Privacy notice

Introduction

Guajii (“we”, “us”, “our”) respects your privacy and is committed to protecting your personal data. This Privacy Notice explains how we collect, use, share, and protect your personal data when you use our website (www.guajiidesign.com) and related services (the “Services”), as well as your rights under applicable law.

If you do not agree with this Privacy Notice, please do not use our Services.

Controller and contact details

Guajii is the data controller responsible for the processing of your personal data.

• Business name: Guajii
• Address: Afroditekade 173, 1076 DZ Amsterdam, The Netherlands
• KvK number: 77094379
• Email: finance@guajiidesign.com

You can contact us using the details above for any privacy-related questions or to exercise your rights.

Personal data we collect

We collect personal data you provide directly and data collected automatically when you use our Services.

• Identity and contact data: name, email address, postal address, phone number
• Payment data: payment details and transaction information (processed by our payment providers; we do not store full card details)
• Account and order data: login credentials, order history, shipping information
• Communications data: messages, customer service requests, and correspondence
• Technical and usage data: IP address, browser type, device information, pages visited, referring URLs, and analytics data
• Public contributions: reviews or content you post on our website

Aggregated or anonymised data that cannot identify you is not considered personal data.

Legal bases for processing

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on the following legal bases:

• Performance of a contract: to process and fulfil your orders, manage payments, deliver products, and provide customer support
• Legal obligations: to comply with tax, accounting, and regulatory requirements
• Legitimate interests: to operate, improve, and secure our Services, prevent fraud, and send essential service communications; we ensure these interests are not overridden by your rights and freedoms
• Consent: for marketing communications and the use of non-essential cookies; you can withdraw your consent at any time

How we use your data

• Process and fulfil orders, payments, and returns
• Provide customer service and respond to enquiries
• Manage accounts and authentication
• Send transactional communications such as order confirmations and updates
• Send marketing communications where you have opted in
• Improve website functionality, performance, and security
• Detect and prevent fraud or misuse
• Perform analytics to understand how our Services are used

Sharing data and international transfers

We share personal data with trusted third-party service providers that help us operate our business, including:

• Shopify (e-commerce platform)
• Payment providers
• Hosting and IT providers
• Email and marketing platforms
• Analytics providers such as Google Analytics

These providers process data only on our instructions and under appropriate contractual safeguards.

Some providers may process personal data outside the EEA, including in the United States. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs), and we conduct transfer impact assessments where required. Where applicable, we also rely on providers certified under the EU–US Data Privacy Framework.

When you leave our website and visit third-party websites, their privacy policies apply.

Payment processing

Our store is hosted on Shopify. Payment information is processed in accordance with the Payment Card Industry Data Security Standard (PCI-DSS).

We do not store full payment card details on our servers. Transaction data is retained only as necessary to complete purchases and comply with legal obligations.

For more information, please refer to Shopify’s Privacy Policy and Terms of Service.

Cookies and similar technologies

We use cookies and similar technologies to operate and improve our website.

• Strictly necessary cookies: required for core functionality
• Functional cookies: remember your preferences
• Analytics cookies: help us understand website usage (configured in a privacy-friendly way where possible)
• Marketing cookies: used to deliver relevant advertising

Non-essential cookies are only placed with your consent via our cookie banner. You can withdraw or modify your consent at any time through your browser settings or our cookie settings tool.

For Dutch compliance, visitors must be able to refuse non-essential cookies as easily as accept them, and consent must be informed and freely given.

Data retention

We retain personal data only for as long as necessary for the purposes described above and to comply with legal obligations.

• Order and transaction data: up to 7 years (tax and accounting obligations in the Netherlands)
• Account data: for the duration of the account and up to 2 years after inactivity
• Customer service communications: up to 2 years
• Analytics data: typically 14–26 months (depending on provider settings)

Where possible, data is anonymised or deleted earlier.

Your rights

If you are located in the EEA, UK, or Switzerland, you have the right to:

• Access your personal data
• Correct inaccurate or incomplete data
• Request deletion of your data
• Restrict processing in certain cases
• Object to processing based on legitimate interests or direct marketing
• Request data portability
• Withdraw consent at any time

We will respond to your request within one month of receipt.

You also have the right to lodge a complaint with a supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens.

Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption (TLS/SSL), access controls, and secure systems.

While we take security seriously, no system is completely secure. In the event of a data breach, we will notify affected users and relevant authorities without undue delay where required by law.

Children

Our Services are not intended for individuals under the age of 16, and we do not knowingly collect personal data from children without parental consent.

If we become aware that we have collected personal data from a child without valid consent, we will take steps to delete such data.

Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in legal requirements or our practices.

Where required, we will notify you of significant changes and request consent where applicable.

Contact and complaints

If you have any questions or wish to exercise your rights, please contact us at finance@guajiidesign.com.

You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens: www.autoriteitpersoonsgegevens.nl.