Privacy Policy

Identity and contact data (name, email, and phone if you provide it); delivery and billing address; order and payment details (your card data is handled by our payment processor — we do not store full card numbers); your correspondence with us; and website, usage and device data such as your IP address and, subject to your consent, analytics and marketing identifiers.

To perform your purchase contract — processing and delivering your order, handling returns and support (Art. 6(1)(b) GDPR). To meet legal obligations such as tax and accounting retention (Art. 6(1)(c)). For analytics, advertising measurement and non-essential cookies, on the basis of your consent, which you can withdraw at any time (Art. 6(1)(a) and Art. 7(3)). To secure the store, prevent fraud and improve our service, on the basis of our legitimate interests (Art. 6(1)(f)).

We rely on carefully selected providers, each bound by a data-processing agreement under Art. 28 GDPR: Stripe (payment processing), WordPress/WooCommerce (the webshop platform), Resend (transactional email), Supabase (data hosting and storage), and our fulfilment partner (order fulfilment and shipping). For advertising and measurement we may use Meta and analytics providers; where such a party determines the purposes of processing it acts as an independent or joint controller (Art. 26 GDPR) for the data it receives.

Some providers may process data outside the European Economic Area. Where they do, the transfer is protected by an appropriate safeguard under Art. 46 GDPR — in particular the European Commission's Standard Contractual Clauses, supplemented where necessary — and, for certain US recipients, certification under the EU–US Data Privacy Framework.

We keep personal data only as long as necessary for the purposes above. Order, invoice and other fiscally relevant data is kept for the statutory retention period (in the Netherlands generally seven years). Data processed on the basis of consent is kept until you withdraw consent or it is no longer needed, after which it is deleted or anonymised.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21) — including objecting to direct marketing at any time — and the right not to be subject to solely automated decisions producing legal or similarly significant effects (Art. 22). Where we rely on consent, you may withdraw it at any time without affecting prior lawful processing. To exercise any right, email airlyft.info@gmail.com.

If you believe we process your data unlawfully, you may lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (Art. 77 GDPR), without prejudice to any other remedy.