Privacy Policy
Draft for review. Complete bracketed fields and confirm operational details before publication.
Effective date: [STORE LAUNCH DATE — TO BE CONFIRMED] Last updated: 6 November 2026
1. Who we are
[LEGAL BUSINESS NAME], trading as Run Club Studio, at [BUSINESS ADDRESS], Netherlands, operates a consumer webshop for running apparel, accessories, and supplements and is the controller of the personal data described here. KVK: [KVK NUMBER]. Website: [WEBSITE URL]. Contact support@runclubstudio.com for privacy questions and rights requests. We have not appointed a data protection officer. Please direct privacy requests to support@runclubstudio.com.
2. Information we collect
We process contact details, billing and shipping addresses, order contents, transaction references, payment status, delivery records, returns, and customer correspondence. Mollie processes payment information relevant to the payment method you select; we receive payment status and relevant transaction details. Our staff can access payment status, transaction references, payment methods, and payer details, but not full payment card credentials.
We also process technical information such as IP addresses, browser/device details, security logs, consent choices, and analytics or advertising information described below. Information comes from you, your use of our website, and payment and delivery providers. [IDENTIFY ANY OTHER SOURCES.]
Accounts are not currently available. If introduced, we will explain account processing before registration. We do not ask you to provide medical information when purchasing supplements. We collect newsletter signup details and preferences, product review submissions, and information you enter in our contact form. Reviews may appear on our own website, Trustpilot, and Google Reviews. For reviews submitted directly to our website, we obtain permission through an explicit checkbox explaining that the review and display name will be public. We display the reviewer’s first name and surname initial. You can withdraw publication consent by contacting support@runclubstudio.com. Reviews submitted to external platforms follow their own publication settings and privacy notices. [CONFIRM WHETHER INVITATIONS, CUSTOMER DETAILS, OR REVIEW CONTENT ARE TRANSFERRED BETWEEN OUR STORE AND THESE PLATFORMS.] Do not include payment details or sensitive medical information in reviews or contact messages.
3. Why we process data
| Purpose | Legal basis |
|---|---|
| Accept and fulfill orders, arrange payment and delivery, handle returns | Performance of the purchase contract |
| Maintain legally required financial records and comply with product safety duties | Legal obligation |
| Answer pre-purchase questions | Steps requested before entering a contract |
| Handle other inquiries and improve support | Legitimate interests in customer service |
| Protect the webshop, investigate fraud, and defend legal claims | Legitimate interests in security and protecting legal rights, subject to your rights |
| Optional analytics, session replay, and advertising tracking | Consent where required; any exempt limited analytics requires a separately assessed lawful basis |
| Publish reviews submitted directly to our website with the reviewer’s first name and surname initial | Consent, obtained through an explicit publication checkbox |
| Optional marketing emails | Consent, or a legally permitted existing-customer exception where its conditions are met |
Required checkout fields are identified when collected. Without necessary contact, address, and payment information, we cannot fulfill your order. You can withdraw consent at any time without affecting earlier lawful processing. You may unsubscribe from marketing through the message's unsubscribe link or support@runclubstudio.com. We send marketing to people who subscribe and, where legally permitted, to existing customers about our own similar products. For the existing-customer exception, we provide a clear, free opportunity to object when collecting the email address and in every marketing message. Where that exception is unavailable, we obtain consent first.
4. Who receives data
We share necessary information with Mollie for payments, PostNL and DHL (we hold stock and fulfill orders ourselves) for delivery, Google Cloud (europe-west4 region) for our custom webshop, and Resend for order, support, and marketing email delivery. We also use Trustpilot and Google Reviews for external reviews. [CONFIRM THE DATA SHARED AND EACH REVIEW INTEGRATION.] Analytics and advertising providers are described in Section 7. [CONFIRM ALL PROVIDER LEGAL ENTITIES AND THEIR CONTROLLER/PROCESSOR ROLES.]
Mollie also processes payment data under its own obligations and privacy notice: Mollie privacy statement. Providers acting as our processors are subject to appropriate data processing agreements. We may disclose relevant information to advisers or authorities where legally necessary, or for a business transfer with appropriate safeguards. We do not sell customer data. We share data with Google and Meta for the advertising purposes described in Section 7, subject to applicable consent requirements. Depending on the law that applies, advertising disclosures may have specific legal classifications; this statement does not remove rights relating to that sharing.
5. International transfers
Our webshop is hosted on Google Cloud in the europe-west4 region. This hosting region does not establish where every service provider, support team, or subprocessor processes data. Providers may process data elsewhere, including outside the EEA. [CONFIRM LOCATIONS AND TRANSFER ARRANGEMENTS FOR EACH PROVIDER.] Where required, we use an applicable adequacy decision or appropriate contractual safeguards and supplementary measures. Contact support@runclubstudio.com for details or a copy of relevant safeguards.
6. Retention
We keep data only as long as necessary for the stated purposes, legal requirements, and relevant claims.
| Data | Retention period |
|---|---|
| Orders and financial records | [APPLICABLE DUTCH TAX RETENTION PERIOD; CONFIRM RECORD CATEGORIES] |
| Customer service and return correspondence | [PERIOD AFTER RESOLUTION] |
| Delivery records | [PERIOD] |
| Technical and security logs | [PERIOD] |
| Analytics and session replay | [ACTUAL PROVIDER SETTINGS / PERIODS] |
| Marketing consent and suppression records | [PERIOD / CRITERIA] |
| Backups | [EXPIRY CYCLE] |
Relevant legal holds may require longer retention, with use restricted to the reason for keeping the records.
7. Cookies and similar technologies
We use the following analytics and marketing services. [CONFIRM ENABLED FEATURES AND CONFIGURATION BEFORE PUBLICATION.]
| Service | Purpose and data | Configuration to confirm |
|---|---|---|
| Google Analytics | Measures traffic, page views, referral sources, device/browser details, and configured interaction events. Cookies and identifiers may associate visits. | We use Google Analytics 4 linked to Google Ads for advertising measurement and audience features. Google Signals is enabled for advertising and cross-device measurement for eligible Google users. GA4 User-ID is disabled at launch and will remain disabled until customer accounts are introduced. Before enabling it, we will update this notice and confirm the applicable consent and configuration. [GA4 EVENTS AND RETENTION — PENDING CONFIGURATION.] |
| Cloudflare Analytics | Measures traffic and performance. Cloudflare Web Analytics is designed to operate without analytics cookies or fingerprinting. | We use Cloudflare Web Analytics, its cookieless website analytics product. |
| Microsoft Clarity | Provides behavioral metrics, heatmaps, and session replay, including clicks, scrolling, navigation, device information, and browser identifiers. | Clarity recording is limited to public browsing pages. Checkout, payment pages, and customer support forms are excluded, and personal information is masked. We use Clarity for website usability analysis only, without Microsoft Advertising integration. [CLARITY RETENTION — PENDING CONFIGURATION.] |
| Meta Pixel and Conversions API | Measures product views, searches, cart actions, checkout steps, purchases and newsletter subscriptions. Browser and server events share an event ID for deduplication. | For conversion matching, Meta may receive hashed contact details together with browser and order-event data. The server token remains private and is never sent to the browser. |
| Facebook/Meta | If enabled, Meta Pixel or Conversions API sends visits, conversions, device details, and identifiers to Meta for advertising measurement and audiences. Meta may associate events with a Meta account. | We use Meta Pixel and Conversions API for purchase measurement and retargeting, with advanced matching enabled. Advanced matching can send hashed customer contact identifiers, such as email addresses, to Meta to match events with Meta accounts. Hashing does not make these identifiers anonymous. [LIST THE EXACT ADVANCED-MATCHING IDENTIFIERS SENT TO META, EVENTS, AND ANY EMBEDS.] |
Analytics and session-replay tools are enabled by default. You can disable them at any time through the permanent Cookie Settings link on our website. Disabling analytics prevents these tools from loading on later page loads. It does not affect processing that took place before you changed the setting. Cookieless analytics still requires an assessment of the applicable privacy obligations.
Our cookie notice at [COOKIE NOTICE LINK] lists actual cookies and similar technologies, providers, purposes, and lifetimes. [COMPLETE THE INVENTORY FROM THE LIVE CONFIGURATION, INCLUDING NECESSARY COOKIES.]
These providers may also process information for their own purposes under their applicable terms. See Google's privacy policy, Cloudflare's privacy policy, Microsoft's privacy statement, and Meta's privacy policy. [CONFIRM PROVIDER LEGAL ENTITIES, CONTROLLER/PROCESSOR ROLES, INTERNATIONAL TRANSFERS, AND ENABLED DATA USES.]
[BEFORE PUBLICATION: Ensure consent controls match this policy. Configure Clarity masking and exclusions, and prevent health information, private customer content, credentials, payment details, and identifying URL parameters from entering session replay, analytics, or advertising events.]
8. Your rights
Subject to applicable legal conditions, you may request access, correction, erasure, restriction, or data portability, and object to processing based on legitimate interests. You may object to direct marketing at any time. You can withdraw consent without affecting the lawfulness of processing before withdrawal.
Contact support@runclubstudio.com. We may request proportionate identity verification. We normally respond within one month; if a lawful extension is needed, we explain it within that initial period.
You can complain to the Autoriteit Persoonsgegevens or another competent supervisory authority, including the authority in the country where you live or work. You do not have to contact us first.
9. Security
We use appropriate technical and organizational safeguards. [CONFIRM ACTUAL ACCESS CONTROLS, ENCRYPTION, AND OTHER MEASURES.] No system is completely secure. We investigate breaches and notify authorities and affected people when legally required.
10. Age and automated decisions
Purchases are intended for customers aged 16+, with parent or guardian permission where legally required. Supplement-specific age restrictions still apply. We do not intentionally invite children under 16 to submit order details. Contact us if you believe a child has provided information contrary to these rules.
[PENDING: DESCRIBE THE CONFIRMED AUTOMATED PAYMENT/FRAUD DECISION PROCESS, WHO MAKES THE DECISION, WHETHER IT IS SOLELY AUTOMATED, ITS LEGAL BASIS, RELEVANT LOGIC AND CONSEQUENCES, AND ANY AVAILABLE HUMAN REVIEW OR CHALLENGE PROCESS. THE OPERATOR HAS NOT YET PROVIDED THESE DETAILS.]
11. Applicable law and updates
This Policy is governed by the laws of the Netherlands, including the GDPR and applicable Dutch data protection legislation, without limiting mandatory rights available under other applicable law.
We publish updates here and provide appropriate notice of material changes. We seek fresh consent before new processing where legally required. Contact support@runclubstudio.com or write to [BUSINESS ADDRESS].