impact.earth
nl

Privacy Policy

Last updated: September 2026

1. Who we are

impact.earth is an online shop for sustainable and fairly made products. impact.earth is a trade name of Tri Summit Consulting, registered with the Dutch Chamber of Commerce under number 91339723, VAT number NL865623132B01. We are responsible for processing your personal data as described in this privacy policy. For questions you can reach us at [email protected].

2. What data we process

  • Account data: name, email address, password (stored encrypted), language preference.
  • Order and address data: delivery address, billing address, phone number, order history and the contents of your orders.
  • Business data: company name, VAT number and Chamber of Commerce number when you order as a business customer.
  • Communication: messages you send us via the contact form or email and, where applicable, your newsletter subscription.
  • Usage data: login times and technical data needed for the security and operation of the shop.

We do not store any payment details. All payments are handled securely by our payment provider Stripe. Your credit card or bank details never reach our systems.

3. Why we process this data

  • To process, ship and deliver your order.
  • To manage your account and provide access to your order history and invoices.
  • To process payments and send invoices.
  • To answer your questions and provide customer service.
  • To send you our newsletter or offers (with your consent).
  • To provide a secure environment (authentication and change logging).
  • To comply with our legal obligations, such as financial administration.

4. Legal bases for processing

We process your data on the basis of: performance of the contract (processing and delivering your order), your consent (for example when creating an account or subscribing to the newsletter), our legitimate interest (a secure and well functioning shop) and legal obligations (the 7 year retention requirement for financial records).

5. Retention periods

  • Account data: for as long as your account is active, plus a maximum of 2 years afterwards.
  • Order and address data: for as long as needed for fulfilment, warranty and returns.
  • Financial data: 7 years after the financial year (legal retention requirement).
  • When you delete your account, your personal data is anonymised. Financial records are retained due to the legal retention requirement.

6. Sharing with third parties

We never sell your data. We only share your data when needed to fulfil your order or when legally required, with:

  • Stripe: for secure payment processing.
  • Suppliers and carriers: your name and delivery address are shared with the supplier and delivery service that ships your order, so the products can be delivered to you.
  • Our shipping and label partner: for creating shipping labels and track & trace.
  • Our IT and hosting partners: for running the shop securely.
  • Government authorities: when we are legally required to do so.

7. Transfers outside the EU

Some products are shipped directly by suppliers that may be based outside the European Union. In that case we only share the data strictly necessary for shipping (name and delivery address) and ensure appropriate safeguards in accordance with the GDPR.

8. Your rights (GDPR)

You have the right to:

  • Request access to your data.
  • Request a copy of your data.
  • Request correction of inaccurate data (much of this you can do yourself via your account).
  • Request deletion of your account and data.
  • Object to processing and withdraw your consent.

You can exercise these rights via the settings in your account or by contacting us at [email protected]. You also have the right to file a complaint with the Dutch Data Protection Authority.

9. Cookies

We use functional cookies that are necessary for the shop to work, such as session cookies for logging in and your shopping cart. We only place analytics or marketing cookies with your consent.

10. Security

We take appropriate technical and organisational measures to protect your data, including encrypted password storage, secure connections (HTTPS), role based access control and change logging.

11. Changes to this privacy policy

We may update this privacy policy from time to time. The most current version is always available on this page, with the date of the last change shown at the top.

12. Contact

For questions about this privacy policy or to exercise your rights, please contact us at [email protected] or via the contact form on our website.