Privacy policy
This Privacy Policy explains how Floven B.V. collects, uses and protects your personal information when you visit our website, make a purchase or communicate with us.
When we say "we", "us" or "our", we refer to Floven B.V. When we say "you", we mean any customer, visitor or person who interacts with our services.
Floven B.V. is the controller of your personal data. Our details are at the bottom of this page. We are not required to appoint a Data Protection Officer, so questions go to hello@floven.nl.
Please read this policy with care. It describes what we do with your data and why we are allowed to do it. Where we rely on your consent, we ask for it separately and you can withdraw it at any time.
Updates to this policy
We may update this Privacy Policy to reflect changes in our practices or in the law. When we do, we adjust the "Last updated" date at the top of this page. If a change materially affects how we use your data, we will tell you directly where we reasonably can.
Information we collect
We collect personal information in three ways: information you share with us directly, information collected automatically when you use our site, and information provided to us by trusted third parties. What we collect depends on how you use our website and services.
Information you provide directly
- Contact details such as your name, email address, phone number and postal address
- Order details such as your billing address, shipping address, order history and payment confirmation
- Account details if you choose to create an account
- Customer support messages, reviews, and any other information you choose to share with us
- Information you give us when you make a return or refund request, including your order number
We do not ask you for health information, and we ask you not to send us medical details. If you do mention something about your health in a support message — for example when asking whether She Sleeps suits your situation — we use that information only to answer your question, we do not add it to your marketing profile, and we never share it with advertising partners.
You may choose not to provide certain information, but this may limit your ability to use some features of our website or to place an order.
Information collected automatically
When you use our website we may collect usage data through cookies and similar technologies, including device details, browser details, IP address, pages viewed and actions taken on the site, referral source, and your interaction with emails we send.
Cookies and similar technologies that are not strictly necessary — including analytics and advertising cookies — are only placed after you give consent through our cookie banner. You can change or withdraw your cookie choices at any time through the cookie settings on our website. Strictly necessary cookies, such as those that keep items in your basket and secure the checkout, are placed without consent because the site cannot work without them.
Blocking cookies in your browser is also possible, but this may affect how the website works.
Information from third parties
We may receive information about you from payment partners, shipping and fulfilment partners, analytics and advertising partners, review platforms, and Shopify services that support our store. Any information we receive is treated according to this policy.
Why we use your information, and on what legal basis
Under the GDPR we need a legal basis for everything we do with your data. Here is the full picture.
To process your order, arrange shipping and delivery, manage your account, handle returns, refunds and warranty claims, and send you service-related notifications such as order and shipping confirmations. Basis: performance of our contract with you.
To keep our financial administration and comply with tax, consumer and product safety law, including handling any recall or safety notification. Basis: compliance with a legal obligation.
To answer your questions and provide customer support. Basis: performance of our contract, or our legitimate interest in helping people who contact us.
To send you marketing emails about products, offers and updates. Basis: your consent, or — if you are an existing customer and the message concerns similar products — our legitimate interest under Dutch electronic communications law. You can unsubscribe from any marketing email using the link at the bottom of it, and we act on that immediately.
To measure how our website and advertising perform, and to show you relevant advertising on platforms such as Meta. Basis: your consent, given through our cookie banner.
To detect and prevent fraud, abuse of our Money Back Promise, and misuse of our website, and to keep our systems secure. Basis: our legitimate interest in protecting our business and our customers.
To improve our products, website and service, including analysing aggregated purchase and usage patterns. Basis: our legitimate interest in running and improving our business.
To establish, exercise or defend legal claims. Basis: our legitimate interest, or compliance with a legal obligation.
Where we rely on legitimate interest, we have weighed our interest against your privacy and concluded the processing is proportionate. You can object to any of it — see "Your rights" below.
Advertising and Meta
We advertise on Meta (Facebook and Instagram). If you consent to advertising cookies, we use the Meta Pixel and Meta's Conversions API to measure which advertisements lead to visits and purchases, and to show advertisements to people who have visited our website or who resemble our existing customers.
For this measurement and audience-building, Floven and Meta act as joint controllers. Meta processes the data further for its own purposes as an independent controller under its own privacy policy, which we do not control.
We do not build advertising audiences on the basis of health information, symptoms or anything you tell us about your personal situation, and we do not upload such information to advertising platforms.
If you would rather not take part, decline advertising cookies in our banner, or adjust your ad settings within Meta.
Who we share your information with
We share personal information only when needed to provide our services or when required by law. Our providers act on our instructions under a data processing agreement, except where they are independent controllers in their own right.
- Shopify — our webshop and hosting platform
- Our payment provider — payment processing. Your full card details are handled by the payment provider and are never stored by us.
- Klaviyo — email marketing and email delivery
- Our shipping and fulfilment partners — delivery and returns
- Trustpilot — collecting and publishing reviews
- Meta and Google — advertising and analytics, subject to your cookie consent
- Our accountant, IT and security providers, and professional advisors, where necessary
- Government or legal authorities, where we are legally required to disclose
We do not sell your personal data, and we do not share it for profiling that is unrelated to delivering our services.
International transfers
Your information may be stored or processed outside the Netherlands. Some of our providers, including Shopify, Meta and Google, are based in or transfer data to the United States.
Where data leaves the European Economic Area, we rely on an appropriate safeguard: either an adequacy decision of the European Commission — such as the EU-US Data Privacy Framework, where the provider is certified — or the European Commission's Standard Contractual Clauses combined with additional measures where needed. You can ask us for more detail about the safeguards applying to a specific provider.
How long we keep your information
We keep personal data only as long as we need it, and no longer.
- Order, invoice and payment data — 7 years from the end of the financial year, because Dutch tax law requires it
- Customer account data — for as long as your account is open, and up to 12 months after you close it or after your last activity
- Customer support and refund correspondence — up to 2 years after the conversation ends, or longer if a dispute is running
- Marketing consent and email interaction data — until you unsubscribe or withdraw consent, after which we keep a minimal record of your unsubscribe so we do not email you again by mistake
- Website and advertising data from cookies — for the retention period set for each cookie, up to a maximum of 14 months
- Data relevant to a legal claim or dispute — until the matter is resolved and any applicable limitation period has passed
After these periods we delete the data or make it permanently anonymous.
Reviews and public content
If you post a review or share content publicly, anyone may see it. We cannot control how others use that content once it is public. Please do not include health details or other sensitive information in a public review. You can ask us to remove a review you posted on our own website at any time.
Third-party websites
Our website may contain links to external websites. We are not responsible for their privacy practices and encourage you to read their policies separately.
Children's privacy
Our products and services are intended for adults and are not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.
Security and data breaches
We take security seriously and use appropriate technical and organisational measures to protect your information, including encrypted connections, access controls, and providers who meet recognised security standards. No method of transmission or storage is completely secure, so we cannot guarantee absolute protection.
If a data breach occurs that is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay, and we will notify the Dutch Data Protection Authority where the law requires it.
Automated decision-making
We do not make decisions that produce legal effects for you, or similarly significantly affect you, based solely on automated processing. Our fraud checks on refund requests are reviewed by a person before any decision is taken.
Your rights
You have the right to:
- Access your personal information and request a copy
- Correct inaccurate or incomplete details
- Delete your data, where we have no overriding reason to keep it — note that we cannot delete invoice data before the 7-year tax retention period ends
- Restrict certain types of processing
- Object to processing based on our legitimate interest, including profiling. If you object to direct marketing, we always stop
- Data portability — receive the data you gave us in a structured, commonly used format, or have it sent to another provider
- Withdraw consent at any time, where consent was the basis. Withdrawing does not affect anything we did lawfully before you withdrew
- Opt out of marketing emails using the unsubscribe link in any of them
Email hello@floven.nl to exercise any of these. We may ask you to verify your identity so that we do not hand your data to someone else. We respond within one month, and we tell you if we need longer because a request is complex.
Exercising your rights is free, and we never treat anyone less favourably for doing so.
Complaints
If you have concerns about how we handle your data, please contact us first at hello@floven.nl — we would rather sort it out with you.
Contact us
If you have questions about this Privacy Policy or want to exercise your rights, reach us at:
hello@floven.nl
Floven B.V. Vlierweg 12, 1032 LG Amsterdam The Netherlands
