Privacy Policy

1. Who are we?

Fumigo is a product of Tradelinc B.V., Goeseelsstraat 15, 4817 MV Breda, the Netherlands. We are the controller for the processing of your personal data described in this policy.

Company registration: 72770716  ·  VAT: NL859230934B01  ·  hello@fumigo.eu

2. What data do we collect?

Depending on how you use our website, we process the following personal data:

• When you place an order: first and last name, email address, delivery address, phone number (optional), order note (optional), the products you order, any discount code and the payment status. You enter your payment details on the secure payment page of our payment provider; we do not receive or store card details.
• When you create a customer account: email address, password (stored only as an encrypted hash, never readable), preferred language, verification status and the date the account was created.
• When you sign in with Google: Google shares your name, email address and Google account ID with us. We only store your email address and Google account ID in your customer account.
• When you use the chat assistant: the messages you type and, if you ask about an order, your email address and order number (see section 5).
• When you sign up for the newsletter: email address, language, sign-up date and the page on which you signed up.
• When you use the contact form or email us: name, email address, subject and your message.
• Technical data: IP address and browser data, which our hosting provider and security services process to deliver the website and block abuse. To limit the number of requests per visitor, we briefly store a hashed (non-readable) version of your IP address.

3. How do we use your data?

• Processing, paying for and shipping orders
• Order communication (confirmation, shipping email with track & trace)
• Your customer account: signing in, viewing your orders and reordering
• Customer service and returns, including answering questions via the chat assistant
• A small number of order-related follow-up emails (for example a reminder if checkout wasn't completed, a thank-you email after your order, or a reminder when it may be time to reorder); you can unsubscribe at any time via the link in the email
• Sending our newsletter, but only if you have signed up for it separately (independently of any order); you can unsubscribe at any time
• Protecting our website and customer accounts against bots and abuse
• Complying with legal obligations, such as financial record-keeping

4. Legal basis for processing

We process your data on the following grounds:

• Performance of a contract: for processing, paying for and shipping orders, order communication and your customer account (including signing in with Google, if you choose to)
• Legitimate interest: for customer service and the chat assistant, for a small number of order-related follow-up emails (you can unsubscribe at any time), and for securing our website against bots and abuse
• Consent: for sending our newsletter if you have signed up for it separately. You can withdraw your consent at any time; this does not affect processing that took place before you withdrew it
• Legal obligation: for financial record-keeping

5. Chat assistant

Our chat assistant (bottom right of the page) answers your questions using an AI model from Anthropic (Claude), a company based in the United States.

• Your messages, together with the earlier messages in the same conversation, are sent to Anthropic to generate a reply. Please do not share sensitive information, such as payment details, in the chat.
• We do not store the conversation on our server. Your browser keeps it temporarily (sessionStorage) so the chat stays visible while you browse; it is deleted when you close the tab.
• If you ask about your order, you provide your email address and order number. Our own server checks these against our order records and only returns the status, pack/colour, order date and track & trace link to the chat, never your address or payment details. This information becomes part of the conversation that is sent to Anthropic.
• Anthropic processes these messages on our behalf. According to its terms for business customers, Anthropic does not use them to train its AI models.
• Legal basis: our legitimate interest in answering questions quickly and, for questions about your order, the performance of the contract.

6. Cookies and local storage

We only use cookies and browser storage that are needed for the website to work. We currently do not use analytical or marketing cookies: no Google Analytics and no Meta Pixel.

We also load fonts from Google Fonts and Fontshare. Your browser connects to their servers for this, which means your IP address is shared with them.

If we start using analytical or marketing cookies in the future, we will only do so with your consent via the cookie banner, and we will update this policy first.

7. Third parties

We only share your data with parties we need to deliver our service. Most of them process data on our behalf; where a party acts on its own responsibility (such as Google when you sign in with Google, or WhatsApp), its own privacy policy also applies.

• Cost+ (payment provider): secure payment processing via the hosted payment page (card, Apple Pay, Google Pay)
• PostNL: delivering your order (name, delivery address and, where needed for delivery, contact details)
• Hostinger: hosting of our website, customer database and email server, including CDN and security
• Anthropic (USA): the chat assistant (see section 5)
• Google (USA): signing in with Google (only if you choose to), loading fonts (Google Fonts) and handling our incoming email
• Cloudflare (USA): bot check (Turnstile) on the sign-in and registration form
• Fontshare: loading fonts
• WhatsApp (Meta): only if you contact us via WhatsApp yourself

We never sell your data to third parties.

8. Transfers outside the EU

Some of these parties (Anthropic, Google and Cloudflare) are based in the United States, so your data may be processed outside the European Economic Area. We only allow such transfers with appropriate safeguards, such as the EU-US Data Privacy Framework (for certified companies) or the European Commission's standard contractual clauses. Contact us at hello@fumigo.eu if you would like more information about these safeguards.

9. Retention periods

• Order data: 7 years (statutory accounting obligation)
• Customer account: as long as your account exists. On request we delete your account; order data that we are legally required to keep remains stored for the statutory period
• Order-related follow-up emails: sent within 30 days of your order, or until you unsubscribe
• Newsletter: until you unsubscribe
• Contact messages: as long as needed to handle your question, and no longer than 2 years
• Chat conversations: not stored on our server; in your browser until you close the tab
• Hashed IP address for limiting requests: maximum 1 hour

10. Your rights

Under the GDPR, you have the following rights:

• Right of access to your personal data
• Right to rectification of incorrect data
• Right to erasure ("right to be forgotten"), including deletion of your customer account
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw your consent at any time

Submit a request to hello@fumigo.eu. We will respond within 30 days.

11. Security

We take appropriate technical and organisational measures to protect your data, including SSL encryption on our website, passwords stored only as a hash, order and account data in folders that are not publicly accessible, and restricted access to customer data.

12. Complaints

If you have a complaint about how we process your data, please contact us first at hello@fumigo.eu. You also have the right to file a complaint with the relevant supervisory authority in your country.

13. Changes

We may update this privacy policy from time to time. The most recent version is always available at fumigo.eu/privacy-policy.