Privacy policy

Last updated: 27 September 2026

Who is responsible?

Harun Ali, trading as HarunShop (sole proprietorship), is responsible for processing personal data in this webshop. Address: IJsvogelplein 250, 3334 XM Zwijndrecht, Netherlands. KvK: 98925334. Privacy questions and requests: support@harunshop.com or +31 6 86056674.

What data do we use and why?

• Orders and delivery: name, contact details, billing and delivery addresses, ordered products, payment status and order history. We need this to fulfil your contract, process payment and provide customer service.
• Personalisation: text, name, font, colour, placement, notes and uploaded logos or images. We use these to fulfil and check your order and answer questions about it. Only supply necessary data and files that you are entitled to share.
• Contact and quotes: details and messages you provide. We process these to answer your question or prepare a contract at your request.
• Administration: order, payment and invoice data that we must retain under legal obligations.
• Security: technical data such as IP address and device and session data. Our legitimate interest is to secure the shop, prevent abuse and resolve problems, respecting your privacy.
• Cookies and marketing: where required, we rely on your consent for non-essential analytics, personalisation and marketing. You can withdraw consent. You can unsubscribe from marketing emails using the unsubscribe link.

We receive data from you, through use of the shop and from the payment and delivery services involved. Without the data needed for ordering or personalisation, we may be unable to fulfil your order.

Who do we share data with?

Our shop runs on Shopify. To fulfil orders, necessary data is processed by Shopify, the selected payment service, relevant production and delivery providers and services supporting the shop. If you leave a review through Judge.me, it processes the information supplied for that purpose. A public review may display your chosen name and review content. We may also share data when required by law.

Shopify may act as an independent controller for certain services of its own. See Shopify’s consumer privacy policy. Shopify privacy settings provide information about your choices and rights with Shopify.

Processing outside the European Economic Area

Using international providers, including Shopify, may involve processing data outside the EEA. This requires lawful safeguards, such as an adequacy decision or standard contractual clauses. Shopify describes international transfers and safeguards in its privacy information. You may ask us for details of the processing involved.

Retention periods

We do not retain data longer than necessary for the purpose for which it was collected. Basic accounting records and invoices are generally subject to a statutory seven-year retention period. This does not automatically mean all uploaded design files are needed for seven years.

For contact messages and personalisation files, the necessary period depends on order fulfilment, any ongoing complaints and the need to handle legal claims. No fixed automatic deletion period applies to these files. You may ask which data is still needed and request deletion; we take any legal obligations into account.

Cookies and your choices

Necessary cookies support the cart, checkout and security. The banner lets you accept or reject non-essential cookies. Use the Cookie preferences link at the bottom of the website to change your choice later. Withdrawing consent does not affect the lawfulness of earlier processing.

Your personal data rights

Subject to legal conditions, you may request access, rectification, erasure, restriction or portability of your data. You may object to processing based on legitimate interests and to direct marketing at any time. You may withdraw consent. Send your request to support@harunshop.com. We may request information needed to verify your identity and normally respond within one month; any legally permitted extension will be explained.

Have a complaint about processing? Contact us. You may also complain to the Autoriteit Persoonsgegevens, the Dutch data protection authority.

Security and changes

We take appropriate technical and organisational measures to protect personal data. No digital service can guarantee absolute security. We update this policy when our processing or services change. The date at the top shows the latest amendment.