Privacy Policy

Last updated: 28 June 2026

This Privacy Policy explains how Roselva ("we", "us", or "our") collects, uses, discloses, and protects your personal information when you visit https://roselva.com (the "Site"), interact with our customer service, or purchase from our online store. By using the Site or placing an order, you acknowledge that you have read and understood this Privacy Policy.

Section 1 – Data Controller
The data controller responsible for processing your personal information is:

Roselva
Ten Katestraat 35
6531 EE Nijmegen
Netherlands
Chamber of Commerce (KvK): 97550671
Email: info@roselva.com
Phone: +31 6 87216087
Customer service hours: Monday–Friday, 9:00 AM – 6:00 PM CET (4:00 AM – 1:00 PM ET)

Roselva is a Netherlands-based company that ships to customers in the United States, Poland, Denmark, and Spain. As an EU-established controller serving customers in the United States and the European Union, we apply the EU General Data Protection Regulation (GDPR) and, for U.S. residents, applicable U.S. state privacy laws (including the California Consumer Privacy Act / California Privacy Rights Act, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, the Texas Data Privacy and Security Act, the Oregon Consumer Privacy Act, and the Montana Consumer Data Privacy Act).

Section 2 – Personal Information We Collect
Depending on how you interact with the Site, we may collect the following categories of personal information:

Identifiers: first and last name, billing and shipping address, email address, phone number, account login credentials.
Commercial information: orders placed, products viewed, items added to cart, returns, exchanges, purchase history.
Financial information: payment card details (processed by our PCI-DSS-compliant payment providers; we do not store full card numbers), transaction confirmations, billing data.
Internet and device activity: IP address, browser type, device identifiers, operating system, referring URL, pages viewed, session duration, clickstream data.
Geolocation data: approximate location derived from your IP address (city / region level only).
Communications: emails, chat messages, customer service requests, product reviews.
Inferences: shopping preferences, marketing affinities, and audience segments derived from the above to personalise your experience.

We do not knowingly collect sensitive personal information (such as Social Security numbers, precise geolocation, racial or ethnic origin, health, biometric, or sexual orientation data).

Section 3 – How We Use Your Information & Legal Bases
We process your personal information for the following purposes:

To fulfil your order – process payment, prepare shipment, deliver products, manage returns and refunds. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
To provide customer service – respond to inquiries, resolve disputes, support warranty claims. Legal basis: contract performance and our legitimate interest (Art. 6(1)(f)).
To comply with legal obligations – tax, accounting, anti-fraud, consumer protection. Legal basis: legal obligation (Art. 6(1)(c)).
To improve our store – analytics, A/B testing, performance monitoring. Legal basis: legitimate interest (Art. 6(1)(f)).
For marketing – email newsletters, product recommendations, advertising on third-party platforms. Legal basis: your consent (Art. 6(1)(a)); you may withdraw at any time.
To prevent fraud and secure our Site – detect unauthorised access, abuse, or chargebacks. Legal basis: legitimate interest (Art. 6(1)(f)).

Section 4 – How Long We Keep Your Information
We retain personal information only for as long as necessary for the purposes described in Section 3:

Order and transaction data: 10 years (statutory accounting and tax retention).
Customer account data: until account closure plus 3 years of inactivity.
Customer service correspondence: 3 years after the last interaction.
Marketing data (where consent given): until withdrawal of consent or 3 years of inactivity.
Cookies and analytics identifiers: maximum 13 months from collection.
Server logs and security data: 12 months.

When the retention period expires, your data is securely deleted or anonymised.

Section 5 – Recipients of Your Information
We share your personal information with the following categories of recipients, exclusively for the purposes described above and under written data processing agreements (Art. 28 GDPR):

Shopify Inc. – e-commerce hosting, order management, checkout, customer accounts.
Payment processors – Shopify Payments, PayPal, Apple Pay, Google Pay, Shop Pay (PCI-DSS Level 1 certified).
Shipping and logistics partners – fulfilment providers and trusted courier services delivering your order to your U.S. address.
Email and marketing platforms – Klaviyo (transactional and marketing emails), Shopify Email.
Analytics and advertising – Google Analytics, Google Ads, Meta (Facebook / Instagram), TikTok Ads. These partners may process your data to deliver personalised advertising.
Customer support tools – Zendesk / Gorgias (where applicable) and our own support inbox.
Professional advisers – accountants, lawyers, auditors, bound by confidentiality.
Public authorities – tax authorities, law enforcement, courts, where legally required.

We do not sell your personal information in exchange for monetary consideration. We may "share" personal information with advertising partners (such as Google and Meta) for cross-context behavioural advertising, which may qualify as a "sale" or "share" under certain U.S. state laws. See Section 7 for your right to opt out.

Section 6 – International Data Transfers
Roselva is established in the Netherlands (EU). Because we serve U.S. customers and use providers in the United States, your data may be transferred to the U.S. or other countries outside the European Economic Area (EEA).

Where data is transferred outside the EEA, we ensure adequate safeguards through:

Adherence to the EU–U.S. Data Privacy Framework (DPF) by certified U.S. recipients;
European Commission Standard Contractual Clauses (SCCs) where the DPF does not apply;
Additional technical and organisational measures such as encryption in transit and at rest.

You may request a copy of these safeguards by contacting info@roselva.com.

Section 7 – Your Privacy Rights

7.1 – Rights of all customers
Regardless of where you reside, you may at any time:

Contact us to ask what personal information we hold about you;
Request correction of inaccurate or outdated data;
Withdraw your consent to marketing communications;
Ask us to delete your data, subject to legal retention obligations.

To exercise any right, email info@roselva.com with the subject "Privacy Request". We will respond within 30 days. We may ask you to verify your identity before processing the request, and we will not discriminate against you for exercising your rights.

7.2 – California residents (CCPA / CPRA)
If you are a resident of California, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

Right to know – request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the third parties with whom we share it.
Right to delete – request deletion of your personal information, subject to certain exceptions.
Right to correct – request correction of inaccurate personal information.
Right to opt out of sale or sharing – opt out of the "sale" or "sharing" of your personal information for cross-context behavioural advertising. You may exercise this right by visiting our Do Not Sell or Share My Personal Information page, by contacting us at info@roselva.com, or through a recognised Global Privacy Control (GPC) browser signal, which we honour automatically.
Right to limit use of sensitive personal information – we do not knowingly collect sensitive personal information for purposes beyond what is necessary to provide our products and services.
Right to non-discrimination – we will not deny goods or services, charge a different price, or provide a different level of quality because you exercised your CCPA rights.

You may designate an authorised agent to make a request on your behalf. We will verify the agent's authority and your identity before processing.

7.3 – Other U.S. state residents
Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana may have rights similar to those described above under their respective state privacy laws, including the right to access, correct, delete, and opt out of targeted advertising or "sales" of personal data. You may exercise these rights by contacting info@roselva.com. We will respond within the statutory timeframe of your state (typically 45 days).

7.4 – EU / EEA / UK residents (GDPR)
If you are located in the EU, EEA, Switzerland, or the United Kingdom, you have the following rights under the GDPR (Articles 15–22):

Right of access (Art. 15);
Right to rectification (Art. 16);
Right to erasure / "right to be forgotten" (Art. 17);
Right to restriction of processing (Art. 18);
Right to data portability (Art. 20);
Right to object to processing (Art. 21);
Right to withdraw consent at any time (Art. 7(3));
Right not to be subject to a decision based solely on automated processing (Art. 22) – we do not use automated decision-making with legal or similarly significant effects.

Section 8 – How to File a Complaint
If you believe we have not handled your personal information lawfully, please first contact us at info@roselva.com so we can resolve the issue.

You also have the right to lodge a complaint with a supervisory authority:

EU residents: the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) – autoriteitpersoonsgegevens.nl – or your local national DPA.
California residents: the California Privacy Protection Agency (CPPA) – cppa.ca.gov – or the California Attorney General – oag.ca.gov/privacy.
Other U.S. residents: your state Attorney General's office.

Section 9 – Security
We apply reasonable technical and organisational measures to protect your personal information against loss, misuse, unauthorised access, disclosure, alteration, and destruction. These include:

HTTPS / TLS encryption for all data in transit;
AES-256 encryption at rest within Shopify's infrastructure;
PCI-DSS-compliant payment processing;
Access controls, strong authentication, and audit logging;
Regular security reviews and patching.

In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, inform affected customers without undue delay (GDPR Art. 33–34).

Section 10 – Cookies and Similar Technologies
We use cookies and similar technologies to operate our Site, remember your preferences, analyse traffic, and personalise content and advertising. We use three categories:

Strictly necessary – required for the Site to function (cart, checkout, security). Always active.
Analytics – help us understand how visitors use the Site (e.g., Google Analytics). Set with consent where required.
Marketing / advertising – enable personalised advertising (e.g., Meta Pixel, Google Ads). Set with consent.

You can manage your preferences via our cookie banner at any time, or through your browser settings. We honour the Global Privacy Control (GPC) signal as an opt-out of "sale" or "sharing" of personal information.

Section 11 – Children's Privacy
Our Site and products are intended for adults aged 18 and over. We do not knowingly collect personal information from children under 13 in compliance with the U.S. Children's Online Privacy Protection Act (COPPA), nor from minors under 16 in compliance with the GDPR. If you believe a child has provided us with personal information, please contact info@roselva.com and we will delete it promptly.

Section 12 – Marketing Communications
We will only send marketing emails if you have given explicit opt-in consent. You may opt out at any time by clicking the "unsubscribe" link in any marketing email, by adjusting your account preferences, or by emailing info@roselva.com. Transactional emails (order confirmations, shipping updates, customer service replies) are not affected by marketing opt-out.

Section 13 – Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. The "Last updated" date at the top of this page indicates when the policy was last revised. Material changes will be notified by a prominent notice on the Site or by email where appropriate. Your continued use of the Site after such changes constitutes your acceptance of the revised policy.

Section 14 – Related Documents
This Privacy Policy should be read together with our other policies:

Section 15 – Contact Us
For any questions, requests, or concerns about this Privacy Policy or our handling of your personal information, please contact us:

Roselva
Ten Katestraat 35
6531 EE Nijmegen
Netherlands
Email: info@roselva.com
Phone: +31 6 87216087
Customer service hours: Monday–Friday, 9:00 AM – 6:00 PM CET (4:00 AM – 1:00 PM ET)
Chamber of Commerce (KvK): 97550671