Privacy policy
Effective date: 27 August 2026 Last updated: 27 August 2026
1. Who is responsible for your personal data?
SnapSelect.nl B.V., trading as GUSTIQUE, is the controller for processing whose purposes and means it determines. Other parties may be independent or joint controllers for specifically described services; their roles are explained below.
SnapSelect.nl B.V. trading as GUSTIQUE Allegroweg 30 5245 AH Rosmalen The Netherlands Dutch Chamber of Commerce number: 95170308 VAT identification number: NL867028105B01 Email: CustomerCare@gustique.eu
You may use the contact details above for all privacy questions and requests.
2. Scope of this policy
This policy explains how we process personal data when you:
1. visit our website;
2. view a product or place it in your cart;
3. place or pay for an order;
4. use a customer account, where this feature is available;
5. contact us;
6. submit a return, complaint or warranty claim;
7. subscribe to email marketing;
8. consent to analytics or marketing cookies.
3. What personal data do we process?
Depending on how you use our services, we may process:
9. Identity and contact data: your name, billing address, delivery address, email address and telephone number.
10. Order data: order number, purchased products, quantities, price, discount code, delivery preference and order status.
11. Payment data: payment method, payment status, transaction details and limited information received from the payment provider. We generally do not receive or store complete payment card details.
12. Account data: login and customer-account information, where customer accounts are available.
13. Communication data: messages, questions, complaints, return information and other correspondence with customer care.
14. Technical data: IP address, device and browser information, cookie identifiers, timestamps, security logs and website-use information.
15. Marketing and referral data: newsletter subscription, consent status, opt-outs and, only where lawful, referral source, creator or link identifier and limited campaign-attribution data.
16. Privacy preferences: your cookie choices and records showing when consent was given or withdrawn.
Sources of data
We receive data directly from you, automatically from your device or browser and, where applicable, from Shopify, payment and fraud-prevention providers, carriers and account or login services. Campaign or referral data may come from the link through which you visit our website. We do not use publicly sourced personal data for the marketing purposes described in this policy.
4. Additional protection due to the nature of our products
Visiting an intimate-wellness store or purchasing a particular product could potentially lead to sensitive assumptions about a person’s private or sex life. We do not want to make such assumptions and do not process your data for that purpose.
We process information about purchased products only where necessary for ordering, payment, delivery, returns, customer care, product safety, administration and legal obligations.
We do not:
17. create profiles concerning your sex life, sexual preferences or intimate interests;
18. use product-level purchase history for personalised advertising;
19. upload customer or order lists to advertising platforms for custom audiences, lookalike audiences or similar audiences;
20. transmit product names, SKUs, variants, order contents, product-page URLs, page titles or other product-level signals to Google, Meta, TikTok or Snap; these services remain disabled until a documented data-flow and privacy review and technical network test confirm that such signals and other special-category data are reliably excluded;
21. provide carriers with more information than is needed to deliver an order;
22. sell your personal data.
Please do not include medical information or other sensitive personal data in free-text fields or routine customer-care messages unless this is necessary for a product-safety question or complaint. If we receive unnecessary sensitive information, we will delete or restrict it where reasonably possible. Where processing is necessary, we use a valid lawful basis and, where Article 9 GDPR applies, an applicable condition. Submitting free text does not by itself constitute explicit consent; where explicit consent is required, we request it separately. We rely on Article 9(2)(f) GDPR for legal claims only where the processing is strictly necessary for that purpose.
5. Why do we process personal data?
Operating the website, cart and checkout — Data: Technical data, cart and preferences — Legal basis: Performance of the contract or steps requested by you before entering into it; for strictly necessary security and operation, our legitimate interests
Processing and delivering orders — Data: Contact, order, payment and delivery data — Legal basis: Performance of a contract
Processing payments and limiting payment fraud — Data: Payment, transaction, order and technical data — Legal basis: Performance of the contract for payment processing; legal obligation for applicable financial controls; legitimate interests for proportionate fraud prevention and security
Invoicing, accounting and tax administration — Data: Identity, order, payment and invoice data — Legal basis: Legal obligation
Customer care, returns, complaints and warranties — Data: Contact, order and communication data — Legal basis: Performance of a contract; legal obligation; legitimate interest in customer service and dispute handling
Securing our website and systems — Data: IP address, device, log and transaction data — Legal basis: Legitimate interest in security, fraud prevention and preventing misuse
Sending newsletters and commercial emails — Data: Name, email address, preferences and consent record — Legal basis: Consent
Measuring general website performance — Data: Cookie and usage data — Legal basis: Consent; for any consent-exempt privacy-friendly measurement, our legitimate interests after a documented assessment
Measuring general campaign and referral attribution — Data: Limited referral source, creator or link identifier, event, conversion and cookie data — Legal basis: Consent
Complying with law and handling legal claims — Data: Relevant contact, order, payment and communication data — Legal basis: Legal obligation; legitimate interests in the establishment, exercise or defence of legal claims; for unavoidable special-category data, Article 9(2)(f) GDPR
Identity, payment and delivery information marked as required during checkout is necessary to enter into and perform the contract. Without it, we cannot process or deliver the order. Newsletter subscription and non-essential cookies are voluntary and are not conditions for ordering.
Where we rely on legitimate interests, we assess whether our interests are outweighed by your rights and interests. You may object to processing based on legitimate interests.
6. Email marketing
We send marketing communications only after you have consented. Subscription is voluntary and is not a condition for placing an order.
You may unsubscribe at any time through the unsubscribe link in each marketing email or by contacting CustomerCare@gustique.eu. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
We do not use individual open or click tracking without separate, valid consent. Where possible, we use only aggregated delivery and campaign statistics.
7. Cookies and similar technologies
We use cookies, pixels, tags and similar technologies. The current list of active cookies and similar storage technologies, their providers, purposes and lifetimes is available through Manage cookies in the footer. Technology that cannot be correctly inventoried there and is not strictly necessary remains disabled until complete and current information can be provided.
Strictly necessary cookies
These support security, the shopping cart, checkout, payment, fraud prevention, session management and storage of your cookie choices. We do not request consent where consent is not legally required.
Preference cookies
These remember settings you choose, such as language or display preferences. They are placed following your choice and, where required, after consent.
Analytics cookies
Google Analytics and similar non-essential measurement remain disabled until the data-flow, cookie and privacy controls described in this section have been completed. If we later activate such a service, we first update this policy and the cookie inventory and activate it only after the required consent. Measurement is then limited to what is needed to understand general website performance.
Marketing cookies and pixels
Google Ads, Meta Pixel, TikTok Pixel and Snap Pixel are not active while the documented data-flow and privacy review and technical network test remain incomplete. Before any later activation, we update this policy and the cookie inventory, describe the precise purpose and transmitted data and obtain the required prior consent.
Until that review is complete, we do not use browsing, pixel or conversion data for retargeting, custom audiences, lookalike audiences or other personalised advertising purposes. Consent alone does not make transmission of sensitive product or interest data permissible. Before any future activation, we configure and test the technology so that no provider request occurs before consent and product names, SKUs, variants, order contents, product-page URLs, page titles, hashed customer identifiers and other product-level signals are reliably excluded. If this cannot be enforced and tested, the technology remains disabled.
Managing your choices
23. Non-essential cookies are not placed before you consent.
24. Consent options are not preselected.
25. Rejecting is as easy as accepting.
26. You can make a choice by category.
27. You can withdraw consent at any time just as easily through Manage cookies in the footer.
28. The website remains accessible when non-essential cookies are rejected, although some optional features may work less effectively.
Deleting or blocking cookies through your browser may not erase consent records held by providers. Please also use Manage cookies in the footer.
8. Who receives your personal data?
We share personal data only where necessary for the purposes described above.
Shopify and affiliated service providers — Purpose: Hosting, storefront, cart, checkout and security
Payment providers available through Shopify checkout — Purpose: Payment processing, identity and fraud checks, and compliance with financial law
Delivery and fulfilment partners — Purpose: Packing, addressing, delivery, tracking and returns
Email marketing provider — Purpose: Managing subscriptions, consent records and opt-outs and sending newsletters
Exact Online — Purpose: Accounting, invoicing and legally required financial records
Google — Purpose: Potential analytics or campaign measurement; no data while the service is disabled under section 7
Meta — Purpose: Potential campaign measurement; no data while the service is disabled under section 7
TikTok — Purpose: Potential campaign measurement; no data while the service is disabled under section 7
Snap — Purpose: Potential campaign measurement; no data while the service is disabled under section 7
Professional advisers — Purpose: Accounting, legal advice, security and dispute handling, where necessary
Authorities and regulators — Purpose: Where disclosure is required by law
Depending on the service and settings, these parties may act as processors, independent controllers or joint controllers. Shopify generally processes core storefront data on our instructions, but may determine its own purposes and means for enabled services such as Shop, Shop Pay or enhanced services. Where a party determines its own purposes and means, its own privacy policy also applies:
29. Shopify Consumer Privacy Policy
Where required, we enter into data-processing agreements and limit service providers to the data they need.
9. International transfers
Shopify, our email marketing provider and their service providers may process data outside the Netherlands or the European Economic Area. This applies to Google, Meta, TikTok and Snap only if a service is later activated under section 7. For each active transfer, we document the recipient, destination, role and applicable transfer mechanism.
When personal data is transferred to a country that does not provide an adequate level of protection, we use a lawful transfer mechanism such as:
35. a European Commission adequacy decision;
36. the EU-US Data Privacy Framework where the recipient holds valid certification;
37. European Commission-approved Standard Contractual Clauses;
38. another safeguard permitted by applicable law.
Where necessary, we assess supplementary technical and organisational measures. You may request information about the applicable safeguards through CustomerCare@gustique.eu.
10. How long do we retain data?
We do not keep personal data longer than necessary. The following periods or criteria apply:
39. elements of order, invoice and payment records governed by Dutch accounting and tax duties: 7 years after the end of the relevant financial year;
40. records governed by the EU One Stop Shop scheme: 10 years from the end of the year in which the relevant transaction occurred, where that specific statutory duty applies;
41. other order, payment, return, guarantee and customer-service data: for as long as needed to perform the contract, honour statutory conformity rights, handle complaints and address possible legal claims; data is then deleted or anonymised unless a statutory retention duty applies;
42. customer-account data: until you request deletion or after a reasonable period of inactivity, except for data forming part of statutory records or an ongoing claim;
43. newsletter data: until you opt out or withdraw consent; a minimal suppression record may then be kept to honour the opt-out and demonstrate compliance;
44. cookie, consent, analytics and any marketing-measurement data: for the currently configured period stated for the active technology in Manage cookies, and only for as long as needed for the described purpose; non-essential technology remains disabled unless section 7 is satisfied;
45. security and access logs: for a short period needed for security and investigation, and longer where a specific incident, fraud investigation or legal claim requires it;
46. privacy requests and their handling: for as long as needed to handle the request and demonstrate GDPR compliance.
We review these criteria periodically. Where a statutory period, dispute, fraud investigation or legal claim requires longer retention, we retain only the data needed for longer. We then delete or anonymise it.
11. Automated decision-making
SnapSelect.nl B.V. does not itself make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
Shopify, payment providers and security services may use automated signals or checks for payment authorisation, fraud prevention and security. Depending on their role, their own privacy notices also apply. If an automated outcome materially affects an order and the GDPR gives you a right to human intervention, you may request a review through CustomerCare@gustique.eu.
12. Security and confidentiality
We use appropriate technical and organisational safeguards, including where appropriate:
47. encrypted connections;
48. role-based access restrictions;
49. strong authentication;
50. logging and monitoring;
51. data minimisation;
52. contracts with service providers;
53. restrictions on product information in marketing exports;
54. security-incident and data-breach procedures.
No security method is completely risk-free. If a personal data breach occurs, we will act in accordance with the GDPR and notify the Dutch Data Protection Authority and affected individuals where legally required.
13. Your privacy rights
Depending on the circumstances, you have the right to:
55. receive information about processing;
56. access your personal data;
57. correct inaccurate data;
58. request deletion;
59. restrict processing;
60. receive or transfer certain data;
61. object to processing based on legitimate interests;
62. object to direct marketing, which we will always respect;
63. withdraw consent;
64. obtain human review if a relevant decision were made solely by automated means.
Send requests to CustomerCare@gustique.eu. Please provide only the information needed to handle your request. We may request additional information to verify your identity.
We normally respond within one month. For a complex request, the GDPR may allow us to extend this period; we will inform you in time if this occurs.
14. Complaints
You may contact us about a privacy question or complaint through CustomerCare@gustique.eu, but doing so is not required before lodging a complaint with a supervisory authority.
You also have the right to lodge a complaint with the Dutch Data Protection Authority:
Submit a tip-off or complaint to the Dutch Data Protection Authority
If you live in another EU country, you may also contact the data-protection authority in that country.
15. Children
Our store and products are intended for people who are legally able to enter into a purchase contract under applicable law. We do not knowingly direct our marketing to children or knowingly collect children’s personal data without valid consent or another lawful basis. For consent-based online processing of personal data concerning a person under 16, consent from the legal representative is required where Dutch law applies.
If you believe a child has provided personal data without a valid basis, please contact us so that we can investigate and take appropriate action.
16. Changes to this policy
We may update this policy when our services, technology or applicable law changes. The current version is published on this page. We will provide appropriate notice of material changes and request fresh consent where legally required.
17. Contact
SnapSelect.nl B.V. trading as GUSTIQUE Allegroweg 30 5245 AH Rosmalen The Netherlands Dutch Chamber of Commerce number: 95170308 VAT identification number: NL867028105B01 Email: CustomerCare@gustique.eu