Cannoli Box Privacy Policy

Cannoli Box values your privacy. In this privacy policy we explain which personal data we process, why we do so, how long we keep it and what rights you have. This policy applies to all visitors to our website and customers of our online shop.

1. Data controller

The controller responsible for processing personal data is:

Spices B.V. (trading as Cannoli Box)
Lübeck 5
2993 LK Barendrecht, the Netherlands
Chamber of Commerce (KvK) 42201694 · VAT NL861337530B01
Email: info@cannolibox.nl

2. Which data do we process?

Depending on your interaction with us, we process the following categories:

• Identification and contact details: first and last name, email address, phone number, billing and delivery address.
• Order data: order number, products purchased, price, payment date, returns.
• Payment data: transaction data processed by our payment provider (we only receive the status, the last digits of the IBAN and the amount).
• Account and communication data: password (encrypted), customer service correspondence, product reviews.
• Technical data: IP address, browser and device type, language preference, pages visited, cookie IDs (see our Cookie Policy).
• Marketing data: newsletter preferences, open and click behaviour in mailings, participation in promotions.

3. Purposes and legal bases

Purpose	Legal basis (GDPR)
Fulfilling your order, payment and delivery	Art. 6(1)(b) – performance of a contract
Customer service, returns and complaints	Art. 6(1)(b) – performance of a contract
Legal obligations (tax retention obligation, accounting)	Art. 6(1)(c) – legal obligation
Preventing fraud and misuse	Art. 6(1)(f) – legitimate interest
Newsletter and marketing	Art. 6(1)(a) – consent (can be withdrawn via the “unsubscribe” link)
Improving the online shop (analytics, A/B tests)	Art. 6(1)(a) – consent via the cookie banner
Collecting and publishing reviews	Art. 6(1)(a) – consent

4. Recipients (processors)

We only share your data with processors engaged by us, in each case on the basis of a data processing agreement (Art. 28 GDPR):

• Shopify International Ltd. (Ireland) – online shop platform and hosting.
• Shopify Payments – payment processing (iDEAL, credit card, Klarna, Bancontact, Apple Pay, Google Pay).
• DHL Parcel / PostNL – delivery.
• Klaviyo Inc. (USA, EU-US Data Privacy Framework) – email marketing and newsletters.
• Google Ireland Ltd. – Google Analytics 4 (anonymised) and Google Ads conversion tracking.
• Meta Platforms Ireland Ltd. – Facebook/Instagram pixels and advertising.
• Reviews.io / Trustpilot – review collection.
• Our bookkeeper and accountant – for tax obligations.

Transfers to countries outside the EEA only take place under appropriate safeguards (Standard Contractual Clauses or the EU-US Data Privacy Framework).

5. Retention periods

• Orders and invoices: 7 years (statutory tax retention obligation, Art. 52 of the Dutch General Tax Act).
• Customer account data: up to 3 years after the last activity, after which it is deleted or anonymised.
• Customer service correspondence: 2 years.
• Newsletter data: until consent is withdrawn.
• Cookies: see our Cookie Policy.
• IP log data (server): 30 days.

6. Your rights

You have the right to:

• access and obtain a copy of your data;
• rectification of incorrect data;
• erasure (“right to be forgotten”) where legally possible;
• restriction of and objection to processing;
• data portability;
• withdraw consent given earlier, without this affecting processing carried out before the withdrawal.

You can exercise these rights by sending an email to info@cannolibox.nl. For verification purposes we may ask for additional information. We respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), PO Box 93374, 2509 AJ The Hague, the Netherlands (autoriteitpersoonsgegevens.nl).

7. Automated decision-making

We do not use automated decision-making that has legal consequences for you (such as automatic credit refusal). We do apply personalisation in our newsletters based on previous orders.

8. Security

We take appropriate technical and organisational measures to protect your data: TLS encryption, access control with multi-factor authentication, regular backups and periodic security audits of our platform.

9. Cookies

Which cookies and similar technologies we use, and how you can manage your consent, is described in our Cookie Policy.

10. Minors

Our online shop is not aimed at children under the age of 16. We do not knowingly collect data from minors without the consent of a parent or guardian. If you suspect that this has happened, please contact us.

11. Changes

We may amend this privacy policy, for example due to changes in legislation or new services. The current version is always available on this page, with the date of the last update at the bottom. In the event of significant changes, we will inform active customers by email.

12. Contact

Questions or comments about this privacy policy can be sent to:

Spices B.V. (trading as Cannoli Box)
Lübeck 5, 2993 LK Barendrecht, the Netherlands
Email: info@cannolibox.nl

Last updated: 10 November 2026