Privacy Policy

Last updated: 4 August 2026

1. Introduction

SC2 Trading B.V., trading as Helmosan, is the data controller. Our registered address is Parklaan 1B, 1777 BA Hippolytushoef, the Netherlands; Chamber of Commerce 57616868; VAT number NL852659763B01. This policy explains which personal data we process, why and how we protect it.

2. Data We Collect

Order Data

When you place an order, we collect: name, email address, delivery address, and payment information. Payments are securely processed via Buckaroo; we do not store credit card numbers.

Technical Data

We use functional cookies for the shopping cart and your language preference. Analytical data is only collected after your explicit consent.

Newsletter data

When you subscribe to the newsletter, we store your name, email address, language preference, subscription time and where you gave consent. If you do not confirm within 24 hours, we delete the unconfirmed request no later than 7 days after the link expires, so within 8 days of your request.

3. How We Use Your Data

• Processing and shipping your orders
• Sending order confirmation emails
• Improving our website and services
• Complying with legal obligations
• Sending the newsletter when you have given consent

Legal bases

We process data to perform our contract with you (orders and accounts), to comply with legal obligations, for our legitimate interest in keeping the webshop secure and reliable, and on the basis of your consent for newsletters and non-essential analytics.

4. Data Sharing

We use only necessary service providers: Supabase for accounts, database and storage; Netlify for hosting; Buckaroo for payments; MyParcel and carriers for delivery; Resend for transactional email; Brevo for newsletters; Sanity for content management; Plausible and Google Analytics for consent-based analytics; Meta for marketing measurement after separate consent; and e-Boekhouden for accounting. They receive only the data needed for their task. Where processing takes place outside the EEA, we use appropriate safeguards such as an adequacy decision or EU Standard Contractual Clauses.

5. Your Rights (GDPR)

You have the right to access, rectification, erasure, restriction, portability and objection. You may withdraw consent at any time without affecting earlier lawful processing. Contact us through the contact form. You may also lodge a complaint with the competent data protection authority.

6. Cookies

Necessary browser storage holds your cart, language, privacy choice, temporary popup state and secure Supabase sign-in session. Your full customer profile is not stored in localStorage. Plausible and Google Analytics load only after analytics consent. Meta Pixel and Conversions API load only after separate marketing consent and process event time and name, a cleaned page URL, product codes, quantities, value, browser agent and, when available, Meta fbp/fbc cookies. This integration sends no name, email address, telephone number, address or IP address to Meta. You can change your choice through ‘Privacy settings’ in the footer.

7. Retention Period

We retain order, invoice and payment data for 7 years for tax obligations. Account data is kept while your account exists and is deleted or anonymised after a valid request, unless a legal duty applies. Newsletter data is kept during the subscription; after opt-out we retain only the minimum evidence needed to honour and demonstrate the opt-out and earlier consent. Security and abuse data is kept as briefly as possible.

8. Contact

Use the contact form for privacy questions. You may also lodge a complaint with the Dutch Data Protection Authority or the authority in your country of residence.

contact form