Privacy policy

Privacy Policy

Norella · www.norella.eu · Info@norella.eu · Last updated: October 19, 2026

At Norella, we consider your privacy important. In this policy, we explain which personal data we process when you visit our online store or place an order with us, why we do so, how long we retain it, and what rights you have.

1. Who Are We?

Norella is the data controller responsible for the processing of your personal data.

2. What Data Do We Process, and Why?

We only process data that we genuinely need. These are the purposes, the data, the legal basis, and the retention period.

Purpose Data Legal basis Retention period
Processing, shipping, and delivering your order Name, address, email address, telephone number, ordered items, order number Performance of the contract Until the order has been completed, then see accounting records
Processing payments Payment method, payment status, and transaction number (your full card or bank details are processed only by our payment provider) Performance of the contract See accounting records
Returns, refunds, and customer service Contact details, order details, contents of your messages, any photographs Performance of the contract and our legitimate interest in assisting you properly 2 years after resolution
Accounting and taxes Invoice and order details Legal obligation 7 years
Creating and managing a customer account [if you offer accounts] Name, email address, password (encrypted), address details, order history Performance of the contract Until you delete your account
Sending newsletters and offers Name, email address, behavior in our emails (such as opens and clicks) Consent Until you unsubscribe
Analyzing and improving website visits IP address, device and browser information, pages visited Consent (via the cookie banner) 14 months
Displaying targeted advertisements if you use advertising pixels Cookie IDs, pages and products visited Consent (via the cookie banner) According to the provider's settings; see the cookie policy
Preventing fraud and securing our online store IP address, order and payment details Our legitimate interest 12 months
Complying with legal obligations and defending our rights Data necessary for these purposes Legal obligation or our legitimate interest As long as necessary

If you do not provide the data necessary for your order, such as your name and delivery address, we cannot process your order. All other data is optional.

3. With Whom Do We Share Your Data?

We never sell your data. We only share it with parties that need it to make your order or our online store work. Where necessary, we have agreements with these parties regarding the secure handling of your data (a data processing agreement).

  • Online store platform: Shopify for hosting our online store and processing orders.

  • Payment service providers: Mastercard / Visa / Apple Pay / iDEAL / PayPal for processing payments.

  • Carriers: PostNL / DHL / DPD for delivering your package.

  • Email software: Shopify Email for order confirmations and newsletters.

  • Accountant and accounting software: [name] for our administration.

  • Government authorities and regulators: if we are legally required to do so.

4. Transfers Outside the European Union

Some of the parties mentioned above may process data outside the European Economic Area, for example, in the United States. We only do this when appropriate safeguards are in place, such as an adequacy decision by the European Commission or European Standard Contractual Clauses.

5. Cookies and Similar Technologies

Our online store uses cookies. Functional cookies, for example, for your shopping cart and checkout page, are necessary for the online store to function. For analytics and marketing cookies, we first ask for your consent via the cookie banner. You can change your choice at any time. You can read which cookies we use and how long they are retained in our cookie policy.

6. Automated Decision-Making

We do not make decisions affecting you solely on the basis of automated processing, such as profiling.

7. How Do We Protect Your Data?

We take appropriate technical and organizational measures to protect your data, such as a secure (SSL/TLS) connection, restricted access to data, and carefully selected suppliers. Your payment details are processed by our payment service provider and are not stored by us. If you discover misuse or believe that your data is not properly secured, please contact us at Info@norella.eu.

8. Your Rights

You have the following rights:

  • Access: you can request information about which data we hold about you.

  • Rectification: you can have incorrect or incomplete data corrected.

  • Erasure: you can request that your data be deleted, unless we are legally required to retain it (such as for tax retention obligations).

  • Restriction: you can request that processing be temporarily restricted.

  • Objection: you can object to processing that we base on our legitimate interest.

  • Data portability: you can request to receive your data in a commonly used format or have it transferred to another party.

  • Withdrawal of consent: if you have given us consent, for example, for our newsletter or cookies, you can withdraw it at any time. This does not affect processing that has already taken place. You can unsubscribe from our newsletter using the link at the bottom of each email.

Would you like to exercise any of these rights? Email us at Info@norella.eu. We will respond within one month. To prevent misuse, we may ask you to verify your identity.

9. Filing a Complaint

Do you have a complaint about how we handle your data? Please contact us first so that we can work together to find a solution. You also have the right to file a complaint with the supervisory authority. In the Netherlands, this is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) (www.autoriteitpersoonsgegevens.nl). If you live or work in another EU country, you can also contact the supervisory authority in your country.

10. Children

Our online store is not intended for children under the age of 13. We do not knowingly collect personal data from children. If you believe that a child has provided us with data, please contact us so that we can delete that data.

11. Changes

We may amend this privacy policy, for example, if we start using new tools. You can always find the most current version on our website, with the date of the latest update at the top. Where necessary, we will actively inform you of significant changes.

12. Contact

Do you have any questions about this privacy policy or about how we handle your data? Email us at Info@norella.eu.