Dragonfly Water Solutions B.V., Gijsbrecht van Amstelstraat 240, 1215 CR Hilversum, Netherlands. KvK 76489256, BTW NL860642574B01. Referred to below as "Dragonfly" or "we".
Version 1.1, effective 12 October 2026. This policy explains what personal data we collect when you visit dragonflywatersolutions.com or buy from us, why we collect it, who else sees it, and what you can make us do about it. It is written under the General Data Protection Regulation, Regulation (EU) 2016/679. For visitors in the United Kingdom the UK GDPR applies in the same way.
1. Who is responsible
Dragonfly Water Solutions B.V. is the controller of the personal data described here. Write to info@dragonflywater.com or to the postal address above. You can also call +31 6 20037980.
We are not required to appoint a data protection officer and we have not appointed one. Your questions go to the address above and a director answers them.
2. What we collect, why, and on what legal basis
| When |
What |
Why |
Legal basis |
| You place an order |
Name, billing and delivery address, email, telephone, what you bought, order value, payment status |
To take payment, ship the order, handle returns, and keep the accounts |
Performance of a contract, art. 6(1)(b). Legal obligation, art. 6(1)(c), for the tax records |
| You pay |
Payment reference and outcome. We never see or store your full card number |
To collect the money and to detect fraud |
Performance of a contract, art. 6(1)(b). Legitimate interest in preventing fraud, art. 6(1)(f) |
| You contact us |
Your message, your contact details, our reply |
To answer you and to keep a record of what was agreed |
Performance of a contract, or legitimate interest in answering enquiries, art. 6(1)(f) |
| You create an account |
Email, password (stored hashed by Shopify), order history, saved addresses |
To let you sign in and see your orders |
Performance of a contract, art. 6(1)(b) |
| You join a waitlist |
Email and the product you asked about |
To send you one message when it is back |
Consent, art. 6(1)(a) |
| You subscribe to our emails |
Email, name if you gave it, what you opened and clicked |
To send you our newsletter and offers, and to see what people read |
Consent, art. 6(1)(a). For existing customers, the soft opt-in in article 13(2) of Directive 2002/58/EC as implemented in article 11.7 of the Dutch Telecommunicatiewet |
| You leave a checkout unfinished |
Email or phone if you entered it, and what was in the cart |
To send you a reminder |
Consent, art. 6(1)(a). We only send this where you gave marketing consent |
| You leave a review |
The name you give, the review, your order reference, any photograph |
To publish it on the product page |
Consent, art. 6(1)(a) |
| You visit the site |
IP address, browser, device, pages viewed, referring site, cart and session identifiers |
To keep the shop working and secure |
Legitimate interest in a working, secure shop, art. 6(1)(f), for the strictly necessary part only |
| You switch on marketing in the cookie banner |
What you do in the store: the pages and products you view, what you search for and add to your cart, the start of checkout, and a completed order with its total. With these: your IP address, your browser and device details, the address of the page, and the identifiers in Meta's cookies. Once you give your contact details at checkout: your name, location, email address and phone number. Meta's Conversions API requires contact details to arrive as a hash, a one-way code |
To measure which of our advertisements on Facebook and Instagram lead to visits and orders, and to show our advertisements to people they are likely to suit, including people who have visited the store. See section 4 |
Consent, art. 6(1)(a), given in the cookie banner. You can withdraw it there at any time |
| You arrive through a partner link and analytics or marketing cookies are switched on |
Referral identifier, pages viewed, whether you bought, order value |
To measure the site and to pay the right partner the right commission |
Consent, art. 6(1)(a). Nothing here is set before you agree |
You do not have to give us anything. Without a name, address and payment we cannot sell you anything and cannot form a contract. Everything else is optional and refusing it costs you nothing.
3. Who else sees your data
We use a small number of companies to run the shop. They process your data on our instructions under a written agreement, and only for what is listed here. Meta also decides for itself what it does with the data once it has received it. Section 4 explains how that works. The companies in this table are the only ones that receive your data.
| Who |
What they do |
What they get |
Where |
|
Shopify International Limited, Ireland |
Runs the store, the checkout, your account and our order records |
Everything you give us in an order or an account |
Ireland, with group companies in Canada and the United States |
| Our payment providers |
Take the payment |
Payment and billing data. We do not see your card number |
iDEAL, card (Visa, Mastercard, Maestro, American Express), PayPal, Klarna, Bancontact, Apple Pay, Google Pay and Shop Pay. Handled by Shopify Payments and the provider you choose; we never see your full card number. |
|
PostNL and their partner carriers |
Deliver your parcel |
Name, delivery address, email or phone for the tracking notice |
Netherlands, and the destination country's carrier for international parcels |
| Judge.me |
Collects and publishes product reviews |
Your email to ask for a review, and what you write |
Judge.me Ltd. We could not confirm its country of establishment from its own published documents; its data processing addendum states that it relies on standard contractual clauses. |
| Enlistly |
Runs our affiliate programme and works out which partner referred an order |
Referral identifier, order reference and order value. See section 4 |
Enlistly, operated from the United States. It does not publish a data processing addendum. We are asking them for one. |
| SmartPush |
Sends order and marketing email |
Email, name, order data, what you opened and clicked |
SmartPush, operated by Starling Labs Limited, Hong Kong, which is outside the European Economic Area. It does not name a transfer mechanism in its published policy. We are asking them for one. |
| Ecomail |
Sends marketing email |
Email, name, what you opened and clicked |
ECOMAIL.CZ, s.r.o., Czech Republic, inside the European Economic Area. |
|
Meta Platforms Ireland Limited, Ireland. For visitors in the United Kingdom: Meta Platforms, Inc., United States |
Runs Facebook and Instagram, where we advertise. Measures our advertisements and delivers them |
What section 4 lists, from the moment you switch on marketing in the cookie banner |
Ireland, and other Meta companies, including in the United States. See section 4 |
| Our accountant, and the Belastingdienst |
Books and tax |
Invoice data |
Netherlands |
Where a provider processes data outside the European Economic Area, the transfer rests on an adequacy decision by the European Commission or on the Commission's standard contractual clauses. Ask us and we will tell you which one applies to which provider and send you the relevant terms.
4. Affiliate tracking and advertising, and being straight about it
We run an affiliate programme. When you arrive through a partner's link, a tracking identifier records that partner so they get paid if you buy. We use that identifier for commission and for our own reporting, and for nothing else.
We advertise on Facebook and Instagram. To see which advertisements bring people to the store and which lead to an order, we use two tools from Meta, connected through Shopify's own Facebook & Instagram app. They are for visitors who switch on marketing in the cookie banner. This is what happens when you do.
The Meta pixel runs in your browser. It tells Meta what you do in the store: the pages and products you view, what you search for and add to your cart, when you start checkout and reach payment, and when you complete an order, with the order total. Like any request your browser makes, each of these carries your IP address and your browser and device details, along with the address of the page. The pixel also uses cookies, such as _fbp and _fbc, which our Cookie Policy describes.
At the data-sharing level we have chosen in Shopify, called Enhanced, Shopify also shares your name, location, email address and phone number with Meta, so that Meta can match you to a Facebook or Instagram account. Meta's Conversions API requires contact details such as these to arrive as a hash, a one-way code made from them.
The Conversions API runs between Shopify's servers and Meta's. When you complete an order with marketing switched on, Shopify also reports that order to Meta from server to server. Meta's documentation lists what such a report can carry: the order details, the contact details above in hashed form, your IP address and browser details, and the values of Meta's cookies.
What it is for. Meta matches these reports to Facebook and Instagram accounts. That lets us measure which advertisements work, and it lets Meta show our advertisements to people they are likely to suit, including people who have already visited the store.
Legal basis. Your consent, article 6(1)(a) GDPR, given in the cookie banner. Storing and reading Meta's cookies rests on that same consent under article 5(3) of Directive 2002/58/EC, implemented in article 11.7a of the Dutch Telecommunicatiewet.
Who is responsible. For collecting this data on our store and sending it to Meta, we and Meta Platforms Ireland Limited are joint controllers under article 26 GDPR. The arrangement between us is Meta's Controller Addendum, which sets out which of us does what. For matching and for measurement reports, Meta works as our processor under its Data Processing Terms. What Meta does with the data once it has arrived, Meta decides as a controller in its own right. Meta's Privacy Policy explains who Meta is, how it processes personal data and how you can use your rights with Meta directly. For visitors in the United Kingdom the same arrangement is with Meta Platforms, Inc., under Meta's UK Controller Addendum.
Where it goes. Meta is a group of companies. Data we send to Meta Platforms Ireland Limited can be processed by other Meta companies, including in the United States. For transfers that start in the European Economic Area, Meta's Data Processing Terms apply its European Data Transfer Addendum, which is linked from those terms.
How long. Meta's Cookies Policy gives the _fbp and _fbc cookies a lifespan of 90 days. Under its Business Tools Terms, Meta may keep the event data it receives for up to two years.
Changing your mind. Click "Cookie settings" in the footer of any page, untick "Advertising and partner attribution" and choose "Save my choice", or choose "Reject all". Your new choice goes to Shopify straight away, and Shopify runs pixels such as Meta's only for visitors who have given the consent they require. We also delete the _fbp and _fbc cookies from your browser.
The companies listed in section 3 are the only ones that receive your data, each for the purpose stated next to it.
5. How long we keep it
-
Orders and invoices: seven years, which is the retention period Dutch tax law requires.
-
Customer accounts: while the account exists, and two years after your last order if you leave it dormant.
-
Waitlist entries: until we send the notification, or twelve months, whichever comes first.
-
Marketing subscription and engagement data: until you unsubscribe, and then a suppression record so we do not email you again by mistake.
-
Correspondence: two years after the matter is closed.
-
Reviews: for as long as the review is published, unless you ask us to remove it.
-
Advertising data: Meta's Cookies Policy gives its _fbp and _fbc cookies a lifespan of 90 days. Under its Business Tools Terms, Meta may keep the event data it receives from our store for up to two years.
-
Consent records: five years, so we can show what you agreed to and when
6. Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or send it to you or another provider in a portable format. You can object to processing based on our legitimate interests.
You can object to direct marketing at any time and we stop, with no balancing and no questions. That is article 21(2). Use the unsubscribe link in any message or email us.
Where we rely on your consent you can withdraw it at any time. For cookies, measurement and advertising, click "Cookie settings" in the footer of any page and change your choice there. Withdrawing does not make what we did beforehand unlawful.
For data Meta holds after we have sent it, you can use the same rights directly with Meta, as set out in its Privacy Policy. You can also send the request to us and we pass it on.
Email info@dragonflywater.com. We answer within one month. There is no charge.
If you are not satisfied with how we handled it, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl, or to the supervisory authority in your own EU country. In the United Kingdom that is the Information Commissioner's Office, at ico.org.uk.
7. Automated decisions
We do not make decisions about you by automated means alone, and we do not profile you in a way that produces legal effects or anything similar. Fraud screening at checkout is done by our payment provider and a human reviews anything it stops. Which advertisement Meta shows to which person is decided automatically by Meta's systems, using the data described in section 4 together with what Meta already holds.
8. Children
The store is not aimed at children and we do not knowingly collect data from anyone under 16. If you think we hold data about a child, tell us and we will delete it.
9. Security
The store runs on platforms that encrypt data in transit and at rest. Access is limited to the people who need it to do their work. If a breach ever puts your data at risk, we notify the Autoriteit Persoonsgegevens within 72 hours and tell you directly where the risk to you is high.
10. Cookies
Cookies and similar technologies have their own page. See our Cookie Policy.
11. Changes
If we change this policy we publish a new version number and date at the top. If a change matters to you, we say so on the site rather than leaving you to notice.
