Privacy Policy

Last updated: October 2026

1. Who We Are

Switch It Up! is an eenmanszaak (sole proprietorship) registered in the Netherlands. We operate the website switchitup.shop and are the data controller for personal data collected through this website.

  • Address: Lijndraaier 39, 1625 ZL Hoorn, the Netherlands
  • Email: info@switchitup.shop
  • KVK: 42077404
  • BTW-id: NL005476302B25

2. What Data We Collect

Order data: When you place an order, we collect:

  • Name and delivery address
  • Email address
  • Phone number (if provided)
  • Payment information (processed securely by Mollie; we never see or store your card details)

Technical data: When you visit our website, our hosting provider automatically logs your IP address, browser type, operating system, and pages visited. This data is used for website security and performance and is not linked to your identity.

Usage statistics: Anonymous, aggregated statistics about how our website is used (see section 10). These cannot be linked to you.

3. Why We Collect It (Purposes)

We use your data to:

  • Process and deliver your order
  • Send order confirmations and shipping updates
  • Handle returns and customer service requests
  • Detect and prevent fraud
  • Comply with legal obligations (tax, accounting)
  • Maintain the security and performance of our website

We do not use your data for marketing, profiling, or automated decision-making.

4. Legal Basis (GDPR Article 6)

We process your data on the following legal grounds:

  • Contract performance (Art. 6(1)(b)): processing necessary to fulfil your order.
  • Legal obligation (Art. 6(1)(c)): retaining financial records as required by Dutch tax law.
  • Legitimate interest (Art. 6(1)(f)): website security, fraud prevention, and service improvement, balanced against your rights and freedoms.

5. Third Parties & Data Processors

We share your data only with parties necessary to fulfil your order or operate our business. We have data processing agreements (verwerkersovereenkomsten) in place with each processor.

  • Mollie (Netherlands): payment processing
  • SpreadConnect (Germany/EU, with individual orders printed and shipped by partner facilities that may be located in the United States): print-on-demand order fulfilment (name, delivery address, email address and phone number, which the carrier may use for delivery notifications)
  • Shipping carriers (EU): order delivery (name and address only)
  • Hetzner (Germany): website and server hosting
  • Resend (United States): transactional email (order confirmations, shipping updates)
  • Zoho (EU data centre): business email correspondence

We do not sell, rent, or trade your personal data to any third party.

6. International Data Transfers

Most of our data processors are based in the EU/EEA. Our transactional email provider Resend is based in the United States; data transfers to Resend are protected by EU Standard Contractual Clauses (SCCs). The data shared with Resend is limited to email address, name, and order details necessary to deliver transactional messages.

Depending on the product ordered, our print-on-demand partner SpreadConnect may have the item produced and shipped directly from a facility in the United States rather than the EU. Where this occurs, your name and delivery address are transferred outside the EU/EEA; this transfer is protected by EU Standard Contractual Clauses (SCCs) under SpreadConnect's data processing agreement.

7. Data Retention

We keep order and financial data for 7 years as required by Dutch tax law (Algemene wet inzake rijksbelastingen). Technical server logs are automatically deleted after 30 days. All other personal data is deleted when it is no longer needed for its original purpose.

8. Data Security

We take appropriate technical and organisational measures to protect your personal data, including:

  • Encrypted connections (HTTPS/TLS) for all website traffic
  • Secure, access-controlled servers hosted within the EU
  • Limited access to personal data on a need-to-know basis

9. Your Rights

Under the GDPR, you have the right to:

  • Access: request a copy of your personal data
  • Rectification: correct inaccurate or incomplete data
  • Erasure: request deletion of your data (where legally permitted)
  • Restriction: restrict processing in certain circumstances
  • Objection: object to processing based on legitimate interest
  • Data portability: receive your data in a structured, machine-readable format
  • Complaint: file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl

To exercise any of these rights, email info@switchitup.shop. We will respond within 30 days.

10. Cookies and Local Storage

Our shop does not set any cookies. To remember your shopping bag, we store a single technical identifier (the ID of your cart) in your browser's local storage. It contains no personal data, is only read by our own website, and is removed when your order is completed. You can clear it at any time through your browser settings.

All fonts and icons are hosted on our own server. Product photos are loaded directly from the image servers of our print partner Spreadshirt (sprd.net AG, Germany), so your browser shares your IP address with them when it displays these images. This is based on our legitimate interest in showing you the products (Art. 6(1)(f) GDPR); no other third-party content is loaded.

To understand how our website is used, we use Umami, a privacy-friendly analytics tool that we host ourselves on our own server (Hetzner, see section 5). No data is shared with any analytics company. Umami sets no cookies, stores nothing on your device, and does not store your IP address. It records only the page visited, the referring website, browser, operating system, device type and country (derived from your IP address, which is then discarded); web addresses are recorded without their query part, so order references never end up in our statistics. The result is aggregated statistics that cannot be used to identify or follow you across websites. This is based on our legitimate interest in improving our website (Art. 6(1)(f) GDPR).

We do not use tracking, advertising, or third-party analytics technologies. Because the only information we store on your device is strictly necessary for the services you request, and our analytics have little or no impact on your privacy, no consent is required under the Dutch Telecommunicatiewet (Art. 11.7a).

11. Changes

We may update this policy from time to time. The latest version is always available on this page with the date of the last update shown at the top.