Privacy policy

Last updated: 16 August 2026

Flossing processes personal data when you visit our website, place an order or get in touch with us. In this policy we explain, calmly and without legal jargon, what data we collect, why we collect it, how long we keep it and what rights you have.

Our store runs on Shopify. This means Shopify processes certain data on our behalf, and in some cases for its own purposes as well. We say so wherever that applies.

If there is any conflict between our Terms of Service and this Privacy Policy, this Privacy Policy takes precedence on matters concerning the collection, processing and disclosure of personal data.

1. Who is responsible for your data

Flossing is the data controller for the processing of your personal data.


Business name	Flossing
Legal form	Sole proprietorship (eenmanszaak) under Dutch law
Owner	Benjamin George Goldsmith
Registered address	Fuut 6, 2381 KM Zoeterwoude-Dorp, The Netherlands
Email	info.flossing@gmail.com
Phone	+31 6 83 65 79 69
Chamber of Commerce (KvK)	97408301
VAT number	NL005268001B15
Websites	www.flossing.nl and www.flossingstore.com

Flossing is not required to appoint a Data Protection Officer. For any privacy-related question, please use the email address above.

2. The personal data we process

By "personal data" we mean information that identifies you or can reasonably be linked to you. Depending on how you use our services, we process:

Contact details — name, email address, phone number, billing address and shipping address.
Order and transaction data — the products you view, add to your cart, order, return or exchange, and your order history.
Payment data — payment method, transaction reference and payment confirmation. We do not receive or store full card or bank account details; these are processed directly by our payment service providers.
Account data — username, password (encrypted), preferences and settings, if you create an account.
Communications — the content of your messages to our customer service, whether by email, contact form or social media.
Device and usage data — IP address, browser type, device, network information, and how you use our website (pages visited, clicks, session duration).
Reviews and user content — if you leave a review or share content with us.
Newsletter and marketing preferences — whether you are subscribed and what you have given consent for.

We do not ask for special categories of personal data, such as health data. Please do not share these with our customer service either. For questions about your teeth or gums, we recommend speaking to your dentist or dental hygienist.

3. How we obtain this data

Directly from you — when you place an order, create an account, subscribe to our newsletter or contact our customer service.
Automatically through the website — via cookies and similar technologies, and via data your browser or device sends automatically.
Through our service providers — for example our payment provider, carrier or review platform.
Through partners and advertising platforms — for example when you reach our site through an advertisement.

4. Why we use your data, and on what legal basis

Purpose	Data	Legal basis (GDPR)
Processing your order, payment, shipping, returns and exchanges	Contact, order and payment data	Performance of a contract (Art. 6(1)(b))
Creating and managing your account	Account and contact data	Performance of a contract (Art. 6(1)(b))
Customer service and aftercare, including guidance on using your product	Contact data and communications	Performance of a contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f))
Service emails about your order, shipment and warranty	Contact and order data	Performance of a contract (Art. 6(1)(b))
Newsletters and marketing emails	Email address, preferences, order history	Consent (Art. 6(1)(a)), or legitimate interest for similar products offered to existing customers, always with an opt-out
Showing advertisements on other platforms and measuring their results	Device, usage and order data	Consent given through the cookie banner (Art. 6(1)(a))
Improving, analysing and securing our website	Device and usage data	Legitimate interest (Art. 6(1)(f)), and consent where analytics cookies are involved
Preventing fraud and misuse	Order, payment and device data	Legitimate interest (Art. 6(1)(f))
Publishing and managing reviews	Name (or first name/initials), review, order reference	Consent (Art. 6(1)(a))
Meeting legal obligations, such as tax retention requirements	Order and invoice data	Legal obligation (Art. 6(1)(c))
Defending our rights in the event of a dispute	All relevant data	Legitimate interest (Art. 6(1)(f))

Where we rely on a legitimate interest, we have weighed it against your interests and rights. You can object to these processing activities at any time; see section 9.

5. Who we share your data with

We do not sell your personal data. We share it only where necessary for the purposes set out above, and always on the basis of a data processing agreement or another valid legal ground.

We work with the following parties:

Payment service providers — Shopify Payments for payments made by iDEAL, Wero, Bancontact, KBC/CBC, Apple Pay, Google Pay and credit card (Visa, Mastercard, American Express), and Klarna Bank AB and PayPal (Europe) S.à r.l. et Cie, S.C.A. when you choose one of those methods. They receive the data needed to process your payment and are responsible for that processing themselves.
Carrier — DHL, for delivering your order. DHL receives your name, address, email address and phone number in order to deliver your parcel and keep you informed.
Email software — Shopify Email, for sending our newsletter and service emails. Your email address is only used for marketing if you subscribed yourself, or where the email concerns your order.
Review platform — Trustpilot A/S, for collecting and displaying reviews. If we invite you to leave a review, we share your email address and order reference for that purpose.
Website and store analytics — Shopify, for the built-in statistics of our store.
Advertising platforms — Meta Platforms Ireland Ltd. (Facebook and Instagram) and Google Ireland Ltd. (Google Ads), for displaying and measuring our advertisements. These parties only place cookies and receive data about your visit if you have given consent through the cookie banner.
Accounting and administration — Balancify, our bookkeeper, for processing invoices and meeting our tax obligations.

We may also share data:

when you ask us to, or give your consent;
when we are legally required to, for example following a request from a competent authority;
in the event of a business transfer, merger or closure, in which case we will inform you in advance.

Our relationship with Shopify

Our store is hosted by Shopify. Shopify processes data about your visit and purchase in order to provide the service to us and to you. In addition, Shopify uses certain data for its own purposes, for example to improve its features and to enable personalised advertising across different stores. For those activities Shopify is the data controller. You can find more information in the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

6. Transfers outside the European Economic Area

Some of our service providers are based outside the EEA, for example in the United States or Canada. We only transfer data outside the EEA where an appropriate level of protection applies:

on the basis of an adequacy decision by the European Commission, such as the EU-US Data Privacy Framework for participating US companies; or
on the basis of the European Commission's Standard Contractual Clauses (SCCs), supplemented by appropriate technical and organisational measures.

If you would like to know which safeguard applies to a specific provider, please contact us.

7. How long we keep your data

We do not keep your data longer than necessary for the purpose it was collected for.

Data	Retention period
Order, invoice and payment data	7 years, under the Dutch statutory tax retention obligation (Article 52 of the General State Taxes Act)
Account data	For as long as your account is active, and up to 12 months after you request deletion or after prolonged inactivity
Customer service correspondence	24 months after your enquiry is resolved
Warranty and returns records	Up to 3 years after purchase, in connection with the statutory warranty
Newsletter subscription	Until you unsubscribe; we keep the record of your consent for a further 12 months
Reviews	For as long as the review is published, or until you ask us to remove it
Cookie and analytics data	Varies per cookie, up to a maximum of 24 months. See our cookie policy

Once these periods expire, we delete or anonymise the data.

8. Cookies

Our website uses cookies and similar technologies. Functional and strictly necessary cookies are always placed; they are needed to make the store work, for example to remember the contents of your cart. Analytics, marketing and advertising cookies are only placed with your consent, which you give through the cookie banner.

You can change your choice at any time through the cookie settings on our website, or by deleting cookies in your browser settings.

A full overview of the cookies we use, their purpose and their retention period can be found in our cookie policy.

9. Your rights

You have the following rights in relation to your personal data:

Access — you may request which data we process about you.
Rectification — you may have inaccurate data corrected.
Erasure — you may ask us to delete your data, unless we are legally required to keep it.
Restriction — you may ask us to pause the processing of your data.
Objection — you may object to processing based on a legitimate interest, and you may always object to direct marketing.
Portability — you may receive your data in a commonly used format, or have it transferred to another party.
Withdrawal of consent — where we rely on consent, you may withdraw it at any time. This does not affect the lawfulness of processing that took place beforehand.
Opting out of marketing — via the unsubscribe link at the bottom of every marketing email. You will continue to receive service emails about your order.

You can exercise these rights by emailing info.flossing@gmail.com. We will respond within one month. For complex requests we may extend this period by two months, and we will let you know in good time if we do. We may ask you to confirm your identity before acting on your request. You may also authorise someone to submit a request on your behalf, in which case we will ask for proof of that authorisation.

Exercising your rights is free of charge and will never count against you as a customer.

10. Complaints

If you are unhappy with how we handle your data, please tell us first at info.flossing@gmail.com. We are glad to talk it through.

You also always have the right to lodge a complaint with the Dutch supervisory authority:

Autoriteit Persoonsgegevens (Dutch Data Protection Authority) PO Box 93374, 2509 AJ The Hague, The Netherlands www.autoriteitpersoonsgegevens.nl

If you live in another EU country, you may also contact the supervisory authority in your own country.

11. Children

Our products and store are not intended for children. We do not knowingly collect personal data from children under the age of 16 without the consent of a parent or guardian. If you are a parent or guardian and believe your child has shared data with us, please contact us and we will delete it.

12. Automated decision-making

We do not make decisions with legal or similarly significant effects on you based solely on automated processing. We do use automated techniques to tailor product recommendations and advertisements; you can object to this or withdraw your cookie consent at any time.

13. Security

We take appropriate technical and organisational measures to protect your data, including encrypted connections (SSL/TLS), access on a need-to-know basis and carefully selected service providers. No security is perfect, and data sent over the internet is never entirely secure. For that reason, please do not share sensitive or confidential information through unsecured channels, and keep your account details to yourself.

14. Links to other websites

Our website may contain links to third-party websites or platforms. We are not responsible for their privacy practices or their content. Please read their own privacy and cookie policies.

15. Changes to this Privacy Policy

We may update this Privacy Policy, for example when our practices change or when legislation requires it. The current version is always available on this page, with an updated date at the top. In the event of significant changes, we will inform you actively, for example by email.

16. Contact

Do you have questions about this Privacy Policy, or about how we handle your data?

Flossing Fuut 6, 2381 KM Zoeterwoude-Dorp, The Netherlands info.flossing@gmail.com +31 6 83 65 79 69 Chamber of Commerce 97408301