GDPR Privacy Policy

Last updated: 20 October 2026

1. Introduction

Touch Ritual operates this online store and website, including related information, content, features, tools, products and services (the “Services”). Our store is powered by Shopify, which provides the e-commerce platform that enables us to offer the Services.

This Privacy Policy explains how Touch Ritual collects, uses, stores and discloses personal data when you visit https://www.touchritual.store, use the Services, make a purchase, contact us or otherwise interact with us. We process personal data in accordance with applicable data protection law, including the EU General Data Protection Regulation (GDPR) and applicable Dutch privacy law.

This Policy should be read alongside any cookie notice or other privacy information presented to you when using the Services. Using or visiting the Website does not, by itself, constitute consent to processing for which consent is legally required. Where necessary, we will request your consent separately.

2. Who is responsible for your personal data?

The data controller for the processing described in this Policy is:

Touch Ritual
Blokkerhoek 30
8232 BG Lelystad
The Netherlands
Email: info@touchritual.store
Website: https://www.touchritual.store

Shopify also processes personal data in connection with hosting and providing its platform and may act as a separate controller for certain processing activities. Shopify’s privacy information is available at https://privacy.shopify.com/en.

3. Personal data we collect

The types of personal data we collect depend on how you use the Services. They may include:

Contact details, such as your name, email address, billing address and delivery address.
Order and transaction information, such as products viewed or purchased, cart contents, order number, payment status, returns, exchanges and cancellations.
Delivery information, including a telephone number only if you provide one or it is needed by a delivery or service provider to fulfil your order.
Account information, if you create an account, such as login details, preferences and settings.
Payment-related information, such as payment method and transaction confirmation. Payments are generally handled by payment providers; we do not intentionally store complete payment-card details unless clearly stated at checkout.
Communications and customer-service information, such as messages, questions, complaints and requests.
Technical and usage information, such as IP address, browser and device details, network information, pages viewed, referral information, timestamps and interactions with the Website.
Cookie and similar technology information, subject to your choices and applicable law.
Marketing preferences, including whether you have subscribed to or unsubscribed from promotional communications.

We may collect information directly from you, automatically through the Services, from providers that help operate the store, and from other third parties where lawful. We do not intentionally request special-category personal data through the Website.

4. How and why we use personal data

We process personal data only where we have a lawful basis under the GDPR. Depending on the circumstances, these bases may include performance of a contract, compliance with a legal obligation, our legitimate interests, or your consent.

We may use personal data to:

Process and fulfil orders, accept payments, arrange delivery, handle returns and provide customer support. Legal basis: performance of a contract.
Create and manage customer accounts and provide requested features. Legal basis: performance of a contract or steps taken at your request before entering into a contract.
Respond to enquiries and manage complaints. Legal basis: performance of a contract, pre-contractual steps, legal obligations or legitimate interests, depending on the circumstances.
Maintain, secure and troubleshoot the Website, and prevent fraud or misuse. Legal basis: legitimate interests and, where applicable, legal obligations.
Maintain tax, accounting and other legally required records. Legal basis: compliance with legal obligations.
Understand and improve our products, services and Website. Legal basis: consent where required for analytics cookies or similar technologies, or another lawful basis where applicable.
Send promotional communications. We will do so only where permitted by applicable marketing and privacy law. You can unsubscribe at any time. A purchase or a visit to the Website does not by itself constitute consent to marketing.
Show personalised advertising or use non-essential tracking technologies, where applicable. We will obtain prior consent where required by law and respect your cookie and privacy choices.

Where we rely on legitimate interests, these may include operating and improving our store, protecting our business and customers, preventing fraud and responding to customer enquiries. We consider the potential impact on your rights and freedoms when relying on this basis.

5. Cookies and similar technologies

The Website may use cookies and similar technologies. Strictly necessary cookies may be used where needed to operate the Website, maintain your shopping basket, support checkout or protect the Services, where permitted by law.

Non-essential cookies and tracking technologies, including analytics, advertising or personalisation technologies, will only be used where the consent required by law has been obtained. You should be able to reject non-essential cookies and change or withdraw your choices through the Website’s cookie settings, where available.

You can also manage cookies through your browser settings. Blocking necessary cookies may affect Website functionality.

The specific cookies, providers, purposes and retention periods depend on our actual Shopify configuration and any apps or services enabled on the Website. The cookie notice and settings should reflect the technologies actually in use.

6. How we share personal data

We may disclose personal data where necessary and for a legitimate purpose, including to:

Shopify and providers that host, operate, secure or support our online store.
Payment providers to process payments and help prevent fraud.
Shipping, fulfilment and returns providers to deliver orders and manage returns.
Customer-service, email, IT, security and technical-support providers, where used.
Analytics, advertising or marketing providers, where used and in accordance with applicable consent requirements.
Professional advisers, accountants, insurers or auditors where necessary.
Courts, regulators, public authorities or law-enforcement bodies where disclosure is required by law or lawfully necessary.
A successor or relevant party in connection with a business sale or restructuring, subject to applicable law and appropriate safeguards.

Service providers processing data on our behalf must be subject to appropriate contractual arrangements. Some third parties may act as independent controllers and process data under their own privacy notices.

We do not sell your personal data for money. We do not share personal data with unrelated third parties for their own direct marketing unless this is clearly explained and permitted by law.

7. Shopify

Our online store is hosted by Shopify. Shopify processes personal data relating to your use of the Services to provide, maintain and improve its platform and to support functions such as checkout and store security. Depending on the activity, Shopify may process data on our behalf or act as a separate controller.

For information about Shopify’s own processing and the privacy choices it offers, visit https://privacy.shopify.com/en.

Your rights in relation to data processed by Touch Ritual can be exercised by contacting us using the details in Section 15. Requests concerning processing for which Shopify is the controller may also need to be directed to Shopify.

8. International data transfers

Some of our service providers, including Shopify or other providers used by the store, may process personal data outside the European Economic Area (EEA). Where the GDPR requires safeguards for a transfer outside the EEA, we will rely on a lawful transfer mechanism, such as an adequacy decision adopted by the European Commission or Standard Contractual Clauses, together with additional measures where required.

You may contact info@touchritual.store for further information about the safeguards applicable to a particular transfer, subject to legal restrictions.

9. How long we keep personal data

We keep personal data only for as long as necessary for the purposes described in this Policy, including to fulfil orders, provide support, comply with legal obligations, resolve disputes and enforce agreements.

For example:

Order, invoice and accounting records are retained for the period required by Dutch law. Certain tax and accounting records generally must be kept for seven years.
Customer-service correspondence is retained for as long as reasonably necessary to resolve the matter and document the outcome.
Account information is retained while the account is active and for a reasonable period afterwards where needed for legal or security purposes.
Marketing information is retained until you unsubscribe or withdraw consent, subject to limited records needed to honour your opt-out and demonstrate compliance.
Cookie and analytics information is retained according to the relevant service, cookie and consent settings.

Actual retention periods depend on the type of information, the purpose of processing, applicable law and the systems or providers used. We securely delete or anonymise personal data when it is no longer needed, unless we are legally required or permitted to retain it for longer.

10. Security

We use appropriate technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. No method of transmission or electronic storage is completely secure, and we cannot guarantee absolute security.

11. Your rights under the GDPR

Subject to the conditions and exceptions in applicable law, you may have the right to:

Request access to your personal data.
Request correction of inaccurate or incomplete personal data.
Request erasure of your personal data.
Request restriction of processing.
Object to processing based on our legitimate interests, including objecting to direct marketing.
Receive certain personal data in a structured, commonly used, machine-readable format and request its transfer to another controller, where the right to data portability applies.
Withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing before withdrawal.
Not be subject to a decision based solely on automated processing, including profiling, where it produces legal or similarly significant effects, unless a lawful exception applies.

To exercise your rights, email info@touchritual.store and describe your request. We may need to verify your identity to protect your information. We will respond within the period required by the GDPR, generally within one month. The period may be extended where the law allows, and we will inform you if an extension is necessary.

These rights are not absolute and may be subject to legal conditions or exceptions. We will not unlawfully discriminate against you for exercising your rights.

12. Complaints

If you have concerns about how we process your personal data, please contact us first at info@touchritual.store so we can try to resolve the issue.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or another competent supervisory authority, particularly in the EU/EEA country where you live, work, or where the alleged infringement took place.

Website of the Dutch Data Protection Authority: https://autoriteitpersoonsgegevens.nl/

13. Children’s privacy

The Services are not intended to knowingly collect personal data from children in circumstances where such collection would be unlawful. If you believe a child has provided personal data that should not have been collected, contact us at info@touchritual.store. We will assess the request and take appropriate steps in accordance with applicable law.

14. Third-party websites

The Services may contain links to third-party websites or platforms that we do not operate. We are not responsible for their privacy or security practices. Please read the privacy notices of those third parties before providing personal data to them.

15. Changes and contact

We may update this Privacy Policy to reflect changes in our practices, services, providers or applicable law. We will publish the revised version on this page, update the date above and provide additional notice where required by law.

For questions about this Policy or your personal data, or to exercise your rights, contact: