Privacy Statement

Last updated: October 13, 2026

This privacy statement explains which personal data Leonie Gort collects when you visit leoniegort.nl, contact us or order from the webshop, why we do so, and what your rights are. We comply with the EU General Data Protection Regulation (GDPR). The Dutch version of this statement is leading.

1. Who is responsible?

The controller of your personal data is:

2. Which data, for what purpose and on what legal basis?

Webshop orders

• Data: name, address, email address, phone number, your order, any comment you add, the time you accepted the terms and conditions and return policy, and payment details (method, status and amount; we never see your bank or card details, Mollie processes those).
• Purpose: handling and shipping your order, keeping you informed (order confirmation, shipping, changes to the expected date of a pre-order), refunds, withdrawals and returns.
• Legal basis: performance of the purchase contract (Art. 6(1)(b) GDPR). We cannot deliver your order without this data. Afterwards we keep it because the law requires us to (tax retention obligation, Art. 6(1)(c) GDPR).

You do not need to give consent for this; we only use this data for your order and do not send you newsletters or advertising, unless you sign up for them (see below).

Newsletter

• Data: your name and email address, and when and with which text you signed up.
• Purpose: sending you an occasional newsletter. Every newsletter contains a link to unsubscribe.
• Legal basis: your consent (Art. 6(1)(a) GDPR), which you give by ticking the newsletter box at checkout. That box is unticked by default. You can withdraw your consent at any time by unsubscribing or emailing us.

Withdrawal via the online form

• Data: name, email address, order number and what you fill in.
• Purpose: processing your withdrawal, sending you an acknowledgement of receipt and refunding you.
• Legal basis: legal obligation (Art. 6(1)(c) GDPR, right of withdrawal).

Contact form and email

• Data: name, email address, phone number if provided, and the content of your message.
• Purpose: answering your question.
• Legal basis: our legitimate interest in answering questions (Art. 6(1)(f) GDPR), or performance of a contract if your question is about one.

Website visits (Google Analytics)

• Data: anonymised IP address, browser and device, pages visited and time spent, the website you came from, and what you do in the webshop: which products you view, add to your cart and order (order number, products and amounts). We never send your name, address, email address or phone number to Google.
• Purpose: understanding how the website and the webshop are used, in order to improve them.
• Legal basis: for analytics cookies, your consent via the cookie banner (Art. 6(1)(a) GDPR). Without consent we do not place analytics cookies; Google then only receives a notice, without cookies or other identifying data, that a page was viewed or an action was taken. This lets us count website use in broad terms (legitimate interest, Art. 6(1)(f) GDPR). You can withdraw your consent at any time in the cookie settings.

3. Cookies

• Necessary cookies (no consent needed): your cookie preference, your shopping cart (medusa_cart_id, 30 days), the payment in progress (medusa_pending_cart, 3 days) and your last order for the thank-you page (medusa_last_order, 1 hour). These cookies only contain a reference (ID), not your name or address.
• Analytics cookies (only with consent): Google Analytics (_ga, _ga_*, _gid, _gat), up to 2 years.

4. Who do we share your data with?

We never sell your data. We only share it when needed for the purposes above:

• Mollie B.V. (Amsterdam): processes your payment and any refund.
• Carrier (PostNL, via MyParcel): name, address and possibly email address/phone number to deliver your parcel and send you track & trace.
• Our email provider: for sending and receiving email.
• Our hosting provider: the server the website and webshop run on.
• Google: Google Analytics; without your consent only notices without cookies (see above).
• Authorities and accountant: when required by law (for example the Dutch Tax Administration) or for our bookkeeping.

We make agreements with parties that process data on our behalf to protect your data. Google may process data outside the European Union; Google uses EU-approved safeguards for this.

5. How long do we keep your data?

• Orders, payments, withdrawals and returns: 7 years, as required by law for our records.
• Unfinished orders (you entered your details but did not pay): up to 6 months.
• Contact form and email: up to 2 years after the last contact.
• Newsletter: until you unsubscribe. We keep the proof of your sign-up with your order.
• Analytics data: up to 26 months (Google Analytics setting).

6. Security

We protect your data with appropriate technical and organisational measures, such as an encrypted connection (https) and access to order data only for those who need it. No internet connection is completely secure, but we do our best to protect your data.

7. Your rights

You have the right to:

• access your data;
• have incorrect data corrected;
• have your data deleted (except data we are legally required to keep, such as your order for our records);
• restrict processing;
• receive your data in a common format (data portability);
• object to processing based on legitimate interest;
• withdraw your consent, without affecting processing before the withdrawal.

Email [email protected] to exercise these rights. We respond within one month. We may ask you to identify yourself, so we know the request comes from you.

We do not make decisions based solely on automated processing, and we do not profile you.

8. Children

This website is not intended for children under 16. If you are under 16 and want to order, please do so together with a parent or guardian.

9. Complaints

Not happy with how we handle your data? Let us know at [email protected]. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): autoriteitpersoonsgegevens.nl.

10. Changes

We may update this privacy statement, for example when the website changes. The date at the top shows when it was last updated.