Sawa Retail B.V. (“Sawa”, “we”, “us”) is a company registered in the Netherlands, with its registered office at Keurenplein 41, Unit D6100, 1069CD Amsterdam, the Netherlands (Chamber of Commerce / KvK number: [KvK number]).
We act as a Merchant of Record: we sell products from the brands we work with to consumers on online marketplaces such as Amazon and Bol.com. That means that if you bought a product and the seller on your order confirmation or invoice is “Sawa Retail B.V.”, we are the legal seller of that product and the controller of the personal data connected to your order.
This policy explains what personal data we process, why, how long we keep it, and what rights you have. It is organized by who you are:
- Section 1 — You bought a product sold by Sawa on a marketplace
- Section 2 — You are a business contact, client representative or prospect
- Section 3 — You are visiting this website
- Section 4 — General
Questions or requests: privacy@wearesawa.com
1. If you bought a product sold by Sawa
1.1 Who is responsible for your data
When Sawa is named as the seller of your order, Sawa Retail B.V. is the data controller for the personal data needed to sell you the product, deliver it, handle returns and answer your questions.
The marketplace where you placed your order (for example Amazon or Bol.com) is a separate, independent controller for the data it processes on its own platform, such as your marketplace account, your browsing activity and your payment card details. We never receive your payment card details. For how the marketplace handles your data, please see its own privacy policy.
1.2 What data we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Name, delivery address, order details | Fulfilling your order, arranging delivery | Performance of a contract (Art. 6(1)(b)) |
| Order and payment-status information received from the marketplace | Confirming payment, processing refunds | Performance of a contract (Art. 6(1)(b)) |
| Customer service messages and their content | Answering questions, handling complaints, returns and disputes | Performance of a contract (Art. 6(1)(b)); legitimate interest in resolving disputes (Art. 6(1)(f)) |
| Order records, invoices, credit notes | VAT, accounting and product safety record-keeping | Legal obligation (Art. 6(1)(c)) |
| Order patterns and dispute history | Preventing fraud and abuse | Legitimate interest (Art. 6(1)(f)) |
1.3 What we do not do with your data
- We do not use your data for marketing. You will not receive newsletters or promotional messages from Sawa.
- We do not share your individual data with the brands whose products we sell. Brands only receive aggregated, anonymized reports (for example, sales per region) that cannot be traced back to you.
- We do not sell your data to anyone.
- We do not make automated decisions about you that have legal or similarly significant effects.
1.4 Who receives your data
We share your data only with parties that are needed to complete your purchase and meet our legal obligations, and only what each of them needs:
- Marketplace platforms (e.g. Amazon, Bol.com) — as independent controllers operating the platform where you ordered
- Logistics and fulfilment providers (e.g. Amazon FBA warehouses and carriers) — to store, pack and deliver your order
- Payment service providers — to process payouts and refunds (we never see your card details)
- Accountants, tax advisors and tax authorities — to comply with VAT and accounting law
- IT and hosting providers — who store data on our behalf under data processing agreements
1.5 International transfers
We sell in the European Union, the United Kingdom and North America. Where your data is transferred outside the European Economic Area, we rely on:
- the European Commission’s adequacy decision for the United Kingdom;
- for the United States, the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise the European Commission’s Standard Contractual Clauses, supplemented where necessary with additional safeguards.
You can request a copy of the safeguards that apply to your data via the contact address above.
1.6 How long we keep your data
- Data connected to your order is deleted within 6 months after the last transaction or the end of the applicable return window, whichever is later, unless we are legally required to keep it longer.
- Invoices and records required by tax law are kept for 7 years (Netherlands) or 6 years (United Kingdom), as required by the applicable tax authority.
- Customer service correspondence connected to an unresolved dispute is kept until the dispute is closed, then deleted on the schedule above.
1.7 Your rights
You have the right to:
- access the personal data we hold about you;
- correct inaccurate data;
- delete your data (where we are not legally required to keep it);
- restrict or object to processing based on our legitimate interests;
- receive your data in a portable format (data portability).
To exercise any of these rights, email privacy@wearesawa.com. We respond within one month. We may ask you to confirm your identity (for example, by referencing your order number) so that we do not disclose your data to the wrong person.
If you are not satisfied with how we handle your data or your request, you can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). If you are in the United Kingdom, you can also complain to the Information Commissioner’s Office (ICO) (ico.org.uk).
2. If you are a business contact or prospect
2.1 Client and partner representatives
If you work for one of our clients, suppliers or partners, we process your business contact data (name, job title, business email address and phone number, correspondence) to manage the relationship and perform our contracts. Legal basis: performance of a contract and our legitimate interest in managing business relationships (Art. 6(1)(b) and (f) GDPR). We keep this data for the duration of the relationship and delete it within 30 days after it ends, except where we need it to enforce or defend legal claims or to meet legal retention obligations.
2.2 Prospects and outbound contact
We contact representatives of brands that may benefit from our services. For this we process business contact data (name, role, company, business email address) obtained from publicly available sources, such as company websites, business registers and professional networking platforms.
Legal basis: our legitimate interest in business-to-business direct marketing (Art. 6(1)(f) GDPR).
You can object at any time, and every message we send includes a way to do so. If you object, we stop contacting you and add your address to our suppression list so you are not contacted again. Prospect data that leads to no relationship is deleted within [12] months of our last interaction.
3. If you are visiting this website
3.1 Contact forms and email
If you contact us through this website or by email, we process the data you provide (name, brand or company, email address, phone number, and the content of your message) to respond to you. Legal basis: our legitimate interest in responding to inquiries, or steps prior to entering into a contract (Art. 6(1)(b) and (f) GDPR). We delete inquiry data within [12] months unless the contact leads to a business relationship.
3.2 Cookies and analytics
This website uses functional cookies only. These are necessary for the site to work and do not require consent:
- a language cookie that remembers whether you read the site in Dutch or English (one year);
- sign-in cookies, only if you have an account and log in, to keep your session active;
- an anonymous visit counter on public brand pages, so that we can count visits without identifying you (90 days).
We use no third-party analytics tool, no advertising cookies and no cross-site tracking. Visits to public brand pages are counted on our own servers: we record the page, the referring site, the country and city reported by the network, the device type (mobile or desktop), the anonymous visit identifier and any campaign parameters in the link. We do not store IP addresses with these records, and they are not used to build a profile of you. Visit records are kept for [12] months.
3.3 Hosting and logs
This website is hosted by Vercel. The data behind it (accounts, contact requests, files) is stored by Supabase in the European Union. Both act as processors on our behalf under data processing agreements. Technical server logs kept by our hosting provider for security and troubleshooting are retained for [30] days, on the basis of our legitimate interest in keeping the website secure (Art. 6(1)(f) GDPR).
4. General
4.1 Security
We protect personal data with technical and organizational measures appropriate to the risk, including access controls, encryption of data in transit, and confidentiality obligations for everyone with access to personal data.
4.2 Changes to this policy
We update this policy when our processing or the law changes. The version date at the top tells you when it was last revised. Material changes affecting consumers will be highlighted on this page.
4.3 Contact
Zie ook onze algemene voorwaarden of neem contact op via hello@wearesawa.com.