Privacy Policy

This Privacy Policy explains how Floven B.V. collects, uses and protects your personal information when you visit our website, make a purchase, take out a subscription or communicate with us.

When we say "we", "us" or "our", we refer to Floven B.V. When we say "you", we mean any customer, visitor or person who interacts with our services.

Floven B.V. is the controller of your personal data. Our details are at the bottom of this page. We are not required to appoint a Data Protection Officer, so questions go to hello@floven.nl.

Please read this policy with care. It describes what we do with your data and why we are allowed to do it. Where we rely on your consent, we ask for it separately and you can withdraw it at any time.

Updates to this policy

We may update this Privacy Policy to reflect changes in our practices or in the law. When we do, we adjust the "Last updated" date at the top of this page. If a change materially affects how we use your data, we will tell you directly where we reasonably can.

Information we collect

We collect personal information in three ways: information you share with us directly, information collected automatically when you use our site, and information provided to us by trusted third parties. What we collect depends on how you use our website and services.

Information you provide directly

• Contact details such as your name, email address, phone number and postal address
• Order details such as your billing address, shipping address, order history and payment confirmation
• Subscription details such as your plan, delivery interval, charge dates, skipped or paused deliveries, and the date and time of any cancellation
• Account details if you choose to create an account
• Customer support messages, reviews, and any other information you choose to share with us
• Information you give us when you make a return, refund or Money Back Promise request, or when you withdraw from a purchase, including your order number

For subscriptions, your payment provider stores a secure reference to your payment method so that later deliveries can be charged. We never receive or store your full card or bank details.

We do not ask you for health information, and we ask you not to send us medical details. If you do mention something about your health in a support message — for example when asking whether She Sleeps suits your situation — we use that information only to answer your question, we do not add it to your marketing profile, and we never share it with advertising partners.

You may choose not to provide certain information, but this may limit your ability to use some features of our website or to place an order.

Information collected automatically

When you use our website we may collect usage data through cookies and similar technologies, including device details, browser details, IP address, pages viewed and actions taken on the site, referral source, and your interaction with emails we send.

Cookies and similar technologies that are not strictly necessary — including analytics and advertising cookies — are only placed after you give consent through our cookie banner. You can change or withdraw your cookie choices at any time through the cookie settings on our website. Strictly necessary cookies, such as those that keep items in your basket, secure the checkout and keep you signed in to your account, are placed without consent because the site cannot work without them.

Blocking cookies in your browser is also possible, but this may affect how the website works.

Information from third parties

We may receive information about you from payment partners, shipping and fulfilment partners, our subscription management provider, analytics and advertising partners, review platforms, and Shopify services that support our store. Any information we receive is treated according to this policy.

Why we use your information, and on what legal basis

Under the GDPR we need a legal basis for everything we do with your data. Here is the full picture.

What we do	Legal basis
Process your order, arrange shipping and delivery, manage your account, handle returns, refunds, Money Back Promise claims and warranty claims, and send service notifications such as order and shipping confirmations	Performance of our contract with you
Run your subscription: charge each delivery, send you a reminder before each charge, process skips, changes and cancellations, and confirm them by email	Performance of our contract with you
Process a withdrawal from a purchase and keep a record of it, including the date and time we received it	Compliance with a legal obligation
Keep our financial administration and comply with tax, consumer and product safety law, including handling any recall or safety notification	Compliance with a legal obligation
Answer your questions and provide customer support	Performance of our contract, or our legitimate interest in helping people who contact us
Send you marketing emails about products, offers and updates	Your consent, or — for existing customers and similar products — our legitimate interest under Dutch electronic communications law
Measure how our website and advertising perform, and show you relevant advertising on platforms such as Meta	Your consent, given through our cookie banner
Detect and prevent fraud, misuse of our Money Back Promise (which applies once per person and per delivery address), and misuse of our website, and keep our systems secure	Our legitimate interest in protecting our business and our customers
Improve our products, website and service, including analysing aggregated purchase, subscription and usage patterns	Our legitimate interest in running and improving our business
Establish, exercise or defend legal claims	Our legitimate interest, or compliance with a legal obligation

Service messages about your order or subscription, such as charge reminders and cancellation confirmations, are part of our contract with you. They are not marketing, so you keep receiving them for as long as your subscription is active, even if you have unsubscribed from marketing emails.

You can unsubscribe from any marketing email using the link at the bottom of it, and we act on that immediately.

Where we rely on legitimate interest, we have weighed our interest against your privacy and concluded the processing is proportionate. You can object to any of it — see "Your rights" below.

Advertising and Meta

We advertise on Meta (Facebook and Instagram). If you consent to advertising cookies, we use the Meta Pixel and Meta's Conversions API to measure which advertisements lead to visits and purchases, and to show advertisements to people who have visited our website or who resemble our existing customers.

For this measurement and audience-building, Floven and Meta act as joint controllers. Meta processes the data further for its own purposes as an independent controller under its own privacy policy, which we do not control.

We do not build advertising audiences on the basis of health information, symptoms or anything you tell us about your personal situation, and we do not upload such information to advertising platforms.

If you would rather not take part, decline advertising cookies in our banner, or adjust your ad settings within Meta.

Who we share your information with

We share personal information only when needed to provide our services or when required by law. Our providers act on our instructions under a data processing agreement, except where they are independent controllers in their own right.

• Shopify — our webshop and hosting platform
• Our payment provider — payment processing, including securely storing a reference to your payment method for subscription charges
• Our subscription management provider — running subscriptions, charge reminders and the subscription section of your account
• Klaviyo — email marketing and email delivery
• DHL and our fulfilment partners — delivery and returns
• Trustpilot — collecting and publishing reviews
• Meta and Google — advertising and analytics, subject to your cookie consent
• Our accountant, IT and security providers, and professional advisors, where necessary
• Government or legal authorities, where we are legally required to disclose

We do not sell your personal data, and we do not share it for profiling that is unrelated to delivering our services.

International transfers

Your information may be stored or processed outside the Netherlands. Some of our providers, including Shopify, Meta and Google, are based in or transfer data to the United States.

Where data leaves the European Economic Area, we rely on an appropriate safeguard: either an adequacy decision of the European Commission — such as the EU-US Data Privacy Framework, where the provider is certified — or the European Commission's Standard Contractual Clauses combined with additional measures where needed. You can ask us for more detail about the safeguards applying to a specific provider.

How long we keep your information

We keep personal data only as long as we need it, and no longer.

Data	How long we keep it
Order, invoice and payment data	7 years from the end of the financial year, because Dutch tax law requires it
Subscription details, including changes and cancellation confirmations	For as long as your subscription is active, and up to 2 years after it ends
Stored payment reference for subscription charges	Until your subscription ends, after which your payment provider removes it from active use
Customer account data	For as long as your account is open, and up to 12 months after you close it or after your last activity
Customer support, refund, Money Back Promise and withdrawal correspondence	Up to 2 years after the conversation ends, or longer if a dispute is running
Record that you have used the Money Back Promise	Up to 5 years, so we can apply the once-per-person rule
Marketing consent and email interaction data	Until you unsubscribe or withdraw consent, after which we keep a minimal record of your unsubscribe so we do not email you again by mistake
Website and advertising data from cookies	For the retention period set for each cookie, up to a maximum of 14 months
Data relevant to a legal claim or dispute	Until the matter is resolved and any applicable limitation period has passed

After these periods we delete the data or make it permanently anonymous.

Reviews and public content

If you post a review or share content publicly, anyone may see it. We cannot control how others use that content once it is public. Please do not include health details or other sensitive information in a public review. You can ask us to remove a review you posted on our own website at any time.

Third-party websites

Our website may contain links to external websites. We are not responsible for their privacy practices and encourage you to read their policies separately.

Children's privacy

Our products and services are intended for adults and are not directed at children. You must be at least 18 to place an order or take out a subscription. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

Security and data breaches

We take security seriously and use appropriate technical and organisational measures to protect your information, including encrypted connections, access controls, and providers who meet recognised security standards. No method of transmission or storage is completely secure, so we cannot guarantee absolute protection.

If a data breach occurs that is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay, and we will notify the Dutch Data Protection Authority where the law requires it.

Automated decision-making

We do not make decisions that produce legal effects for you, or similarly significantly affect you, based solely on automated processing. Our checks on Money Back Promise and refund requests are reviewed by a person before any decision is taken.

Your rights

You have the right to:

• Access your personal information and request a copy
• Correct inaccurate or incomplete details
• Delete your data, where we have no overriding reason to keep it — note that we cannot delete invoice data before the 7-year tax retention period ends
• Restrict certain types of processing
• Object to processing based on our legitimate interest, including profiling. If you object to direct marketing, we always stop
• Data portability — receive the data you gave us in a structured, commonly used format, or have it sent to another provider
• Withdraw consent at any time, where consent was the basis. Withdrawing does not affect anything we did lawfully before you withdrew
• Opt out of marketing emails using the unsubscribe link in any of them

If you ask us to delete your data while your subscription is active, we cancel the subscription first, because we cannot deliver or charge it without your details.

Email hello@floven.nl to exercise any of these. We may ask you to verify your identity so that we do not hand your data to someone else. We respond within one month, and we tell you if we need longer because a request is complex.

Exercising your rights is free, and we never treat anyone less favourably for doing so.

Complaints

If you have concerns about how we handle your data, please contact us first at hello@floven.nl — we would rather sort it out with you.

You also have the right to lodge a complaint with a data protection supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). If you live in Belgium, you can also contact the Gegevensbeschermingsautoriteit (gegevensbeschermingsautoriteit.be).

Contact us

If you have questions about this Privacy Policy or want to exercise your rights, reach us at:

hello@floven.nl

Floven B.V. Vlierweg 12, 1032 LG Amsterdam The Netherlands Chamber of Commerce (KvK): 98818872