Privacy Policy

This Privacy Policy describes how we collects, uses, and discloses your Personal Information when you visit or make a purchase from the Site.

Title

Last updated: August 2025

1. Contact

2. What Data We Collect

3. How We Use Your Data

4. Legal Basis for Processing

5. Sharing Your Data

6. Cookies

7. Data Storage & Security

8. Your GDPR Rights

9. Changes

10. Complaints

1. contact

This Website is operated by Ninefold, acting under the trade name NUNA Matcha, registered with the Dutch Chamber of Commerce under number 94706670.

If you have questions, requests regarding your data, or wish to exercise your privacy rights, you can contact us via:
📧 hello@nunamatcha.com
🌍 www.nunamatcha.com

If you are not satisfied with our response, you may file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

2. what data we collect

When using our Website, we may collect and process the following categories of personal data:

Identity Data: full name, email address, phone number
Contact Data: billing and shipping addresses
Order Data: products purchased, order history, delivery status
Payment Data: transaction ID, masked card info (via third-party providers – we do not store full card details)
Technical Data: IP address, browser type and version, device type, time zone setting, operating system, platform, and usage data
Marketing & Communication Preferences: email newsletter opt-in, interaction with marketing emails
Cookies & Tracking Data: please refer to our Cookie Policy for more information

We do not collect special categories of personal data (e.g. health, political beliefs).

3. how we use your data

We use your personal data only for specified, explicit, and legitimate purposes:

To process and deliver your orders, including payment and shipping
To communicate with you about your order or customer service request
To provide you with information, products, and services you request from us
To send marketing communications, promotions, or newsletters (only with your explicit consent)
To administer, secure, and improve our Website (including troubleshooting, testing, analytics)
To comply with legal and fiscal obligations (e.g. tax reporting)
To detect and prevent fraud and security breaches

We never use your data for profiling or automated decision-making without your knowledge.

4. legal basis for processing

We process your personal data based on one or more of the following legal bases under Article 6 of the GDPR:

Consent (Article 6(1)(a)) – for marketing emails or newsletter subscriptions
Contractual necessity (Article 6(1)(b)) – to fulfill your purchase or respond to your inquiries
Legal obligation (Article 6(1)(c)) – e.g. storing invoices for tax purposes
Legitimate interest (Article 6(1)(f)) – e.g. to improve our website, prevent fraud, or ensure customer satisfaction

You may withdraw your consent at any time by contacting us or unsubscribing from email communications.

5. sharing your data

We do not sell your personal data. We only share your data with third parties when strictly necessary, and under contractual agreements ensuring data protection compliance:

Shipping providers (e.g. PostNL, DHL)
Payment processors (e.g. Shopify Payments, Mollie)
Email marketing services (e.g. Klaviyo, Mailchimp)
Analytics tools (e.g. Google Analytics)
Hosting providers and IT service companies

All third parties we work with are GDPR-compliant and subject to data processing agreements (DPAs).

In rare cases, we may disclose your data to legal authorities if required by law or judicial order.

6. cookies

We use cookies and similar technologies to:

Operate and improve our website
Analyse usage statistics
Store your preferences (e.g. language, currency)
Provide you with personalised content or marketing (only with consent)

You can manage or revoke cookie consent anytime through our Cookie Banner or browser settings. Please refer to our [Cookie Policy] for detailed information.

7. data storage & security

We take appropriate technical and organizational security measures to protect your personal data, including:

Secure HTTPS encryption
Firewalls and access control
Regular software updates and data backups
Limiting access to authorised personnel only

We store your data on secure servers located in the EU or with providers offering adequate protection under GDPR (e.g. EU-U.S. Data Privacy Framework or SCCs).

Data Retention:
We retain personal data only as long as necessary for the purposes described:

Order and invoicing data: 7 years (in line with Dutch tax regulations)

Marketing consent: until withdrawn

Customer service records: up to 2 years after the last contact

8. cookies

As a data subject under the GDPR, you have the following rights:

Right of access – to view the personal data we hold about you
Right to rectification – to correct incorrect or outdated data
Right to erasure – to have your data deleted (“right to be forgotten”)
Right to restrict processing – to limit how we use your data
Right to data portability – to request a copy of your data in a common format
Right to object – to object to direct marketing or legitimate interests
Right to withdraw consent – at any time, without affecting prior lawful processing

To exercise any of these rights, please email: hello@nunamatcha.com. We may require proof of identity.

9. changes

We reserve the right to update this Privacy Policy at any time to reflect changes in our practices, services, or legal obligations.
The latest version will always be posted on our Website with the date of the most recent update.

10. complaints

If you believe your data is not being processed in accordance with this policy or the GDPR, you have the right to file a complaint with:

Autoriteit Persoonsgegevens (Dutch Data Protection Authority)
📍 Bezuidenhoutseweg 30, 2594 AV The Hague, Netherlands
🌍 https://autoriteitpersoonsgegevens.nl/enhttps://autoriteitpersoonsgegevens.nl/en