Privacy Policy
This Privacy Policy explains how Decotize (“we,” “us,” or “our”) collects, uses, stores, and protects your personal information when you visit decotize.com or place an order with us. Decotize is operated by KEUN Marketing B.V., a private limited company established in Netherlands, which is the data controller for all personal data processed through this website. We sell to customers in the United States. Because we are established in the EU, the General Data Protection Regulation (GDPR) governs our processing — which means you benefit from EU-level protections regardless of where you live.
Data controller
KEUN Marketing B.V. — trading as Decotize
As the data controller, KEUN Marketing B.V. determines the purposes and means of processing your personal data in connection with the decotize.com online store. Shopify acts as a data processor on our behalf for platform and payment functions.
Registered entity
KEUN Marketing B.V.
Lintelerweg 60
7556 PD Hengelo
Netherlands
KvK 98931644 · VAT NL868708598B01
Privacy contact
For all privacy-related requests:
info@decotize.com
+31 6 45675135
decotize.com
Data Protection Officer: KEUN Marketing B.V. is not required to appoint a Data Protection Officer under Article 37 GDPR, as our core activities do not involve large-scale systematic monitoring or large-scale processing of special categories of data. Privacy requests are handled directly by our team at the address above.
Data We Collect
We collect only the personal data that is necessary to fulfil your order, provide customer support, and operate our store lawfully. We do not collect data we do not need, and we do not retain data beyond the periods described in this Policy.
Personal Data
Full name
Email address
Shipping address
Billing address
Phone number (if provided)
IP address
Browser type and version
Device type and operating system
Order Data
Items purchased and quantities
Order history
Payment method type (e.g., Visa, Mastercard, Apple Pay — not full card number)
Order number and transaction reference
Shipping carrier, tracking number, and customs declaration details
We never store full card numbers, CVV codes, or card expiry dates
What we do not collect
We do not collect special categories of personal data under Article 9 GDPR — health information, racial or ethnic origin, religious or philosophical beliefs, trade union membership, genetic or biometric data, or data concerning sex life or sexual orientation. We do not knowingly collect personal information from children under 16. If you believe a minor has provided us with personal data, please contact us at info@decotize.com and we will delete it promptly.
How We Use Your Data
We use your personal data only for the purposes listed below. Under the GDPR we must have a lawful basis for every processing activity: contractual necessity (Art. 6(1)(b)) to fulfil your order, legitimate interest (Art. 6(1)(f)) for fraud prevention and site improvement, legal obligation (Art. 6(1)(c)) for tax and customs compliance, and consent (Art. 6(1)(a)) for marketing.
Order fulfilment
Processing and confirming your order
Payment processing via Shopify Payments
Preparing customs documentation for export from the EU and import into the US
Arranging shipping and providing tracking updates
Managing returns, refunds, and exchanges
Customer service
Responding to your enquiries and support requests
Handling warranty and after-sales matters
Sending order confirmations and shipping notifications
Following up on unresolved issues
Legal & compliance
Fraud prevention and detection
Dutch tax and accounting obligations
Customs and export documentation requirements
Responding to lawful government or regulatory requests
Site security and abuse prevention
Marketing (with consent)
Sending promotional emails and product updates where you have opted in
Site improvements via aggregated analytics data
You may unsubscribe at any time via the link in any marketing email, or withdraw consent at any time without affecting prior lawful processing
We do not send marketing without your consent
Data Sharing & Third Parties
We share your personal data only with the service providers that are essential to operating our store and fulfilling your order. All third-party providers act as processors under a data processing agreement and are bound by confidentiality obligations. We never sell your personal data to anyone, for any purpose, ever.
Decotize does not sell, rent, trade, or otherwise transfer your personal information to any third party for their own marketing, commercial, or advertising purposes. This includes “sale” and “sharing” as those terms are defined for California residents under the CCPA. Your data is used only to serve you.
Who we share data with
Shopify — our e-commerce platform and payment processor. Processes order, customer, and payment data on our behalf under a data processing agreement.
Payment processors (Shopify Payments / Stripe) — process your payment securely under PCI DSS compliance. We share only what is required to authorise and complete your transaction.
Shipping carriers and customs brokers — including PostNL, DHL, UPS, FedEx, and USPS for final-mile delivery. Your name and delivery address are shared to fulfil shipment, clear customs, and provide tracking.
Customs authorities — Dutch and EU export authorities and US Customs and Border Protection receive the declaration data required by law for your shipment to cross the border.
Google Analytics — aggregated site traffic analysis, with IP anonymisation enabled.
Email service provider (marketing only) — receives your email address solely to send you communications you have consented to receive.
Who we do not share with
Data brokers or data aggregators
Social media platforms for advertising targeting without your consent
Any third party for their own marketing purposes
Any purchaser of personal data — we never sell data
Any party outside the scope of order fulfilment, customs clearance, and support without your explicit consent or a legal obligation requiring us to do so
Shopify as data processor
Shopify processes your data on our behalf and is bound by strict data processing obligations.
Shopify provides the e-commerce platform and payment infrastructure that powers decotize.com. In this role, Shopify acts as a data processor under Article 28 GDPR: it processes your personal data only on our documented instructions and subject to a Data Processing Addendum. Shopify maintains its own privacy programme and security infrastructure, including PCI DSS Level 1 compliance for payment data and SOC 2 certification for platform security.
What Shopify processes
Order data, customer contact details, payment method information, shipping details, and site analytics. Shopify does not use this data for its own marketing or sell it to third parties on our behalf.
Contracting entity
As a merchant established in Europe, our contract is with Shopify International Limited (Dublin, Ireland). Shopify's privacy policy is available at shopify.com/legal/privacy.
International Data Transfers
Decotize is established in Netherlands and its customers are in the United States, so your personal data necessarily moves between the EU and the US. This section explains where your data goes and what legal protections apply to those transfers.
Where your data is processed
Your order data is processed on Shopify infrastructure, which stores data on servers primarily located in the United States and Canada. Our own team accesses that data from Netherlands. Shipping and customs data is transmitted to carriers and to customs authorities in both jurisdictions. In practice this means personal data you provide at checkout may be processed in the EEA, the United States, and Canada.
Transfer safeguards — Chapter V GDPR
Transfers out of the EEA are covered by recognised legal safeguards.
Where personal data is transferred from the EEA to a country outside it, we rely on one of the transfer mechanisms permitted under Chapter V of the GDPR. We do not transfer personal data to any country without an appropriate safeguard in place.
Adequacy decisions
Canada holds a partial adequacy decision from the European Commission for commercial organisations. Transfers to certified US recipients may rely on the EU–US Data Privacy Framework adequacy decision where the recipient is self-certified under it.
Standard Contractual Clauses
Where no adequacy decision covers a transfer, we rely on the European Commission's Standard Contractual Clauses (SCCs), supplemented by a transfer impact assessment and any additional technical measures required.
Legally required disclosures: customs declaration data is transmitted to US Customs and Border Protection because import law requires it. This transfer is made under Article 49(1)(d) GDPR — necessary for important reasons of public interest — and cannot be objected to without preventing your order from being delivered.
Requesting transfer documentation
You may request a copy of the safeguards we rely on for a particular transfer by emailing info@decotize.com with the subject line “Transfer Safeguards”. We will provide the relevant documentation, redacted where necessary to protect commercial confidentiality.
Cookies & Tracking Technologies
We use cookies and similar tracking technologies on decotize.com to enable essential site functions, analyse traffic, and (where you have consented) deliver personalised advertising. You can control cookie use through our consent banner and through your browser settings at any time.
How to opt out
Consent banner: analytics and marketing cookies are only set after you accept them. You can change or withdraw your choice at any time via the cookie preferences link in our site footer.
Browser settings: Most browsers allow you to block or delete cookies via their privacy or security settings. See your browser’s help documentation for instructions.
Google Analytics opt-out: Install the Google Analytics Opt-out Browser Add-on available at tools.google.com/dlpage/gaoptout.
Global Privacy Control: We honour GPC and browser Do Not Track (DNT) signals where technically feasible.
California CCPA opt-out
California residents have the right to opt out of the sale or sharing of personal information for cross-context behavioural advertising purposes.
We do not sell personal information as defined under the CCPA. Analytical and advertising cookies that may share pseudonymous identifiers with third-party platforms are subject to your right to opt out.
To exercise this right, email info@decotize.com with subject “CCPA — Opt Out of Sharing”.
Note on essential cookies
Disabling essential cookies may prevent core site features from functioning correctly, including the shopping cart and checkout process. We recommend keeping essential cookies enabled for the best shopping experience on decotize.com.
Your Rights Under the GDPR
Because KEUN Marketing B.V. is established in Netherlands, the GDPR applies to our processing of your personal data. The rights below are available to you in respect of the data we hold, and we apply them to all our customers regardless of where they live.
How to make a request
Email: info@decotize.com
Subject line: “Privacy Request”
Include your full name, the email address used on your order, and a description of your request. We may ask for information to verify your identity before acting — we will not disclose personal data to someone who cannot demonstrate it is theirs.
We respond within one month, extendable by up to two further months for complex requests, in which case we will tell you within the first month. Requests are handled free of charge.
Right to lodge a complaint
If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority.
Our lead supervisory authority is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Postbus 93374, 2509 AJ Den Haag, Netherlands — autoriteitpersoonsgegevens.nl.
If you are in the EEA you may also complain to the authority in your own country of residence. US residents may contact the FTC or their state attorney general.
We would prefer to resolve directly
We take all privacy concerns seriously and will do our best to address your query promptly and fairly. You always retain the right to go to a supervisory authority, but we ask that you contact us first at info@decotize.com so we have the opportunity to put things right.
California Privacy Rights (CCPA)
If you are a resident of California, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with specific rights regarding your personal information. These rights sit alongside the GDPR rights described in Section 06 — you may rely on whichever gives you the stronger protection.
California Consumer Privacy Act (CCPA / CPRA)
California residents have meaningful rights over their personal information.
The CCPA grants California residents rights including the right to know, delete, correct, and opt out of the sale or sharing of personal information. These rights apply to personal information collected, used, or disclosed by Decotize (KEUN Marketing B.V.) in relation to California residents.
Right to Know
You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share it.
Right to Delete
You have the right to request deletion of personal information we have collected from you, subject to certain exceptions (e.g., where retention is required to complete a transaction, detect fraud, or comply with a legal obligation such as Dutch tax law).
Right to Correct
You have the right to request that we correct inaccurate personal information we maintain about you, taking into account the nature of the data and the purposes of the processing.
Non-Discrimination
We will not discriminate against you for exercising any of your CCPA rights. We will not deny you goods or services, charge different prices, provide a different quality of service, or suggest that you will receive a different quality of service because you exercised your rights.
Opt-out of sale of personal information
We do not sell your personal information as that term is defined under the CCPA. We do not transfer your personal information to third parties in exchange for monetary or other valuable consideration. You therefore have nothing to opt out of with respect to the sale of your data — but we are committed to being transparent about this. If you have questions, please contact us.
How to exercise your rights
Email: info@decotize.com
Subject line: “CCPA Request”
Include your full name, email address, and a description of your request. We may need to verify your identity before processing your request.
We will acknowledge your request within 10 business days and respond in full within 45 days. If additional time is needed (up to a further 45 days), we will notify you of the extension and the reason for it.
Authorised agents
You may designate an authorised agent to make a CCPA request on your behalf. To do so, your agent must provide written permission signed by you, and we may still require you to verify your identity directly with us to confirm the agent’s authority.
We respond to California residents’ requests at no charge. We will not discriminate against you for exercising any of your CCPA rights.
Data Retention & Security
We retain personal data only for as long as necessary for the purposes for which it was collected or as required by applicable law. We implement industry-standard security measures to protect your data against unauthorised access, loss, or disclosure.
Order & accounting data
Retained for 7 years from the end of the financial year of the transaction, as required by the Dutch fiscal retention obligation (Article 52 of the Algemene wet inzake rijksbelastingen) and Book 2 of the Dutch Civil Code. Customs records are retained for the same period. After this period, data is securely deleted or anonymised.
Marketing data
Retained for as long as you remain subscribed to marketing communications. Upon unsubscribe, we retain a minimal suppression record of your opt-out to ensure we do not contact you again. If no commercial email has been sent for 3 years, the record is reviewed and deleted unless you are also an active customer.
Account & customer data
Retained until you request deletion of your account or personal data, subject to our legal retention obligations above. We will confirm deletion within one month of a valid request.
Analytics & cookies
Aggregated analytics data is retained in line with Shopify and Google Analytics retention settings (typically 14–26 months). Session-level cookie data is purged at the end of each browsing session.
Security measures
Your data is protected by industry-standard technical and organisational security controls.
We partner with Shopify, a leading e-commerce platform with robust security infrastructure and a dedicated security team, to store and process your personal information. Payment data is processed exclusively by PCI DSS-certified processors — we never see or store your full card details, CVV, or card expiry date.
Technical measures
SSL/TLS encryption on all pages. PCI DSS compliance via Shopify Payments. Access controls and role-based authentication for internal systems. Regular security updates and monitoring via Shopify’s platform infrastructure.
Organisational measures
Access to personal data restricted to personnel who require it to fulfil orders or provide customer support. Article 28 data processing agreements with all third-party processors. Incident response and breach notification procedures in place.
Data breach notification
While we implement strong security measures, no system is 100% secure and we cannot guarantee absolute security of your personal data. Under Article 33 GDPR we will notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk to your rights and freedoms. Where a breach is likely to result in a high risk to you, we will notify you directly without undue delay, and we will also comply with applicable US state breach notification laws. Breach notifications will describe the nature of the breach, the data involved, likely consequences, and the steps we have taken or will take to address it.
Changes to This Policy & Contact
We review and update this Privacy Policy periodically to reflect changes in our business practices, applicable law, and the services we offer. When we make material changes, we will notify you.
Policy updates
We may update this Privacy Policy at any time. The effective date at the top of this page always reflects the current version. For material changes — those that meaningfully affect your privacy rights or how we handle your data — we will notify you by posting a prominent banner on decotize.com before the changes take effect, and by email where we hold your address and the change requires it. We encourage you to review this Policy periodically.
Governing law
This Privacy Policy is governed by the laws of Netherlands and by the GDPR, except where superseded by mandatory consumer privacy laws applicable in your jurisdiction — including the CCPA/CPRA for California residents and comparable state privacy laws elsewhere in the United States.
Privacy contact
KEUN Marketing B.V. — Decotize
For all privacy-related enquiries, data access requests, correction requests, deletion requests, or complaints, please contact us using the details below. We take every privacy request seriously and will respond promptly and fairly.
Mailing address
KEUN Marketing B.V.
Lintelerweg 60
7556 PD Hengelo
Netherlands
KvK 98931644
Contact details
Email: info@decotize.com
Phone: +31 6 45675135
Website: decotize.com
Subject line: “Privacy Request”
Response times: GDPR requests — within one month, extendable by two further months for complex requests. California residents — CCPA requests within 45 days. We will acknowledge your request within 5 business days of receipt.
Supervisory authority
Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, Netherlands — autoriteitpersoonsgegevens.nl. You may lodge a complaint with them at any time. California residents may additionally contact the California Privacy Protection Agency or the California Attorney General.
Privacy questions?
We respond to all privacy requests within 30–45 days depending on your request type.
info@decotize.comThis Privacy Policy applies to the processing of personal data by Decotize (KEUN Marketing B.V.) via decotize.com. It is effective from 20 July 2026. As a controller established in Netherlands we are subject to the EU GDPR and the Dutch UAVG; California residents are additionally covered by the CCPA/CPRA. KEUN Marketing B.V., Lintelerweg 60, 7556 PD Hengelo, Netherlands · KvK 98931644 · VAT NL868708598B01.