Privacy Statement

Version: March 2026 — IZY Bottles B.V., based in the Netherlands

At IZY Bottles, we take your privacy seriously. In this statement, we explain clearly and transparently which personal data we collect, why we do so, how long we keep it and what rights you have. IZY Bottles B.V. is the data controller within the meaning of the General Data Protection Regulation (GDPR).

1. Which data do we collect?

Depending on how you use our website, we collect:

• Placing an order — name, email address, delivery address (street, house number, postal code, city, country), phone number and payment reference.
• Creating an account — name, email address and encrypted password.
• Newsletter — email address and optionally name.
• Contact form or email — name, email address and the content of your message.
• Business order or B2B — company name, VAT number, contact person and business address.
• Visiting the website — cookies and device data, only with your prior consent.

We never store full payment details. Payments are handled entirely through certified payment service providers (Mollie, Klarna, PayPal and others).

2. Why do we process your data?

We process your data solely for clearly defined purposes, with the corresponding legal basis from the GDPR:

Performance of a contract (art. 6(1)(b))
Processing your order, delivery, account management, returns handling and customer service.

Legal obligation (art. 6(1)(c))
Retaining invoices and financial records on the basis of the 7-year statutory tax retention obligation.

Legitimate interest (art. 6(1)(f))
Fraud prevention, securing our systems and improving our services based on anonymised usage data.

Consent (art. 6(1)(a))
Newsletter and marketing emails (only if you have signed up), non-functional cookies and personalised advertising. You can withdraw your consent at any time via the unsubscribe link in our emails or via the cookie settings on our website.

3. How long do we keep your data?

We do not keep your data longer than necessary:

• Order data and customer accounts — 7 years (statutory tax retention obligation), then deleted or anonymised.
• Newsletter — until you unsubscribe; deleted immediately afterwards.
• Contact messages — a maximum of 2 years after handling.
• Cookies — see the Cookies section below for specific retention periods.

4. Do we share your data with third parties?

IZY Bottles never sells your data. We share it only when this is necessary for our services:

• Delivery services (DPD, GLS, DHL) — name and delivery address, solely for delivery.
• Payment service providers (Mollie, iDEAL, Klarna, PayPal) — payment reference, solely for transaction processing.
• Email marketing (Klaviyo) — email address and name, only after your consent to the newsletter.
• Shopify — our e-commerce platform processes order and customer data as a processor on our behalf, on the basis of a data processing agreement (GDPR-certified).
• Loox — review platform, receives the email address solely to invite a review after a purchase.
• Google Analytics — anonymised usage data for website optimisation, only after consent via the cookie banner.
• Meta (Facebook/Instagram) — conversion data for advertising, only after consent via the cookie banner.

All of these parties are contractually obliged to treat your data confidentially and in accordance with the GDPR.

5. International data transfers

Some processors (including Shopify and Google) may store data outside the European Economic Area (EEA). Where this is the case, we put appropriate safeguards in place such as the EU Standard Contractual Clauses (SCCs) or an adequacy decision by the European Commission — so that your data enjoys the same protection as within the EEA.

6. Cookies

We use three types of cookies:

• Functional cookies — necessary for the website to work (such as remembering your shopping cart). No consent required. Retention period: session up to a maximum of 1 year.
• Analytical cookies (Google Analytics) — help us understand how the website is used. IP anonymisation is enabled. Consent required. Retention period: 2 years (_ga) / 24 hours (_gid).
• Marketing cookies (Meta Pixel, Google Ads, TikTok Pixel, Klaviyo) — for personalised advertising and measuring campaign performance. Consent required. Retention period: 3 to 13 months.

On your first visit, you can choose via our cookie banner which cookies you accept. You can change this at any time via the cookie settings at the bottom of the website.

You can also manage or delete cookies via your browser settings. Please note: disabling functional cookies may affect how the website works.

7. Your rights

Under the GDPR, you have the following rights:

• Right of access (art. 15) — request which data we process about you.
• Right to rectification (art. 16) — have inaccurate or incomplete data corrected.
• Right to erasure (art. 17) — request the deletion of your data (unless we are legally required to retain it).
• Right to restriction (art. 18) — have processing restricted in certain situations.
• Right to data portability (art. 20) — receive your data in a readable format or have it transferred.
• Right to object (art. 21) — object to processing for direct marketing or based on legitimate interest.
• Right to withdraw consent — always possible, without retroactive effect.

To submit a request: send an email to support@izybottles.com. We respond within 30 days. We may verify your identity before handling your request.

Do you disagree with how we process your data? Then you can file a complaint with the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority): www.autoriteitpersoonsgegevens.nl

8. Security

We protect your data with appropriate technical and organisational measures:

• SSL/TLS encryption (https) on all pages
• Limited access to personal data — only employees who need it
• Data processing agreements with all external processors
• Regular security reviews

In the event of a data breach that endangers your rights and freedoms, we report this to the Autoriteit Persoonsgegevens and — where applicable — also to you personally, in accordance with art. 33 and 34 of the GDPR.

9. Minors

Our website and products are not aimed at children under the age of 16. We do not knowingly collect personal data from minors. If we discover that we have accidentally collected a child's data, we delete it as soon as possible. Parents or guardians can report this via support@izybottles.com.

10. Changes to this statement

We update this statement when necessary, for example in the event of new legislation or changes to our services. The most recent version is always available on our website. In the event of significant changes, we will inform you by email or via a notification on the website.

11. Contact

Do you have questions, comments or requests about this privacy statement or the way we handle your personal data? Then please contact us via:

IZY Bottles B.V.
Email: support@izybottles.com
Website: www.izybottles.com