Privacy policy

1. Who are we?

NOVACRYNE is a trade name of Finco (trade name still to be registered with the Chamber of Commerce (KvK)), registered with the Dutch Chamber of Commerce under number 77251954, with its registered address at Pfinztalstraat 34, 4143 JB Leerdam, the Netherlands. VAT number: NL223505407B01.

Finco is the controller of the personal data we process through this website and (later) the webshop. In this notice, "we", "us" and "our" mean: Finco, trading as NOVACRYNE.

Questions about privacy or your data? Email [privacy@...]. We have not appointed a data protection officer (DPO); we are not required to do so.

2. Who does this notice apply to?

To everyone who visits our website or signs up for the waiting list and, once the webshop opens, to customers, newsletter subscribers and anyone who contacts us.

3. What data do we process, for what purpose and on what legal basis?

3.1 Waiting list (applies now)

On our website you can sign up for the waiting list, for NOVACRYNE in general or for a product that is coming soon ("Let me know").

• Data: your email address; the product or product line you are interested in (if you choose one); the date and time of your sign-up and of your confirmation; the consent text you saw at that moment. We do not ask for your name.
• Purpose: to send you emails ([frequency to follow]) about the launch of the NOVACRYNE perfumes or of the product you signed up for, and about when you can order, with the information that goes with the launch (such as the date from which you can order). And to be able to show that you gave your consent.
• Legal basis: your consent (Art. 6(1)(a) GDPR). You give it by ticking the box (it is not pre-ticked) and then confirming your sign-up via the link in our confirmation email (double opt-in). We record your consent on the basis of our legal obligation to be able to demonstrate consent (Art. 7(1) GDPR).
• Withdrawing consent: you can do this at any time, using the unsubscribe link in every email or via [privacy@...]. Withdrawing does not affect processing before that.
• Not: we do not use your waiting-list sign-up for an ongoing newsletter, unless you give separate consent for that (see 3.4).

3.2 Orders and payments [Phase 2 – applies once the webshop goes live]

• Data: name, delivery address, billing address (if different), email address, phone number (if you provide it or if the carrier needs it), order details (products, amounts, date, order number), payment details (payment method, payment status, transaction reference; we do not see your full card or bank details – the payment service processes those), any gift card message, return and exchange details, and (if you create an account) your account details and order history.
• Purposes: to process, take payment for, ship and deliver your order; to keep you informed about your order; to handle returns, withdrawal and guarantee claims; to keep track of credit (such as the credit with a discovery set); to prevent fraud and misuse in payments.
• Legal bases: performance of the sales contract (Art. 6(1)(b) GDPR); legal obligation (point (c)) for the tax records; legitimate interest (point (f)) for fraud prevention and securing payments.

3.3 Customer service and contact [Phase 2 – applies once the webshop goes live]

• Data: your name, email address, the content of your message and, if applicable, your order number and attachments.
• Purpose: to answer and handle your question, complaint or request.
• Legal basis: performance of the contract if your question is about an order (point (b)); otherwise our legitimate interest in answering messages properly (point (f)).

3.4 Newsletter [Phase 2 – applies once the webshop goes live]

• Data: email address, first name (optional), date of sign-up and consent, and whether you open our newsletters and click on links (only if you choose this in the cookie or newsletter settings – [to be decided]).
• Purpose: to keep you informed about new fragrances, promotions and stories from the atelier.
• Legal basis: your consent (point (a)). For existing customers, within the limits of Art. 11.7 of the Dutch Telecommunications Act, we may send emails about similar products of our own on the basis of legitimate interest (point (f)), with an unsubscribe link in every email. [to be decided whether we use this]

3.5 Website visits, cookies, analytics and advertising [Phase 2 – applies once the webshop goes live]

• Data: technical data such as IP address (shortened where possible), browser and device data, pages visited, click behaviour, referring website, and cookie and advertising IDs.
• Purposes: to make the website work technically (functional cookies, basket, security); with your consent, to measure use of the website via Google Analytics 4, and to measure the effectiveness of ads and show ads via Google Ads.
• Legal bases: for functional cookies, our legitimate interest (point (f)) and the exemption in Art. 11.7a of the Dutch Telecommunications Act; for analytics and advertising cookies, your consent (point (a)), which you give or refuse via our cookie banner. We use Google Consent Mode v2: as long as you do not give consent, Google Analytics and Google Ads do not place analytics or advertising cookies. You can change your choice at any time via [link "Cookie settings" in the footer].
• More information is in our cookie policy [separate policy, still to be drafted].

3.6 Administration and legal obligations [Phase 2 – applies once the webshop goes live]

• Data: invoice and order details and payment details.
• Purpose: to comply with the statutory tax record-keeping obligation and other legal obligations, and to handle any disputes.
• Legal basis: legal obligation (point (c); including Art. 52 of the Dutch General State Taxes Act); for disputes, our legitimate interest (point (f)).

4. How long do we keep your data?

We do not keep your data longer than necessary. Proposed periods [for review]:

5. Who do we share your data with?

We do not sell your data. We only share it with parties we need for the purposes above. We conclude a data processing agreement with our processors.

Phase 1 (now):

• [Email service/platform for the waiting list – still to be chosen]: storage of the waiting list and sending of the confirmation and launch emails (processor).
• Website hosting [Lovable or another hosting provider – still to be confirmed] (processor).

[Phase 2 – applies once the webshop goes live]:

• Shopify – webshop platform and backend: orders, customer data, payments (Shopify Payments) (processor; partly an independent controller for payments – still to be verified).
• Lovable – building and hosting the storefront (processor).
• Shopify Payments and the payment services behind it, and PayPal – handling payments, including iDEAL. These parties are themselves responsible for part of the processing (for example for fraud checks and the legal obligations of payment services); their own privacy notice then applies.
• [carrier to follow, Patron's choice] – shipping and delivery; receives your name, delivery address and, where needed, your email address and phone number for track and trace.
• Google (Google Analytics 4, Google Ads) – analytics and advertising, only with your consent.
• [Email service for newsletter and customer service email – still to be chosen] (processor).
• [Accountant/accounting software – still to be decided] – for the accounts.
• Government authorities, such as the Dutch Tax and Customs Administration, if the law requires us to.

6. Data outside the European Economic Area (EEA)

Some partners are (also) established outside the EEA or use sub-processors outside it, in particular in the United States. This applies in any case to Shopify, Google and Lovable, and possibly to PayPal and the email service. If your data ends up outside the EEA, we ensure an appropriate level of protection through:

• the European Commission's adequacy decision for the EU-US Data Privacy Framework (if the party concerned is certified under it); or
• the European Commission's standard contractual clauses (SCCs), with additional measures where necessary.

[Still to be verified per processor: contracting entity (EU or US), DPF certification, SCCs and location of data storage.] You can request a copy of the safeguards via [privacy@...].

7. Your rights

You have the following rights regarding your personal data:

• Access: to know what data we hold about you.
• Rectification: to have incorrect data corrected.
• Erasure: to have your data deleted, unless we have to keep it (for example because of the statutory tax record-keeping obligation).
• Restriction: to have the processing temporarily stopped.
• Data portability: to receive your data in a commonly used format or have it sent on, if we process it on the basis of consent or a contract.
• Objection: to object to processing based on legitimate interest. You can always object to use for direct marketing; we will then stop immediately.
• Withdrawing consent: at any time, for the waiting list, the newsletter and cookies. This does not affect processing before that.

Send your request to [privacy@...]. We respond within one month; for a complex request this may be extended by two months, and we will let you know if so. To prevent misuse, we may ask you to show that the request comes from you; we never ask for a copy of your identity document if that is not necessary.

8. Making a complaint

Not happy with how we handle your data? Please let us know first via [privacy@...], and we will look for a solution together. You also always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) (www.autoriteitpersoonsgegevens.nl).

9. Security

We take appropriate technical and organisational measures to protect your data against loss and unauthorised use, such as an encrypted connection (https/TLS), access to data only for those who need it, strong passwords and two-step verification on our accounts, and agreements with our processors. Payments go through certified payment services; we do not store full card or bank details. If we discover a data breach, we act in accordance with the law, including notifying the Dutch Data Protection Authority and, where necessary, you.

10. No automated decision-making

We do not take decisions about you based solely on automated processing, including profiling, that have legal effects or similarly significant effects on you. [Phase 2: automated fraud checks by payment services fall under their own responsibility – still to be verified.]

11. Children

Our website and webshop are not intended for children under 16. We do not knowingly process data of children under 16. Are you under 16? Then do not sign up without the consent of your parent or guardian. If we discover that we have nevertheless received data of a child under 16 without that consent, we will delete it.

12. Changes

We may update this privacy notice, for example when the webshop opens or when we start using a new service. The latest version is always on this page. If there are important changes, we will let you know, for example by email if you are on the waiting list.

Version: [version number] · last updated: [date of publication] (draft 0.1 of 2 November 2026)