GradinaruSiera — Privacy Policy
Last updated: 16 September 2026

Your jewelry purchase should come with clear information about your personal data. This policy explains what information is used when you browse gradinarusieraden.nl, place an order, save favourites, subscribe to updates or contact us. It also explains your choices and your rights under the General Data Protection Regulation (GDPR).

This policy is information about our processing, not a request for blanket consent. Visiting our website, reading this policy or accepting the purchase terms does not give permission for optional marketing or tracking.

1. Who is responsible for your information?

The controller for the store's customer information is Georgiana Anișoara Grădinaru, trading as Gradinaru Sieraden & Reparaties, a Dutch sole proprietorship operating the GradinaruSiera brand.

Address: Arend Verkleijstraat 34, 2172 BE Sassenheim, the Netherlands.
KVK number: 42056004.
VAT identification number: NL005459914B77.
Privacy and customer service email: info@gradinarusieraden.nl.
Telephone: +31 6 57760222.
Alternative business email: finlaw.mix@gmail.com.

You may use these details for questions, complaints or requests to exercise your privacy rights. Please put “Privacy request” in the subject line where possible so we can identify your request promptly.

2. Information you give us

Orders and delivery. When you place an order, we process your name, delivery and billing details where applicable, telephone number, email address when supplied, selected products, options, quantities, discounts, order value, payment method, delivery instructions and the status of the order. Required fields are identified in the form. Without information essential to arranging delivery and payment, we may be unable to accept or fulfil your order.

Cash on delivery. Our Releasit form collects the details needed to create and manage your Shopify order. Cash on delivery does not require you to give us a payment-card number in that form. The courier needs delivery and contact information and the amount to collect. Payment, attempted delivery, collection and return updates may be returned to us. If you agree to a refund by bank transfer, we will need the account information required to pay that refund.

Customer enquiries. When you email, telephone or otherwise contact us, we process the contact details and information you choose to provide. This can include your order reference, a description of a problem and photographs supporting a warranty or return enquiry. Please avoid sending unrelated sensitive information, passwords, complete payment-card details or identity documents.

Subscriptions and accounts. Newsletter subscriptions involve your email address and subscription preferences. If you use Shopify customer-account features, information needed to authenticate you and display your order history is processed through Shopify. Creating an account is separate from consenting to marketing.

3. Information collected through the website

Shopify and the services supporting the store process technical information needed to deliver and protect the site. Depending on your interaction and privacy choices, this may include your IP address, browser and device characteristics, language, requested pages, timestamps, referring pages, session identifiers, errors and interactions with store functions.

The storefront remembers saved product handles in your browser under gs-wishlist and recently viewed product handles under gs-recent. These lists support your favourites and browsing history on that browser. They are not a separate public profile. Shared-device users may be able to see them. You can remove wishlist items or clear the site's browser storage. Clearing this storage does not cancel an order or delete records that Shopify must retain.

We also receive information from service providers where it relates to your purchase, such as order processing, delivery progress, payment collection, refunds, security alerts and communications sent on our behalf. If someone purchases a gift for you, we may receive your recipient name, address and delivery contact details from that person. They should provide only the details needed for delivery and let you know they have done so.

4. Why we process data and our legal grounds

To take and fulfil orders: selecting and confirming products, arranging delivery, collecting payment and providing order updates. The basis is taking steps at your request before a contract and performing the contract (GDPR Article 6(1)(b)).
To handle cancellation, returns, refunds and product problems: processing is necessary to perform the purchase agreement and meet consumer-law obligations (Articles 6(1)(b) and 6(1)(c)). Relevant records may also be kept for the legitimate interest of resolving or defending legal claims (Article 6(1)(f)).
To maintain legally required records: accounting, tax obligations and responding to lawful official requests are based on legal obligations (Article 6(1)(c)).
To answer questions: pre-purchase enquiries may be steps requested before a contract. Other correspondence is handled for our legitimate interest in communicating with customers and resolving problems (Articles 6(1)(b) or 6(1)(f), according to the enquiry).
To protect the store: proportionate security, abuse prevention, troubleshooting and investigation of suspicious activity serve our legitimate interests in protecting customers, systems and the business (Article 6(1)(f)). Those interests must be balanced against your rights.
To send optional newsletters: we rely on your consent to the subscription (Article 6(1)(a)). Withdrawing it does not affect an existing order.
To use optional tracking or personalisation: where consent is required, the basis is the permission you give through the relevant privacy control (Article 6(1)(a)). Essential technical storage is limited to providing the requested service or meeting applicable obligations.

We do not treat all customer information as necessary for every purpose. For example, a newsletter does not require your delivery address, and a withdrawal request does not require an explanation of why you changed your mind. If we want to use information for a new, incompatible purpose, we will provide the required information and obtain consent where needed.

5. Shopify, Releasit and other recipients

Our store is hosted on Shopify. Shopify provides the commerce platform, hosting, order records, customer features and related technical services. It processes information for us to provide those services and can also act as a controller for certain processing described in its own consumer privacy policy, such as protecting and operating its services. The relevant details are available in Shopify's Consumer Privacy Policy and through Shopify's privacy portal.

Releasit COD Form & Upsells, operated by Shop Circle, provides the cash on delivery order form and associated order-processing features. The information entered into that form is handled through the app and Shopify to administer your order. See Releasit's Privacy Policy for information about the provider. An installed app does not mean that every optional feature it offers is used by our store.

Information may also be disclosed, where relevant, to:

Delivery and fulfilment providers, to prepare, transport, deliver or return your parcel and collect cash on delivery.
Banks or payment providers, where necessary to receive a payment or make an agreed refund.
Email and communications providers, to deliver transactional messages, answer enquiries and manage subscriptions.
Professional advisers and bookkeeping providers, where needed for accounting, legal advice or the handling of a claim.
Public authorities or other recipients where disclosure is legally required or necessary for a lawful claim.

We limit disclosure to what is needed for the relevant task. A processor acting on our instructions must be subject to the protections required by data-protection law. A provider acting as an independent controller, such as a bank or an authority, is responsible for its own legal duties. We do not sell customer contact lists to other retailers.

6. Cookies, local storage and your choices

Cookies store small pieces of information in your browser. Similar technologies, including local storage, can remember preferences and support site functions. Necessary technologies can support security, session continuity, privacy preferences and the services you request. Optional analytics or marketing technologies require consent where applicable law requires it.

Use the site's cookie banner or privacy controls to accept, refuse or manage optional categories. Refusing optional cookies should not prevent you from purchasing. You can also delete or block cookies and site storage through your browser; doing so may reset preferences or prevent some functions from working correctly. Browser settings apply to that browser and device and may need to be repeated elsewhere.

Provider technology and cookie durations can change with the services in use. Shopify explains its technologies in its Cookie Policy. We do not assume that an identifier or a hashed email address is anonymous merely because it is not directly readable. Where such data can still be linked to a person, the data-protection rules continue to apply.

7. Newsletters and service messages

You can subscribe to news about GradinaruSiera products and offers. Subscription is optional and is not a condition of buying jewelry or receiving customer service. You can unsubscribe using the link in a marketing email or by contacting us. We may keep limited suppression information so that your choice is respected.

Order confirmations, delivery updates, responses to your enquiry and important product or account messages are service communications. They may still be sent when needed even if you unsubscribe from marketing. We will not describe promotional messages as necessary order updates to bypass your choice.

8. Accounts, reviews and outside websites

If you use a customer account, protect access to the email account used to sign in. Ask us if you need help correcting or deleting account information. Deleting an account does not necessarily erase invoices or other records we are legally required to keep.

If you send a review, testimonial or photograph, we will explain any proposed public use and seek permission where required. Contacting customer service or tagging a social account does not itself grant an unlimited right to use your photographs in advertising.

Links to external services take you to sites governed by their own privacy practices. If you contact us through a social platform, that platform also processes your account and message information under its own terms. Please use email for order details you do not wish to share on a social network.

9. How long information is kept

We keep identifiable information only for as long as its purpose or a legal requirement justifies. The relevant period depends on the type of record, the purchase, any ongoing issue and applicable limitation periods.

Tax and accounting records: core business records are generally retained for seven years under Dutch requirements. A longer period is used where a specific rule applies, for example to records subject to particular VAT schemes. This does not mean every browsing record must be kept for seven years.
Orders and after-sales evidence: retained to fulfil the order, manage applicable warranty and consumer rights and handle actual or reasonably anticipated disputes. Records included in the accounting administration follow its legal retention period.
Enquiries and complaints: retained while the matter is handled and afterwards only to the extent needed for follow-up, relevant rights or a claim. Irrelevant attachments and excessive information should not be kept simply because they were supplied.
Newsletter information: retained while your subscription remains active. After withdrawal, active marketing use stops; limited evidence of consent and suppression records may remain where necessary to demonstrate compliance and respect your choice.
Customer accounts: retained while needed for the account service, subject to deletion requests and separate legal retention obligations for transaction records.
Wishlist and recently viewed lists: stored in the browser until removed, cleared by you or cleared by the browser. The current lists do not have an automatic expiry set by the storefront.
Security and technical records: retained for the period needed to diagnose incidents, protect the service and investigate a specific problem, subject to the relevant provider's retention arrangements.

Where information must be preserved for a legal obligation or dispute, its use is restricted to that purpose when it is no longer needed for ordinary customer service. You can ask us which retention criteria apply to your particular information.

10. International processing

Shopify, Releasit and their service providers may process information in countries outside the European Economic Area. The fact that our business is in the Netherlands does not mean all service-provider systems are located here.

Transfers must use an applicable lawful mechanism, such as a current European Commission adequacy decision, or appropriate safeguards such as the Commission's Standard Contractual Clauses together with additional safeguards where required. We do not rely on the former EU–US Privacy Shield. You can contact us for information about the safeguards relevant to your data and how to obtain a copy, subject to lawful redactions. The linked provider policies give further details of their international processing arrangements.

11. Security and data minimisation

Access to customer information should be limited to people and providers who need it for their work. We use the security features of the store platform and appropriate organisational measures to protect information against unauthorised access, misuse and loss. No internet service can promise absolute security.

Please do not send passwords or full payment-card details by email. We do not need a copy of your identity document for an ordinary jewelry purchase. If a privacy request raises reasonable doubts about identity, we will ask for proportionate verification, favouring information already associated with the account or order. We will not routinely demand an unredacted passport copy.

12. Children and sensitive information

The store is intended for customers able to enter a purchase agreement or act with any required parent or guardian consent. Our marketing subscriptions are not directed at children under 16. If you believe a child has supplied information without the consent required by law, contact us so we can investigate and take appropriate action.

We do not ask for medical information, political or religious beliefs, biometric identification data or other special-category information to sell jewelry. If you ask about a material sensitivity, share only what is needed to ask the question; customer service does not provide medical advice.

13. Automated processing

The platform and order form automate routine tasks, such as calculating totals, recording orders and sending status information. These tasks are different from a decision producing legal or similarly significant effects based solely on automated processing. If a technical or security check prevents an order, contact us to request an explanation and human review. Any use of significant automated decision-making must meet the specific transparency and safeguard requirements of the GDPR.

14. Your privacy rights

Subject to the conditions in the GDPR, you may ask to:

Access your personal information and receive a copy.
Correct inaccurate information and complete incomplete information.
Erase information where there is no remaining lawful reason to retain it.
Restrict processing in the circumstances provided by law.
Receive data you supplied in a structured, commonly used, machine-readable format, and have it transmitted to another controller where the portability right applies.
Object, on grounds relating to your situation, to processing based on legitimate interests.
Object at any time to direct marketing, including related profiling.
Withdraw consent at any time, without affecting the lawfulness of earlier processing based on that consent.

Send requests to info@gradinarusieraden.nl. Explain what you want and identify the relevant account or order if useful. You do not need to provide unnecessary information to make a request. We normally respond within one month. For complex or numerous requests, the law permits up to two additional months; we will explain an extension within the first month.

Requests are normally free. Any refusal or permitted fee must meet the GDPR's conditions and will be explained. Some information cannot immediately be erased, for example a legally required invoice or evidence needed for a legal claim. Where a right is limited, we will explain the relevant reason rather than simply ignoring your request.

15. Complaints and policy updates

You may complain directly to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or another competent supervisory authority, including in the EU country where you live or work. You do not have to contact us first, although we welcome the opportunity to resolve your concern.

We may update this policy when store functions, providers or legal requirements change. The revision date appears at the top. Material changes will be communicated as required, and any new consent will be sought where necessary. A change to this text alone does not authorise an incompatible use of previously collected data.

For questions or a copy of this policy, contact Gradinaru Sieraden & Reparaties / GradinaruSiera at info@gradinarusieraden.nl, +31 6 57760222, or Arend Verkleijstraat 34, 2172 BE Sassenheim, the Netherlands.