At BIBO Fashion, we handle your personal data with care. In this Privacy Policy, you can read which data we process, why we do so, who we share it with, which cookies we use and what rights you have. This Privacy Policy applies to our webshops bibofashion.nl, bibofashion.de and bibofashion.eu.
1. Who are we?
The controller for the processing of your personal data is:
Luut van der Bij, trading under the name BIBO Fashion (sole proprietorship)
Hanenburch 22, 9298 VS Kollumerzwaag, the Netherlands
Chamber of Commerce (KvK) number: 73904813
VAT identification number: NL001584846B18
E-mail: info@bibofashion.nl
Telephone: +31 (0)85-4018324
2. What data do we process, why, and for how long?
Your order and its delivery
When you place an order, we process your name, address, e-mail address, telephone number, the products you ordered, the payment and shipping method you chose and the status of your payment. We need this data to deliver your order, keep you informed and handle any returns or withdrawals. If you order without an account, we store your data as a guest order.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Retention period: we keep invoices and the order data needed for them for 7 years, as required by the Dutch tax retention obligation.
Completing your address
At checkout, you can have your address completed automatically. To do this, we only send what you type in the search field (for Dutch addresses, your postcode and house number) to an external address service, which returns the street and town. That service does not receive your name or any other data from you.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in a correct delivery address.
Your country for the shipping costs
As long as you have not yet entered an address, we show the shipping costs for the country from which you are visiting the website. That country is determined based on your IP address. We do not store this.
Your customer account
If you create an account, we store your details, addresses and orders, so that you don't have to enter them again with every order and you can look back at your orders.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Retention period: until you have your account deleted (except for data we are legally required to keep).
Payment
Payments are handled by our payment provider Mollie. Mollie processes your payment details; we do not see your full card or bank account details. If you choose to pay later (Klarna) or pay in instalments (in3), that party checks your details before the payment is approved. Klarna and in3 are themselves responsible for this; please also read their privacy policies. The same applies to PayPal and Apple when you pay with PayPal or Apple Pay.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
Shipping
To ship your order, we pass your name, delivery address, e-mail address and telephone number on to our shipping platform and to the carrier, PostNL. Outside the Netherlands, PostNL delivers together with local partners, for example Hermes in Germany. If you choose delivery to a pick-up point at checkout, we load a pick-up point map from our shipping platform.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
Accounting and invoices
Order and invoice data are processed in our accounting and invoicing software.
Legal basis: legal obligation (Art. 6(1)(c) GDPR), namely our obligation to keep and retain accounting records. Retention period: 7 years.
Contact and customer service
If you contact us by e-mail, by telephone or via the contact form, we use your data to answer your question. Our e-mail runs via an external e-mail provider. Forms on the website are protected against spam and abuse with Google reCAPTCHA.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Retention period: up to 2 years after your question has been dealt with.
Reviews
After your order, you may receive an invitation to write a review via Kiyoh. For this purpose, we pass your name, e-mail address and the date of your order on to Kiyoh. We show the reviews that customers write via Kiyoh on our website.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR). You can always unsubscribe from these invitations via the link in the invitation.
Newsletter
If you sign up for our newsletter, we send you e-mails about new collections and offers from time to time. We send the newsletter via an external newsletter service. For bibofashion.nl, we also give that service data about orders (such as the products ordered, amounts and status) and about shopping carts that were not checked out, so that we can tailor the e-mails to what interests you and remind you about your shopping cart.
Legal basis: consent (Art. 6(1)(a) GDPR) for the newsletter; legitimate interest (Art. 6(1)(f) GDPR) for the tailoring and the reminders. You can unsubscribe at any time via the link at the bottom of every e-mail or via your account.
Back-in-stock notifications
If you ask to be notified when a product is back in stock, we keep your e-mail address until we have sent that notification.
Legal basis: consent (Art. 6(1)(a) GDPR).
Website statistics and advertising (only with your consent)
Only if you give your consent for this via our cookie banner do we use Google Analytics to see how our website is used, and Google Ads to measure our advertising and to show you relevant ads, including on other websites. We only load Google Tag Manager, which is used to load these services, after you have given your consent.
Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via ‘Cookie settings’ at the bottom of the website.
Instagram feed (only with your consent)
On the homepage, we may show our Instagram feed via Curator.io. We only load it if you allow ‘External media’. When it loads, Curator.io and Meta (Facebook/Instagram) receive your IP address, among other things.
Legal basis: consent (Art. 6(1)(a) GDPR).
Hosting and security
Our webshops run on servers in Germany and are protected against attacks, abuse and bots by a security and network service. In the process, your IP address and technical data about your browser, among other things, are processed. Our servers keep log files for a short time for security and troubleshooting purposes.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in a secure and properly functioning website.
3. Who do we share your data with?
We never sell your data. We only share it with parties that help us provide our services, or when the law requires us to:
- Payment: Mollie (the Netherlands); for pay-later or instalment payments, Klarna (Sweden) or in3 (the Netherlands); for PayPal and Apple Pay, also PayPal and Apple
- Shipping: our shipping platform and PostNL (the Netherlands), with their partners in other countries
- Address completion: an external address service (the Netherlands)
- Accounting: our accounting and invoicing software (the Netherlands)
- Reviews: Kiyoh (the Netherlands)
- Newsletter: an external newsletter service (United States)
- E-mail: an external e-mail provider
- Google (Ireland/United States): reCAPTCHA and, with your consent, Google Tag Manager, Google Analytics and Google Ads
- With your consent for external media: Curator.io and Meta
- Hosting and security: our hosting partner (Germany) and a security and network service (United States/EU)
We have made agreements with the parties that process data on our behalf to protect your data. Some parties (such as Google, Meta, our security and network service and our newsletter service) also process data outside the European Economic Area, mainly in the United States. This is done on the basis of the EU-US Data Privacy Framework or the Standard Contractual Clauses of the European Commission.
4. Cookies and similar technologies
A cookie is a small text file that is stored on your device when you visit our website. We store some data in a similar way in your browser's storage (local storage). On your first visit, we use a cookie banner to ask for your consent for everything that is not necessary. You can change your choice at any time via ‘Cookie settings’ at the bottom of the website.
Necessary (always on)
- Session cookies of the webshop (BIBO Fashion): remember your shopping cart, language and login session. Retention period: 20 days up to 13 months.
- Cookie choice (BIBO Fashion): remembers your cookie choice. Retention period: 12 months.
- Security cookie (security and network service): security and bot detection. Retention period: 1 year.
- Payment cookie (Mollie): checks whether Apple Pay is available on your device. Retention period: until the end of your visit.
- Google reCAPTCHA (Google): protects forms against spam and may use Google cookies to do so.
- Our website's browser storage (BIBO Fashion): remembers, for example, that you have closed the newsletter pop-up.
Statistics (only with your consent)
- _ga and _ga_… (Google Analytics): recognise your browser in order to compile visitor statistics. Retention period: 13 months.
Marketing (only with your consent)
- _gcl_au and browser storage _gcl_ls (Google Ads): measure which ads lead to a visit or purchase. Retention period: 90 days.
- Google cookies on google.com and doubleclick.net (Google Ads): for showing and measuring ads, including on other websites. Retention period: up to 13 months.
External media (only with your consent)
- Instagram feed via Curator.io: Curator.io and Meta (Facebook/Instagram) may set or read their own cookies, for example if you are logged in to Facebook or Instagram.
You can also delete or block cookies in your browser settings. If you block necessary cookies, the webshop may not work properly.
5. Security
We take appropriate technical and organisational measures to protect your data against loss and unauthorised access. Our website uses a secure connection (https), and only authorised persons have access to your data.
6. Your rights
You have the right to access your personal data and to have it corrected or deleted. You can also object to the use of your data, have the processing restricted, have your data transferred and withdraw any consent you have given. If you have an account, you can also view and download your data yourself via your account. Send your request to info@bibofashion.nl. We will respond within one month. To make sure the request comes from you, we may ask you to confirm your identity, for example via the e-mail address we have on file for you.
We do not make decisions about you that are based solely on automated processing. If you choose to pay later or pay in instalments, Klarna or in3 may carry out an automated credit check themselves.
Not happy with how we handle your data? Let us know, and we will work with you to find a solution. You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority, autoriteitpersoonsgegevens.nl) or with the data protection authority in your country of residence.
7. Changes
We update this Privacy Policy when our working methods or the law change. You can always find the most recent version on this page.
Last updated: 19 October 2026
