Privacy Policy – Tavellio

1. Controller and Contact Details
Tavellio – a brand of the Amsterdam Lighting Group
Keizersgracht 482, 1017 EG Amsterdam, The Netherlands
Email: info@tavellio.com
Phone: +31 (0)20 123 4567
Chamber of Commerce (KvK) No: 92601065

For all data privacy inquiries, you may contact us at the above email or telephone. We have not appointed a separate data protection officer.

• GDPR (EU & EEA)

• UK GDPR (post-Brexit)

• Data Protection Act 2018 (UK)

• CCPA/CPRA (California, USA)

• PIPEDA (Canada)

• CNIL guidelines (France)

• BDSG & TTDSG (Germany)

• AVG & UAVG (Netherlands)

• Belgian Privacy Act (Belgium)

• Order processing and fulfilment

• Customer account management

• Marketing (with consent)

• Website analytics and optimization

• Legal and tax obligations

• Customer service communication

Types of data collected:

• Identity information (name, address, email, phone)

• Order and payment information

• IP address and browser/device data

• Communication history

• Marketing consent preferences

We do not sell or rent personal data to third parties.

• Contract performance (Art. 6(1)(b) GDPR)

• Legal obligation (Art. 6(1)(c) GDPR)

• Legitimate interest (Art. 6(1)(f) GDPR)

• Consent (Art. 6(1)(a) GDPR – for marketing & cookies)

• Payment providers: Mollie, PayPal, Klarna, Visa, Mastercard, American Express, Apple Pay, Google Pay

• Shipping & logistics: PostNL, DHL, FedEx, UPS

• Platform services: Shopify (hosting, webshop, email), Omnisend (email marketing), Google (Analytics, Ads), Meta (Facebook, Instagram), TikTok, Bing (Microsoft)

International Data Transfers
Some service providers (e.g. Shopify, Google, Meta, TikTok) may process your data outside the EU/EEA (e.g. USA, Canada). These transfers rely on:

• Standard Contractual Clauses (SCCs)

• Data Processing Agreements (DPAs)

• Appropriate safeguards under Art. 46 GDPR

• Adequacy decisions where applicable

Note: Shopify relies on SCCs for transfers of personal data to the United States, as the EU-US Privacy Shield has been invalidated.

• SSL encryption

• Access restrictions

• Pseudonymization and anonymization

• Employee confidentiality agreements

• Customer data: as long as your account is active or as required for the purpose collected

• Order data: 7–10 years (tax/legal requirements)

• Email and marketing preferences: until withdrawn

• Analytics and log data: maximum 26 months (Google default)

California (CCPA/CPRA)

• Right to know, delete, correct

• Right to opt-out of “sale” of personal data

• Right to non-discrimination

You can exercise your rights by emailing info@tavellio.com. We will respond within 30 days.

• Functionality (necessary)

• Preferences

• Statistics (e.g. Google Analytics)

• Marketing (Meta, TikTok, Bing)

We use Pandectes GDPR for cookie consent management. Users can adjust preferences via the banner or settings at any time.

We do not permit access to the content or metadata of our communications unless legally required. All email communication is stored securely and encrypted in transit.