Privacy policy
Last updated: 22 August 2026. Written for shoppers in the EU under the General Data Protection Regulation (GDPR) and the Dutch UAVG.
The short version
We collect what we need to sell you something and get it to you, and nothing else. We do not sell your data. Analytics only runs if you accept cookies, and you can change that at any time from the Cookie preferences link in the footer. You can ask us for a copy of your data, or to delete it, by emailing hello@routinae.com.
Who is responsible for your data
The data controller is Cloudrix, trading as Routinae, Schoolstraat 355, 5038 RL Tilburg, Netherlands. Chamber of Commerce (KvK) 97732699. Email hello@routinae.com, telephone +31 6 52130980.
We are a small business and are not required to appoint a Data Protection Officer. Privacy questions go to the address above and are answered by a person.
What we collect, why, and on what legal basis
| What | Why | Legal basis | How long we keep it |
|---|---|---|---|
| Name, delivery and billing address, email, telephone | To take, fulfil and deliver your order, and to contact you about it | Performance of a contract, Art. 6(1)(b) GDPR | 7 years from the end of the tax year, because Dutch tax law requires it |
| Order and payment records, invoices | To keep the accounts the law requires us to keep | Legal obligation, Art. 6(1)(c) GDPR, with art. 52 Algemene wet inzake rijksbelastingen | 7 years |
| Payment card details | To take payment | Performance of a contract, Art. 6(1)(b) | We never see or store full card details. Our payment providers handle them and hold them under their own policies |
| Messages you send us, and our replies | To answer you, and to have a record if you come back about the same order | Performance of a contract where it concerns an order, Art. 6(1)(b); otherwise our legitimate interest in answering people who write to us, Art. 6(1)(f) | 2 years from the last message, or 7 years where it relates to an order |
| Account details, if you create an account | To let you sign in and see your orders | Performance of a contract, Art. 6(1)(b) | Until you delete the account, plus 7 years for the order records inside it |
| Newsletter email address | To send you the newsletter | Consent, Art. 6(1)(a) | Until you unsubscribe |
| Analytics: pages viewed, what you clicked, device and browser, approximate location from your IP address | To understand what works on the site | Consent, Art. 6(1)(a), given through the cookie banner. Nothing is measured unless you accept | 14 months |
| Answers you give the Routine Finder and Skin Profile tools | To produce the routine you asked for | Performance of a contract at your request, Art. 6(1)(b) | Held in your browser for the session. We do not build a profile of you from it |
| Fraud and security signals | To stop fraudulent orders and protect the shop | Legitimate interests, Art. 6(1)(f) — our interest in not being defrauded, balanced against the limited data involved | Up to 2 years |
We do not ask for and do not want special-category data. We sell cosmetics, not treatments. Please do not send us medical information — if you do, we use it only to answer you and delete it when the conversation ends.
Who else sees your data
We share the minimum needed, with these categories of recipient:
- Shopify — runs this shop, the checkout and the hosting. Shopify processes your data on our instructions and, for some of its own features, as a controller in its own right.
- Our payment providers — to take and, where needed, refund your payment. They handle card data as controllers in their own right, under their own privacy policies.
- The suppliers who fulfil your order — this is the one people do not expect, so we say it clearly. We hold no stock. Your name, delivery address and the contents of your order go to the supplier who holds each product, so that they can pack and post it to you. Where that supplier is in another country, your delivery details go there.
- Carriers — to deliver the parcel and to let you track it. For deliveries outside the EU, carriers also pass your details to the destination country's customs authority, which they are legally required to do.
- Google (Google Analytics 4) — only if you accept analytics cookies. Data retention is set to 14 months.
- Professional advisers and authorities — our accountant, and any authority we are legally obliged to answer.
We do not sell your personal data, and we do not share it with advertising networks. If that ever changes we will ask for your consent first and say so here.
Cookies and tracking
Cookies that are strictly necessary to make the shop work — keeping you signed in, remembering your basket, security — are always on. They do not track you and no consent is needed for them.
Everything else waits for your consent. Analytics cookies are set only after you accept them in the banner. If you choose “Necessary only”, or if you never answer, nothing is measured, on that visit or any later one.
Changing your mind is easy and costs nothing. Use the Cookie preferences link in the footer of any page. If you withdraw consent we stop measuring immediately and Google is instructed to drop the cookies it set. Withdrawing does not affect anything that was lawful before you withdrew.
Sending data outside the EU
Some of the services above are provided from outside the European Economic Area, and some of your delivery details necessarily travel to the country your parcel is posted from or to.
Where personal data leaves the EEA we rely on either an adequacy decision of the European Commission — including the EU-US Data Privacy Framework, where the recipient is certified under it — or the Commission's Standard Contractual Clauses, with additional safeguards where they are needed. You may ask us which applies to a particular recipient and we will tell you.
Your rights
You can exercise any of these free of charge by emailing hello@routinae.com. We answer within one month. We may ask you to confirm who you are first, so that we do not hand your data to someone else.
- Access (Art. 15) — a copy of the personal data we hold about you.
- Rectification (Art. 16) — correction of anything wrong or incomplete.
- Erasure (Art. 17) — deletion, where we no longer need it. We cannot delete invoices inside the seven-year tax retention period, and we will tell you if that is the reason.
- Restriction (Art. 18) — ask us to hold the data but stop using it while something is being sorted out.
- Portability (Art. 20) — the data you gave us, in a machine-readable file, or sent to another provider.
- Objection (Art. 21) — object to processing based on our legitimate interests. You may object to direct marketing at any time and we will stop, with no questions asked.
- Withdraw consent (Art. 7(3)) — at any time, as easily as you gave it. The Cookie preferences link for analytics; the unsubscribe link in any newsletter.
- Not to be subject to automated decisions (Art. 22) — we do not make decisions about you by automated means that produce legal or similarly significant effects. The routine tools generate suggestions; they decide nothing about you.
If you are unhappy with how we handled your data
Tell us first — hello@routinae.com — and we will look at it properly.
You also have the right to complain to a data protection authority (Art. 77 GDPR). Ours is the Autoriteit Persoonsgegevens in The Hague. You may equally complain to the authority in the EU country where you live or work, or where you think something went wrong.
Children
This shop is not intended for children. In the Netherlands, anyone under 16 needs a parent's or guardian's consent for their data to be processed by an online service. If you are a parent or guardian and believe we hold data about your child, email us and we will delete it.
Security
We keep your data on Shopify's infrastructure, access it only from accounts protected by two-factor authentication, and give access only to people who need it. No system is perfectly secure, and we would rather say that than promise otherwise. Please do not send card details or anything sensitive by email.
Changes to this policy
We may update this policy. We will change the date at the top and, where the change matters to you, tell you directly.