Privacy policy

 

 

This is the privacy policy of Front Trading, acting under the tradename Pop-Up Surf Shop (“Pop-Up Surf Shop”, “we”, “us” or “our”), registered with the Dutch Chamber of Commerce under number 62299808, and located at Viaductweg 48 (2525 KL), The Hague, The Netherlands.

In this privacy policy we explain how we collect, use and protect your personal data when you visit our website, place an order, or otherwise interact with us. We take the protection of your personal data seriously and handle it with care.

Who is responsible for your data?

Pop-Up Surf Shop is the data controller within the meaning of the General Data Protection Regulation (“GDPR/AVG”) for the processing activities described in this policy.

If you have questions about this privacy policy or about how we use your personal data, you can contact us via:

Email: info@popupsurfshop.eu
Website: www.popupsurfshop.eu

What personal data do we process?

Personal data means any information relating to an identified or identifiable natural person.

Depending on how you use our website or services, we may process the following categories of personal data:

• Contact and identification details - Name, billing address, shipping address, email address, phone number, country and location details.
• Company details (if applicable) - Company name, VAT number and Chamber of Commerce number.
• Order and transaction data - Products purchased, order history, invoice details, payment status.
• Financial data - Payment method and transaction references (payment details themselves are processed by our payment providers).
• Account details - Username and encrypted password (we cannot see or access your password).
• Communication data - Messages sent to us by email, contact forms or customer support.
• Website usage data - IP address, device information, browser type, and website behaviour (via cookies and similar technologies, subject to consent).
• Other personal data - Any information you voluntarily provide to us.

For what purposes do we use your data?

We process your personal data for the following purposes:

• To process and deliver your orders;
• To communicate with you about your purchases or questions;
• To create and manage your customer account;
• To process payments and refunds;
• To comply with legal and administrative obligations (e.g. tax laws);
• To improve our website, products and services;
• To analyse website usage and performance;
• To send newsletters or marketing communications (only if you have given consent);
• To prevent fraud and misuse of our services;
• To share data with third parties where necessary to provide our services.

Legal bases for processing

We only process personal data when we have a valid legal basis under the GDPR. 

These are:

• Performance of a contract - When processing is necessary to fulfil an agreement with you (e.g. processing an order).
• Legal obligation - When we must comply with legal requirements (e.g. tax retention obligations).
• Consent - When you have explicitly given consent (e.g. newsletters, marketing cookies).
• Legitimate interest - When processing is necessary for our legitimate business interests, such as improving our services or preventing fraud, and where your rights do not override those interests.

Is providing personal data mandatory?

In some cases, providing personal data is necessary. For example, we cannot process or deliver an order without your name, address and payment details.

If consent is required for specific processing activities (such as marketing or tracking cookies), you are free to give or withhold that consent. Withholding consent may affect certain functionalities, but not the core operation of the webshop.

Automated decision-making

Pop-Up Surf Shop does not use automated decision-making or profiling that produces legal effects or significantly affects you within the meaning of Article 22 GDPR.

How long do we keep your data?

We do not retain personal data longer than necessary for the purposes for which it was collected, unless a longer retention period is required by law.

Indicative retention periods include:

• Order and invoice data: 7 years (legal tax obligation);
• Customer account data: for as long as the account exists;
• Marketing data: until you withdraw consent or unsubscribe;
• Contact requests: up to 2 years after last contact.

Sharing personal data with third parties

We do not sell your personal data.

We only share personal data with third parties where this is necessary to perform our services or to comply with legal obligations. Where required, we enter into data processing agreements with these parties.

Categories of recipients include:

• Shopify - Our webshop platform, which processes orders, customer accounts and technical website data.
• Payment service providers - For processing payments and refunds.
• Accounting and administration providers - For financial administration and legal compliance.
• IT and software providers - Such as website hosting, email services and security providers.
• Analytics and marketing providers Such as Google Analytics and social media platforms (subject to consent).

International data transfers

Some of our service providers (such as Shopify, Google or social media platforms) process personal data outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place, such as:

An adequacy decision by the European Commission; or

Standard Contractual Clauses (SCCs) approved by the European Commission.

Security of your personal data

We take appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access or disclosure, taking into account the nature of the data and the risks involved.

Children under 16

Our website and services are not intended for children under the age of 16. If you are under 16, you may only provide personal data with the consent of a parent or legal guardian.

Parents or guardians may exercise the rights relating to their child’s personal data.

Your rights

You have the following rights under the GDPR:

• Right of access – to know whether and how we process your data;
• Right to rectification – to correct inaccurate or incomplete data;
• Right to erasure – to request deletion of your data where applicable;
• Right to restriction – to limit certain processing activities;
• Right to data portability – to receive your data in a structured, machine-readable format;
• Right to object – to object to processing based on legitimate interests or for direct marketing;
• Right to withdraw consent – at any time, where processing is based on consent.

To exercise your rights, please contact us via info@popupsurfshop.eu. If necessary to verify your identity, we may ask for additional information, but only where strictly required.

We will respond within one month of receiving your request.

Complaints

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): https://autoriteitpersoonsgegevens.nl

Cookies

We use cookies and similar technologies on our website.

Cookies are small text files stored on your device to ensure the website functions properly and to improve your user experience.

Types of cookies we use:

• Functional cookies – necessary for the operation of the website;
• Analytical cookies – to analyse website usage (only with consent where required);
• Marketing cookies – to personalise content and advertisements (only with consent).

You can manage or withdraw your cookie preferences at any time via your browser settings or our cookie banner.

Third-party cookies (such as Google Analytics or social media platforms) are subject to the privacy policies of those third parties.

Changes to this privacy policy

We may update this privacy policy from time to time. The most recent version will always be published on our website.

Language

The original version of this privacy policy is written in Dutch. This English version is provided for convenience. In case of discrepancies, the Dutch version shall prevail.

Last updated: 09-01-2026