Privacy Policy — Heleen Jurriana Artwork

Last updated: July 14, 2026

Heleen Jurriana Artwork ("we", "us", "our") operates this store and website (the "Services"). This Privacy Policy explains what personal information we collect, why, and what rights you have, in accordance with the EU General Data Protection Regulation (GDPR) and Dutch data protection law.

For the purpose of applicable data protection law, we are the data controller of your personal information, except where stated otherwise below (see "Relationship with Shopify").

If there is a conflict between our Terms of Service and this Privacy Policy regarding the handling of personal information, this Privacy Policy controls.

Personal Information We Collect

Depending on how you interact with us, we may collect:

• Contact details — name, address, phone number, email address.
• Financial information — payment details, transaction records (processed via our payment provider; we do not store full card numbers ourselves).
• Account information — username, preferences, order history.
• Transaction information — items viewed, purchased, returned, or exchanged.
• Communications — messages you send us, e.g. customer support requests.
• Device and usage information — IP address, browser type, and how you interact with the Services, collected via cookies and similar technologies (see "Cookies" below).

Where This Information Comes From

• Directly from you (creating an account, placing an order, contacting us).
• Automatically, through your use of the Services (cookies, device data).
• From service providers who process data on our behalf (e.g. our hosting platform, payment processor).
• From Shopify's Network Intelligence feature, where applicable (see below).

How We Use Your Information, and On What Legal Basis

Purpose	Legal basis (GDPR Art. 6)
Processing your order, payment, shipping, returns, and account management	Performance of our contract with you
Customer support and communication about your order	Performance of our contract with you
Preventing fraud and securing the Services	Our legitimate interest in running a safe store
Complying with legal obligations (e.g. tax/bookkeeping records)	Legal obligation
Sending you marketing emails or newsletters	Your consent — you opt in, and can withdraw consent at any time via the unsubscribe link. If you're an existing customer, we may email you about similar products based on our legitimate interest, always with an easy opt-out
Personalized advertising via Shopify Network Intelligence	Your consent, given through our cookie/privacy preference tool

We only use your information for a new purpose beyond this list if that new purpose is compatible with the original one, or if we ask for your consent again.

Cookies and Similar Technologies

We use cookies and similar technologies for:

• Strictly necessary cookies — required for the store to function (cart, checkout, security). No consent needed.
• Analytics cookies — to understand how visitors use the site.
• Marketing/advertising cookies — including those used for Shopify Network Intelligence (see below), used to personalize ads.

Analytics and marketing cookies are only placed after you give consent via our cookie banner, in line with Dutch telecommunications law (art. 11.7a Telecommunicatiewet). You can change your preferences at any time through the cookie settings on our site.

How We Disclose Personal Information

We may share personal information with:

• Shopify and other service providers who support our operations (hosting, payments, analytics, shipping, customer support), acting on our instructions as processors.
• Business and marketing partners, where relevant to advertising features you've consented to.
• Third parties, when you direct us to (e.g. shipping carriers) or when required by law.
• A successor business, in the event of a merger, acquisition, or sale of the business.

Relationship with Shopify

Our store is hosted on Shopify, which processes data on our behalf as our processor for standard store operations (checkout, payments, order data).

In addition, we use Shopify Network Intelligence, a feature that draws on data from your interactions with our store and other Shopify merchants to support personalized advertising. For this specific feature, Shopify acts as an independent data controller, not as our processor — meaning Shopify determines how that data is used and is directly responsible for it. To exercise your rights regarding this processing, or to learn more, visit Shopify's Consumer Privacy Policy and the Shopify Privacy Portal.

Third-Party Websites and Links

The Services may link to third-party websites we don't control. We're not responsible for their privacy practices — please review their policies before sharing information with them.

Children's Data

The Services are not intended for children. In line with Dutch law, we do not knowingly collect personal information from children under 16 without parental consent. If you believe a child has provided us with personal information, contact us and we will delete it.

Data Retention

We keep personal information only as long as necessary for the purpose it was collected, including:

• Order and financial records: 7 years, in line with the Dutch statutory bookkeeping retention requirement (fiscale bewaarplicht, art. 52 AWR).
• Account information: for as long as your account is active, plus a reasonable period after.
• Marketing data: until you withdraw consent or unsubscribe.

Data Breach Notification

If a personal data breach occurs that poses a risk to your rights or freedoms, we will assess it promptly and, where required by law, notify the Autoriteit Persoonsgegevens within 72 hours and inform affected customers without undue delay.

Your Rights and Choices

Under the GDPR, you have the right to:

• Access the personal information we hold about you.
• Rectify inaccurate information.
• Erase your information, in certain circumstances.
• Restrict or object to our processing of your information.
• Data portability — receive your data in a portable format.
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us using the details below. We may need to verify your identity first. You can also authorize someone else to make a request on your behalf, provided we can verify that authorization.

You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens (the Dutch data protection authority, autoriteitpersoonsgegevens.nl), or with the data protection authority in your own EU country of residence.

International Transfers

If we transfer your personal information outside the European Economic Area or the UK, we rely on recognized safeguards such as the European Commission's Standard Contractual Clauses, unless the destination country is already recognized as offering an adequate level of protection.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted here with an updated "Last updated" date, and we'll notify you of material changes where required by law.

Contact

Questions about this Privacy Policy or your personal information? Contact us at:

Heleen Jurriana Artwork (handelsnaam van Infinite Minded) Eisenhowerlaan 114, 2517 KM Den Haag, Netherlands contact [@] heleenjurriana.nl