Privacy policy

Pavelo ("we", "us") respects your privacy and processes your personal data solely in accordance with the General Data Protection Regulation (GDPR). This policy explains what data we collect, what we use it for, who we share it with and what rights you have.

1. What data we collect

• Order details: name, email address, delivery and billing address, phone number and your order history.
• Account details: if you create an account, your email address and an encrypted (hashed) password.
• Affiliate details: for affiliate partners: name, email address, (optional) company name and website, and payout details.
• Cookies & tracking: a shopping cart cookie and, when you use an affiliate link, an attribution cookie (aff_ref) to credit a sale to the right partner. If you choose 'accept all' in the cookie banner, the Meta pixel also sets an advertising cookie (_fbp).
• Technical data: IP address and browser information, for security, fraud detection and the correct functioning of the site.

2. What we use your data for

• Processing and delivering your order and handling payments.
• Sending order and service messages by email.
• Managing your account and (for partners) the affiliate programme, including commission calculation and payout.
• Preventing misuse and fraud, and securing the platform.
• Meeting legal obligations (such as a tax retention requirement).

3. Third parties that receive data

We only share data when it is necessary for the purposes above, with processors that are themselves GDPR compliant:

• Shopify: handling orders and checkout (order processing, payment flows).
• Railway / PostgreSQL: secure database hosting of account, order and affiliate data.
• Vercel: hosting of the website and logging for availability and security.
• Resend: sending transactional emails (such as order confirmations).
• Meta (Facebook/Instagram): advertising measurement. With marketing consent the Meta pixel loads in your browser; in addition, when you place an order Meta receives a hashed representation of your email address server-side for conversion measurement. Raw personal data never leaves our server.
• Stripe / Mollie: payment processing (once these payment methods go live).

We never sell your data to third parties.

4. How long we keep data

We do not keep your data longer than necessary. Order data is kept in line with the legal (tax) retention period of seven years. Account and affiliate data is kept for as long as your account is active; after that we delete or anonymise it. Cookies have a limited lifespan (the affiliate cookie lasts up to 30 days).

5. Your rights

Under the GDPR you have the right to:

• Access to the data we hold about you.
• Rectification of incorrect or incomplete data.
• Erasure of your data (the "right to be forgotten").
• Restriction of or objection to the processing.
• Portability of your data.

You can submit a request via the email address below. You also have the right to lodge a complaint with the Dutch Data Protection Authority.

6. Contact

Questions about this privacy policy or about your data? Email us at info@pavelo.eu.