Privacy & data protection
Privacy Policy
In this privacy policy, we clearly explain what personal data The Great Illuminary processes, why we do so, with whom data may be shared, and what privacy rights you have.
1. Who is responsible for your data?
The Great Illuminary determines for which purposes and how personal data is processed through the webshop.
The data controller for the personal data described in this privacy policy is:
Superdealz, trading as The Great Illuminary
Aramstraat 32
1336 HS Almere
Netherlands
Chamber of Commerce number: 75062135
VAT identification number: NL001226683B78
Email:
info@thegreatilluminary.nl
Phone:
+31 (0)36 203 64 03
This privacy policy applies to the use of www.thegreatilluminary.nl, purchases through our webshop, and communication with our customer service.
2. What personal data do we process?
The data we process depends on how you use our webshop.
Identification and contact details
- first and last name;
- email address;
- phone number;
- billing and delivery address;
- any company details.
Order and transaction data
- ordered products and quantities;
- order and invoice numbers;
- payment status and payment method;
- shipping and return details;
- discounts and refunds.
Payment details
Payments are processed via Shopify and the chosen payment provider. We typically do not receive full credit card or debit card details, but we do receive data such as payment status, chosen payment method, and a transaction reference.
Communication data
- messages via the contact form;
- email and WhatsApp communication;
- messages via social media;
- complaints, return requests, and questions;
- photos you send in case of damage.
Technical and usage data
- IP address;
- browser and device type;
- operating system;
- language, country, and currency settings;
- pages and products viewed;
- date, time, and referring website.
Marketing data
- newsletter subscription;
- marketing preferences;
- cookie consent;
- interaction with campaigns;
- advertising and conversion data, if permitted.
3. How do we obtain your data?
Personal data can be provided directly by you or collected automatically via the webshop.
We receive personal data when you, for example:
- place or attempt to place an order;
- create or use a customer account;
- contact our customer service;
- submit a return or cancellation;
- sign up for marketing communications;
- visit our website and use cookies or similar technologies;
- communicate with us via social media.
We may also receive data from Shopify, payment providers, carriers, fraud prevention services, advertising platforms, and other service providers involved in your order or website use.
4. Why do we process personal data?
For each processing, we use a purpose and an appropriate legal basis.
| Purpose | Examples of data | Legal basis |
|---|---|---|
| Process orders | Name, address, contact details, order, payment status, and shipping details. | Performance of the contract. |
| Payments and refunds | Transaction reference, payment method, amount, and payment status. | Performance of the contract and legal obligation. |
| Customer service | Contact details, order information, correspondence, and photos sent. | Performance of the contract and legitimate interest. |
| Returns and cancellations | Order number, contact details, return products, proof of shipment, and refund. | Performance of the contract and legal obligation. |
| Administration and taxation | Invoices, transactions, payments, order, and company details. | Legal obligation. |
| Prevent fraud and abuse | IP address, order details, payment status, and technical signals. | Legitimate interest to protect our webshop and customers. |
| Website security and operation | IP address, browser data, log data, and necessary cookies. | Legitimate interest and performance of the contract. |
| Website analysis and improvement | Usage data, viewed pages, device, and campaign data. | Consent where required; otherwise legitimate interest in privacy-friendly analysis. |
| Newsletters and marketing | Email address, preferences, interactions, and purchase information. | Consent or, for existing customers where permitted, legitimate interest with an opt-out option. |
| Targeted advertisements | Cookie identifiers, website behavior, conversions, and advertising data. | Consent. |
| Legal claims and disputes | Order details, correspondence, payments, and shipping information. | Legitimate interest and legal obligation. |
5. Fraud control and automated signals
Shopify, payment providers and other security services can automatically assess transactions for potential fraud.
In case of increased risk, we may manually review an order, request additional information, refuse a payment, or cancel an order. We try not to base important decisions solely on automated processing when this has significant consequences for you.
Do you believe an order has been unfairly withheld? Please contact us so we can assess the situation.
6. With whom do we share personal data?
We do not sell your personal data. Data is only shared when necessary for our services or to comply with legal obligations.
Shopify
Our webshop runs on Shopify. Shopify processes, among other things, order, account, technical and payment-related data to make the shopping platform available.
Payment providers
The chosen payment provider processes data necessary to handle payments, checks, refunds, and any disputes.
Carriers and fulfilment
Name, delivery address, contact details and shipping information may be shared with carriers and shipping platforms to deliver your order.
Analysis and advertising partners
To the extent enabled and permitted, data may be processed by, for example, Google, Meta or similar platforms for analysis, conversion measurement and advertising.
Communication and marketing
Email, newsletter, customer service and communication providers may process data to send messages and service communications.
Professional and legal parties
Data may be shared with accountants, advisors, insurers, banks, regulators or competent authorities when necessary or legally required.
Processor agreements
When a service provider processes personal data solely on our behalf, we make agreements where necessary regarding confidentiality, security and careful data usage.
External websites and social media
Our website may contain links to external websites and social media platforms. The processing by these parties is subject to their own privacy conditions. We recommend consulting those privacy statements before providing data.
7. Transfer outside the European Economic Area
Some technology and service providers may process personal data in countries outside the European Economic Area.
When personal data is processed outside the European Economic Area, we or our service providers ensure an appropriate transfer ground. This may, for example, be an adequacy decision by the European Commission or the use of standard contractual clauses approved by the European Commission.
Shopify states that personal data of customers from the European Economic Area is initially processed by Shopify International Limited in Ireland. Other Shopify entities and sub-processors may then be involved in providing the service.
You can contact us if you would like more information about the safeguards used in a specific international transfer.
9. Newsletters and marketing
We send marketing communications only when there is a valid basis for it.
When you sign up for our newsletter, we may use your email address and preferences to inform you about Disney Lorcana releases, pre-orders, new products, offers, and news from The Great Illuminary.
You can unsubscribe at any time via the unsubscribe link in a marketing message or by contacting us. Withdrawing consent does not affect the lawfulness of processing that occurred before the withdrawal.
Important service messages about an order, payment, shipment, return, or account are not marketing messages and may remain necessary to execute our agreement with you.
10. How long do we retain personal data?
We do not retain personal data longer than necessary, except when a legal retention obligation applies.
| Category | Indicative retention period |
|---|---|
| Invoices and financial administration | Generally 7 years. For data subject to a longer legal retention period, such as certain One Stop Shop administration, a period of 10 years may apply. |
| Order and payment data | As long as necessary for the order, service, warranty, returns, disputes, and thereafter insofar as it forms part of our legal administration. |
| Customer account | As long as the account is active or until you request deletion, subject to data we are legally required to retain. |
| Customer service and correspondence | Generally a maximum of 2 years after the question or complaint has been handled, unless longer retention is necessary for an order, dispute, or legal obligation. |
| Returns, damage, and complaints | As long as necessary for handling and evidence, and thereafter as long as a possible legal claim or legal obligation requires. |
| Newsletter data | Until you unsubscribe. Thereafter, we may keep a minimal record to prevent you from receiving unwanted marketing again. |
| Cookie and analytics data | According to the period specified for the relevant cookie or service provider in the cookie policy or cookie settings. |
| Fraud and security data | As long as necessary to investigate and prevent fraud, abuse, and security incidents. |
11. How do we secure personal data?
We take appropriate technical and organizational measures to protect personal data.
Depending on the nature of the processing, these measures may include:
- secure connections and encryption during data transfer;
- access restrictions and account security;
- limited access to personal data based on necessity;
- security and fraud prevention features of Shopify and payment providers;
- management of installed apps and service providers;
- procedures for security incidents and data breaches.
No digital processing is entirely without risk. We therefore ask you to handle passwords, order data, and received messages carefully. Never share your password or full payment card details via email, WhatsApp, or social media.
12. What are your privacy rights?
Depending on the circumstances, you can exercise various rights under the GDPR.
You can ask what personal data we process about you and receive a copy thereof.
You can have inaccurate or incomplete personal data corrected or supplemented.
In certain situations, you can ask for your personal data to be deleted.
Under certain conditions, you can request that processing be temporarily restricted.
You can request certain data in a structured and commonly used digital format.
You can object to processing based on a legitimate interest and always to direct marketing.
Where processing is based on consent, you can withdraw that consent at any time.
You can file a complaint with us and with the Dutch Data Protection Authority.
Submitting a request
Send your request to info@thegreatilluminary.nl . Clearly describe which right you wish to exercise and state the email address known to us.
To prevent data from being provided to the wrong person, we may request additional information to verify your identity. Do not send a full copy of your identity document without being requested to do so.
Some rights are not absolute. For example, we may not be able to immediately delete certain order and invoice data if we are required to retain it due to a statutory retention period.
13. Personal data of children
Our webshop is not intended to independently collect personal data of young children.
If you are a minor, we ask you to involve a parent or legal guardian in placing an order and providing personal data.
Do you believe that a child has provided personal data to us without appropriate consent? Please contact us so that we can investigate this and take appropriate measures where necessary.
14. Changes to this privacy policy
We may amend this privacy policy when our webshop, service providers or legal obligations change.
The most current version is always available on this page. At the top we state the date on which the privacy policy was last updated.
If a change has significant consequences for the way we use personal data, we may provide additional information about it via the website or an appropriate communication channel.
Questions about privacy or your data?
Contact us if you have a privacy question, want to exercise a right, or want to file a complaint. Please state clearly that your message concerns privacy.
Clarity and trust
The Great Illuminary believes it is important that you understand what data is processed and what choices you have in this regard.
