Legal
Privacy policy
We collect as little as we can. What we do need is set out here: what, why, for how long, and what you can do about it.
Last updated on 16 October 2026
1. Who is responsible
The business below is the data controller for the data processed through this website. If you want to ask something about your data, email is the fastest channel.
- Name
- Cord&Collar
- Address
- Kleine Vuurvlinder 305731 ZJ MierloThe Netherlands
- Chamber of Commerce
- 17260629
- VAT number
- NL001145890B06
- Phone
- +31 6 15832332
- Send us a WhatsApp
2. What data we process
If you order something, we process your name, delivery address, email address and the details of your order. Your payment details go straight to the payment provider: they never reach us and we do not store them.
If you order a name tag, we also process the dog's name you give us, and the phone number if you have it put on the back. They travel along with your order line to the workshop as an attribute, because without them we cannot make the tag.
If you email us, we process your message and your email address so that we can reply.
We also keep anonymous visitor figures: which pages are visited, and from what kind of device. That measurement works without cookies and without profiles, and cannot identify an individual visitor.
We process no special categories of personal data, and the shop is not aimed at children under sixteen.
3. Why, and on what legal basis
To carry out your order and keep you informed about it. Basis: performance of the contract with you.
To answer your questions and complaints. Basis: performance of the contract, or our legitimate interest in a working customer service.
To keep our books and retain invoices. Basis: the statutory obligation under tax law.
To see how the shop is used and to improve it. Basis: our legitimate interest in a website that works, weighed against your privacy — which is exactly why that measurement is anonymous.
We do not use your data for automated decision-making or profiling, and we sell it to no one.
4. Who we share it with
We rely on a handful of parties that process data on our behalf. We have a processing agreement with each of them, and they may only use the data for what we instruct them to do.
Beyond that, we share data where the law requires it — with the Dutch tax authority, for instance.
- Shopify International Ltd.
- Shop software, checkout and order processing.Processed in: IE / CA / USPrivacy policy
- Vercel Inc.
- Hosting of this website and anonymous visitor statistics.Processed in: US / EUPrivacy policy
- Mollie B.V.
- Handling of the payment.Processed in: NLPrivacy policy
- MyParcel.com B.V.
- Creating shipping labels and track and trace.Processed in: NLPrivacy policy
- PostNL
- Delivery of your parcel.Processed in: NLPrivacy policy
5. Transfers outside the European Economic Area
Shopify and Vercel are non-European in origin, with establishments in the EU. In so far as data is processed outside the European Economic Area, that happens on the basis of the European Commission's standard contractual clauses or of a valid adequacy decision.
Where we have a choice, we choose processing within the EU.
6. Newsletter
If you sign up for the newsletter, we process your email address and the language you viewed the site in. Basis: your consent.
That data is held by Shopify, which also sends the emails. Every email has an unsubscribe link at the bottom; an email to us works too. Withdrawing consent applies from that moment on, not to what we sent before.
We keep your address for the newsletter until you unsubscribe. To prevent misuse of the form, we also record for one day which IP address it was sent from.
7. Social media
Cord & Collar has an account on Instagram and Facebook. If you follow us, comment on a post or send us a direct message, we see your username and what you send us. We use that only to reply to you. Legal basis: our legitimate interest in answering people who contact us. We keep messages the way we keep email: while your question is open, and at most two years after that.
Both platforms belong to Meta Platforms Ireland Ltd. Meta also processes data about how you use Instagram and Facebook itself, under its own privacy policy. For the visitor statistics of our pages, Meta and we are joint controllers. Meta has published an arrangement covering this, and is the point of contact for your rights regarding those statistics.
This website only contains plain links to our profiles. No Meta buttons, pixels or embedded posts are loaded, so Meta does not see that you visit this site unless you click through.
If you tag us in a photo, we first ask whether we may show it on this website. If you say yes, the photo appears on the homepage with your username and a link to your post. For that we keep a copy of the photo, your username and when you gave permission. Legal basis: your consent. You can withdraw it at any time with a message; we then remove the photo and the copy.
8. WhatsApp
If you send us a WhatsApp message, we see your phone number, your profile name and what you send us. We use that only to answer you. Legal basis: the performance of the contract when it is about an order, and otherwise our legitimate interest in being in touch with people who contact us. We keep messages the same way as email: for as long as your question is open, and at most two years after that.
WhatsApp belongs to WhatsApp Ireland Limited, part of Meta. The messages themselves are end-to-end encrypted, but WhatsApp also processes data about how you use the service, under its own privacy policy, and may process data outside the European Economic Area in doing so. Rather not? An email works just as well.
This website only contains a plain link to WhatsApp. No chat window or WhatsApp script is loaded, so WhatsApp does not see that you visit this site unless you click through. You can edit or discard the prepared message before you send anything.
9. How long we keep it
We keep order data and invoices for seven years. That is not our choice: the statutory retention period under tax law prescribes it.
We keep email correspondence for as long as it takes to deal with your question, and for at most two years after that, so we can find an earlier exchange.
The shopping cart expires on its own. The cookie policy states the exact period.
Anonymous visitor statistics cannot be traced back to you and therefore carry no retention period for personal data.
10. Your rights
You may see your data, have it corrected, or have it erased. You may have the processing restricted, object to processing based on a legitimate interest, and receive your data in a common file format so you can take it elsewhere.
Send an email saying what you want. You will hear from us within a month. To avoid handing data to the wrong person, we may ask for extra information that lets us establish it is really you.
Some data we are not allowed to erase while the statutory tax retention period runs. We will then tell you what stays and why.
If you disagree with how we handle your data, you can complain to the Dutch Data Protection Authority. You are free to do that at any time — though we would rather hear it from you first, while we can still put it right.
11. Security
The website runs entirely over an encrypted connection. The shopping cart is tracked with a cookie only the server can read, holding nothing but an internal reference.
Checkout happens in Shopify's environment, which is PCI-DSS compliant for that purpose. We store no payment details ourselves.
If you suspect a leak or a vulnerability, report it by email. We take such reports seriously and you will get an answer.
12. Changes
If the way we handle data changes, we amend this statement. The date at the top shows when that last happened.
Contact
A question this page doesn't answer
Send us a message with your order number and we'll look into it.
Terms & conditionsCookie policyRight of withdrawalDisclaimerContact