Privacy Policy

Last updated: 6 September 2026

1. Introduction

SC2 Trading B.V., trading as Helmosan, is the data controller. Our registered address is Parklaan 1B, 1777 BA Hippolytushoef, the Netherlands; Chamber of Commerce 57616868; VAT number NL852659763B01. This policy explains which personal data we process, why and how we protect it.

2. Data We Collect

Order Data

When you place an order, we collect: name, email address, delivery address, and payment information. Payments are securely processed via Mollie; we do not store credit card numbers.

Technical Data

We use functional cookies for the shopping cart and your language preference. Analytical data is only collected after your explicit consent.

Newsletter data

When you subscribe to the newsletter, we store your name, email address, language preference, subscription time and where you gave consent. If you do not confirm within 24 hours, we delete the unconfirmed request no later than 7 days after the link expires, so within 8 days of your request.

3. How We Use Your Data

• Processing and shipping your orders
• Sending order confirmation emails
• Improving our website and services
• Complying with legal obligations
• Sending the newsletter when you have given consent

Legal bases

We process data to perform our contract with you (orders and accounts), to comply with legal obligations, for our legitimate interest in keeping the webshop secure and reliable, and on the basis of your consent for newsletters and non-essential analytics.

4. Data Sharing

We use only necessary service providers: Supabase for accounts, database and storage; Netlify for hosting; Mollie for payments; MyParcel and carriers for delivery; Resend for transactional email; Brevo for newsletters; Sanity for content management; Plausible and Google Analytics for consent-based analytics; Meta for marketing measurement after separate consent; and e-Boekhouden for accounting. They receive only the data needed for their task. Where processing takes place outside the EEA, we use appropriate safeguards such as an adequacy decision or EU Standard Contractual Clauses.

5. Your Rights (GDPR)

You have the right to access, rectification, erasure, restriction, portability and objection. You may withdraw consent at any time without affecting earlier lawful processing. Contact us through the contact form. You may also lodge a complaint with the competent data protection authority.

6. Cookies

Necessary browser storage holds your cart, language, privacy choice, temporary popup state and secure Supabase sign-in session. Your full customer profile is not stored in localStorage. Plausible and Google Analytics load only after analytics consent. Meta Pixel and Conversions API load only after separate marketing consent and process event time and name, a cleaned page URL, product codes, quantities, value, browser agent and, when available, Meta fbp/fbc cookies. The CAPI server message contains no customer name, email address, telephone number, address or IP address. Meta does receive the browser IP address through direct browser connections, such as loading the Pixel. You can change your choice through ‘Privacy settings’ in the footer.

Microsoft Clarity helps us find issues on public pages through usage measurements, heatmaps and session views with masked text. Clarity starts only after a new analytics choice that mentions Clarity. Account, order, checkout and contact pages are excluded. Advertising storage remains disabled. You can withdraw consent in the footer. Microsoft privacy statement

With your marketing consent, we also report confirmed purchases to Meta from our server. Matching cookies and browser details are retained until processing finishes, for up to seven days. Consent and delivery metadata are retained for up to one year after the last associated processing. You can withdraw consent through Privacy settings; once your withdrawal reaches our server, purchase messages that have not started are stopped.

7. Retention Period

We retain order, invoice and payment data for 7 years for tax obligations. Account data is kept while your account exists and is deleted or anonymised after a valid request, unless a legal duty applies. Newsletter data is kept during the subscription; after opt-out we retain only the minimum evidence needed to honour and demonstrate the opt-out and earlier consent. Security and abuse data is kept as briefly as possible.

8. Contact

Use the contact form for privacy questions. You may also lodge a complaint with the Dutch Data Protection Authority or the authority in your country of residence.

contact form