Privacy policy

Privacy Policy

Last updated: 8 May 2025

CR NL GROUP B.V. ("we", "us", "our") is responsible for the processing of your personal data as described in this Privacy Policy. We operate a group of online stores listed below and are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable Dutch law.

1. Who We Are (Data Controller)

CR NL GROUP B.V.
Koornmarktpoort 25 C, 8253 TE Dronten, Netherlands
KVK: 89845145
VAT: NL865130681B01
Email: info@salonselect.nl
Phone: +31 617985604 / +31 856664755
Business hours: Monday–Friday, 10:00–16:00 (CET)

CR NL GROUP B.V. is the single data controller for all of the following domains:

Regardless of which domain you use, your data is processed by CR NL GROUP B.V. under the same privacy principles described in this policy.

2. What Personal Data We Collect

Depending on how you interact with our store, we may collect and process the following categories of personal data:

  • Identity data: first name, last name, company name (for B2B customers)
  • Contact data: email address, phone number, billing address, shipping address
  • Financial data: payment method details (processed via our payment providers; we do not store full card numbers)
  • Transaction data: details of products purchased, order history, returns and exchanges
  • Account data: username, password (hashed), account preferences
  • Technical data: IP address, browser type and version, device type, operating system, time zone, pages visited, referral source
  • Usage data: information about how you use our website and services
  • Communication data: records of correspondence with us (email, contact form, chat)
  • Business data (B2B only): VAT number, KVK/company registration number, job title

3. Legal Basis for Processing (GDPR Art. 6)

We process your personal data on the following legal bases:

  • Performance of a contract (Art. 6(1)(b)): to process your order, arrange delivery, handle returns and refunds, and manage your account.
  • Legal obligation (Art. 6(1)(c)): to comply with Dutch tax law (Belastingdienst), accounting obligations (7-year retention), and other statutory requirements.
  • Legitimate interests (Art. 6(1)(f)): to prevent fraud, ensure website security, improve our services, and for direct marketing to existing customers (you can opt out at any time).
  • Consent (Art. 6(1)(a)): for non-essential cookies, newsletter subscriptions, and targeted advertising, where we have obtained your explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

4. How We Use Your Personal Data

We use your personal data for the following purposes:

  • Order fulfilment: processing payments, arranging shipment via our logistics partners, and handling returns
  • Customer account management: creating and maintaining your account, sending order confirmations and shipping notifications
  • Customer support: responding to your questions, complaints, and warranty claims
  • Legal compliance: meeting our tax, accounting, and regulatory obligations
  • Fraud prevention and security: detecting and preventing fraudulent transactions and unauthorised access
  • Marketing (with your consent or based on legitimate interest for existing customers): sending promotional emails about products and offers; you can unsubscribe at any time via the link in each email
  • Website improvement: analysing how our website is used to improve user experience

5. Order Fulfilment and Data Sharing with Logistics Partners

We work with a network of trusted suppliers and logistics partners across Europe to fulfil your orders. Depending on the product and your location, your order may be dispatched from one of our partner warehouses. The sender's name or address on the parcel may therefore differ from our registered address. Your contract is always with CR NL GROUP B.V.

For the purposes of order dispatch, we share the following personal data with our fulfilment partners:

  • Full name
  • Delivery address
  • Phone number (for delivery coordination)
  • Order reference
  • Product details required for dispatch

All our fulfilment partners are located within the European Economic Area (EEA) and are bound by Data Processing Agreements (DPA) in accordance with GDPR Art. 28. They may only process your data for the purpose of fulfilling your order and are not permitted to use it for any other purpose.

6. Who We Share Your Data With

We do not sell your personal data. We may share it with the following categories of recipients:

  • Fulfilment and shipping partners (see Section 5): to dispatch your order
  • Payment service providers (e.g. Shopify Payments, Mollie, iDEAL): to process your payment securely
  • Shopify Inc.: our e-commerce platform provider. Shopify processes data on our behalf as a data processor. Transfers to Shopify (US) are covered by Standard Contractual Clauses (SCC). See Shopify's Privacy Policy.
  • Google Analytics / Google LLC: for website analytics (anonymised IP). Governed by SCC. You can opt out via cookie settings.
  • Consentmo: our cookie consent management provider
  • Email service providers: to send transactional and marketing emails
  • Accounting and tax advisors: as required by Dutch law
  • Competent authorities: if required by law (e.g. Belastingdienst, police, courts)

7. International Data Transfers

Most of our data processing takes place within the EEA. Where we transfer personal data outside the EEA (e.g. to Shopify Inc. in the United States or Google LLC), we ensure appropriate safeguards are in place, including:

  • Standard Contractual Clauses (SCC) approved by the European Commission
  • Adequacy decisions where applicable

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our website. Cookies are small text files stored on your device.

Categories of cookies we use:

Category Purpose Legal basis
Strictly necessary Shopping cart, session management, security, checkout, cookie consent storage Legitimate interest / contract performance — no consent required
Statistics / Analytics Shopify analytics, Google Analytics — understanding how visitors use our site Consent (Art. 6(1)(a) GDPR)
Marketing Google DoubleClick, YouTube, LinkedIn, Meta (Facebook), AdRoll — targeted advertising and remarketing Consent (Art. 6(1)(a) GDPR)
Preferences Language and regional settings, Cloudflare Consent (Art. 6(1)(a) GDPR)

The full list of cookies currently active on our websites, including name, provider, purpose, and retention period, is managed and kept up to date by our cookie consent provider Consentmo. You can view and manage the full list at any time via the cookie settings panel on our website.

document.addEventListener("DOMContentLoaded", function() { if (window.CookieConsent && typeof window.CookieConsent.renderCookieList === "function") { window.CookieConsent.renderCookieList("cmo-cookie-list"); } });

You can manage your cookie preferences at any time by clicking the Cookie Settings button in the footer of our website, or by adjusting your browser settings. Disabling certain cookies may affect website functionality.

9. Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy:

  • Order and transaction data: 7 years (Dutch accounting and tax law — Belastingdienst requirement)
  • Customer account data: for the duration of your account, plus 2 years after last activity
  • Marketing data: until you unsubscribe or withdraw consent, and in any event reviewed and purged after 3 years of inactivity
  • Support correspondence: 3 years from the date of resolution
  • Cookie consent records: 3 years

10. Your Rights Under GDPR

As a data subject, you have the following rights under the GDPR:

  • Right of access (Art. 15): you may request a copy of the personal data we hold about you
  • Right to rectification (Art. 16): you may request correction of inaccurate or incomplete data
  • Right to erasure (Art. 17): you may request deletion of your data ("right to be forgotten"), subject to legal retention obligations
  • Right to restriction of processing (Art. 18): you may request that we limit how we use your data in certain circumstances
  • Right to data portability (Art. 20): you may request your data in a structured, machine-readable format
  • Right to object (Art. 21): you may object to processing based on legitimate interests, including direct marketing
  • Right to withdraw consent (Art. 7(3)): where processing is based on consent, you may withdraw it at any time
  • Right not to be subject to automated decision-making (Art. 22): we do not make automated decisions with legal or similarly significant effects on you, and we do not carry out profiling for such purposes

To exercise any of these rights, please contact us at:

Email: info@salonselect.nl
Post: CR NL GROUP B.V., Koornmarktpoort 25 C, 8253 TE Dronten, Netherlands

We will respond within one month of receiving your request (GDPR Art. 12(3)). For complex or numerous requests, we may extend this period by a further two months; we will inform you of any extension within the first month. If we are unable to fulfil your request, we will explain why. There is no fee for making a request unless it is manifestly unfounded or excessive.

11. Right to Lodge a Complaint

If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Dutch data protection authority:

Autoriteit Persoonsgegevens (AP)
Website: www.autoriteitpersoonsgegevens.nl
Phone: +31 70 888 8500
Post: Prins Clauslaan 60, 2595 AJ Den Haag, Netherlands

You may also contact the supervisory authority in your country of residence within the EEA. A list of EEA supervisory authorities is available at: edpb.europa.eu.

12. Children's Data

Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

13. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration, in accordance with GDPR Art. 32. These include SSL/TLS encryption, access controls, and regular security reviews. However, no method of transmission over the internet is 100% secure.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, where required by law, notify you by email or via a prominent notice on our website. We encourage you to review this policy periodically.

15. Contact Us

For any questions about this Privacy Policy or your personal data, please contact us:

CR NL GROUP B.V.
Koornmarktpoort 25 C, 8253 TE Dronten, Netherlands
Email:

You can reach us by email at the address corresponding to your store:

Store Email
www.salonselect.nl info@salonselect.nl
www.salonselect.eu info@salonselect.eu
www.salonselect.bg info@salonselect.bg
www.salonselect.fi info@salonselect.fi
www.salonselect.fr info@salonselect.fr
www.salon-select.ie info@salon-select.ie

Phone: +31 617985604 / +31 856664755
Business hours: Monday–Friday, 10:00–16:00 (CET)