Privacy Policy

Last updated: 4 November 2026

At NØLSON, we value your privacy and are committed to handling your personal information responsibly, transparently and securely.

This Privacy Policy explains how we collect, use, store, share and protect your personal data when you visit our website, purchase our products, create an account, participate in our loyalty programme, contact us or otherwise interact with our services.

We process personal data in accordance with the General Data Protection Regulation (GDPR), the Dutch GDPR Implementation Act (UAVG), the Dutch Telecommunications Act and other applicable privacy legislation.

This Privacy Policy is intended to provide you with clear information about our processing activities. Where your consent is required by law, we will request it separately. Merely visiting or using our website does not constitute consent to optional processing activities.

1. Who We Are

The website www.nolson.nl is operated by NICOTEX B.V., trading under the brand name NØLSON.

Company information

NICOTEX B.V. (NØLSON)
Gerard Douplein 2
1072 VE Amsterdam
The Netherlands

Chamber of Commerce (KvK): 76687198
VAT number: NL860748911B01

Email: info@nolson.nl
Website: https://nolson.nl

NICOTEX B.V. is the data controller responsible for determining the purposes and means of processing personal data through our website, webshop and related services, unless otherwise stated.

For privacy-related questions or requests, you can contact us using the details above.

2. What Personal Data Do We Collect?

We collect and process personal data that is necessary to operate our webshop, provide our services, fulfil orders, manage customer relationships and comply with applicable legal obligations.

The categories of personal data we process depend on how you interact with us.

2.1 Personal and Contact Information

We may collect:

• First and last name

• Email address

• Telephone number

• Billing and shipping address

• Customer account information

• Communication preferences

• Information you voluntarily provide when contacting us

2.2 Order and Payment Information

When you place an order, we process information necessary to complete and manage your purchase, including:

• Order numbers and purchase history

• Products purchased, selected sizes and quantities

• Order values, discounts and promotional codes

• Payment method, payment status and transaction references

• Billing and delivery information

• Shipping and delivery status

• Returns, exchanges, complaints and refunds

Payments are processed through authorised payment service providers.

Depending on your selected payment method, payment providers may process payment credentials and other information necessary to authorise transactions, prevent fraud and fulfil regulatory obligations.

NØLSON generally receives payment confirmations and transaction details rather than complete payment card numbers.

2.3 Customer Accounts and Loyalty Programme

If you create a customer account or participate in the NØLSON loyalty programme, we may process:

• Account identification and contact information

• Account login and security information

• Purchase history connected to your account

• Loyalty points earned and redeemed

• Membership tier and programme status

• Rewards, vouchers and discounts

• Participation in loyalty benefits and promotional activities

Loyalty points may be associated with qualifying purchases made through our webshop or physical store.

We use this information to administer your membership, calculate loyalty points, provide rewards, determine programme benefits and respond to membership-related inquiries.

Participation in the loyalty programme is voluntary and is governed by the applicable programme terms.

2.4 Website and Technical Information

When you visit our website, we may automatically collect certain technical information, including:

• IP address

• Browser type and device information

• Operating system

• Pages visited and website interactions

• Referral sources

• Approximate geographical location derived from technical information

• Cookie identifiers and privacy preferences

• Shopping cart and checkout interactions

• Technical logs and security-related information

Some of this processing is necessary to operate and secure our website.

Other activities, particularly advertising tracking and certain analytics, take place only where we have an appropriate legal basis and comply with applicable cookie and privacy requirements.

2.5 Marketing and Communication Information

Where applicable, we may process:

• Newsletter subscription status

• Marketing and communication preferences

• Consent and unsubscribe records

• Previous purchases and product interests

• Products viewed or added to a shopping cart

• Interactions with promotional communications

• Advertising interactions and campaign-related information

We use this information to communicate with customers, provide relevant product information and improve our marketing activities, subject to applicable legal requirements.

2.6 Customer Service and Returns

When you contact our customer service team, submit a complaint or request a return or exchange, we may process:

• Your name and contact details

• Relevant order and product information

• Return reasons and refund requests

• Customer service correspondence

• Photos or documents you provide

• Information necessary to investigate and resolve your request

Please avoid submitting sensitive personal information unless it is necessary for your request.

3. Where Do We Obtain Your Personal Data?

We generally obtain personal data directly from you when you place an order, create an account, subscribe to marketing communications, participate in our loyalty programme or contact us.

We also collect certain information automatically when you use our website, subject to applicable legal requirements.

Where necessary for our services, we may receive relevant information from:

• Payment providers, such as transaction confirmations or payment status

• Delivery and logistics partners, such as delivery updates

• Returns management services

• Customer service and e-commerce technology providers

• Partners supporting our loyalty programme or related services

Where personal data is obtained from another source, we process it only for legitimate and legally permitted purposes and provide any additional information required by applicable law.

4. Why Do We Process Your Personal Data?

We process personal data only when we have a valid legal basis under Article 6 of the GDPR.

The applicable legal basis depends on the particular processing activity.

4.1 Performance of a Contract — Article 6(1)(b)

We process personal data when necessary to perform a contract with you or take steps at your request before entering into a contract.

This includes:

• Processing and confirming purchases

• Arranging payment and delivery

• Managing returns, refunds and exchanges

• Providing customer account functionality

• Administering voluntary loyalty programme membership

• Providing support concerning orders or contractual services

If you do not provide information that is necessary for an order, such as your delivery address, we may be unable to complete your purchase.

4.2 Legal Obligations — Article 6(1)(c)

We process certain personal data to comply with applicable legal obligations, including:

• Tax and accounting requirements

• Financial recordkeeping

• Applicable consumer protection obligations

• Responding to legally valid requests from competent authorities

• Fulfilling data protection and regulatory obligations

4.3 Legitimate Interests — Article 6(1)(f)

Where permitted by law, we may process personal data where necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms.

Our legitimate interests may include:

• Protecting our website and systems

• Preventing fraud and misuse

• Handling general business inquiries

• Maintaining appropriate business records

• Improving our products and customer service

• Performing limited, privacy-friendly website analytics

• Establishing, exercising or defending legal claims

• Carrying out permitted direct marketing to existing customers

Before relying on legitimate interests, we assess the necessity and proportionality of the processing and consider its impact on individuals.

We do not rely on legitimate interests as a substitute for consent where consent is legally required, including for advertising tracking technologies.

4.4 Consent — Article 6(1)(a)

Where required, we obtain your consent before carrying out specific processing activities.

Examples may include:

• Sending promotional emails where the existing-customer exception does not apply

• Using non-essential advertising and tracking cookies

• Certain analytics technologies

• Tracking website activity for personalised advertising

• Certain forms of marketing profiling

• Sharing or matching customer information with advertising platforms where consent is required

Consent must be freely given, specific, informed and unambiguous.

You can withdraw your consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

4.5 Marketing to Existing Customers

Under applicable Dutch electronic marketing rules, we may contact existing customers about our own similar products or services without obtaining separate prior marketing consent, but only where the legal requirements for this exception are satisfied.

This includes providing a clear, free and easy opportunity to object when the contact details are collected and in every subsequent marketing message.

Where the exception does not apply, we obtain the necessary consent before sending promotional electronic communications.

You may object to direct marketing at any time, without charge.

5. Newsletter and Marketing Communications

You may subscribe to the NØLSON newsletter to receive information about new collections, product launches, promotions, exclusive offers and other brand updates.

When you subscribe, we process your email address, subscription preferences and information necessary to administer your subscription.

Where legally permitted, we may personalise marketing communications using relevant information about your purchases, product interests or interactions with our website.

Marketing personalisation involving non-essential tracking technologies is subject to the applicable consent requirements.

We do not treat the creation of a customer account or the placement of an order as automatic consent to receive promotional emails.

Promotional abandoned-checkout reminders and similar recovery communications are treated in accordance with applicable electronic marketing rules and are not sent merely because someone entered an email address at checkout.

Unsubscribing

You can unsubscribe from marketing emails at any time by:

• Clicking the unsubscribe link included in our promotional emails

• Contacting us at info@nolson.nl

Once you unsubscribe or object, we will stop processing your personal data for the relevant direct marketing purpose.

We may retain a limited suppression record to ensure that your preference is respected and that you are not inadvertently subscribed again.

Unsubscribing does not prevent us from sending necessary transactional communications relating to existing orders, payments, deliveries or returns.

6. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to provide essential webshop functionality, remember preferences, measure website performance and, where permitted, support advertising.

These technologies may include browser cookies, pixels, local storage and comparable technologies.

6.1 Strictly Necessary Cookies

Strictly necessary cookies support essential website functions, including:

• Shopping cart functionality

• Secure checkout and payment processes

• Customer account login

• Website security

• Remembering privacy and cookie choices

• Essential technical operations

These cookies generally do not require prior consent where they meet the applicable legal conditions.

6.2 Analytical Cookies

Analytical technologies help us understand how visitors use our website and identify opportunities to improve usability and performance.

We may use analytics services, including Google Analytics where enabled.

Analytical cookies may be used without prior consent only where they meet the applicable Dutch legal requirements, including having no or only limited impact on visitors' privacy.

Where analytical technologies do not qualify for an exemption, we obtain the necessary consent before activating them.

6.3 Marketing and Advertising Technologies

Subject to applicable consent and privacy requirements, marketing technologies may be used to:

• Measure the effectiveness of advertisements

• Understand interactions with advertising campaigns

• Create or refine advertising audiences

• Display relevant advertisements on third-party platforms

• Measure conversions and campaign performance

• Limit repeated advertising

These activities may involve advertising platforms such as Meta, including Facebook and Instagram.

Where required, we obtain your valid consent before activating advertising pixels, marketing cookies or comparable tracking technologies.

The same applicable privacy requirements are considered for server-side tracking, customer matching and other technologies used to process personal data for advertising.

6.4 Your Cookie Choices

When you visit our website, you can choose whether to accept or reject non-essential cookies and tracking technologies.

We aim to provide clear and equally accessible options to accept, reject or customise optional cookies.

Non-essential tracking technologies requiring consent must not be activated before that consent has been obtained.

You can withdraw or modify your consent through the cookie preference settings on our website.

Rejecting optional cookies does not prevent you from using essential webshop functions.

Further information about the relevant cookies, technologies, providers, purposes and storage periods should be available through our cookie preference settings and any separate Cookie Policy published on our website.

7. Sharing Personal Data With Third Parties

We use selected external service providers to operate our webshop, fulfil purchases and provide customer services.

We share personal data only where necessary, legally permitted and appropriate for the relevant purpose.

Depending on the service and your interactions with us, recipients may include the following.

7.1 E-commerce Platform

Shopify provides our e-commerce infrastructure, including webshop functionality, checkout, customer accounts and order management.

7.2 Returns Management

Returnless supports the registration and management of product returns and exchanges.

Return portal: https://nolson.returnless.com/en/

7.3 Payment Services

Payment-related information may be processed by the payment providers available at checkout, including Mollie, PayPal and other supported payment services.

Apple Pay and similar digital wallets may be available as payment methods, depending on the checkout configuration.

The providers involved may process certain data as independent controllers for activities such as payment authorisation, fraud prevention and regulatory compliance.

7.4 Shipping and Logistics Providers

We share the information necessary to arrange shipping and delivery, including relevant names, delivery addresses and contact information.

Delivery partners may also provide us with shipping status information.

7.5 Customer Service Providers

Where used, customer service platforms such as Gorgias assist us with customer inquiries, order support, returns and complaint management.

7.6 Marketing and Analytics Providers

Subject to applicable legal requirements and your privacy choices, we may use services including:

• Google Analytics

• Meta advertising services

• Email marketing and customer relationship management platforms

• Relevant analytics and advertising technology providers

The information shared depends on the relevant service, technical configuration and applicable privacy permissions.

7.7 Loyalty Programme Providers

We may use technology providers to operate our customer loyalty programme, manage membership information, calculate points and administer rewards.

These providers receive only the information necessary for their respective services.

7.8 Privacy and Consent Management

We use privacy management technology, including services supplied by Consentmo, to support privacy choices, consent records and data protection requests.

Depending on the relevant function, these services may process information such as IP addresses, email addresses, consent preferences and information needed to handle privacy-related requests.

7.9 Professional Advisers and Authorities

We may share relevant personal data with accountants, legal advisers, competent regulatory bodies or public authorities where necessary and legally permitted.

7.10 Responsibilities of Third Parties

Where a service provider processes personal data on our behalf, we use appropriate contractual arrangements, including data processing agreements where required by Article 28 GDPR.

Some third parties, such as payment providers or advertising platforms, may independently determine the purposes and means of certain processing activities.

Where this occurs, those providers may act as independent data controllers and have their own legal privacy obligations.

We do not sell customer personal information to third parties for monetary consideration. However, personal data may be disclosed to advertising platforms where permitted by applicable privacy law, as described in this Policy.

8. International Data Transfers

Some of our service providers may process or access personal data outside the European Economic Area (EEA).

When personal data is transferred to a country outside the EEA, we assess the applicable legal requirements under Chapter V of the GDPR.

Depending on the destination and recipient, transfers may rely on:

• An adequacy decision issued by the European Commission

• The EU-US Data Privacy Framework, where the relevant US organisation is appropriately certified and the transfer is covered by that certification

• European Commission-approved Standard Contractual Clauses, together with supplementary safeguards where required

• Another transfer mechanism expressly permitted under the GDPR

We assess the relevant safeguards and, where required, the risks associated with international transfers.

You may contact us at info@nolson.nl to request further information about applicable transfer safeguards or how to obtain a copy of relevant safeguards, subject to permitted redactions.

9. How Long Do We Retain Your Personal Data?

We retain personal data only for as long as necessary for the purpose for which it was collected, unless a longer period is required or permitted by law.

Retention periods are determined according to the relevant processing purpose, statutory requirements and whether the information remains necessary.

9.1 Order and Financial Records

Financial and administrative records subject to Dutch tax obligations are generally retained for seven years, calculated in accordance with the applicable statutory rules.

For transactions covered by the EU One Stop Shop or Import One Stop Shop schemes, relevant records may be subject to a ten-year statutory retention requirement.

The statutory retention obligation applies to the records required by law and does not automatically justify retaining all related personal information for the same period.

9.2 Customer Accounts

We retain account information while your account remains active and afterwards only for as long as necessary to resolve outstanding transactions, comply with legal obligations or address legitimate legal claims.

You may request deletion of your account and eligible personal data at any time.

Certain transaction records may need to be retained independently of your account.

9.3 Loyalty Programme Information

Information relating to loyalty points, membership tiers and rewards is generally retained for the duration of your participation in the programme.

After membership ends, information that is no longer required will be deleted or anonymised, unless retention is necessary for outstanding transactions, applicable legal obligations or legitimate claims.

9.4 Marketing and Newsletter Information

Marketing subscription information is retained while your subscription remains active.

After you unsubscribe or withdraw consent, we stop the relevant marketing processing and remove or anonymise information that is no longer necessary.

We may retain limited unsubscribe, objection or consent records where necessary to demonstrate compliance and respect your preferences.

9.5 Customer Service and Returns

Customer service and return information is retained for the time necessary to handle the request, fulfil relevant legal obligations and address any applicable complaints or legal claims.

The applicable retention period depends on the nature and outcome of the matter.

9.6 Cookies and Analytics

Cookie storage periods and related data retention periods vary according to the technology, provider and purpose.

Further information is provided through our cookie preference settings and relevant cookie disclosures.

9.7 Security and Privacy Administration

Security logs, consent records and documentation of privacy-related requests are retained only for the period necessary for security, compliance, accountability or legal purposes.

Once personal data is no longer necessary and no valid basis for retention remains, we delete or anonymise it in accordance with our applicable procedures.

10. How Do We Protect Your Personal Data?

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, unlawful processing or disclosure.

Depending on the systems and risks involved, these measures may include:

• Secure connections and protected payment processes

• Access controls and appropriate account permissions

• Authentication and system security measures

• Restricted access to customer information

• Service provider security arrangements

• Internal procedures for managing personal data

• Security monitoring and incident response processes

Access to personal data is restricted to authorised personnel and relevant service providers who require access for legitimate business purposes.

We regularly assess the need for appropriate protective measures.

No electronic system can be guaranteed to be completely free from security risks.

Where a personal data breach occurs, we assess and fulfil the notification obligations applicable under the GDPR.

11. Your Rights Under the GDPR

Under applicable data protection legislation, you have rights concerning the personal data we process about you.

These rights are subject to the conditions and exceptions established by law.

11.1 Right of Access

You may request confirmation of whether we process your personal data and, where applicable, obtain access to and a copy of that information.

11.2 Right to Rectification

You may request correction of inaccurate personal data or completion of incomplete information.

11.3 Right to Erasure

You may request deletion of your personal data where the applicable legal conditions are met.

We may need to retain certain information where required by law or where another permitted exception applies.

11.4 Right to Restriction of Processing

You may request restriction of processing in the circumstances provided for under the GDPR.

11.5 Right to Data Portability

Where applicable, you may request to receive personal data you provided to us in a structured, commonly used and machine-readable format.

You may also request that the information be transmitted to another controller where the legal conditions are met and transmission is technically feasible.

11.6 Right to Object

You may object to processing based on legitimate interests, including related profiling, where applicable.

We will assess objections in accordance with the GDPR.

You have the unconditional right to object at any time to the processing of your personal data for direct marketing purposes, including profiling related to direct marketing.

If you object, we will stop processing your personal data for those direct marketing purposes.

11.7 Right to Withdraw Consent

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

11.8 Rights Relating to Automated Decision-Making

Where applicable, you have rights concerning decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

If we engage in such decision-making, we will provide the information and safeguards required by applicable legislation.

11.9 How to Exercise Your Rights

You can submit a privacy request by emailing:

info@nolson.nl

You may also use the privacy rights management tools on our website:

https://nolson.nl/pages/gdpr-compliance

You are not required to use the online portal and may contact us directly.

We may request additional information where reasonably necessary to verify your identity and prevent unauthorised disclosure.

We respond to requests without undue delay and, in principle, within one month of receipt.

Where permitted by law, this period may be extended by up to two additional months for complex or multiple requests. We will inform you of the extension and the reasons for it within the initial one-month period.

Exercising your GDPR rights is generally free of charge.

Fees or refusals are permitted only in the limited circumstances specified by law, including manifestly unfounded or excessive requests.

12. Profiling and Personalised Advertising

We may analyse information about purchases, product interests and website interactions to improve the shopping experience and provide relevant product recommendations.

Depending on the activity, this may involve:

• Previous purchases

• Product categories and preferences

• Products viewed or added to a shopping cart

• Website interactions

• Loyalty programme activity

• Newsletter engagement

• Advertising interactions

These activities may be used to recommend products, personalise permitted marketing communications, measure campaign performance or develop relevant advertising audiences.

Where personalised advertising, audience creation or associated tracking requires consent, we obtain that consent before carrying out the relevant processing.

Profiling for direct marketing is subject to your unconditional right to object.

You can withdraw consent for optional advertising tracking through the cookie preference settings on our website.

Ordinary product recommendations and marketing segmentation should be distinguished from solely automated decisions that have legal or similarly significant effects.

If processing subject to Article 22 GDPR is carried out, we will provide the required information about the decision-making process, its significance, potential consequences and applicable safeguards.

13. Children's Privacy

Our website and products are not specifically directed at children under the age of 16.

We recognise that children are entitled to additional protection under applicable data protection legislation.

Where parental or guardian consent is legally required for processing the personal data of a child under 16, we will obtain the necessary authorisation.

We do not knowingly carry out unlawful behavioural advertising or marketing profiling involving children's personal data.

Under applicable Dutch law, children aged 12 or older may exercise certain privacy rights themselves, including requesting access to their personal data and withdrawing consent.

Parents or legal representatives may also exercise rights on behalf of children in the circumstances permitted by law.

If you believe that personal data relating to a child has been processed unlawfully, please contact info@nolson.nl.

14. External Websites and Third-Party Services

Our website may contain links to external websites, payment services, social media platforms and third-party services.

These services may have their own privacy policies and may independently determine how they process personal data.

Where a third party acts as an independent data controller, its processing activities are subject to its own responsibilities under applicable privacy law.

We recommend reviewing the relevant privacy information before providing personal data directly to those services.

This Privacy Policy describes processing for which NØLSON is responsible and does not replace the privacy policies of independent third parties.

15. Changes to This Privacy Policy

We may update this Privacy Policy when our business operations, service providers, technologies or applicable legal requirements change.

The current version will be published on www.nolson.nl with an updated revision date.

Where changes materially affect how we process personal data, we will provide additional information or obtain renewed consent where required by law.

Any changes will apply in accordance with applicable privacy legislation.

Updating this Privacy Policy does not retrospectively establish a lawful basis for processing that previously lacked one.

16. Complaints and Supervisory Authority

If you have concerns about how NØLSON processes your personal data, you may contact us at info@nolson.nl.

We will assess your concern and seek to address it appropriately.

You also have the right to lodge a complaint with a competent data protection supervisory authority.

In the Netherlands, the supervisory authority is:

Autoriteit Persoonsgegevens (AP)
Website: https://autoriteitpersoonsgegevens.nl

Depending on the applicable circumstances, you may also have the right to seek an effective judicial remedy under data protection law.

17. Contact

For questions concerning this Privacy Policy, our processing of personal data or the exercise of privacy rights, please contact:

NØLSON – NICOTEX B.V.

Gerard Douplein 2
1072 VE Amsterdam
The Netherlands

Email: info@nolson.nl
Website: https://nolson.nl

We are committed to protecting your personal information and handling your data responsibly, transparently and securely.

Thank you for trusting NØLSON.