Privacy Policy

Effective date: 1 September 2026

RosaRose Boutique operates QuaLux Decor. This policy explains what personal data we collect, why we hold it, who we share it with, and the rights you have over it.

We are the data controller for the personal data described here, and we process it in line with the EU General Data Protection Regulation (GDPR) and Dutch data protection law.

What we collect

Category	Examples
Identity and contact	Name, email address, phone number, delivery and billing address
Order data	Items purchased, order value, order history, returns and exchanges
Payment data	Confirmation of payment and the last four digits of a card. We never receive or store full card numbers.
Account data	Username, password (stored hashed), saved preferences
Technical data	IP address, browser and device type, pages viewed, referring site
Correspondence	Messages you send us by email, phone or contact form

Why we process it, and on what legal basis

Purpose	Legal basis
Taking payment, fulfilling and delivering your order, handling returns	Performance of a contract
Customer support and responding to your enquiries	Performance of a contract / legitimate interests
Fraud prevention and securing the store	Legitimate interests
Keeping accounting and tax records	Legal obligation
Marketing emails and personalised advertising	Consent, which you can withdraw at any time
Analytics to understand and improve the store	Consent (non-essential cookies)

Where the data comes from

Mostly from you directly — when you order, create an account, subscribe, or contact us. Some is collected automatically by our website and cookies. We also receive limited data from service providers such as our payment processor and fraud-screening tools.

Who we share it with

We do not sell your personal data. We share it only with parties who need it to run the store:

Shopify, which hosts our store and processes orders
Payment providers, who handle the transaction and screen for fraud
Carriers (DHL, FedEx, UPS) and our tracking provider 17TRACK — name, address, phone number and tracking reference, so your parcel can be delivered and followed
Email and analytics providers, where you've consented
Professional advisers and authorities, where we're legally required to disclose

If our business is sold or merged, personal data may transfer to the buyer, who would remain bound by this policy.

Transfers outside the EEA

Some of our providers operate outside the European Economic Area. Where data is transferred out of the EEA, we rely on an adequacy decision by the European Commission, or on Standard Contractual Clauses together with appropriate additional safeguards.

How long we keep it

Order and invoice records: 7 years, as Dutch tax law requires
Account data: until you close your account, then deleted or anonymised
Marketing contacts: until you unsubscribe
Support correspondence: up to 2 years after the matter is closed

Your rights

Under the GDPR you can ask us to:

Access the personal data we hold about you
Correct anything inaccurate or incomplete
Erase your data, where we have no overriding obligation to keep it
Restrict how we process it
Port it — receive it in a machine-readable format, or have it sent to another provider
Object to processing based on our legitimate interests, including profiling
Withdraw consent at any time, without affecting processing already carried out

Email info@qualuxdecor.com to exercise any of these. We'll respond within one month. We may ask you to verify your identity first, to make sure we're not disclosing your data to someone else.

Complaints

If you think we've handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority where you live.

Marketing emails

We only email marketing to people who've asked for it. Every message has an unsubscribe link, and unsubscribing takes effect immediately. Transactional emails about an order you've placed aren't marketing and will still be sent.

Cookies

Cookies are small files your browser stores. We use:

Essential cookies — keeping you signed in, remembering your basket. The store can't work without these.
Analytics cookies — understanding which pages people use. Set only with your consent.
Advertising cookies — measuring ads and limiting repeat views. Set only with your consent.

You can refuse or delete cookies through your browser settings, though blocking essential ones will stop parts of the store working. We never put directly identifying information in a cookie.

Security

Traffic to our store is encrypted with TLS, payment data goes straight to a PCI DSS compliant processor, and access to customer data is limited to people who need it. No system is completely secure, and we can't guarantee absolute security — but if a breach ever put your rights at risk, we'd notify you and the Autoriteit Persoonsgegevens as the law requires.

Children

Our store isn't intended for children. In the Netherlands, anyone under 16 needs a parent or guardian's consent for their data to be processed. If you believe a child has given us personal data, contact us and we'll delete it.

Other websites

Our pages sometimes link to sites we don't control. This policy stops at our boundary — once you follow a link, that site's own privacy policy applies.

Changes

We'll update this policy when our practices or the law change, and we'll revise the effective date at the top. Material changes will be flagged on the store before they take effect.