Privacy policy

Privacy Policy

StopNicotine

Effective from: 3 February 2026

1. Introduction and Scope

1.1 This Privacy Policy describes how StopNicotine (hereinafter “we”, “us” or “our company”) collects, processes and uses personal data when you use our online shop and the associated services.

1.2 The data controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection legislation is:

StopNicotine
info@stop-nicotine.com
+31 085 06 06 702 (all languages)

1.3 This Privacy Policy applies to all services provided via our website and our online shop, including all associated information, content, features, tools, products and services.

1.4 By using our services, you consent to the collection, processing and disclosure of your personal data in accordance with this Privacy Policy.

1.5 This Privacy Policy supplements our General Terms and Conditions. In the event of any conflict between this Privacy Policy and the General Terms and Conditions, this Privacy Policy shall take precedence with regard to the processing of personal data.

2. Definitions

2.1 Personal data means any information relating to an identified or identifiable natural person. A natural person is considered identifiable if they can be identified, directly or indirectly.

2.2 Processing means any operation or set of operations performed on personal data, including collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

2. 3 Services refers to our online shop, our website and all associated services.

3. Categories of personal data

3.1 We collect and process the following categories of personal data, depending on how you interact with our Services:

3.1.1 Contact details:

  • Surname and first name
  • Address (delivery and billing address)
  • Telephone number
  • Email address

3.1.2 Payment information:

  • Credit or debit card details
  • Bank account details (for GoCardless payments)
  • Transaction details
  • Payment confirmations

3.1.3 Account information:

  • Username
  • Password (stored in encrypted form)
  • Preferences and settings

3.1.4 Transaction information:

  • Items viewed, added to the basket or purchased
  • Order history
  • Returns, exchanges or cancellations

3.1.5 Communication data:

  • Correspondence with our customer service team via email or WhatsApp
  • Content of your enquiries and our replies

3.1.6 Device information:

  • IP address
  • Browser type and version
  • Operating system
  • Device identifiers
  • Network connection information

3.1.7 Usage data:

  • Information about your interaction with our services
  • Pages visited and links clicked
  • Time spent on pages
  • Search terms
  • Date and time of access

3.2 We do not collect any special categories of personal data within the meaning of Article 9 of the GDPR (e.g. health data). The product recommendation tools and calculators available on our website do not store any information you enter and do not link this to your customer profile.

4. Sources of personal data

4.1 We collect personal data from the following sources:

4.1.1 Directly from you:

  • When creating an account
  • When using our services
  • When communicating with us
  • When placing an order

4.1.2 Automatically through our services:

  • Via your device when using our website
  • Via cookies and similar technologies (see Section 8)

4.1.3 From our service providers:

  • From payment service providers during transaction processing
  • From technology service providers when providing our services

4.1.4 From third parties:

  • From advertising partners as part of marketing campaigns
  • From social media platforms when you interact with our adverts

5. Purposes and legal bases for data processing

5.1 We process your personal data for the following purposes and on the basis of the legal grounds set out below:

5.1.1 Performance of a contract (Article 6(1)(b) of the GDPR):

  • Processing and fulfilling your orders
  • Payment processing
  • Delivery of products
  • Management of returns and exchanges
  • Creation and management of your customer account
  • Provision of customer service

5.1.2 Consent (Article 6(1)(a) of the GDPR):

  • Sending marketing and promotional communications via email or SMS
  • Use of analytics and marketing cookies
  • Personalised advertising on our website and other platforms
  • Creation of user profiles for marketing purposes

You may withdraw your consent at any time without this affecting the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal.

5.1.3 Legitimate interests (Article 6(1)(f) of the GDPR):

  • Improvement and optimisation of our services
  • Fraud detection and prevention
  • Ensuring the security of our systems
  • Analysis of user behaviour to improve products
  • Carrying out internal administration
  • Asserting legal claims

5.1.4 Legal obligations (Art. 6(1)(c) GDPR):

  • Fulfilment of tax and accounting obligations
  • Compliance with statutory retention periods
  • Responding to enquiries from public authorities
  • Fulfilment of commercial law documentation obligations

6. Recipients and disclosure of personal data

6.1 We disclose your personal data to third parties in the following cases:

6.1.1 E-commerce platform:

Our services are provided via Shopify Inc. (“Shopify”). Shopify collects and processes personal data on our behalf to provide the e-commerce platform. Shopify acts as a data processor in accordance with Article 28 of the GDPR.

Further information on data processing by Shopify can be found at: https://www.shopify.com/legal/privacy

6.1.2 Payment service providers:

  • Shopify Payments: Processing of credit/debit card payments, iDEAL and Bancontact
  • Klarna: Processing of instalment payments and purchase on account
  • PayPal: Processing of PayPal payments
  • GoCardless: Processing of direct debits (German customers only)

These service providers process payment data in accordance with PCI-DSS standards and act as independent data controllers.

6.1.3 Logistics and shipping service providers:

  • SpeedBee Logistics: Warehousing, order picking and dispatch of orders

Address: Oder 20, 2491DC The Hague, Netherlands.

6.1.4 Marketing and analytics service providers:

Google LLC (Google Analytics):

  • Purpose: Website analysis and tracking of user behaviour
  • Data processed: IP address (anonymised), device information, usage data
  • Legal basis: Consent (Art. 6(1)(a) GDPR)
  • Privacy policy: https://policies.google.com/privacy

Meta Platforms Ireland Limited (Meta Pixel):

  • Purpose: Remarketing and conversion tracking for Facebook and Instagram
  • Data processed: Cookie IDs, device information, interaction data
  • Legal basis: Consent (Article 6(1)(a) of the GDPR)
  • Privacy policy: https://www.facebook.com/privacy/explanation

TikTok Technology Limited (TikTok Pixel):

  • Purpose: Remarketing and conversion tracking for TikTok
  • Data processed: Cookie IDs, device information, interaction data
  • Legal basis: Consent (Article 6(1)(a) of the GDPR)
  • Privacy policy: https://www.tiktok.com/legal/privacy-policy

Taboola Inc. (Taboola Pixel):

  • Purpose: Native advertising and conversion tracking
  • Data processed: Cookie IDs, device information, interaction data
  • Legal basis: Consent (Art. 6(1)(a) GDPR)
  • Privacy policy: https://www.taboola.com/privacy-policy

Triple Whale Inc.:

  • Purpose: Attribution tracking and marketing analytics
  • Data processed: UTM parameters, traffic sources, conversion data
  • Legal basis: Consent (Art. 6(1)(a) GDPR)

6.1.5 Email marketing service providers:

Klaviyo Inc.:

  • Purpose: Sending marketing emails, transactional emails, SMS marketing and automations
  • Data processed: Email address, name, telephone number, purchase history, open and click behaviour
  • Legal basis: Consent (Art. 6(1)(a) GDPR) for marketing; performance of a contract (Art. 6(1)(b) GDPR) for transactional emails
  • Privacy policy: https://www.klaviyo.com/legal/privacy

6.1.6 Customer service:

WhatsApp Business API (Meta Platforms Ireland Limited):

6.1.7 Hosting and technical infrastructure:

Strato AG:

6.2 We will disclose your data to third parties if:

  • You expressly request us to do so or give your consent
  • This is necessary for the performance of a contract
  • There is a legal obligation to do so
  • This is necessary to safeguard our legitimate interests and your interests do not override them

6.3 In the event of a company takeover, merger or sale of assets, your personal data may be transferred to the acquirer.

7. International data transfers

7.1 Some of our service providers are based outside the European Economic Area (EEA) or process data on servers outside the EEA.

7.2 When transferring data to third countries, we ensure an adequate level of data protection through appropriate safeguards:

7.2.1 Use of standard contractual clauses in accordance with Article 46(2)(c) of the GDPR

7.2.2 Transfer to recipients in countries for which the European Commission has issued an adequacy decision in accordance with Article 45 of the GDPR

7.3 The following service providers may process data outside the EEA:

  • Google LLC (USA)
  • Meta Platforms Inc. (USA)
  • TikTok Inc. (USA/Singapore)
  • Taboola Inc. (USA/Israel)
  • Klaviyo Inc. (USA)
  • Triple Whale Inc. (USA)

7.4 Shopify uses servers within the European Union to provide our services. Details regarding data processing by Shopify can be found in their privacy policy.

8. Cookies and similar technologies

8.1 Our website uses cookies and similar technologies to ensure functionality, improve the user experience and carry out marketing activities.

8.2 What are cookies?

Cookies are small text files that are stored on your device when you visit a website. They enable the website to recognise your device and store certain information.

8.3 Types of cookies:

8.3.1 Strictly necessary cookies:

These cookies are essential for the functioning of our website and cannot be disabled. They include:

  • Session cookies for shopping basket functionality
  • Security cookies for secure connections
  • Load-balancing cookies for server distribution

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)

8.3.2 Analytics cookies:

These cookies help us understand how visitors interact with our website:

  • Google Analytics (GA4) for website analytics
  • Tracking of page views, time spent on site, and click behaviour

Legal basis: Consent (Art. 6(1)(a) GDPR)

Retention period: Up to 12 months

8.3.3 Marketing and advertising cookies:

These cookies are used to display relevant advertising to you:

  • Meta Pixel (Facebook/Instagram)
  • TikTok Pixel
  • Taboola Pixel
  • Google Ads Remarketing

Legal basis: Consent (Article 6(1)(a) of the GDPR)

Retention period: Up to 12 months (technically; actual usage typically 30 days)

8.4 Cookie consent:

8.4.1 On your first visit to our website, a cookie banner will be displayed informing you about the use of cookies.

8.4.2 By clicking ‘Accept’, or by scrolling or otherwise interacting with the website after the banner has been displayed for at least 5 seconds, you consent to the use of all cookies in accordance with this privacy policy.

8.4.3 Use of our website requires acceptance of cookies. Without cookies, certain functions cannot be provided.

8.5 Managing cookies:

8.5.1 You can adjust your cookie settings in your browser at any time. Most browsers allow you to:

  • Block cookies
  • To delete existing cookies
  • To receive notifications before cookies are set

8.5.2 Please note that blocking cookies may affect the functionality of our website.

8.5.3 Further information on managing cookies can be found in your browser’s help section:

8.6 Opt-out options for advertising cookies:

Google Analytics: https://tools.google.com/dlpage/gaoptout

Meta/Facebook: https://www.facebook.com/settings/?tab=ads

TikTok: Via your TikTok account settings

Taboola: https://www.taboola.com/privacy-policy#user-choices-and-optout

9. Marketing and advertising

9.1 Email marketing:

9.1.1 We send marketing emails and newsletters if you:

  • Have given your consent to receive marketing communications when placing an order
  • Have subscribed to our newsletter

9.1.2 Our marketing emails may contain information about:

  • New products and offers
  • Exclusive discounts and promotions
  • Tips on how to successfully quit smoking
  • Reminders about items in your shopping basket

9.1.3 Legal basis: Consent (Article 6(1)(a) of the GDPR)

9.1.4 You can unsubscribe from receiving marketing emails at any time by:

  • Clicking on the unsubscribe link in every marketing email
  • Contacting us at info@stop-nicotine.com
  • Updating your preferences in your customer account

9.1.5 Please note that even after you have unsubscribed from marketing emails, we will continue to send you transaction-related emails (e.g. order confirmations, dispatch notifications).

9.2 SMS marketing:

9.2.1 If you provide your telephone number and consent to SMS marketing, we may send you marketing messages via SMS.

9.2.2 Legal basis: Consent (Art. 6(1)(a) GDPR)

9.2.3 You can unsubscribe from SMS marketing at any time by:

9.3 Personalised advertising:

9.3.1 We use your information to display personalised advertising to you on our website, in our emails and on third-party platforms (e.g. Facebook, Instagram, TikTok, Google).

9.3.2 This advertising may be based on:

  • Products you have viewed or added to your basket
  • Your purchase history
  • Your browsing behaviour on our website

9.3.3 Legal basis: Consent (Article 6(1)(a) of the GDPR)

9.4 Abandoned-cart emails:

9.4.1 If you add items to your shopping basket but do not complete the purchase, we may send you reminders by email.

9.4.2 These emails contain a summary of the items in your shopping basket and may include an incentive to complete the purchase.

9.4.3 Legal basis: Consent (Article 6(1)(a) of the GDPR), given during the checkout process

10. Retention period for personal data

10.1 We will only retain your personal data for as long as is necessary for the purposes set out in this privacy policy, or as required by law.

10.2 Account data:

Account data is stored until you delete your account or request its deletion.

10.3 Transaction and invoicing data:

10.3.1 To comply with tax and commercial law retention obligations, we retain invoicing data and transaction-related information for seven (7) years from the end of the calendar year in which the transaction took place.

10.3.2 Legal basis: Legal obligation (Article 6(1)(c) of the GDPR)

10.4 Marketing data:

10.4.1 Data used for marketing purposes is stored until you withdraw your consent or unsubscribe from marketing communications.

10.4.2 Once you have unsubscribed, your data will no longer be used for marketing purposes, but will remain in our systems for accounting and legal purposes in accordance with statutory retention periods.

10.5 Analytics data:

Data in Google Analytics is automatically deleted after fourteen (14) months.

10.6 Communication data:

Email correspondence and WhatsApp messages with our customer service team are stored for three (3) years following the last communication, to enable us to trace support enquiries.

10.7 Cookies:

The retention period for cookies is specified in section 8.3 for each category.

11. Data security

11.1 We implement appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, misuse or alteration.

11.2 Security measures include:

11.2.1 SSL/TLS encryption for all data transfers between your browser and our servers

11.2.2 Encrypted storage of passwords

11.2.3 PCI-DSS-compliant payment processing via certified payment service providers

11.2.4 Regular security updates and maintenance of our systems

11.2.5 Access restrictions and authentication for staff

11.3 Please note that no method of transmission over the internet or electronic storage is completely secure. Although we endeavour to take reasonable measures to protect your data, we cannot guarantee absolute security.

11.4 Your responsibility:

When you create an account, you are responsible for keeping your login details confidential. Do not share your login details with third parties and inform us immediately if you suspect that your account has been compromised.

11.5 Data breaches:

In the event of a data breach that is likely to pose a high risk to your rights and freedoms, we will inform you without undue delay in accordance with Article 34 of the GDPR and notify the relevant supervisory authority within 72 hours.

12. Your rights as a data subject

12.1 Under the GDPR, you have the following rights in relation to your personal data:

12.1.1 Right of access (Article 15 GDPR):

You have the right to obtain information about the personal data we process. This includes information on:

  • What data we process about you
  • The purposes for which the data is processed
  • The recipients to whom the data is disclosed
  • How long the data is stored
  • The rights to which you are entitled

12.1.2 Right to rectification (Art. 16 GDPR):

You have the right to request the rectification of inaccurate personal data or the completion of incomplete personal data.

12.1.3 Right to erasure (Art. 17 GDPR):

You have the right to request the erasure of your personal data if:

  • The data is no longer necessary for the purposes for which it was collected
  • You withdraw your consent and there is no other legal basis
  • You object to the processing and there are no overriding legitimate grounds
  • The data has been processed unlawfully
  • Erasure is necessary to comply with a legal obligation

12.1.4 Right to restriction of processing (Art. 18 GDPR):

You have the right to request the restriction of the processing of your data if:

  • You contest the accuracy of the data
  • The processing is unlawful, but you object to erasure
  • We no longer need the data, but you require it to establish, exercise or defend legal claims
  • You have objected and it has not yet been determined whether our interests override yours

12.1.5 Right to data portability (Art. 20 GDPR):

You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format and to transmit this data to another controller, provided that:

  • The processing is based on consent or a contract
  • The processing is carried out by automated means

12.1.6 Right to object (Art. 21 GDPR):

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you carried out on the basis of Article 6(1)(f) of the GDPR (legitimate interests).

In the case of direct marketing, you have the right to object at any time without giving reasons.

12.1.7 Right to withdraw consent (Art. 7(3) GDPR):

Where processing is based on your consent, you have the right to withdraw that consent at any time. The lawfulness of the processing carried out prior to withdrawal remains unaffected.

12.2 Exercising your rights:

12.2.1 To exercise any of your rights, please contact us:

12.2.2 We will process your request within thirty (30) days. In complex cases, this period may be extended by a further sixty (60) days, in which case we will inform you of the delay and the reasons for it.

12.2.3 In order to process your request, we may ask you to confirm your identity by providing information that we already hold about you (e.g. order number, email address, name).

12.2.4 We will not discriminate against you or treat you unfavourably for exercising your rights.

13. Right to lodge a complaint

13.1 You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.

13.2 The supervisory authority responsible for us is:

Autoriteit Persoonsgegevens

Postbus 93374

2509 AJ The Hague

Netherlands

Telephone: +31 (0)70 888 8500

Email: info@autoriteitpersoonsgegevens.nl

Website: https://autoriteitpersoonsgegevens.nl

13.3 You may also contact the data protection authority in your country of residence. A list of EU data protection authorities can be found at: https://edpb.europa.eu/about-edpb/board/members_de

13.4 Before lodging a complaint, we encourage you to contact us directly so that we can attempt to resolve your concern.

14. Minors

14.1 Our services are intended for individuals who are at least eighteen (18) years of age.

14.2 We do not knowingly collect personal data from individuals under the age of eighteen (18).

14.3 If you are a parent or legal guardian and discover that your minor child has provided us with personal data, please contact us at info@stop-nicotine.com so that we can delete this data.

14.4 If we discover that we have collected personal data from minors without parental consent, we will take steps to delete this data without delay.

15. Links to third-party websites

15.1 Our website may contain links to third-party websites or services that are not operated or controlled by us.

15.2 We are not responsible for the privacy practices of these third parties. We recommend that you read the privacy policies of these websites before providing them with personal data.

15.3 The inclusion of links to third-party websites does not constitute an endorsement of the content or practices of those websites.

16. Changes to this Privacy Policy

16.1 We reserve the right to amend or update this Privacy Policy at any time to reflect changes to our practices or for other operational, legal or regulatory reasons.

16.2 We will publish any significant changes on our website and update the ‘Effective from’ date at the beginning of this Privacy Policy.

16.3 In the event of significant changes that could affect your rights, we will also notify you by email, provided we have your email address.