PRIVACY STATEMENT
Version: 1.0
Date: 19 January 2026
1. Who are we?
Kalpaky Olives B.V. (“Kalpáky”, “we” or “us”) respects your privacy and processes your personal data with care.
Contact details
Kalpaky Olives B.V.
Ottho Heldringstraat 3B-23
1066 AZ Amsterdam
The Netherlands
Email: olives@kalpaky.com
Website: https://www.kalpaky.com
Kalpaky Olives B.V. is the controller within the meaning of the General Data Protection Regulation (“GDPR”) for all processing of personal data described in this Privacy Statement.
Kalpáky has not appointed a Data Protection Officer (DPO), as it is not currently legally required to do so. If you have any questions about this Privacy Statement or about how we process your personal data, please contact us using the contact details above.
2. When does this Privacy Statement apply?
This Privacy Statement applies to all personal data that Kalpáky processes in relation to:
· visitors to the website www.kalpaky.com (the “Webshop”);
· (potential) consumers who place an order;
· persons who contact us via email, the contact form or social media.
This Privacy Statement does not apply to third-party websites, services or applications to which we refer via links. We recommend that you consult the privacy statements of those third parties yourself.
3. What personal data do we process?
Depending on how you use the Webshop, we may process the following categories of personal data:
· Identification and contact details: name, address, place of residence, email address, telephone number;
· Order and payment details: selected products, invoice and delivery address, order number, payment status and limited payment information;
· Logistical details: selected shipping option, track & trace information, delivery status;
· Communication details: content of messages you send to us;
· Marketing data: your preferences for receiving marketing communications (opt-in/opt-out), preferred communication channel, and the time and method of your consent or withdrawal;
· Online data: IP address, cookie ID, browser and device characteristics, pages visited and click behaviour, insofar as recorded via cookies and similar techniques. For more details, please see our separate Cookie Statement;
· Social media data: username and public profile information when you contact us via social media channels or share our content.
In principle, we do not collect special categories of personal data and we ask you not to share such information with us. If such data is inadvertently provided, we will delete it as soon as possible, unless we are legally required to retain it.
4. How do we obtain your personal data?
We obtain personal data in the following ways:
- directly from you, for example when you:
· visit our Webshop;
· place an order;
· contact us by email, via the contact form or via social media;
· automatically, when you use our Webshop, by means of cookies and similar techniques;
· from third parties that provide services on our behalf (such as payment service providers and shipping and delivery services), insofar as this is necessary for the performance of our agreement with you.
5. Legal bases and purposes of processing
We only process your personal data if there is a legal basis for doing so under the GDPR. Below you will find the corresponding bases for each purpose.
5.1 Order process and customer service
We process your personal data in order to:
· register, confirm and process your order;
· have the products delivered to you;
· inform you about the progress of your order;
· handle questions, requests or complaints;
· record and respect your preferences for receiving (digital) marketing, so that we do not send you marketing if you have objected to this.
Basis:
· performance of the agreement (insofar as the processing is necessary for processing your order, payment and delivery);
· compliance with legal obligations, such as tax retention obligations;
· our legitimate interest in efficient business operations and customer communication;
· our legitimate interest and, where applicable, our legal obligations under the Telecommunications Act to record and respect your marketing preferences.
5.2 Analysis, improvement and security of the Webshop
We use (mainly aggregated) data to:
· analyse the use of the Webshop;
· improve the functioning, speed and user-friendliness of the Webshop;
· prevent abuse and fraud and ensure the security of our systems.
Basis:
· our legitimate interest in improving our services and ensuring the security and integrity of our systems.
Where possible, we aggregate this data in such a way that individual persons are no longer identifiable.
5.3 Cookies, statistics and advertisements
Cookies and similar technologies may be used to process personal data for:
· statistical analysis of the use of the Webshop;
· measuring the effectiveness of advertising campaigns;
· displaying relevant advertisements on third-party websites.
For certain processing operations in the context of the Meta pixel, Kalpáky and Meta Platforms Ireland Limited act as joint controllers. This concerns the collection and transfer of your browsing and interaction data (such as pages visited, click behaviour and device information) via the Meta pixel placed on our Webshop. Kalpáky is responsible for the lawful placement of the pixel and obtaining your consent; Meta is responsible for the further processing of this data for advertising purposes (including personalisation and targeting).
You can exercise your rights with both Kalpáky (via olives@kalpaky.com) and Meta. Meta is the independent controller for the further processing of your data by Meta after it has been collected via the Meta pixel. More information about the division of responsibilities can be found in Meta’s privacy policy (https://www.facebook.com/privacy/policy) and the Meta Business Tools terms and conditions (https://www.facebook.com/legal/controller_addendum).
Basis:
· consent for non-essential (analytical and marketing) cookies;
· our legitimate interest for certain functional cookies, as explained in our Cookie Statement.
For more information about the specific cookies used, their purposes, retention periods and third parties involved, please refer to our separate Cookie Statement, which is accessible from every page of the Webshop.
5.4 Legal obligations and disputes
We may use your data to comply with:
· tax and accounting obligations;
· requests from competent supervisory authorities or other government agencies;
· the need to defend our rights in the event of a dispute.
Basis:
· compliance with a legal obligation;
· our legitimate interest in protecting our rights, property and interests
5.5 Explanation of the balancing of interests in the case of legitimate interest
Where we process personal data on the basis of our legitimate interest, we have weighed our interests against your interests, rights and freedoms before starting the processing. In doing so, we have considered, among other things:
· the nature of the data (mainly non-sensitive contact and usage data);
· your reasonable expectations in the context of a Webshop and customer relationship;
· the limited impact of the processing on your privacy;
· the safeguards we put in place, such as aggregation where possible and the right to object.
This balancing of interests has been documented in writing prior to processing and can be viewed on request (please contact us at olives@kalpaky.com).
You retain the right to object to processing based on legitimate interest at any time.
6. Who do we share your personal data with?
We only share your personal data with third parties to the extent this is necessary for the purposes set out in this Privacy Statement, or where we are legally obliged to do so.
The following categories of recipients may receive your data:
· IT and hosting service providers;
· payment service providers;
· shipping and logistics service providers;
· marketing service providers;
· providers of analytical and advertising services (including Google Ireland Limited for Google Analytics and Meta Platforms Ireland Limited for advertising via the Meta pixel), as further specified in our Cookie Statement;
· professional advisers, but only to the extent necessary for the provision of advisory services, compliance with legal obligations or the protection of our rights in disputes;
· government bodies such as the Tax and Customs Administration or supervisory authorities, where we are legally required to disclose data.
We enter into a processing agreement with parties that process personal data on our behalf as processors. These processors may only process personal data on our instructions and may not use it for their own purposes. Our processors may engage sub-processors under their responsibility, but only if we have given our prior written consent for this in the processing agreement. Our processors are obliged to inform us of any intended changes regarding the addition or replacement of sub-processors, so that we have the opportunity to object. Sub-processors are subject to the same data protection obligations as those laid down in our processing agreement with the main processor.
The main processors we use are:
· Google Ireland Limited (analytics and advertising services);
· Meta Platforms Ireland Limited (advertising services);
· Mollie B.V. (payment processing);
· Shopify Inc. (webshop platform and hosting);
· Sendcloud B.V. (shipping and tracking services).
For an up-to-date overview of all processors, please contact us at olives@kalpaky.com.
7. Transfer of personal data outside the EEA
Some of our service providers process personal data outside the European Economic Area (“EEA”). Where this is the case, we ensure that appropriate safeguards are in place within the meaning of the GDPR. In particular:
· Shopify Inc. (webshop platform): Transfers may take place to the United States and Canada. Safeguard: Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by technical and organisational measures as set out in Shopify’s Data Processing Addendum.
· Google Ireland Limited (analytics and advertising services): Transfers may take place to the United States. Safeguard: Google LLC is certified under the EU–U.S. Data Privacy Framework (adequacy decision; certification can be verified at https://www.dataprivacyframework.gov). Where this certification does not apply, Standard Contractual Clauses (SCCs) are used.
· Meta Platforms Inc. (advertising services): Transfers may take place to the United States. Safeguard: Meta Platforms Inc. is certified under the EU–U.S. Data Privacy Framework (adequacy decision; certification can be verified at https://www.dataprivacyframework.gov). Where this certification does not apply, Standard Contractual Clauses (SCCs) are used.
· Sendcloud B.V. (shipping and tracking services): Sendcloud processes your name, address and shipping details and passes them on to your chosen parcel carrier (such as PostNL, DHL, etc.). These parcel carriers process your data for the purpose of delivery and are independently responsible for this insofar as they pursue their own purposes (such as optimising delivery routes). Data remains within the EEA, unless a parcel carrier chosen by you carries out an international shipment.
For more information about specific transfers in the context of cookies, please refer to our Cookie Statement. You can contact us at any time for further information about the safeguards used, or to request a copy of the relevant SCCs, via olives@kalpaky.com.
8. How long do we retain your data?
We do not retain your personal data for longer than is necessary for the purposes for which it was obtained, unless we are legally obliged to keep it for a longer period.
In general, we apply the following retention periods:
· Order and invoice data: at least 7 years after the end of the relevant financial year, in connection with statutory tax retention obligations.
· Customer service data: up to a maximum of 2 years after your request or complaint has been handled, unless a longer period is necessary in connection with an (impending) dispute.
· Cookies and online identifiers: in accordance with the specific retention periods per cookie as stated in the detailed cookie overview, accessible via the “Cookie settings” button at the bottom of each page of the Webshop.
When personal data is no longer necessary for the purposes for which it was collected and we are no longer legally obliged to retain it, we permanently delete it from our systems.
9. How do we protect your personal data?
We take appropriate technical and organisational measures to protect your personal data against loss or unlawful processing, including:
· the use of secure connections (TLS/SSL) when sending data;
· restricted access to systems and data by means of passwords and, where appropriate, additional authentication measures;
· logging and monitoring access to systems in which personal data is stored;
· regular backups and updates of systems and software;
· confidentiality obligations for employees and processors.
Although we do our utmost to provide an appropriate level of security, no system can guarantee 100% security. If a data breach occurs with potentially adverse consequences for your privacy, we will report this to the competent Data Protection Authority where required and, if necessary, also inform you.
10. Your rights
Under the GDPR, you have various rights in relation to your personal data. You can exercise the rights listed below by contacting us at olives@kalpaky.com.
· Right to information and access – you have the right to know which of your personal data we process and to access that personal data.
· Right to rectification – you have the right to have incorrect or incomplete personal data corrected.
· Right to erasure (“right to be forgotten”) – in certain cases, you can ask us to delete your personal data, for example when the data is no longer necessary for the purposes for which it was collected, or when you withdraw your consent and there is no other legal basis for the processing.
· Right to restriction of processing – in certain cases, you may ask us to restrict the processing of your personal data, for example while we assess the accuracy of the data or an objection you have raised.
· Right to data portability – if the processing is based on consent or on a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format and to transfer it to another controller.
· Right to object – you have the right to object to processing that takes place on the basis of our legitimate interest. We will cease that processing unless we can demonstrate compelling legitimate grounds that outweigh your interests, rights and freedoms, or if the processing is related to the establishment, exercise or defence of legal claims. You also have the right to object at any time to the use of your personal data for direct marketing (including profiling for that purpose). In that case, we will immediately stop processing your personal data for direct marketing.
· Right to withdraw consent – insofar as we process your personal data on the basis of your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not have retroactive effect and does not affect the lawfulness of processing before the withdrawal.
We may ask you to identify yourself adequately before we process your request, to prevent us from providing data to the wrong person. We will inform you as soon as possible, and in any event within five (5) to ten (10) working days of receiving your request, what additional information we may need for this purpose (for example, a copy of a valid identity document showing your passport photo, name, date of birth and document number, with other details such as your national insurance number fully obscured). The period for processing your request will start once we have received this additional information.
11. Complaints
If you have any complaints about how we handle your personal data, please contact us at olives@kalpaky.com. We aim to respond to your request or complaint within one month of receiving it. In the case of complex or multiple requests, this period may be extended by up to two months; we will inform you if this is the case.
You also have the right to lodge a complaint with the competent supervisory authority:
Data Protection Authority (Autoriteit Persoonsgegevens)
Available at: https://www.autoriteitpersoonsgegevens.nl
12. Mandatory provision of personal data
In some cases, providing personal data is a necessary condition for entering into an agreement with us. This is the case, for example, where we need the data to deliver your order or to comply with legal obligations (such as issuing an invoice). If you do not provide this data, we will not be able to enter into an agreement with you or execute an order, because the data is necessary for delivery or invoicing. Where this is the case, we will make this clear during the ordering process or in our communication with you.
13. Cookies and similar technologies
Our Webshop uses cookies and similar technologies. The way in which we handle these, the types of cookies we use, the purposes for which we use them and how long they are stored are described in our separate Cookie Statement.
In the event of any conflict between this Privacy Statement and the Cookie Statement, the Cookie Statement shall prevail insofar as cookies and similar technologies are concerned. For other processing activities, this Privacy Statement shall prevail.
14. Changes to this Privacy Statement
We may amend this Privacy Statement from time to time, for example if our processing activities change or if this is required by law or regulation.
The most recent version is always available on our Webshop. The date of the last change is stated at the bottom of this Privacy Statement. In the event of material changes that affect the processing of your personal data, we will inform you in advance by email or by means of a clear notification on the Webshop.
This Privacy Statement was last amended on 19 January 2026.
