Privacy policy
Tavellio Privacy Policy
1. Controller and Contact Details
Tavellio, a brand of Amsterdam Lighting Group B.V.
Keizersgracht 482, 1017 EG Amsterdam, The Netherlands
Email: info@tavellio.com
Phone: +31 20 261 34 28 (Monday to Friday, 09:00 to 17:00 CET)
Chamber of Commerce (KvK) No: 92601065
VAT ID: NL866112625B01
For all data privacy inquiries, you may contact us at the above email address or telephone number. We have not appointed a data protection officer, as we are not required to do so under Art. 37 GDPR.
2. Scope of this Privacy Policy
This policy applies to all users of Tavellio's websites and services, including individuals located in the EU, EEA, the United Kingdom, Switzerland, the United States and Canada. It is drafted in accordance with:
GDPR (EU and EEA)
UK GDPR and Data Protection Act 2018 (United Kingdom)
CCPA/CPRA (California, USA) and other applicable US state privacy laws
PIPEDA (Canada)
CNIL guidance (France)
BDSG and TDDDG (Germany)
AVG and UAVG (Netherlands)
Data Protection Act (Belgium)
3. Data Collection and Purpose of Use
We collect only the personal data necessary for the following purposes:
Order processing and fulfilment
Customer account management
Customer service communication, including messages you send us via email, our contact form or WhatsApp
Marketing (with consent)
Website analytics and optimisation
Legal and tax obligations
Types of data collected:
Identity information (name, address, email, phone)
Order and payment information
IP address and browser/device data
Communication history
Product reviews
Marketing consent preferences
We do not sell or rent personal data to third parties for money. Please note that under the California definition of "sharing", our use of advertising cookies and pixels (Google, Meta, Pinterest, Microsoft) may qualify as sharing personal information for cross-context behavioural advertising. You can opt out of this at any time via the cookie settings on our website or by emailing info@tavellio.com. See Section 8 for your rights.
4. Legal Basis for Processing (EU/UK)
Contract performance (Art. 6(1)(b) GDPR and UK GDPR)
Legal obligation (Art. 6(1)(c) GDPR and UK GDPR)
Legitimate interest (Art. 6(1)(f) GDPR and UK GDPR)
Consent (Art. 6(1)(a) GDPR and UK GDPR, for marketing and non-essential cookies)
5. Third Parties and International Transfers
We share personal data with the following categories of processors:
Payment providers: Mollie, PayPal, Klarna, Visa, Mastercard, American Express, Apple Pay, Google Pay
Shipping and logistics: DHL, DPD
Platform and marketing services: Shopify (hosting, webshop, transactional email), Klaviyo (email and SMS marketing), Yotpo (product reviews), Google (Analytics, Ads), Meta (Facebook, Instagram), Pinterest, Microsoft Bing, Pandectes (cookie consent management)
Customer contact: WhatsApp Business (Meta), where you contact us via WhatsApp. Messages sent through WhatsApp are processed by Meta under its own terms; if you prefer not to use WhatsApp, you can reach us by email or telephone.
We may also share data with our accountant, legal advisors or government authorities where legally required.
International Data Transfers
Some service providers, such as Shopify, Google, Meta and Microsoft, may process your data outside the EU/EEA and the United Kingdom, including in the United States and Canada. These transfers rely on:
Standard Contractual Clauses (SCCs)
For transfers from the United Kingdom: the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the SCCs
Data Processing Agreements (DPAs)
Appropriate safeguards under Art. 46 GDPR and UK GDPR
Adequacy decisions and UK adequacy regulations where applicable
6. Security Measures
We take technical and organisational measures to protect your data against loss, misuse, unauthorised access, disclosure, alteration or destruction. This includes:
SSL/TLS encryption
Access restrictions
Pseudonymisation and anonymisation where appropriate
Confidentiality agreements with employees and processors
7. Data Retention
Customer account data: deleted after three years of inactivity, unless a longer period is required by law
Order and invoice data: seven years (Dutch tax law)
Email and marketing preferences: until consent is withdrawn
Analytics and log data: maximum 26 months
8. Your Rights
You have the right to access, rectify and erase ("right to be forgotten") your personal data, to restrict or object to processing, and to data portability. You may withdraw consent at any time and lodge a complaint with a supervisory authority: in the Netherlands the Autoriteit Persoonsgegevens, in Germany the competent state authority for your federal state, in the United Kingdom the Information Commissioner's Office (ICO).
United States (CCPA/CPRA and other state laws)
Right to know, delete and correct personal information
Right to opt out of the sale or sharing of personal information, via our cookie settings or by emailing info@tavellio.com
Right to limit the use of sensitive personal information (we do not use sensitive personal information beyond what is necessary to provide our services)
Right to non-discrimination for exercising your rights
We honour Global Privacy Control (GPC) browser signals as an opt-out of sharing where technically supported.
To exercise your rights, email info@tavellio.com. We respond within one month as required under the GDPR and UK GDPR, and within 45 days for requests under the CCPA/CPRA.
9. Automated Decision Making and Profiling
We use limited automated tools such as Google Analytics, Meta Pixel, Pinterest Tag, Microsoft Bing and Klaviyo to optimise our marketing. This does not produce legal effects or similarly significant effects for individuals within the meaning of Art. 22 GDPR.
10. Use of Cookies
We use cookies for:
Functionality (necessary)
Preferences
Statistics (Google Analytics)
Marketing (Google, Meta, Pinterest, Microsoft Bing)
Non-essential cookies are placed only with your consent. Refusing is as straightforward as accepting, and you may withdraw your consent at any time. We use Pandectes for cookie consent management; you can adjust your preferences via the banner or the cookie settings at any time. Visitors from the United States can use the same cookie settings to opt out of the sharing of personal information for advertising purposes.
11. Communication and Email Privacy
Our transactional and marketing emails are sent via Shopify and Klaviyo. These systems are secured and content is not accessible to third parties. All data is encrypted during transmission.
We do not permit access to the content or metadata of our communications unless legally required. All email communication is stored securely and encrypted in transit.
12. Anonymised and Aggregated Data
We may share anonymised or aggregated data with partners to improve our services. This data contains no personal identifiers and cannot be traced back to individuals.
13. Children
Our store is not aimed at children under 16. We do not knowingly collect data from children. If you believe we have, please contact us and we will delete it.
14. Policy Changes
We may revise this policy. Updates will be posted on our website with the new effective date. We will notify users of significant changes by email where appropriate.
15. Contact
Tavellio, a brand of Amsterdam Lighting Group B.V.
Keizersgracht 482, 1017 EG Amsterdam, The Netherlands
Email: info@tavellio.com
Phone: +31 20 261 34 28
KvK: 92601065
VAT ID: NL866112625B01
Last updated: 11 August 2026