Privacy policy

Last updated: 2 October 2026

This privacy policy explains which personal data we process when you visit our online store or place an order, why we do so, how long we keep the data and what rights you have.

1. Who we are

NEFLYX B.V. is responsible for processing your personal data (the controller within the meaning of the General Data Protection Regulation, GDPR).

NEFLYX B.V.
Middelweg 2a
5253 CA Nieuwkuijk
The Netherlands
Chamber of Commerce no.: 81160445
Email: info@neflyx.nl

You can reach us at this email address with any privacy question.

2. What data we process and why

We only process the data needed for the purpose you give it to us for.

Orders and delivery

Data: name, delivery and billing address, email address, phone number (if you provide one), company name and VAT number (for business orders), the items ordered and the payment status.
Purpose: processing, charging, shipping and invoicing your order, handling returns and warranty claims, and keeping you informed about your order and shipment by email.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR). For invoices and our accounts: legal obligation (Art. 6(1)(c) GDPR).
Retention: 7 years, because of the statutory tax retention obligation.

Customer account

Data: name, email address, password (only stored encrypted), saved addresses, order history and NEFLYX Points.
Purpose: letting you sign in, check out faster, view your orders and returns, and collect points.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
Retention: for as long as you have an account. You can ask us to delete your account at any time; we then keep your order data only for as long as the tax retention obligation applies.

Did you have an account in our previous online store? Then we transferred your account and order history to this store, so you can keep signing in and return earlier orders.

Returns

Data: order number, email address, the items you return and the reason.
Purpose: handling your return and refund and creating a return label for you.
Legal basis: performance of the contract and the statutory rules on the right of withdrawal (Art. 6(1)(b) and (c) GDPR).
Retention: 7 years, like the order.

Data: email address and language.
Purpose: telling you about discounts and new collections.
Legal basis: consent (Art. 6(1)(a) GDPR). You can unsubscribe through the link in every newsletter.
Retention: until you unsubscribe.

"Back in stock" alerts

Data: email address, language and the item and size you choose.
Purpose: emailing you as soon as that size is available again.
Legal basis: consent (Art. 6(1)(a) GDPR): you request the alert yourself.
Retention: until you ask us to delete the request.

Contact form and email

Data: name, email address and the content of your message.
Purpose: answering your question. To protect the contact form against spam, Cloudflare Turnstile checks that the form is filled in by a person; this processes, among other things, your IP address and browser data.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR): answering your question and protecting our website against abuse.
Retention: for as long as needed to handle your question, and at most 2 years after that.

Cookies and advertising

Our store uses a few functional cookies and data stored in your browser that it needs to work: your shopping bag, your language choice, your sign-in session and your cookie choice (which we keep for 180 days). These do not require consent.

With your consent through the cookie notice, we use services of advertising partners to measure the effect of our advertising. Without your consent, no advertising cookies are placed and no advertising identifiers are read. Legal basis: consent (Art. 6(1)(a) GDPR). You can change your choice by deleting our website's cookies in your browser; the cookie notice will then appear again.

3. Who we share data with

We never sell your data. We only share it with parties we need to provide our service:

Stripe – processes your payment (card, iDEAL and Bancontact). We never receive your full card number.
GLS – delivers your parcel and receives your name, address, email address and phone number for that purpose, so GLS can keep you informed about the delivery.
MyParcel, with PostNL and bpost – creates return labels and handles the return shipment.
Postcode.eu – checks your postcode and house number when you enter an address.
European Commission (VIES) – checks the VAT number on a business order.
Cloudflare – protects the contact form against spam.
Advertising partners – measure the effect of our advertising, only with your consent.
Our hosting and email providers – for storing the online store and sending emails.

We have agreements with the parties that process data on our behalf about the security and confidentiality of your data. We also provide data to authorities where the law requires us to, such as the tax authorities.

4. Data outside the European Union

Some of these parties may process data outside the European Economic Area, for example in the United States. This only happens with appropriate safeguards, such as an adequacy decision of the European Commission (like the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.

5. Security

We protect your data with appropriate technical and organisational measures. Our website uses a secure connection (HTTPS), passwords are only stored encrypted, and only staff who need your data for their work have access to it.

6. Your rights

You have the right to:

access your data;
have incorrect data corrected;
have your data deleted, unless we are legally required to keep it;
have the processing restricted;
receive your data in a common format (data portability);
object to processing based on legitimate interest;
withdraw your consent at any time, without this making the processing before then unlawful.

Send your request to info@neflyx.nl. We respond within one month. To prevent misuse, we may ask you to verify your identity.

Not happy with how we handle your data? Let us know and we will look for a solution together. You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the supervisory authority in your own country.

7. Automated decision-making

We do not make decisions about you based solely on automated processing, such as profiling.

8. Changes

We may update this privacy policy, for example when our store changes. The latest version is always on this page.