Legal
Privacy Policy
Last updated: [DATE]
This Privacy Policy explains how [LEGAL BUSINESS NAME, e.g. "Little Shine (trade name of [Full Name], sole proprietor)"] ("Little Shine", "we", "us") collects, uses and protects personal data when you visit littleshine.nl, use our online shop, or book our home ear-piercing service. We process personal data in accordance with the General Data Protection Regulation (GDPR / AVG).
1. Who we are
Little Shine
Trading as: Little Shine NL
Registered address: [STREET + HOUSE NUMBER], 3645AR Vinkeveen, Netherlands
Chamber of Commerce (KvK) number: [KVK NUMBER]
VAT/BTW number: [VAT NUMBER]
Email: hello@littleshine.nl
Phone / WhatsApp: +31 6 57301956
We are the data controller for the personal data described in this policy.
2. What personal data we collect
2.1 Contact form
When you use the contact form we collect the name, email address, optional phone number and message you provide, so we can reply to your enquiry or booking request.
2.2 Shop orders
Our online shop is powered by Shopify. When you place an order, Shopify collects your name, delivery and billing address, email address and payment details on our behalf, in order to process, ship and invoice your order. We can see your order details inside our Shopify admin, but we never see or store your full payment card details — these are handled directly by Shopify and its payment providers.
2.3 Home service bookings
Bookings for the home ear-piercing service are currently made via WhatsApp, email or the contact form. To plan and carry out an appointment safely, we collect the parent/guardian's name, contact details, home address, and information about the child (such as age) that is relevant to performing the piercing safely and providing correct aftercare advice. This data is provided to us by the parent or legal guardian, never collected directly from the child.
2.4 Shopping cart
To remember your shopping bag between pages, we store a single cart reference ID in your browser's local storage (not a personal identifier by itself). The cart contents themselves are stored by Shopify under that reference.
2.5 Technical data
Like most websites, our server and hosting provider may automatically log technical data such as IP address, browser type and request timestamps, for security and troubleshooting purposes.
3. Why we process your data, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Answering enquiries submitted via the contact form | Legitimate interest / pre-contractual steps |
| Processing and delivering shop orders | Performance of a contract |
| Planning, performing and following up on home service appointments | Performance of a contract |
| Keeping records for bookkeeping and tax purposes | Legal obligation |
| Keeping our website secure and functioning | Legitimate interest |
4. Sharing your data with third parties
We only share personal data with third parties where necessary to provide our services:
- Shopify Inc. — our e-commerce and checkout platform; processes order, delivery and payment data. See Shopify's Privacy Policy.
- Payment providers connected to our Shopify checkout (e.g. iDEAL, credit card providers) — process payment details directly; we never see full card numbers.
- WhatsApp / Meta Platforms Ireland Ltd. — if you contact us via WhatsApp, your messages are subject to WhatsApp's Privacy Policy.
- Google Fonts — our website loads fonts from Google's servers, which may process your IP address as part of that request.
- Hosting provider — [HOSTING PROVIDER NAME], which stores the website and technical logs on our behalf.
We do not sell personal data to third parties, and we do not use your data for automated decision-making or profiling.
5. International data transfers
Some of the providers listed above (such as Shopify and Google) may process data outside the European Economic Area. Where this happens, they do so under appropriate safeguards such as the European Commission's Standard Contractual Clauses.
6. How long we keep your data
- Contact form enquiries that don't lead to a booking: deleted after [e.g. 12 months].
- Order and booking records: kept for as long as required by Dutch tax law (currently 7 years for financial administration).
- Appointment/aftercare notes: kept for [retention period] to allow follow-up in case of complications, then deleted.
7. Data security
We take appropriate technical and organisational measures to protect your personal data against loss or unlawful processing, including using reputable, security-audited third-party platforms (Shopify) for payment and order handling rather than storing sensitive data ourselves.
8. Your rights
Under the GDPR/AVG, you have the right to:
- Access the personal data we hold about you;
- Correct inaccurate data;
- Request deletion of your data;
- Restrict or object to processing;
- Data portability;
- Withdraw consent at any time, where processing is based on consent.
To exercise any of these rights, email us at hello@littleshine.nl. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
9. Cookies
Our website uses limited functional storage — see our Cookie Policy for details.
10. Changes to this policy
We may update this Privacy Policy from time to time. The "last updated" date at the top of this page reflects the most recent revision.
11. Contact
Questions about this policy? Email hello@littleshine.nl.