Privacy policy

We collect Personal Information for various purposes and in various contexts as part of our Services (see descriptions in the table below). We receive Personal Information from you directly, or indirectly through your use of our Online Services or social media channels. 

Instagram en Facebook integraties 

When you contact us on Instagram or Facebook (YAYA.thebrand), Meta shares data with us. The integration with Instagram and Facebook enables us to process your requests, complaints, comments or other messages within our own systems. The information that Meta shares with us are the content of your messages, sender ID, message metadata, and limited profile information required to deliver messaging functionality (“Platform Data”). This data is used solely to manage and respond to customer inquiries and is not used for advertising, profiling, or marketing purposes. We will not sell, rent or otherwise share Platform Data with third parties for cross-contextual advertising purposes. Platform Data is only accessible to authorized personnel for customer support purposes (as described below). 

If you have any questions about this integration or would like to exercise your rights in relation to Platform Data, please contact us as described in the “Contacting Us” section below. 

Why we process Personal Information 

Order processing 

 

Events & promotions 

 

Loyalty program & marketing 

 

Customer Services 

Purpose	Personal Information	Legal basis
Customer service  We will process your Personal Information when you contact us with requests for support, complaints or questions. For example when you contact us through the contact form on our Site or through our social media channels.	First and last name Email Phone number Order number Content of message Other information relevant or needed to process your request, complaint or question Platform Data	We rely on our legitimate interest to respond to questions or complaints.   If you request a specific service from us, we will rely on the performance of the contract to process Personal Information needed to provide you with such service.  If you submit a request on the basis of a law (such as an access request based on your rights under European data protection law), we will process your Personal Information as needed to comply with our legal obligation to respond and process your request.
Communicating important changes / Service messages In certain situations we may need to contact you directly to communicate administrative information with you. This may include important information regarding our relationship with you, our Services, any changes to our terms, conditions, policies and procedures, and/or other administrative information.	We use your first and last name and at least one contact method to contact you. Depending on the content of the communications, we may also process other Personal Information related to you for this purpose.	We rely on our legitimate interest, such as to ensure our Services are used in accordance with our terms, conditions, and policies.   We rely on the performance of contract, where the communication relates to an agreement we have with you.   In certain instances we may also have a legal obligation to inform you of material changes to our Terms & Conditions or Privacy Notice (e.g., in case of mergers, acquisitions and other reorganizations and restructurings of our business).

 

Suppliers, vendors and other Business Partners 

Purpose	Personal Information	Legal basis
Procurement of products and/or services, including negotiations around such procurement.  If you are (a representative of) a supplier, vendor or other business partner with whom we interact in the context of our business, we will process your Personal Information in the context of our business relationship with you. E.g., to negotiate or draft a contract.	Name and surname  Email  Phone number  Role  Name of employer/company  Content of our communications  Date, time and subject of our (online) meetings  If you are a sole proprietor:  Content of our agreement  Chamber of Commerce extract	Performance of our contract with you, including steps taken in preparation of a contract.  Our legitimate interest to manage our relationship and negotiate with suppliers, vendors and business partners.
Cooperation & partnerships  We process your Personal Information if you are (a representative of) a company with whom we otherwise do business, e.g., our logistical partners.	Name and surname Role Name of employer/company Content of our communications Date, time and subject of our (online) meetings Email and phone number	Performance of our contract with you, including steps taken in preparation of a contract.  Our legitimate interest to manage our relationship with and negotiate with our business partners.

 

Improving Our Services

Purpose	Personal Information	Legal basis
Improving and developing new products and Services We will use the Personal Information that we collect about you for analytical purposes, so that we can improve our existing products and Services and develop new products or Services of interest. For example, we will conduct data analysis to monitor and analyze the usage of our Online Services. We may also use the insights gained to develop new products or Services, such as on the basis of feedback, or to improve existing products or Services or the way we promote them. We also want to be able to identify usage trends, and to monitor the effectiveness of our promotional campaigns and adjust them where needed. We also use pseudonymized or anonymized payment information to gain insight into the average spending, recurring customers, and other related data.	We use the Personal Information that we have collected from or about you for this purpose. Where possible and feasible, we will do this in a manner that does not directly identify you (e.g., by creating aggregated insights from pseudonymized data, as described below).	We rely on our legitimate interest for these activities. We have an interest in making sure our products and Services remain relevant to our customers, and our promotional campaigns remain effective.
Aggregating or anonymizing Personal Information.  Where we don’t need your Personal Information in identifiable form to pursue our purposes (such as performing analytics to obtain aggregate insights), we will aggregate and/or anonymize your Personal Information so that it is no longer considered Personal Information.   Our external service provider, Loyyo, analyzes transaction data on our behalf in a way that does not identify you as an individual. Loyyo does not receive Personal Information from us, such as your name or contact details for these purposes. Instead they only process a “token” that is generated by the payment provider and cannot be used to identify you.	We may aggregate, anonymize or pseudonymize any of your Personal Information as is necessary or required for the relevant purpose of anonymization or pseudonymization.	We rely on our legitimate interests to anonymize your information, such as the interest to generate other data for our use.

 

Security and legal reasons 

Purpose	Personal Information	Legal Basis
Fraud prevention and security  We may use your Personal Information if this comes up in the context of: security purposes, including system security and on-site security of our premises (where we use CCTV cameras in our Stores, we will indicate this with appropriate signs);  monitoring for and preventing fraud; and  audits to verify that our internal processes function as intended and are compliant with legal, regulatory and contractual obligations.	Depending on the specific purpose, this may include any Personal Information that we have collected about you, including images from the CCTV-cameras. These images are stored for a period of 4 weeks, unless an incident occurs.	We rely on our legitimate interests, such as identifying and/or preventing fraudulent transactions or theft and ensuring the security of our Stores and systems.   We have a legal obligation to conduct audits.
Legal and compliance  We have general legal and compliance obligations to process your Personal Information. This includes a.o.: Complying with applicable laws; Complying with legal processes (e.g., in legal proceedings);  Responding to requests from public and government authorities; Meeting national security or law enforcement requirements We may also process your Personal Information for our general legal interests, insofar as they apply, such as: Enforcing our terms and conditions; Protecting our operations; Protecting our rights, privacy, or property; and Allowing us to pursue available legal remedies, defend claims and limit the damages that we may sustain.	We use the Personal Information as relevant for the specific legal action, regulatory investigation, and/or legal processes in question.	We rely on our relevant legal obligation to process the relevant Personal Information. We rely on our legitimate interest, such as enforcing terms and conditions and bringing or defending legal claims.
Emergency and incident response  In exceptional circumstances, we may need to process your Personal Information to respond to an incident or emergency. This may include purposes such as: Ensuring the safety of on-site personnel and visitors;   Responding to, handling and documenting on-site accidents and medical and other emergencies;   Actively monitoring properties to ensure adequate incident prevention, response and documentation (including CCTV);  Requesting assistance from emergency services; and Sending notifications and alerts in the event of incidents or emergencies (such as via SMS, email, call, audio-visual device prompts, etc.).	We use Personal Information as necessary and relevant for the specific purpose and context.	We have a legal obligation to adequately address emergencies and incidents. In certain instances, processing Personal Information may also be necessary to protect an individual’s vital interests (such as when we need to contact medical or emergency services).

 

DISCLOSURE OF PERSONAL INFORMATION

We disclose Personal Information to the following third parties: 

• Our affiliates 

• Third party service providers, including our CRM platform service provider and other IT- and related infrastructure service providers, including website hosting and email delivery 

• Advertising networks 

• Providers of analytics services, promotional services and social media 
• Other service providers, such as Loyyo (provider of the loyalty program and analytical services) 

We will also disclose your Personal Information as necessary or appropriate, in particular when we have a legal obligation or legitimate interest to do so: 

• To public and/or government authorities and/or regulatory authorities, including courts, tribunals, supervisory authorities, tax authorities and other government authorities (e.g., if the data protection authority or the tax authorities commence an investigation); 

• To third parties (legal or natural persons), as relevant for the specific legal action and/or procedure (such as lawyers, accountants, insurers, advisors, auditors, etc.) 
• To third parties such as an acquiring entity and its advisors, in connection with a sale or business transaction. We may disclose or transfer your Personal Information in the event of any reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings). You will be notified of any such business transaction and of possible changes to the processing of your Personal Information.  

THIRD PARTY ADVERTISING 

We use third-party advertising companies to serve advertisements regarding goods and services that may be of interest to you when you access and use the Online Services and other websites or online services (as also described above). 

You may receive advertisements based on information relating to your access to and use of the Online Services and other websites or online services on any of your devices, as well as on information received from third parties. These companies place or recognize a unique cookie on your browser (including using pixel tags). They also use these technologies, along with information they collect about your online use, to recognize you across the devices you use, such as a mobile phone and a laptop. 

The purpose is to show you ads that are relevant to you. You can limit this by opting out at:  

• www.networkadvertising.org  

• www.aboutads.info  

You will still see advertising, but they will no longer be tailored to your interests.  

THIRD PARTY PAYMENT SERVICE 

We may provide functionality allowing you to make payments to us using third-party payment services with which you have created your own account. When you use such a service to make a payment to us, your Personal Information will be collected by such third party and not by us and will be subject to the third party’s privacy policy, rather than this Privacy Notice. We have no control over, and are not responsible for, this third party’s collection, use, and disclosure of your Personal Information. 

COOKIES AND SIMILAR TECHNOLOGIES

Information about cookies and similar technologies is available in our cookie tool. You can accept or reject cookies on our Sites at any time through the cookie tool or your browser settings.  

The cookie tool is available at the bottom right and looks like this:

You can find informaiton about your browser settings here: http://www.allaboutcookies.org/manage-cookies/index.html. Note that the performance of the Site may be affected if all cookies are rejected. Some cookies are necessary to provide the functionality of the Site.  

SECURITY 

We seek to use reasonable organizational, technical, and administrative measures to protect Personal Information within our organization. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the “Contacting Us” section below. 

YOUR RIGHTS 

Newsletters 

You can always opt out of receiving our newsletter on a going-forward basis by clicking the “Unsubscribe” link at the bottom of the newsletter. Please note that if you opt out of receiving marketing from us, we may still send you important administrative messages, from which you cannot opt out. 

Members 

Our loyalty members can access, edit and/or erase parts of their Personal Information by logging into their member account.  

You may:

• request us to give you access to your Personal Information; 
  
• request us to rectify, limit the use of, or erase your Personal Information; 
  
• object to (or opt out of) our processing of your Personal Information; 
  
• withdraw your consent (which will not affect the lawfulness of processing prior to the withdrawal); 
  
• request to receive, or provide to a third party, an electronic copy of your Personal Information. 

We will respond to your request consistent with applicable law. Note that the exercise of certain rights is subject to exemptions or conditions under applicable law. 

In your request, please make clear what Personal Information your request relates to. For your protection, we may need to verify your identity before implementing your request. For example, we will only implement requests with respect to the Personal Data associated with the particular email address that you use to send us your request. We will try to comply with your request as soon as reasonably practicable. 

Please note that we may need to retain certain information for recordkeeping purposes and/or to complete any transactions that you began prior to requesting a change or deletion (e.g., when you make a purchase, you may not be able to change or delete the Personal Information provided until after the completion of such purchase).   

Complaint with a supervisory authority 

Depending on your jurisdiction, you may also lodge a complaint with a data protection authority for your country or region, or where an alleged infringement of applicable data protection law occurs. A list of EEA data protection authorities is available at: http://ec.europa.eu/justice/data-protection/article-29/structure/data-protection-authorities/index_en.htm. 

RETENTION PERIOD 

We will retain your Personal Information for as long as needed or permitted in light of the purpose(s) for which it was obtained as outlined in this Privacy Notice, unless a longer retention period is required or permitted by applicable law, e.g., for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. 

The criteria used to determine our retention periods include:  

1. the length of time we have an ongoing relationship with you (for example for as long as you have an account);
   
   
2. whether there is a legal obligation to which we are subject; or
   
   
3. whether retention is advisable in light of our legal position (e.g., in regard to applicable statutes of limitations, litigation or regulatory investigations). 

THIRD PARTY SERVICES 

This Privacy Notice does not address, and we are not responsible for, the privacy, information, or other practices of any third parties. This includes any third party operating any website or service to which the Services link. The inclusion of a link on the Services does not imply endorsement of the linked site or service by us or by our affiliates. 

In addition, we are not responsible for the information collection, use, disclosure, or security policies or practices of other organizations, such as Meta, Apple, Google, Microsoft, or any other app developer, app provider, social media platform provider. 

USE OF SERVICES BY MINORS 

The Services are not directed to individuals under the age of sixteen (16), and we do not knowingly collect Personal Information from individuals under 16. 

JURISDICTION AND INTERNATIONAL TRANSFERS

Your Personal Information may be stored and processed in countries outside the European Economic Area (EEA), such as in the United States. 

For such transfers, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented: 

Adequacy Decisions: Some non-EEA countries are recognized by the European Commission as providing an adequate level of data protection according to EEA standards (the full list of these countries is available here). 

Standard Contractual Clauses: For transfers of Personal Information from the EEA to third countries where Personal Information is transferred, which are not considered adequate by the European Commission, we have put in place standard contractual clauses adopted by the European Commission to protect your Personal Information. You may obtain a copy of these measures by contacting us in accordance with the “Contacting Us” section below or by following this link. 

SENSITIVE INFORMATION 

Unless we request it, we ask that you not send us, and you not disclose, any sensitive Personal Information (e.g., social security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background, or trade union membership) on or through the Online Services or otherwise to us. 

UPDATES TO THIS PRIVACY NOTICE 

The “Last Updated” legend at the top of this Privacy Notice indicates when this Privacy Notice was last revised. Any changes will become effective when we post the revised Privacy Notice on our Site.  

CONTACTING US 

YAYA B.V., located at the Haarlemmerstraatweg 95 (1165 MK) Halfweg, is the company generally responsible for the processing of your Personal Information under this Privacy Notice.  

If you make a purchase in one of our Stores, then the relevant Store will be the party responsible for the processing of your Personal Information (whether or not together with YAYA B.V.). 

If you make a purchase online through our Site, YAYA Webshop B.V. will be the party responsible for the processing of your Personal Information.  

If you have any questions about this Privacy Notice, please contact us at service@yaya.nl

Please note that email is not always secure. Do not include sensitive information in emails to us.