Privacy Policy

Last updated: 22-04-2026

1. Data Controller

The data controller responsible for processing your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 is:

Verleij Trading Europe
Hornweg 22, 1721CV Broek op Langedijk, The Netherlands
Chamber of Commerce (KvK): 76109135
VAT number: NL860510529B01
Email: info@verleijservices.nl
Phone: +31(0)226-752493

2. What Data We Collect

We process the following categories of personal data:

  • Name (for order processing and invoice addressing)
  • Email address (for delivery of EAN codes, order confirmation and customer support)
  • Billing address (for legally required invoice records)
  • Payment information (transaction ID provided by the payment processor; we do not store full payment card data)
  • Order history (which EAN packages were purchased and when)
  • IP address (for security, fraud prevention and technical logs)

3. Purposes and Legal Bases for Processing

3.1 Performance of a Contract

We process your name, email address, billing address and payment information to process your order and deliver the purchased EAN codes to you by email. Legal basis: Article 6(1)(b) UK GDPR (performance of a contract to which you are a party).

3.2 Legal and Tax Obligations

We are legally required to retain invoices and order data in accordance with applicable tax and accounting legislation. Legal basis: Article 6(1)(c) UK GDPR (compliance with a legal obligation).

3.3 Marketing Emails (with consent only)

If you have explicitly opted in to receive our newsletter or marketing emails, we may use your email address to send you information about our products and offers. Legal basis: Article 6(1)(a) UK GDPR (your consent). You may withdraw your consent at any time via the unsubscribe link in any email or by contacting us directly.

3.4 Security and Fraud Prevention

IP addresses and technical logs are processed to prevent misuse and to ensure the security of our website. Legal basis: Article 6(1)(f) UK GDPR (legitimate interests).

4. Recipients and International Data Transfers

We share your personal data only with the following parties, to the extent necessary:

  • PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg / United States) – payment processor. PayPal is based in the United States. Transfers are made on the basis of Standard Contractual Clauses (SCCs) approved by the relevant supervisory authorities. See PayPal's privacy policy.
  • MultiSafePay B.V. (Amsterdam, Netherlands) – payment processor for credit cards and other payment methods. MultiSafePay is based in the EU (Netherlands). See MultiSafePay's privacy policy.
  • Sendinblue SAS (Brevo) (Paris, France) – email delivery service for order confirmations and transactional emails. Brevo is based in the EU and processes data in accordance with GDPR. See Brevo's privacy policy.

We do not sell your personal data to third parties, and we do not share it for third-party commercial purposes.

5. Retention Periods

  • Order data and invoices: retained for 7 years after the end of the tax year, in line with legal obligations.
  • Customer account data (if applicable): a maximum of 3 years after the last contact or last order, unless you request deletion sooner.
  • Marketing consent records: until you withdraw your consent.
  • IP addresses in security logs: a maximum of 90 days.

6. Your Rights as a Data Subject

Under the UK GDPR, you have the following rights:

  • Right of access (Article 15): you may request details of the personal data we hold about you.
  • Right to rectification (Article 16): you may have inaccurate or incomplete data corrected.
  • Right to erasure (Article 17): you may request deletion of your data, unless we have a legal obligation to retain it.
  • Right to restriction of processing (Article 18): you may request that we restrict processing of your data in certain circumstances.
  • Right to data portability (Article 20): you may receive your data in a structured, commonly used and machine-readable format.
  • Right to object (Article 21): you may object to processing based on legitimate interests, including direct marketing.
  • Right to withdraw consent (Article 7(3)): where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal.

7. How to Exercise Your Rights

You may exercise your rights by emailing info@verleijservices.nl. Please include your name and the email address used for your order so that we can verify your identity. We will respond to your request within 4 weeks (one calendar month as required by UK GDPR).

8. Right to Lodge a Complaint

If you believe we are not processing your personal data in accordance with the UK GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Website: ico.org.uk
Helpline: 0303 123 1113

9. Cookies

We use only strictly necessary functional cookies required for the operation of the website, such as maintaining your shopping basket and session state. We do not place tracking, profiling or advertising cookies. No cookie consent banner is required as we rely solely on cookies that are exempt from the consent requirement under the Privacy and Electronic Communications Regulations (PECR).

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or destruction. These measures include:

  • SSL/TLS encryption for all data transfers
  • Access controls for systems and databases
  • Access to personal data limited on a need-to-know basis

11. Changes to This Privacy Policy

We may update this privacy policy from time to time. The most recent version will always be available on this page with the date of the latest update shown above. In the event of material changes, we will notify you by email or by a prominent notice on the website.