Tietosuojakäytäntö

The data controller responsible for your personal data is Kesekesa Holding B.V., operating under the trade name CALQIX. Kesekesa Holding B.V. is a private limited company incorporated under the laws of the Netherlands and registered with the Dutch Chamber of Commerce (Kamer van Koophandel / KVK).

In accordance with our business privacy policy, our registered company address is not published on this website. Customers or third parties seeking corporate or legal information are referred to the public KVK registry at kvk.nl or to our contact page at calqix.com.

For all privacy-related enquiries, requests, or complaints, you may contact CALQIX via the contact page at calqix.com. We will respond to all privacy-related correspondence within 30 calendar days.

We do not knowingly collect special category data (also known as sensitive personal data) as defined under Article 9 GDPR — including data relating to health, race, religion, political opinions, sexual orientation, or biometric data — unless you voluntarily provide such information in the context of a support or return enquiry, in which case it is used solely to resolve that specific matter.

We do not collect or process full payment card details. All card and payment data is processed exclusively by our authorised payment service providers (such as Shopify Payments, Mollie, or equivalent), which operate under their own security certifications (PCI-DSS compliance). CALQIX only receives a tokenised transaction reference and payment status confirmation.

Order fulfilment. We use your identity, contact, delivery, and transaction data to process and fulfil your order, communicate its status, and manage any returns or complaints. This is the primary purpose for which we collect personal data and is necessary for the performance of our contract with you.

Marketing communications. Where you have opted in to receive marketing communications, we will use your email address to send you relevant information about CALQIX products, promotions, new launches, and personalised offers. You may withdraw consent and unsubscribe at any time by clicking the unsubscribe link in any email or by contacting us via the contact page.

Advertising campaign optimisation. We use behavioural, device, and marketing interaction data — collected via advertising pixels, browser cookies, and platform SDKs — to measure the performance of our advertising campaigns on Meta (Facebook and Instagram), TikTok, Google, and their associated applications and networks. This data helps us understand which campaigns generate the most value, reduce our cost per acquisition, and improve the relevance of the ads you see. Further details are set out in Section 5.

Commercial analysis and revenue optimisation. We analyse aggregated purchase behaviour, campaign performance, and customer lifetime value data to make informed business decisions, including pricing strategy, product selection, inventory planning, and the allocation of commercial surplus to customer rewards and discounts. This analysis is conducted on anonymised or pseudonymised datasets where possible. Further details are set out in Section 6.

Fraud prevention and security. We use technical and device data to detect and prevent fraudulent transactions, chargebacks, and misuse of our platform. This processing is necessary to protect both CALQIX and its customers.

Legal and regulatory compliance. We retain and process certain data as required by Dutch law, including financial records, VAT documentation, and records of consumer transactions, for the legally mandated retention periods.

What data is shared with advertising platforms. Depending on your consent, the following categories of data may be transmitted to our advertising platforms via tracking pixels, browser cookies, server-side APIs, or hashed audience uploads:

• Hashed (encrypted) email addresses, used to match your profile on advertising platforms for custom audience creation and attribution — transmitted only via server-side Conversions APIs, not in plain text.
• Behavioural event data from our website, including page views, product views, add-to-cart events, checkout initiations, and purchase completions — transmitted with event value, product identifiers, and currency.
• Device and technical identifiers, including browser cookies, IP addresses (which may be anonymised or truncated in compliance with GDPR before transmission), and user agent strings.
• Aggregated conversion data used to train advertising platform algorithms for automated bidding and audience targeting optimisation.

Purpose of advertising data use. Data shared with advertising platforms is used exclusively for the following purposes: measuring the return on investment of our paid advertising campaigns; retargeting visitors who have not yet completed a purchase; building Lookalike Audiences to reach new customers with similar profiles to our existing buyers; and optimising automated bidding strategies to reduce cost per acquisition — savings that are partially passed back to customers in the form of discounts and rewards (see Section 6).

Consent and opt-out. Advertising tracking is only activated after you provide explicit consent via our cookie consent tool. You may withdraw consent at any time by updating your cookie preferences on our website. Additionally, you may opt out of personalised advertising directly through each platform using the links below:

• Meta: facebook.com/ads/preferences
• Google: adssettings.google.com
• TikTok: Settings → Privacy → Ads Personalisation within the TikTok app
• General opt-out: youronlinechoices.eu (EU) or optout.aboutads.info (US)

Data Processing Agreements. Where required under GDPR, CALQIX has entered into or relies on standard data processing terms with each advertising platform. Meta, TikTok, and Google each act as independent data controllers for the data they receive and process within their own platforms, in addition to acting as data processors in respect of conversion tracking. Their respective privacy policies govern their use of data once received.

What data informs commercial decisions. CALQIX uses the following categories of aggregated and anonymised data to inform commercial and pricing decisions:

• Aggregate purchase volumes, average order values, and repeat purchase rates — used to negotiate better pricing with suppliers and to plan inventory efficiently.
• Advertising campaign performance data (cost per click, cost per acquisition, return on ad spend) — used to reduce marketing expenditure per order, with savings contributing to the customer rewards pool.
• Conversion funnel data — used to identify and remove friction in the purchasing process, thereby reducing cart abandonment and increasing the efficiency of each marketing euro spent.
• Product-level profitability analysis — used to determine which products generate sufficient margin to fund discount programmes without compromising product quality or supply chain integrity.

How savings are returned to customers. Commercial efficiencies generated through data-driven operations are partially distributed back to customers in the following forms:

• Promotional discounts — time-limited discount codes communicated via email or social media to our customer base, funded by reductions in our cost base.
• Loyalty rewards — discounts or added value offered to repeat customers and subscribers, reflecting the reduced cost of serving an existing customer versus acquiring a new one.
• Referral benefits — rewards for customers who refer new buyers, funded by the reduction in advertising spend that a referred customer represents.
• Volume and bundle pricing — price reductions on multi-unit or subscription orders that reflect the operational efficiencies of serving higher-volume customers.

What data is not used. Commercial and pricing decisions at CALQIX are made on the basis of aggregated, anonymised datasets and never on the basis of individual customer profiling for the purpose of dynamic pricing or price discrimination. We do not charge different prices to different customers based on their individual browsing history, location, or personal characteristics.

No automated decision-making with legal effect. No decisions that produce legal effects or similarly significantly affect individual customers — such as eligibility for products, credit assessments, or access restrictions — are made solely on the basis of automated processing of personal data. All such decisions involve human review.

CALQIX does not sell, rent, trade, or otherwise commercially transfer your personal data to any third party for their own marketing or commercial purposes. Data sharing with third parties is strictly limited to what is necessary for the operational purposes described in this policy.

CALQIX may be required to disclose personal data to governmental authorities, law enforcement agencies, or regulatory bodies where required by applicable law, court order, or legal process. In such cases, CALQIX will disclose only the minimum data required and, where permitted by law, will notify the affected customer.

As CALQIX operates globally and uses service providers headquartered outside the European Economic Area (EEA) — including Shopify (Canada/USA), Meta (USA), Google (USA), and TikTok (Singapore/USA) — your personal data may be transferred to and processed in countries outside the EEA.

Wherever personal data is transferred outside the EEA, CALQIX ensures that appropriate safeguards are in place in accordance with Chapter V of the GDPR. These safeguards include:

• Adequacy decisions — transfers to countries that the European Commission has determined offer an adequate level of data protection (e.g. Canada for certain processing activities).
• Standard Contractual Clauses (SCCs) — where an adequacy decision does not apply, transfers are governed by the European Commission's standard contractual clauses for international data transfers.
• Platform compliance frameworks — Meta, Google, and TikTok each participate in data transfer compliance frameworks applicable to their platforms and have implemented SCCs for EEA data transfers.

You may request further information about the specific safeguards applied to any particular transfer by contacting CALQIX via the contact page at calqix.com.

You may manage, update, or withdraw your cookie preferences at any time by accessing the cookie settings on our website. Note that disabling certain cookie categories — particularly marketing cookies — may reduce the quality and relevance of advertisements you see from CALQIX and will also reduce the data available to us for the customer reward calculations described in Section 6.

In addition to browser cookies, we may use pixel tags (also known as web beacons) in our emails to determine whether an email has been opened and whether links have been clicked. You may prevent this by disabling image loading in your email client.

We do not use cookie "walls" — you are not required to accept non-essential cookies as a condition of accessing or purchasing from our website. Consent to non-essential cookies is always freely given, specific, informed, and unambiguous, in accordance with Article 7 GDPR and Recital 32.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Order and transaction data — retained for 7 years from the date of the transaction, in compliance with Dutch accounting and tax retention obligations (Artikel 52 Algemene Wet inzake Rijksbelastingen).
• Customer contact and identity data — retained for the duration of the customer relationship and for a period of 2 years thereafter, to handle any post-purchase enquiries, warranty claims, or disputes.
• Marketing communications data (email lists) — retained for as long as you remain subscribed. Upon unsubscribing, your email address is suppressed (retained on a do-not-contact list) to prevent accidental re-subscription, but is not used for any further marketing communications.
• Behavioural and analytics data — retained in anonymised or aggregated form for up to 26 months in Google Analytics 4 (the platform maximum), after which it is automatically deleted or anonymised.
• Advertising pixel and conversion data — governed by the respective platform's data retention policies (typically 180 days to 2 years for attribution windows).
• Support and communication records — retained for 3 years from the date of the last communication, to handle any follow-up claims or disputes.

At the end of the applicable retention period, personal data is securely deleted, anonymised, or pseudonymised. Data that has been anonymised such that it can no longer be attributed to an identifiable individual is not subject to GDPR and may be retained indefinitely for statistical or commercial analysis purposes.

How to exercise your rights. To exercise any of the rights listed above, please submit a written request via the contact page at calqix.com. We may ask you to verify your identity before processing your request. We will respond within 30 calendar days. Where a request is complex or numerous, we may extend this period by a further 2 months, in which case we will notify you.

Free of charge. Exercising your data rights is free of charge. However, where requests are manifestly unfounded or excessive, particularly if repetitive, CALQIX may charge a reasonable administrative fee or refuse to act on the request.

CALQIX's products and website are not directed at children under the age of 16. We do not knowingly collect personal data from individuals under 16 years of age. If we become aware that a child under 16 has provided us with personal data without verifiable parental or guardian consent, we will take immediate steps to delete such data.

If you are a parent or guardian and believe that your child has provided us with personal data, please contact us via the contact page at calqix.com and we will address the matter without delay.

CALQIX implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures include, but are not limited to: SSL/TLS encryption for all data transmitted to and from calqix.com; access controls limiting data access to authorised personnel on a need-to-know basis; use of reputable, security-certified third-party processors (including Shopify, which is PCI-DSS Level 1 certified); and regular reviews of our data handling practices.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, CALQIX will notify the affected individuals and, where required by Article 33 GDPR, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of becoming aware of the breach.

No method of data transmission over the internet or method of electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security. We encourage you to use strong, unique passwords for any account you create with us and to notify us immediately if you suspect any unauthorised access to your account.

CALQIX may update this Privacy Policy from time to time to reflect changes in our business practices, legal requirements, or the introduction of new advertising platforms or data processing activities. The most current version of this policy is always available at calqix.com, alongside its effective date and version number.

Where a material change is made to this policy that affects the processing of your personal data in a way that requires renewed consent, CALQIX will notify you by email (where we hold your email address) or via a prominent notice on the website, and will request fresh consent where required.

Your continued use of calqix.com or continued purchasing from CALQIX after the effective date of any non-material update constitutes acceptance of the updated policy. For material changes requiring consent, continued use is conditional upon providing that consent.

Contact CALQIX. For all privacy-related enquiries, data subject requests, or concerns about how we handle your personal data, please contact us via the contact page at calqix.com. We will acknowledge receipt of your message within 2 Business Days and respond substantively within 30 calendar days.

Right to lodge a complaint. If you are not satisfied with our response to a privacy concern, or if you believe that we are processing your personal data in breach of the GDPR, you have the right to lodge a complaint with the competent supervisory authority. In the Netherlands, this is:

We encourage you to contact us directly before lodging a formal complaint with a supervisory authority, as we are committed to resolving privacy concerns swiftly and transparently.