PRIVACY POLICY | VELION HAIR

Last updated: 9 August 2026

Velion Hair is a brand operated by Layered Lines 3D, a business registered in the Netherlands. Layered Lines 3D is the data controller responsible for the processing of personal data through Velion Hair. References in this Privacy Policy to “Velion Hair”, “we”, “our” or “us” therefore refer to Layered Lines 3D operating under the Velion Hair brand.

  • Legal business name: Layered Lines 3D
  • Brand name: Velion Hair
  • Chamber of Commerce (KvK): 95447024
  • VAT number: NL005154011B53
  • Contact: info@velionhair.com
  • Website: velionhair.com

This Privacy Policy explains how we collect, use, share, retain and protect your personal data when you visit our website, create an account, place an order, contact us or subscribe to our marketing communications.

Our website uses SSL/TLS encryption to protect information while it is transmitted. You can recognise an encrypted connection by the https:// prefix and the lock icon in your browser.

1. PERSONAL DATA WE COLLECT

Data collected automatically

When you visit our website, our website and service providers may automatically collect:

  • IP address, anonymised or shortened where applicable
  • Date and time of access
  • Pages viewed, time spent on the website and interactions with the website
  • Referring URL
  • Browser type and operating system
  • Device type and technical identifiers
  • Cookie and consent information

We process necessary technical and server-log data on the basis of our legitimate interests under Article 6(1)(f) GDPR, including website security, fraud prevention, stability and performance. Optional analytics and marketing data are processed only after you have given consent where consent is required.

Data you provide to us

Depending on how you use our website, we may collect:

  • Name, billing address and shipping address
  • Email address and telephone number
  • Order details, including products, order value, currency and transaction date
  • Account details and login credentials, if you create an account
  • Newsletter preferences and proof of consent
  • Messages, emails and other communications you send us
  • Information you provide when requesting customer support, a return or a refund

Payment data

Payments are processed by our payment providers. We do not store complete payment-card numbers. We may receive limited payment information, such as the payment method, payment status, transaction identifier and the last digits of a card, where necessary to administer your order.

2. HOW WE USE YOUR PERSONAL DATA

We may use your personal data to:

  • Process, fulfil and deliver your orders
  • Take payment and handle refunds
  • Send order confirmations, shipping updates and service messages
  • Create and manage your customer account
  • Respond to questions and customer-support requests
  • Process returns, warranty requests and complaints
  • Send newsletters and promotional messages when you have subscribed
  • Personalise and improve our website, advertising and product offering
  • Measure website use and the effectiveness of our marketing
  • Detect, investigate and prevent fraud, misuse and security incidents
  • Establish, exercise or defend legal claims
  • Comply with tax, accounting and other legal obligations

We do not use your personal data for purposes that are incompatible with those described in this Privacy Policy unless permitted or required by law.

3. LEGAL BASES UNDER THE GDPR

We process personal data on one or more of the following legal bases:

  • Performance of a contract — Article 6(1)(b) GDPR: to process payment, fulfil and deliver your order, administer returns and provide requested customer service.
  • Consent — Article 6(1)(a) GDPR: for newsletters, promotional communications and non-essential cookies or tracking technologies.
  • Legitimate interests — Article 6(1)(f) GDPR: for website security, fraud prevention, service improvement, limited business analytics and the protection of our legal rights, provided that your interests and fundamental rights do not override those interests.
  • Legal obligation — Article 6(1)(c) GDPR: to comply with tax, accounting, consumer-protection and other legal requirements.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

4. HOSTING AND E-COMMERCE PLATFORM

Our online store is hosted by Shopify International Limited, 2nd Floor, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland.

Shopify processes personal data required to operate our website, checkout, customer accounts and order administration. Data may also be processed by Shopify Inc., 150 Elgin Street, Ottawa, Ontario K2P 1L4, Canada, and by Shopify affiliates or subprocessors in other countries.

We use Shopify under a data-processing agreement. Where personal data are transferred outside the European Economic Area, appropriate transfer safeguards are used as described in Section 12.

5. PAYMENT PROVIDERS

Shopify Payments

When you pay through Shopify Payments, the information required to process the transaction—such as your name, billing details, payment information, currency, transaction number and order details—is shared with Shopify and its payment-processing partners. This processing is necessary to perform the purchase contract under Article 6(1)(b) GDPR.

PayPal

If you choose PayPal, the information required to process your payment and order is shared with PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. This processing is necessary to perform the purchase contract under Article 6(1)(b) GDPR.

For certain payment methods, PayPal may carry out identity, fraud or credit checks under its own legal responsibilities and privacy terms.

6. SHIPPING PROVIDERS

We use the following shipping and fulfilment providers:

  • PostNL, Prinses Beatrixlaan 23, 2595 AK The Hague, the Netherlands
  • MyParcel, Antareslaan 31, 2132 JE Hoofddorp, the Netherlands

We share the information required to deliver your order, such as your name, delivery address and relevant order details. Where needed for delivery notifications or track-and-trace services, we may also share your email address and telephone number.

This processing is based on Article 6(1)(b) GDPR where it is necessary to fulfil and deliver your order. Where consent is legally required for optional delivery notifications, processing is based on Article 6(1)(a) GDPR and you may withdraw that consent at any time.

7. EMAIL MARKETING

We may use the following providers to send newsletters and promotional emails:

  • Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02110, USA
  • Shopify Email, provided by Shopify International Limited, Ireland

We send marketing emails only where you have subscribed or where another lawful basis permits us to do so. We use a double opt-in process: after submitting your email address, you must confirm your subscription through a confirmation email before you are added to the active mailing list.

Marketing emails may contain tracking technologies that help us measure delivery, opens and link clicks. Depending on your settings, this may involve information such as the time of interaction, IP address, browser, operating system and device type. This processing takes place on the basis of your consent under Article 6(1)(a) GDPR.

You can unsubscribe at any time through the link in any marketing email or by contacting us. After unsubscribing, your email address is removed from active marketing. We may retain a minimal suppression record where necessary to ensure that we continue to honour your opt-out request.

8. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies to operate our website and, with your consent, to understand website use and measure or personalise advertising.

Cookies may be:

  • Session cookies, which are deleted when you close your browser
  • Persistent cookies, which remain on your device for a defined period or until you delete them

We use the following categories:

  • Essential cookies: necessary for functions such as the shopping cart, checkout, security and customer login. These do not require consent where they are strictly necessary.
  • Analytics cookies: used by services such as Google Analytics, Google Tag Manager and Shopify Analytics to understand website use and improve performance. These are activated only after consent where required.
  • Marketing cookies: used by services such as Meta Pixel and TikTok Pixel for advertising, audience measurement and conversion tracking. These are activated only after consent where required.

We use Shopify Customer Privacy to manage cookie preferences. Optional cookies and tracking technologies are loaded only in accordance with the consent choices recorded through the cookie banner. You can change or withdraw your preferences at any time through the cookie-preferences link or banner. You can also block or delete cookies through your browser, although parts of the website may then not function correctly.

9. ANALYTICS AND ADVERTISING SERVICES

Google Analytics 4

We use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand how visitors use our website. Depending on your consent and settings, Google Analytics may collect information such as pages viewed, interactions, approximate location and device or browser details. Google states that it does not log or store individual IP addresses from users in the EU.

This processing takes place only after consent under Article 6(1)(a) GDPR where consent is required. You can withdraw your consent through our cookie settings.

Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Limited, to manage website tags. Google Tag Manager does not itself create visitor profiles for us, but it enables other analytics and marketing services to load. The tags managed through Google Tag Manager are activated in accordance with the applicable consent settings.

Meta Pixel

We use Meta Pixel, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, to measure advertising performance and show more relevant advertisements on Facebook and Instagram. Meta may receive information about your visit and may associate it with your Meta account where permitted.

This processing takes place only after consent under Article 6(1)(a) GDPR where consent is required. Information may be processed by Meta group companies outside the EEA subject to applicable transfer safeguards.

TikTok Pixel

We use TikTok Pixel, provided in the EEA by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, for advertising, audience measurement and conversion tracking. TikTok may receive information about your visit and may associate it with your TikTok account where permitted.

This processing takes place only after consent under Article 6(1)(a) GDPR where consent is required. Information may be processed by TikTok group companies outside the EEA subject to applicable transfer safeguards.

10. DATA RETENTION

We retain personal data only for as long as necessary for the purpose for which it was collected and to meet legal requirements. In general:

  • Order, invoice and tax records: generally 7 years under Dutch tax law, or up to 10 years where a longer statutory period applies, including certain records under EU VAT schemes
  • Customer-account data: for as long as the account remains active, followed by deletion or anonymisation unless continued retention is legally required
  • Newsletter data: until you unsubscribe or withdraw consent, subject to a minimal suppression record where necessary
  • Analytics data: generally up to 14 months, depending on the service configuration
  • Customer-support communications: for as long as needed to resolve and document the matter, and longer where required for legal obligations or claims
  • Cookie-consent records: for as long as reasonably necessary to demonstrate and manage your consent choices

When personal data are no longer required, we delete or anonymise them unless the law requires continued retention.

11. YOUR RIGHTS UNDER THE GDPR

Subject to the conditions of the GDPR, you may have the right to:

  • Access your personal data — Article 15 GDPR
  • Rectify inaccurate or incomplete personal data — Article 16 GDPR
  • Erase your personal data — Article 17 GDPR
  • Restrict processing — Article 18 GDPR
  • Receive and transfer certain data — Article 20 GDPR
  • Object to processing based on legitimate interests — Article 21 GDPR
  • Withdraw consent at any time — Article 7(3) GDPR
  • Lodge a complaint with a supervisory authority

To exercise a right, contact info@velionhair.com. We may ask for information reasonably necessary to verify your identity. We will respond without undue delay and in principle within one month. Where permitted by law, this period may be extended by a further two months for complex or numerous requests; if so, we will inform you within the first month.

You may lodge a complaint with the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens
autoriteitpersoonsgegevens.nl

Right to object

If we process your personal data on the basis of our legitimate interests under Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation.

If we process your personal data for direct-marketing purposes, you have the right to object at any time. Once you object, we will stop processing your personal data for those direct-marketing purposes.

12. INTERNATIONAL DATA TRANSFERS

Some of our providers or their subprocessors may process personal data outside the European Economic Area, including in Canada and the United States.

Where required, international transfers are protected by one or more recognised safeguards, such as:

  • An adequacy decision adopted by the European Commission
  • The EU–U.S. Data Privacy Framework, where the relevant US recipient is actively certified
  • Standard Contractual Clauses approved by the European Commission
  • Additional technical or organisational safeguards where appropriate

The transfer mechanism used may differ by provider and destination.

13. DATA SECURITY

We take reasonable technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include SSL/TLS encryption, access controls and the use of established service providers that apply recognised security standards.

No method of transmission or storage is completely secure. We therefore cannot guarantee absolute security, but we work to reduce risks and respond appropriately to security incidents.

14. CHILDREN

Our website and products are not directed at children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has provided personal data to us, please contact us so that we can investigate and, where appropriate, delete the data.

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time, for example when our services, providers or legal obligations change. The current version will be published on this page with a revised “last updated” date. Where appropriate, we will provide additional notice of material changes.

16. CONTACT

If you have questions about this Privacy Policy or the way we process personal data, contact:

Velion Hair
A brand operated by Layered Lines 3D
Chamber of Commerce (KvK): 95447024
VAT number: NL005154011B53
Email: info@velionhair.com