Privacy policy

Privacy Policy

Last updated: April 2026

This Privacy Policy explains which personal data Sonayah Boutique collects about you, why we collect it, and what your rights are. We process your data in accordance with the EU General Data Protection Regulation (GDPR).

1. Data Controller

Sonayah Boutique is a store operated by VALCS Media, which is the data controller for the processing of your personal data.
VALCS Media, Multatulihof 16A, 7081AS Gendringen, the Netherlands
Business registration number: 42056754
Email: info@sonayah.com

2. What information do we collect?

We only collect the information we need to provide our services:

  • When making a purchase: name, address, email, telephone number, payment information and order history
  • For newsletters: email address and first name
  • When contacting us: the information you choose to provide to us
  • When visiting the website: IP address, browser type, pages visited, referral source (via cookies — see our Cookie Policy)

3. What do we use the information for?

  • To process and deliver your order
  • To communicate with you about your order
  • To send you newsletters if you have subscribed
  • To improve the webshop and your experience
  • To comply with legal requirements (accounting, tax, consumer law)

4. Legal basis

We process your information on the following bases:

  • Contract (GDPR Article 6(1)(b)): when we process your order
  • Consent (GDPR Article 6(1)(a)): when you subscribe to the newsletter or accept cookies
  • Legal obligation (GDPR Article 6(1)(c)): when we retain order information for accounting purposes
  • Legitimate interest (GDPR Article 6(1)(f)): to improve the webshop

5. How long do we retain the information?

  • Order information: 5 years (statutory accounting requirements)
  • Newsletter: until you unsubscribe
  • Contact enquiries: maximum 2 years
  • Technical data from cookies: see our Cookie Policy

6. Who do we share the information with?

We only disclose information to partners who help us operate the shop:

  • Shopify (webshop platform, Canada/EU)
  • Payment providers (processing of Visa, Mastercard, American Express, Apple Pay, Google Pay and Shop Pay payments)
  • USPS, UPS, FedEx (shipping)
  • Klaviyo (newsletter, if you have subscribed)
  • Google Analytics and Meta (only if you accept marketing cookies)

All partners are subject to data processing agreements. If data is transferred outside the EU/EEA, this is done on the basis of the European Commission's standard contractual clauses.

7. Your rights

Under the GDPR, you have the following rights:

  • Access: you can find out what information we hold about you
  • Rectification: you can have incorrect information corrected
  • Erasure: you can have your information deleted ("the right to be forgotten")
  • Restriction: you can have processing restricted in certain cases
  • Data portability: you can receive your information in a structured format
  • Objection: you can object to our processing
  • Withdrawal of consent: you can withdraw consent at any time

Write to info@sonayah.com to exercise your rights. We will respond within 30 days.

8. Complaints

You can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), our supervisory authority, if you are dissatisfied with our processing of your personal data:

Autoriteit Persoonsgegevens
P.O. Box 93374
2509 AJ The Hague, the Netherlands
autoriteitpersoonsgegevens.nl