Privacy policy

Order data. Name, email address, phone number, delivery address, company name if given, the products ordered, the payment method, payment reference and order history. Purpose: to fulfil the contract, ship your order, match your payment and handle complaints and returns. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and legal obligations such as tax record-keeping (Art. 6(1)(c)).

Payment data. We never see card details because we do not take cards. For bank transfer we see the name and IBAN your bank sends us. For cryptocurrency we see the sending wallet address and transaction hash on a public blockchain. Legal basis: contract.

Account-free tracking. There are no customer accounts. To look up an order you enter its number and the email address used. Nothing is stored beyond the order itself.

Email list. If you give us your email for a discount code we store the address, the code issued, whether you used it, the language you were browsing in, the strain you told us you were interested in, and where you came from (referrer and campaign tags). Legal basis: consent (Art. 6(1)(a)). Marketing emails are sent only if you ticked the box; you can unsubscribe with one click in every email or by writing to info@prozyum.com.

Cookie consent log. Each time a visitor makes a choice in the cookie banner we record the choice, the time, the policy version, the language, device type, screen size, time zone, referring site and landing page. Purpose: to prove that consent was given and to honour it. Legal basis: legal obligation (Art. 7(1) GDPR) and legitimate interest.

Analytics and personalisation. Only with your consent. Page views, products viewed, items added to the cart, checkout starts and purchases, tied to a random session identifier, the landing-page variant you were shown, device type, country and the referring site or campaign. We use this to see which pages convert and to show you the strains you looked at before. Legal basis: consent (Art. 6(1)(a) GDPR, Art. 11.7a Dutch Telecommunications Act). Without consent we record only purchases and the consent decision itself.

Server logs. Our hosting provider logs IP address, time, URL and user agent for security and to keep the site running. Retained 30 days. Legal basis: legitimate interest.

Carriers (PostNL, DHL, DPD) receive name, address, phone number and email for delivery. Our hosting provider stores the database and backups within the EU. Our email provider sends order and marketing emails. Our accountant receives invoice data. Public authorities receive data only when we are legally required to hand it over. We do not sell personal data and we do not use third-party advertising networks.

Data is stored in the EU. If a provider processes data outside the EU we rely on the EU Standard Contractual Clauses. Cryptocurrency transactions are by nature recorded on a public, global ledger.

Order and invoice data: 7 years, as required by Dutch tax law. Email list: until you unsubscribe, then 30 days. Cookie consent log: 2 years. Analytics events: 26 months. Server logs: 30 days. Customer notes in our CRM: for as long as you remain a customer plus 2 years.

You may ask for access to your data, correction, erasure, restriction, a copy in a portable format, and you may object to processing based on legitimate interest. Where processing is based on consent you may withdraw it at any time; this does not affect processing before withdrawal. Write to info@prozyum.com. We answer within one month.

You have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority in your own EU country.

The site is served over HTTPS. The database is stored on encrypted disks with daily backups. Access to the order system is limited to staff who need it, behind a password and time-limited sessions. We never send you passwords because there are none.

This shop is for adults. We do not knowingly process data of anyone under 18. If you believe a minor has ordered, contact info@prozyum.com and we will delete the data.

We update this policy when our processing changes. The date above tells you the current version. Material changes to cookie use trigger a new consent request.