Privacy policy
Last updated 23 October 2026
In short
- We only collect what we need to sell, deliver and support your order.
- Payment details are handled by Stripe and PayPal. We never see your full card number.
- We do not sell your data and we do not use advertising or tracking cookies.
- You can ask to see, correct or delete your data at any time via [email protected].
Who is responsible
A10 ecommerce B.V., trading as CombiBag, is the controller of your personal data under the General Data Protection Regulation (GDPR).
- Address: IJburglaan 731, 1087 CH Amsterdam, Netherlands
- KVK: 42188960
- Company email: [email protected]
- Email for privacy questions: [email protected]
What data we collect
- Order details: your name, email address, delivery and billing address, the products you order and your order history. Your phone number if you give it.
- Payment details: the payment method, amount, transaction reference and payment status. Card and bank details are processed by Stripe and PayPal; we do not receive your full card number.
- Messages: what you write to us by email or through our forms, including withdrawal statements and complaints.
- Technical data: IP address, browser type and the pages you request, recorded in our web server logs for security.
- Cart and session: stored with cookies that are strictly necessary for the shop. See our cookie policy.
Why we use it
| Purpose | Data | Legal basis |
|---|---|---|
| Processing, delivering and supporting your order | Order details, messages | Performance of a contract (Art. 6(1)(b) GDPR) |
| Handling payments and refunds | Order and payment details | Performance of a contract (Art. 6(1)(b) GDPR) |
| Preventing fraud and misuse | Order, payment and technical data | Legitimate interest in protecting our customers and our business (Art. 6(1)(f) GDPR) |
| Handling withdrawals, returns, complaints and guarantee claims | Order details, messages | Legal obligation (Art. 6(1)(c) GDPR) and performance of a contract |
| Accounting and tax | Order and payment details | Legal obligation (Art. 6(1)(c) GDPR) |
| Keeping the website secure | Technical data | Legitimate interest in a secure website (Art. 6(1)(f) GDPR) |
| Newsletter, only if you sign up | Email address | Consent (Art. 6(1)(a) GDPR), which you can withdraw at any time |
Who we share it with
We share your data only where needed for the purposes above:
- Payment providers: Stripe Payments Europe, Limited (Ireland) and PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg). For their own fraud prevention and legal obligations, they act as independent controllers. See the privacy notices on stripe.com and paypal.com.
- Carriers: PostNL and DHL receive your name, address and, for delivery updates, your email address or phone number.
- Service providers: our website host, email provider and accounting software provider process data on our behalf under a data processing agreement.
- Our accountant and authorities: where Dutch law requires it, for example the Dutch Tax Administration.
We do not sell your personal data.
Transfers outside the EU
Some service providers, including Stripe and PayPal, may process data outside the European Economic Area. In that case the transfer is protected by an adequacy decision of the European Commission, such as the EU–U.S. Data Privacy Framework, or by the European Commission’s standard contractual clauses.
How long we keep it
- Order, payment and invoice records: 7 years, as required by Dutch tax law.
- Customer service messages, withdrawal statements and complaints: up to 2 years after the matter is closed, or longer if they form part of the order records.
- Web server logs: no longer than 90 days.
- Newsletter subscription: until you unsubscribe.
Your rights
You have the right to access, correct and delete your personal data, to restrict or object to its processing, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Email [email protected] and we respond within one month.
If you are not satisfied with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the data protection authority in your own EU country.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Stripe and PayPal may use automated fraud checks on payments; see their privacy notices.
Cookies
We only use cookies that are strictly necessary for the shop to work. Read the details in our cookie policy.
Security
Our website uses an encrypted HTTPS connection. Access to customer data is limited to the people who need it to handle your order. Our fonts and images are hosted on our own server, so loading our pages does not send your data to other websites.
Children
Our shop is not intended for children under 16. We do not knowingly collect their personal data.
Changes
We may update this policy. The date at the top shows the latest version. If a change affects you significantly, we let you know by email.