Privacy Policy
Last updated: 9 September 2026
In this Privacy Policy, we explain how GengieTCG, part of VOF Jolian Horeca, collects, uses, stores and shares personal data when you visit our website www.gengietcg.nl, use our services, place an order, or otherwise contact us.
We believe it is important that you understand which personal data we process, why we process it, and what rights you have.
1. Who are we?
GengieTCG is part of:
VOF Jolian Horeca
Kerkstraat 9
2959 BS Streefkerk
The Netherlands
Email: gengietcg@gmail.com
For the processing of personal data in connection with our website and services, we are the data controller within the meaning of the General Data Protection Regulation (GDPR).
2. What personal data do we collect?
The information we process depends on how you use our website and services.
Information you provide directly
This may include:
- first and last name;
- billing and delivery address;
- email address;
- telephone number;
- information necessary to process an order;
- information you provide when contacting us;
- information you provide when creating or using an account;
- information you provide in connection with a question, complaint, return or other customer service interaction.
Order information
When you place an order, we may process, among other things:
- order number;
- products ordered;
- name;
- billing and delivery information;
- contact details;
- payment status and payment confirmation;
- information relating to returns, refunds and exchanges.
We do not necessarily receive or store your complete payment card details. Payments are processed by the payment provider used for the relevant payment method.
Automatically collected information
When you visit our website, certain technical information may be collected automatically, such as:
- IP address;
- device type;
- browser information;
- operating system;
- network connection information;
- pages and sections of our website that you visit;
- date and time of your visit;
- technical information necessary for the operation and security of our website.
The information actually collected depends on the features, cookies and services that are active on our website at the relevant time.
3. Why do we use your personal data?
We use personal data only to the extent necessary for the purposes described below.
Processing your order
We use personal data to:
- process your order;
- process your payment;
- deliver your order;
- keep you informed about the status of your order;
- process returns and refunds;
- answer questions about your order.
Processing that is necessary for the performance of our agreement with you is based on Article 6(1)(b) GDPR.
Customer service and communication
When you contact us, we use the information you provide to handle your question, request or complaint.
Depending on the circumstances, this processing is necessary for the performance of a contract, compliance with a legal obligation, or based on our legitimate interest in providing good customer service.
Administration and legal obligations
We may process personal data in order to:
- maintain our administration;
- comply with tax and administrative obligations;
- comply with other legal obligations;
- handle disputes or establish, exercise or defend legal claims.
This processing may be necessary to comply with a legal obligation or may be based on our legitimate interest.
Security and fraud prevention
We may process personal data to protect our website, systems, customers and business and to prevent and investigate fraud, misuse or other unlawful activities.
Where applicable, this processing is based on our legitimate interest in keeping our services and systems secure.
Marketing
Where you have subscribed to marketing communications, we may send you marketing communications, for example by email.
You can unsubscribe from marketing communications at any time by using the unsubscribe option included in the relevant communication.
Where consent is required for marketing activities, we will ask for your consent in advance. You can withdraw your consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
4. Legal bases for processing
We only process personal data where there is a valid legal basis for doing so.
Depending on the circumstances, we may rely on:
- performance of a contract (Article 6(1)(b) GDPR);
- compliance with a legal obligation (Article 6(1)(c) GDPR);
- legitimate interests (Article 6(1)(f) GDPR);
- consent (Article 6(1)(a) GDPR).
Where we rely on legitimate interests, we carry out a balancing assessment in which we take your interests, rights and reasonable expectations into account.
5. Cookies and similar technologies
Our website uses cookies and similar technologies.
Cookies may be necessary for the operation of the website, for example to enable the shopping cart to function or to support website security.
Functional cookies
Cookies that are strictly necessary for the operation of the website do not require prior consent.
Analytics, marketing and tracking cookies
Where cookies or similar technologies are used to analyse visitors, track visitors across different websites or provide personalised advertising, we will obtain prior consent where required by applicable law.
You must be given a genuine choice. Refusing non-essential cookies should not be made unnecessarily more difficult than accepting them.
We do not place non-essential cookies until the required consent has been obtained.
You can change your cookie preferences or withdraw your consent through the cookie settings available on our website.
The specific cookies and similar technologies used, the parties involved and the retention periods of these cookies may be listed in our cookie settings or in a separate Cookie Policy.
6. Shopify and other service providers
Our online store is supported by external service providers, including Shopify.
These parties may process personal data where necessary to provide their services to us, for example for:
- hosting and technical support;
- online store functionality;
- payment processing;
- security;
- shipping and fulfilment;
- customer service;
- analytics or other functionality that we actually use.
We only provide personal data to the extent necessary for the relevant purpose and where there is a valid legal basis for doing so.
7. Who may we share personal data with?
We may share personal data with service providers that perform services on our behalf.
Depending on the services we use, this may include:
- online store and hosting providers;
- payment providers;
- carriers and delivery services;
- fulfilment and logistics providers;
- IT and security service providers;
- customer service providers;
- analytics or marketing service providers, where we actually use them;
- professional advisers, such as accountants or legal advisers, where necessary.
Where an external party processes personal data on our behalf, we will enter into appropriate agreements concerning the protection of personal data where required.
We do not sell your personal data as part of our normal business operations.
8. Marketing and sharing with advertising partners
Where we use marketing or advertising services that involve sharing personal data with third parties, this will only take place to the extent permitted by applicable law.
For tracking and personalised advertising, we may obtain prior consent where required.
You can withdraw your consent for such processing at any time through the available settings.
9. International transfers
Some of our service providers may process personal data outside the Netherlands or outside the European Economic Area (EEA).
Where personal data is transferred outside the EEA, we ensure that a valid transfer mechanism is used, such as:
- an adequacy decision adopted by the European Commission; or
- appropriate safeguards, such as Standard Contractual Clauses (SCCs) adopted by the European Commission, where applicable.
Where necessary, we take additional measures to ensure that personal data receives an appropriate level of protection.
10. How long do we retain personal data?
We do not retain personal data for longer than necessary for the purpose for which it was collected, unless we are legally required to retain it for a longer period.
The retention period depends on the type of data and the purpose for which it is used.
For example:
- Order and invoice data: for as long as necessary to perform the agreement and for as long as required under applicable tax or other legal obligations.
- Account data: while your account remains active and for as long as necessary to provide the account service, unless a longer retention period is legally required.
- Customer service data: for as long as reasonably necessary to handle your question or complaint and any necessary follow-up.
- Marketing data: until you unsubscribe or withdraw your consent, where consent is the legal basis, unless another legal basis applies.
- Cookie and tracking data: according to the retention periods applicable to the relevant cookies and services.
When data is no longer required and there is no legal obligation to retain it, we will delete or anonymise it.
11. Security
We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure.
However, no method of data transmission or electronic storage is completely secure. We therefore cannot guarantee absolute security.
If a personal data breach occurs despite our measures, we will assess it in accordance with applicable legal requirements and, where required, notify the Dutch Data Protection Authority and/or affected individuals.
12. Children's data
Our website and services are not specifically directed at children.
We do not knowingly collect personal data from children where there is no valid legal basis for doing so.
If a parent or legal guardian believes that a child has provided personal data to us, they may contact us at gengietcg@gmail.com.
13. Your privacy rights
Under the GDPR, you may have various rights depending on the circumstances.
You may, among other things:
- request access to the personal data we process about you;
- request correction of inaccurate personal data;
- request deletion of your personal data;
- request restriction of processing;
- object to certain processing activities;
- request data portability where applicable;
- withdraw previously given consent;
- object to the processing of your personal data for direct marketing.
You have the right to object to the processing of personal data for direct marketing purposes. Following such an objection, we will no longer process your personal data for that purpose.
Not every right applies in every situation. For example, legal exceptions or obligations may require us to retain certain data.
14. How can you exercise your rights?
You can send a request concerning your personal data to:
Please state as clearly as possible which request you are making.
To prevent us from disclosing personal data to the wrong person, we may request additional information to verify your identity. We will not request more information than necessary for this verification.
We will handle your request within the applicable statutory time limit.
15. Complaints
If you have a complaint about the way we handle your personal data, we encourage you to contact us first at:
You also have the right to lodge a complaint with the relevant supervisory authority.
In the Netherlands, this is:
Autoriteit Persoonsgegevens
You can consult the website of the Autoriteit Persoonsgegevens for more information about submitting a complaint.
16. Links to third-party websites
Our website may contain links to websites or services operated by third parties.
We are not responsible for the privacy practices, content or security of websites that we do not operate or control.
We recommend that you review the privacy policy of any external website before providing personal data.
17. Changes to this Privacy Policy
We may update this Privacy Policy when our services, business practices or applicable laws and regulations change.
When we make changes, we will publish the updated version on our website and update the date at the top of this Privacy Policy.
Where significant changes are made, we will provide additional information where required by law.
18. Contact
If you have any questions about this Privacy Policy or about how we handle personal data, please contact us:
GengieTCG / VOF Jolian Horeca
Kerkstraat 9
2959 BS Streefkerk
The Netherlands
Email: gengietcg@gmail.com