our”) collects, uses, discloses, and protects your personal data when you visit our website, place orders for Orvella, or interact with our services. We are committed to transparency and compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
Data Controller: Chroxxenavorbao.world, Stationsplein 80, 3511 ED Utrecht, Netherlands. Email: admin@chroxxenavorbao.world.
2. Purposes of Data Processing
We process your personal data for the following purposes:
- Processing and fulfilling orders for Orvella and related products
- Communicating with you about your orders, deliveries, and customer service inquiries
- Improving our website, products, and user experience
- Complying with legal, tax, and regulatory obligations
- Preventing fraud and ensuring security of our systems
- With your explicit consent: analytics to understand how visitors use our site
- With your explicit consent: marketing communications and personalised advertising
We will not use your data for purposes incompatible with those stated above without obtaining your consent.
3. Legal Basis Under GDPR
We process your personal data only where we have a lawful basis:
- Contract performance: Processing orders you place with us, including payment and delivery
- Legitimate interests: Improving our services, ensuring security, preventing fraud, and managing our business operations
- Consent: Analytics and marketing cookies; you may withdraw consent at any time
- Legal obligation: Tax, accounting, and regulatory requirements (e.g., retention of transaction records)
Where we rely on legitimate interests, we have conducted a balancing test and ensure your rights are not overridden.
4. Types of Data Collected
We may collect the following categories of personal data:
- Identity data: Name, title
- Contact data: Email address, postal address, telephone number
- Transaction data: Order history, payment details (processed securely by our payment provider)
- Technical data: IP address, browser type, device information
- Usage data: How you use our website (with your consent for analytics)
- Cookie data: As described in our Cookie Policy
We do not collect special categories of personal data (e.g. health data) unless you voluntarily provide it in a message, in which case we process it only with your consent and for the purpose you specify.
5. Retention Periods
We retain your data only for as long as necessary to fulfil the purposes for which it was collected:
- Order and transaction data: Up to 7 years for legal, tax, and accounting requirements
- Customer inquiries and support: Up to 2 years from the last contact
- Marketing consent: Until you withdraw consent
- Analytics data: Up to 26 months, or as specified in our Cookie Policy
- Logs and security data: Up to 12 months
After the retention period expires, we securely delete or anonymise your data.
6. Your Rights Under GDPR
You have the following rights in relation to your personal data:
- Right of access: Request a copy of the personal data we hold about you
- Right to rectification: Request correction of inaccurate or incomplete data
- Right to erasure: Request deletion of your data (subject to legal retention requirements)
- Right to restriction: Request that we limit how we process your data in certain circumstances
- Right to data portability: Receive your data in a structured, machine-readable format
- Right to object: Object to processing based on legitimate interests or for direct marketing
- Right to withdraw consent: Withdraw consent at any time where processing is based on consent
- Right to lodge a complaint: Lodge a complaint with a supervisory authority (e.g. the Dutch Autoriteit Persoonsgegevens)
To exercise any of these rights, please contact us at admin@chroxxenavorbao.world. We will respond within one month.
7. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:
- Encryption of data in transit (HTTPS/TLS)
- Access controls and authentication
- Regular security assessments
- Staff training on data protection
We do not sell your personal data to third parties. In the event of a data breach that poses a risk to your rights, we will notify the supervisory authority and, where required, you.
8. Third-Party Sharing & Transfers
We may share your data with trusted third parties who assist us in operating our business, such as:
- Payment processors (for secure payment handling)
- Shipping and logistics partners (for order fulfillment)
- Analytics providers (with your consent)
- IT and hosting providers
All such sharing is governed by data processing agreements. We do not transfer your data outside the European Economic Area (EEA) without adequate safeguards (e.g. Standard Contractual Clauses) as required by GDPR.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email (where we have your contact details) or through a prominent notice on our website. The updated version will be effective upon posting. We encourage you to review this policy periodically.
10. Contact Us
For any privacy-related questions or to exercise your rights, please contact us:
Email: admin@chroxxenavorbao.world
Address: Chroxxenavorbao.world, Stationsplein 80, 3511 ED Utrecht, Netherlands.