Privacy Policy

Last updated: 30 August 2026

This Privacy Policy explains how S&S Ecommerce, trading as Velarosy, collects, uses, shares, stores, and protects personal data when you visit or use velarosy.com, place an order, contact us, exercise your consumer rights, or otherwise interact with our services.

We process personal data in accordance with applicable data protection law, including the EU General Data Protection Regulation (GDPR). This Privacy Policy is intended to provide the information required under Articles 13 and 14 GDPR. It does not limit any rights available to you under applicable law.

1. Who We Are and Who Is Responsible for Your Data

Data controller: S&S Ecommerce, trading as Velarosy
Address: Elizabeth Anscombestraat 363, 1062 LE Amsterdam, Netherlands
Email: contact@velarosy.com
Phone: +31 6 15721897
VAT number: NL869097660B01
Trade Register number: 99701960

For the purposes of the GDPR, S&S Ecommerce is the controller of personal data processed for the purposes described in this Privacy Policy, except where another party is independently responsible for a specific processing activity under applicable law.

2. Personal Data We Collect

Depending on how you interact with Velarosy, we may collect or process the following categories of personal data:

Identity and contact data: name, email address, telephone number, billing address, shipping address, and other contact details you provide.
Order and transaction data: products ordered or viewed, order number, order value, discounts, shipping method, delivery status, returns, withdrawals, refunds, exchanges, complaints, and related transaction history.
Payment-related data: payment method, payment status, transaction identifiers, and limited payment information made available to us by payment providers. Full payment-card details are generally processed directly by payment providers and are not stored by Velarosy unless explicitly stated otherwise.
Account data: account identifiers, login-related information, saved addresses, preferences, and order history where customer account features are used.
Communications: messages, emails, support requests, product questions, return or warranty communications, and other information you provide when contacting us.
Device and usage data: IP address, browser type, device information, operating system, referral information, approximate location derived from technical data, pages visited, interactions with our website, and similar technical information.
Cookie and preference data: cookie identifiers, consent choices, marketing preferences, and information generated through cookies or similar technologies as described below.
Fraud and security data: technical signals, transaction information, and other information reasonably necessary to detect, investigate, or prevent fraud, abuse, security incidents, or unlawful activity.

We aim to collect only personal data that is adequate, relevant, and necessary for the purposes described in this Privacy Policy.

3. How We Obtain Personal Data

We may obtain personal data:

directly from you, for example when you place an order, create an account, contact us, submit a return or withdrawal request, or subscribe to marketing;
automatically when you use our website, through cookies, similar technologies, server logs, and technical systems;
from service providers that help us operate our store, process payments, fulfil and deliver orders, provide customer support, prevent fraud, or provide other services on our behalf; and
from business partners or other third parties where this is permitted by law and relevant to the services you use.

4. Why We Use Personal Data and Our Legal Bases

We process personal data only where we have an appropriate legal basis. Depending on the processing activity, we may rely on one or more of the following:

Performance of a contract or steps requested before entering into a contract (Article 6(1)(b) GDPR): to process and fulfil orders, take payment, arrange delivery, provide order updates, manage customer accounts, handle ordinary customer-service requests, and administer contractual returns, exchanges, warranties, and other purchase-related matters.
Compliance with a legal obligation (Article 6(1)(c) GDPR): to meet tax, accounting, consumer-protection, product, record-keeping, legal-guarantee, withdrawal, refund, and other obligations imposed by applicable law.
Our legitimate interests or those of a third party (Article 6(1)(f) GDPR): where necessary and balanced against your rights, for example to secure our website, detect and prevent fraud or abuse, protect our business and customers, establish or defend legal claims, maintain appropriate business records, improve the reliability and operation of our services, and understand non-intrusive aggregate business performance.
Your consent (Article 6(1)(a) GDPR): where required, for example for certain direct marketing communications and for non-essential cookies or tracking technologies. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

We do not use the performance of a contract as a legal basis for processing that is not genuinely necessary to provide the purchased service, such as behavioural advertising.

5. Orders, Payments, Delivery, Returns, and Customer Support

When you place an order, we use the information required to create and manage the purchase, process payment, communicate with you, fulfil the order, arrange shipping and tracking, and provide after-sales support. We may share the minimum necessary information with payment providers, fulfilment partners, and delivery carriers for these purposes.

When you exercise a right of withdrawal, request a return, make a warranty claim, or contact customer support, we process the information necessary to identify the order, assess and administer the request, communicate with you, and comply with our contractual and legal obligations.

6. Marketing Communications

Where required by law, we send electronic marketing communications only with your consent. Where applicable law permits marketing to existing customers without separate consent for similar products or services, we will provide a clear and easy opportunity to object.

You may unsubscribe from marketing emails at any time by using the unsubscribe option in the message or by contacting us. Withdrawing from marketing does not stop essential service communications relating to an order, account, legal notice, return, refund, or customer-support request.

7. Cookies and Similar Technologies

Our website may use cookies and similar technologies for purposes such as operating the website, remembering settings, security, analytics, and advertising.

Strictly necessary or technical technologies: these may be used without consent where permitted by law because they are necessary to provide a service you requested or to operate essential website functions.
Non-essential analytics, advertising, profiling, or similar technologies: where consent is legally required, these technologies should not be activated until you have provided valid consent.

Where a cookie preference or consent tool is made available, you can use it to accept, reject, or change choices for non-essential technologies. Withdrawing consent does not affect processing that occurred lawfully before withdrawal.

Specific cookies, providers, purposes, and retention periods may also be described in our cookie preference tool or cookie notice where available. Browser settings may provide additional controls, but blocking strictly necessary cookies can affect website functionality.

8. How We Share Personal Data

We may disclose personal data only where necessary and lawful, including to the following categories of recipients:

Shopify: our ecommerce platform and hosting provider, which provides infrastructure used to operate the store and checkout.
Payment service providers: to authorize, process, secure, and reconcile payments and refunds.
Fulfilment, logistics, and delivery providers: to prepare, ship, track, and deliver orders and handle relevant delivery issues.
Customer-support and communication providers: where used to manage customer communications or service requests.
Email and marketing service providers: where used lawfully to send communications or administer marketing preferences.
Analytics, advertising, and technology providers: only to the extent permitted by law and, where required, based on valid consent.
IT, security, fraud-prevention, and hosting providers: where necessary to protect and operate our systems.
Professional advisers: such as accountants, legal advisers, insurers, or auditors where reasonably necessary.
Public authorities, courts, regulators, or law-enforcement bodies: where disclosure is required by law or necessary to establish, exercise, or defend legal claims.

Service providers that process personal data on our behalf are required, where applicable, to process the data only in accordance with appropriate contractual and legal safeguards.

9. Shopify

Velarosy is hosted on Shopify. Shopify processes personal data to provide and secure the ecommerce platform and related services. Depending on the Shopify service or feature involved, Shopify may act as our processor and, for certain processing activities, may have its own responsibilities under applicable data protection law.

Information submitted through our store may therefore be processed through Shopify systems and infrastructure. You can find further information about Shopify's privacy practices in Shopify's published privacy information.

10. International Transfers

Some service providers may process personal data outside the European Economic Area (EEA). Where personal data is transferred to a country that is not covered by an applicable adequacy decision, we use or require appropriate safeguards where legally necessary, such as the European Commission's Standard Contractual Clauses, together with supplementary safeguards where appropriate.

You may contact us if you would like further information about the safeguards relevant to an international transfer of your personal data.

11. How Long We Keep Personal Data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and to meet legal, tax, accounting, consumer-protection, dispute-resolution, and security requirements.

Retention periods may differ by category. In particular:

Order, invoice, and core accounting records: generally retained for at least 7 years where required by Dutch tax and record-keeping law. Certain records may need to be retained longer where a specific legal or tax regime requires it.
Returns, withdrawals, warranty, complaints, and customer-support records: retained for as long as reasonably necessary to administer the matter and thereafter where needed for legal obligations, evidence, or limitation periods.
Marketing data: retained while you remain subscribed or until the relevant purpose ends. We may keep limited suppression information where necessary to respect an opt-out or demonstrate compliance.
Account data: retained while the account is active and thereafter only to the extent necessary for legal, contractual, security, or record-keeping obligations.
Technical and security logs: retained only for a period proportionate to operational, security, fraud-prevention, and legal needs.
Cookie and consent records: retained according to the relevant technology, consent setting, and applicable legal requirements.

When personal data is no longer required, we delete, anonymize, or otherwise securely dispose of it where appropriate.

12. Security

We use reasonable technical and organisational measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction. No online service can guarantee absolute security, and you should use appropriate care when communicating sensitive information electronically.

13. Your Rights Under the GDPR

Subject to the conditions and limitations of applicable law, you may have the right to:

receive information about how your personal data is processed;
request access to personal data we hold about you;
request correction of inaccurate or incomplete personal data;
request erasure of personal data in certain circumstances;
request restriction of processing in certain circumstances;
receive personal data in a structured, commonly used, machine-readable format and, where applicable, request portability to another controller;
object to processing based on legitimate interests, including on grounds relating to your particular situation;
object at any time to processing of your personal data for direct marketing;
withdraw consent at any time where processing is based on consent; and
not be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you, except where such processing is lawfully permitted and the required safeguards apply.

To exercise a privacy right, contact us at contact@velarosy.com. We may ask for information reasonably necessary to verify your identity and protect your data.

We will respond without undue delay and normally within one month of receiving a valid request. Where permitted by law, that period may be extended for complex or numerous requests, in which case we will inform you within the initial one-month period.

These rights are not absolute. For example, we may need to retain certain information to comply with a legal obligation, establish or defend legal claims, or complete a transaction you requested.

14. Automated Processing and Fraud Prevention

Our ecommerce, payment, or security systems may use automated signals to identify suspected fraud, abuse, or security risks. To the extent a decision based solely on automated processing would produce legal effects or similarly significant effects for you, we will apply the rights and safeguards required by applicable law.

15. Children's Privacy

Our store is not directed to children. We do not knowingly seek to collect personal data from children who are not legally able to provide the relevant information or consent under applicable law. If you believe a child has provided personal data to us inappropriately, please contact us so we can assess the request and take appropriate action.

16. Third-Party Websites

Our website may contain links to websites or services operated by third parties. Their processing of personal data is governed by their own privacy notices, and we are not responsible for third-party privacy practices that are outside our control.

17. Complaints to a Supervisory Authority

If you believe that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority, including in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement.

Customers in Italy may contact the Garante per la protezione dei dati personali. As our business is established in the Netherlands, the Autoriteit Persoonsgegevens may also be a relevant supervisory authority depending on the circumstances. You may exercise this right without first contacting us, although we welcome the opportunity to address your concern directly.

18. Changes to This Privacy Policy

We may update this Privacy Policy when our processing activities, services, or legal obligations change. The current version will be published on this page with an updated revision date. Where legally required, we will provide additional notice of material changes.

19. Contact Us

For privacy questions or to exercise your rights, contact:

S&S Ecommerce, trading as Velarosy
Elizabeth Anscombestraat 363
1062 LE Amsterdam
Netherlands
Email: contact@velarosy.com
Phone: +31 6 15721897
VAT number: NL869097660B01
Trade Register number: 99701960