Privacy Statement Winkelstraat.nl

Last updated: 16 March 2026

Via Winkelstraat.nl you can view and order items from various affiliated sellers. In doing so, we process personal data of visitors, customers and other users of our platform. We handle this data carefully and secure it appropriately.

In this privacy statement, we explain which personal data we process, why we do so, with whom we share data, how long we retain it, and what rights you have.

1. Who is responsible for your personal data?

WSNL B.V. is responsible for the processing of personal data as described in this privacy statement.

WSNL B.V.
Buizerdlaan 2
3435 SB Nieuwegein
Nederland
Email: privacy@winkelstraat.nl
Phone: 020-2415608

This privacy statement also applies to the legal successor(s) of WSNL B.V. When our business or a relevant part of it is transferred, as described in article 7, the controller may change. We and/or the acquiring party will inform you about this and make clear which privacy statement applies from that moment on.

When you place an order via our platform with an affiliated seller, that seller processes certain personal data for the sale and handling of the order. The seller is, in principle, an independent controller for that purpose. In article 6, we explain how responsibility is divided between us and the seller. More information can be found in the privacy statement of the relevant seller.

2. Who does this privacy statement apply to?

This privacy statement applies to the processing of personal data via:

the website and mobile environment of Winkelstraat.nl;
your Winkelstraat account;
orders placed via our platform;
our customer service, chat and other contact channels;
newsletters and other marketing communication;
our social media activities to the extent that we are responsible for the processing involved;
other services where reference is made to this privacy statement.

This privacy statement does not cover personal data of our employees or of contact persons of affiliated sellers and other business relations. Separate arrangements apply to that data. If you have questions about this, please contact us at privacy@winkelstraat.nl.

3. What personal data do we process?

Depending on how you use our platform, we may process the following categories of personal data.

Identification and contact details

first and last name;
address, place of residence and country;
billing and delivery address;
email address;
phone number;
date of birth and gender, when you provide this information yourself or when it is necessary for a specific service.

Account data

username and account number;
encrypted login details;
saved addresses and preferences;
wish lists, favorites and account settings;
communication and marketing preferences;
information about the use and status of your account.

Order and transaction data

ordered and returned items;
order date, amounts, discounts and discount codes used;
the seller involved;
delivery, return, warranty and refund data;
payment method and payment status;
information needed for administration, invoicing and handling disputes.

Payments may be processed by specialized payment service providers. We generally do not receive complete credit card or bank details, but we do receive information such as the chosen payment method, payment status and transaction identification.

Contact and customer service data

the content of emails, chats, messages and phone calls;
questions, complaints, return requests and other service requests;
information you provide yourself when you contact us.

Technical and usage data

IP address;
device, browser and operating system data;
unique online identifiers;
date, time and duration of visits;
pages and items viewed;
click, search, navigation and interaction data;
cookie data and similar technologies;
log, security and error data.

Preferences and derived data

item, brand and size preferences;
interests that can be derived from your use of the platform;
segments or profiles used for personalization, analysis or marketing, to the extent a valid legal basis exists for this.

Fraud and security data

signals of possible misuse, fraud or unusual transactions;
information necessary for access security, investigation of incidents and protection of our rights and those of others.

During fraud investigations, we may also process data about the suspicion that someone has committed a criminal offense, for example in the case of fraud with orders or payments. We use this data to protect ourselves, our users and the affiliated sellers. We only share it with others when the law allows this, for example with the police or a supervisory authority, or in the limited cases described in article 7.

We do not ask you to share special categories of personal data with us, such as medical information, religious beliefs or biometric data. Only provide such data if this is strictly necessary for handling a specific request.

4. How do we obtain your personal data?

We may obtain personal data:

directly from you, for example when you create an account, place an order, sign up for the newsletter or contact us;
automatically when you use our website or services, for example via necessary cookies, log files and — after your consent — analytical or marketing cookies;
from the seller with whom you order via our platform;
from payment, delivery, return and other service providers, for example about the status of a payment or delivery;
from parties involved in fraud prevention, security and dispute resolution;
from public sources when this is legally permitted and necessary for a clearly defined purpose;
in the context of a business transaction, when we receive personal data as the acquiring party.

5. Why and on which legal bases do we process personal data?

We only process personal data when a valid legal basis exists for doing so.

Purpose	Examples of processing	Legal basis
Providing and managing the platform	Creating and managing an account, logging in, offering wish lists and settings	Performance of a contract or our legitimate interest in offering the requested platform service
Facilitating and handling orders	Forwarding the order to the seller, tracking payment and delivery, supporting returns, refunds and warranties	Performance of a contract and, where relevant, our legitimate interest in ensuring the platform functions properly
Customer service and communication	Answering questions, handling complaints, informing about orders and sending service messages	Performance of a contract or our legitimate interest in providing good service and handling requests
Payments, administration and legal obligations	Processing payment status, invoicing, bookkeeping, tax administration and responding to competent authorities	Performance of a contract and legal obligation
Security and fraud prevention	Account and platform security, detecting misuse, investigating incidents and preventing fraudulent transactions	Our legitimate interest in protecting users, sellers, the platform and our business; where applicable, a legal obligation
Establishing and protecting rights	Handling disputes, collecting claims and conducting or preventing legal proceedings	Our legitimate interest in protecting our rights and those of the parties involved
Analysis and improvement	Analyzing use and performance, fixing errors and improving usability, items and services	Consent when non-necessary cookies or similar techniques are used; otherwise our legitimate interest in limited, necessary and privacy-friendly analyses
Personalization	Tailoring items, content and recommendations to preferences and previous use	Consent when this takes place using non-necessary cookies or similar techniques; in other cases only when another valid legal basis exists
Newsletters and direct marketing	Sending news, offers and item information by email, SMS or app message, or contacting you by phone	Consent. We only contact private individuals by phone when they have given us prior consent for this
Surveys and research	Requesting feedback and measuring satisfaction	Consent or our legitimate interest in evaluating our services, depending on how this is done
Business transactions and business continuity	Preparing, assessing and carrying out a concrete merger, reorganization, financing, investment, insolvency, sale or transfer of (part of) our business or assets, and continuing the services afterwards	Our legitimate interest and that of the party involved in enabling a concrete transaction and safeguarding the continuity of the business and the services. For data subject to a statutory retention obligation, we additionally retain a copy ourselves on the basis of that legal obligation

When we rely on a legitimate interest, we assess in advance whether the processing is necessary and whether our interests or those of a third party outweigh your interests, rights and freedoms. Where necessary, we take additional measures to limit the consequences for you.

In the event of a transfer of our business, the purposes for which we use your personal data remain the same: the Winkelstraat.nl platform and the associated services are continued. We do not transfer personal data for new or incompatible purposes. How we assess and document this in advance is described in article 7. If a processing activity is based on your consent and that consent was legally given only to us, the new owner will ask you again for consent before using your data for that purpose.

When we ask for your consent, you can always withdraw that consent again. The processing that took place before the withdrawal remains lawful.

Which data must you provide?

When personal data is necessary to create an account, place an order, handle a payment or delivery, or comply with a legal obligation, we indicate this on the relevant form. Without this data, we may not be able to provide the requested service or fully facilitate the order. Data that is not necessary can be provided voluntarily.

6. Winkelstraat.nl as a platform and disclosure to sellers

Winkelstraat.nl is a platform on which items from affiliated sellers are offered. When you place an order, we provide the personal data necessary for the sale and handling to the relevant seller. This may include, among other things, your name, contact details, delivery address and relevant order, return and payment information.

The seller uses this data, among other things, to:

accept and fulfill the order;
ship the item or make it available;
handle returns, complaints and warranties;
comply with administrative and legal obligations.

Responsibility is divided as follows. We are the controller for the platform, your account, the creation and registration of the order, the payment via the platform, our customer service, our marketing and the security of the platform. The seller is an independent controller for the performance of the purchase agreement, the shipment, the handling of returns, complaints and warranties to the extent these fall to the seller, and for its own administrative and legal obligations. The seller may not use the data received for other purposes without its own valid legal basis and may not contact you for its own marketing without your consent.

7. Business transactions and transfer of the business

We may process and disclose personal data in connection with an intended or actual merger, reorganization, financing, investment, insolvency, sale or transfer of our business or of a relevant part of our activities or assets. This may include, among other things, the platform, the Winkelstraat.nl brand, contracts, customer relationships and the associated personal data.

Preparation and due diligence

When there is a concrete intended transaction, we may, to the extent necessary, share information with potential buyers, investors, financiers and their professional advisors. During this phase, we use aggregated, anonymized or pseudonymized data where possible. Personal data is only made available when necessary to assess, prepare or carry out the transaction.

We limit access to this data and make appropriate arrangements regarding confidentiality, security, permitted purposes, retention periods and the deletion or return of data when a transaction does not proceed.

Transfer upon completion of a transaction

When a transaction is completed, personal data necessary for the continuation of the business and services may be transferred to the acquiring legal entity. That party then, in principle, becomes the new controller.

The transfer may be necessary, among other things, to:

continue Winkelstraat.nl and the associated services;
continue accounts and customer relationships;
handle ongoing and previous orders, payments, returns, refunds, warranties and customer service;
prevent or investigate fraud, misuse and security incidents;
comply with administrative, tax and other legal obligations;
take over or handle rights and obligations arising from contracts and disputes.

Prior to such processing, we assess and document the concrete interest, the necessity of the data transfer, whether the further use by the acquiring party is compatible with the purposes for which we collected the data, the reasonable expectations of data subjects and the possible consequences for their rights and freedoms. We do not transfer more personal data than is necessary for the transaction and the continuation of the relevant activities.

Existing marketing preferences, consents given and withdrawn, opt-outs, objections, deletion and rectification requests, restrictions of processing and privacy requests still pending at that time are handed over as part of the transfer, together with the date and manner in which they were recorded. The acquiring party must respect these and further handle pending requests. If a consent was legally given only to us and cannot be attributed to the acquiring party, the acquiring party will ask you again for consent before using your data for that purpose. The acquiring party may not use the data for new or incompatible purposes without its own valid legal basis.

Data we do not transfer, or transfer only to a limited extent

We do not transfer personal data for which the retention period has expired, which has been or must be deleted on the basis of a deletion request, or which is not necessary for the continuation of the services. Prior to a transfer, we clean up our files based on the retention periods in article 13.

We only transfer data about fraud, misuse and security incidents to the extent legally permitted and necessary for the protection of users, sellers and the platform, and after a separate assessment per category. Flags that are no longer necessary or insufficiently substantiated are not transferred.

Data for which we are subject to a statutory retention obligation also remains with us. After a transfer, we use this data exclusively for administrative, tax and legal purposes and not for marketing.

Objecting to the transfer

Because we base the transfer on a legitimate interest, the right to object under article 16 also applies to the transfer itself. When we inform you about an intended transfer, we will let you know within what period and in what manner you can object.

We need some data to fulfill your account or order, or to comply with a legal obligation. If you object to the transfer of that data, we or the acquiring party may often not be able to continue your account or order. In that case, we will explain your options, including terminating your account.

Transition period and remaining data

Around the completion of a transaction, you can always submit your privacy request to either of us; we will ensure it reaches the right party. Behind the scenes, we agree in writing in advance who has which role — one of us may process data for a period solely on the instructions of the other, or we may be joint controllers — and who handles requests and complaints relating to the period before the transfer. These agreements cover, among other things, purposes, instructions, security and retention periods.

This is necessary because systems, payments or customer service may still be carried out by one of us for a limited period. When we ourselves still retain personal data after a transfer, we will let you know through which address you can reach us about this.

Information in the event of a change of controller

When the controller changes, we and/or the acquiring party will inform you in advance of that change, with a reasonable period during which you can object or have your account deleted. Only when this is not reasonably possible, for example in the case of insolvency, will we inform you no later than the moment of the change.

We do this in an appropriate and prominent manner, in principle by email and via our website, and state at least the identity and contact details of the new controller, the purposes and legal bases of the further processing, your rights and how you can exercise them.

When the acquiring party or its service providers are established outside the European Economic Area or process personal data there, the safeguards from article 9 apply.

We do not sell your personal data as a standalone product and do not trade address or customer data for marketing purposes by third parties. Your data may, however, be included when our business or a relevant part of it is sold or transferred, because it is then part of the business. What this means and which safeguards apply is described in article 7.

We may share personal data, to the extent necessary and lawful, with the following categories of recipients:

the affiliated seller with whom you place an order;
payment and financial service providers;
delivery, logistics and return service providers;
IT, hosting, cloud, security and customer service providers;
email, communication and marketing service providers;
analytics and advertising partners, only to the extent a valid legal basis and, where necessary, consent exists;
suppliers that support us with fraud prevention, identity or transaction verification and dispute resolution;
accountants, auditors, insurers, banks, lawyers and other professional advisors;
group companies, when this is necessary and lawful for internal support or business operations;
potential or actual buyers, investors, financiers and their advisors in the context of a business transaction as described in article 7;
the acquiring party and, during a transition period as described in article 7, the processors engaged by it;
competent supervisory authorities, tax authorities, investigative services, courts and other government bodies when we are legally required to do so or when this is necessary for the protection of rights;
other parties when you have given consent for this or when another legal basis exists.

Parties that process personal data solely on our instructions may only use it according to our instructions. We make appropriate arrangements with these processors regarding privacy and security. Recipients that determine the purpose and means of processing themselves are independently responsible for their processing.

9. Transfer outside the European Economic Area

Some service providers or other recipients may be established outside the European Economic Area or process personal data there.

When we transfer personal data to a country outside the European Economic Area, we only do so if the legal requirements are met. We use, for example:

an adequacy decision of the European Commission;
standard contractual clauses approved by the European Commission;
other legally permitted safeguards or exceptions.

Where necessary, we take additional technical and organizational measures. You can contact us for more information about the safeguards used for a specific transfer.

These safeguards also apply when personal data is shared with or transferred to a party outside the European Economic Area in the context of a business transaction.

10. Cookies and similar technologies

We use cookies and similar technologies to make our website function technically, remember preferences, analyze the use of the platform and — when you have given consent for this — personalize content and advertisements.

For non-necessary cookies and similar technologies, we ask for consent in advance. You can adjust your choices at any time or withdraw your consent via the cookie settings on our website.

More information about the cookies used, the parties involved, purposes and retention periods can be found in our cookie statement.

For advertising and ads personalization we work with Google. In that context Google also processes personal data itself. Read how Google handles data from its business partners at business.safety.google/privacy.

Cookies and similar technologies are placed by or on behalf of the party that operates Winkelstraat.nl. If that party changes as a result of a transfer of our business, the cookie notice will be adjusted to reflect the new controller, and we, or the acquiring party, will ask you again for your choices regarding non-necessary cookies and similar technologies.

11. Newsletters and other marketing

If you have signed up for our newsletter or have given consent in another valid way, we may send you information about items, brands, offers and services of Winkelstraat.nl.

If you give your consent on or after 16 March 2026, that consent applies to Winkelstraat.nl and to the party that operates Winkelstraat.nl, including a legal successor after a transfer of our business as described in article 7. If you gave your consent earlier, it may be that it was legally given only to us; in that case, the new owner will ask you again for consent before sending you marketing messages. Your opt-out options remain unchanged in both cases. If an acquiring party wants to contact you about other brands, platforms or services than Winkelstraat.nl, it will always ask for your consent again first.

You can unsubscribe at any time:

via the unsubscribe link in every marketing email;
via the settings in your account, when this option is available;
by contacting us at privacy@winkelstraat.nl.

An unsubscribe applies to marketing communication. We may still send you necessary service messages, for example about your account, order, return or an important change to our services.

12. Personalization and profiling

We may combine data about your preferences and use of the platform to make items and content more relevant, to compile segments, or to measure the effectiveness of our services and marketing.

When personalization or profiling is based on non-necessary cookies or similar technologies, we only do this with your consent. You can withdraw this consent via the cookie settings.

Based on the profiling described here, we do not make decisions based solely on automated processing that have legal effects for you or similarly significantly affect you, unless we inform you of this separately and a valid legal basis exists for this.

Segments, profiles and derived preferences may be transferred as part of a transfer of our business, to the extent they are necessary for the continuation of the services and the original legal basis continues to exist. Profiles based on your cookie consent will only be used again by the acquiring party after you have given it consent again as described in article 10.

13. How long do we retain personal data?

We do not retain personal data longer than necessary for the purpose for which it was collected, unless we must retain data longer due to a legal obligation, a dispute or the protection of rights.

As a starting point, we use the following retention periods or criteria:

Category	Retention period or criterion
Account data	As long as your account is active. If you delete your account, we delete or anonymize the account data within 30 days. If your account has not been used for 36 months, we send you an email; if you do not respond within 30 days, we delete or anonymize your account. Longer retention only takes place when this is necessary for orders, legal obligations, fraud investigations or disputes
Order, payment, invoice and administration data	As long as necessary for performance and thereafter for the applicable tax and administrative retention periods, in principle seven years. For data falling under the Union or Import scheme for VAT, a period of ten years may apply
Return, warranty and complaint data	As long as necessary for handling and thereafter for as long as a claim or dispute may reasonably arise or continue
Customer service and correspondence	As long as necessary for handling the request and thereafter for a reasonable period for quality control, follow-up and any disputes
Newsletter and marketing data	Until you withdraw your consent or unsubscribe. We may retain limited data about your unsubscribe to prevent you from being contacted again and to demonstrate compliance
Security, fraud and log data	As long as necessary for security, investigation and protection of rights, taking into account the nature and severity of the risk or incident
Cookie and analytics data	According to the periods in the cookie statement and your cookie settings
Data for a business transaction	As long as necessary for preparation, assessment, execution and settlement of the transaction. If the transaction does not proceed, personal data is deleted, returned or anonymized as soon as it is no longer necessary, subject to a statutory retention obligation. Documentation we retain to demonstrate the course of the negotiations does not contain personal data of customers
Data after a transfer of the business	The acquiring party continues the retention periods set out in this table, unless it informs you of a change and has a valid legal basis for this. Data that we ourselves must continue to retain, we retain according to the statutory periods mentioned above and use exclusively for administrative, tax and legal purposes

After expiry of the applicable period, we delete or anonymize the data.

14. How do we secure personal data?

We take appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, disclosure and alteration. Depending on the risks, these measures include, among other things:

access restrictions and authorization management;
secure connections and encryption where appropriate;
logging, monitoring and incident response;
security agreements with suppliers;
periodic assessment and improvement of security measures;
measures to support availability and recovery of systems.

No method of storage or transmission is completely risk-free. If you suspect misuse or a security problem, please contact us as soon as possible at privacy@winkelstraat.nl.

15. What privacy rights do you have?

Depending on the circumstances, you have the right to:

obtain access to your personal data;
have incorrect or incomplete data corrected;
have your personal data deleted;
have the processing restricted;
object to processing based on a legitimate interest, including the transfer of your data in the context of a business transaction;
object to direct marketing; in the case of direct marketing, we stop the relevant processing;
receive personal data that you have provided to us in a structured, commonly used and machine-readable format, or have it transferred, when the right to data portability applies;
withdraw your consent at any time;
receive information about appropriate safeguards for international transfers;
not be subjected to certain decisions based solely on automated processing that have legal effects or similarly significant effects.

You can submit a request via privacy@winkelstraat.nl. Please clearly state which right and which personal data your request relates to.

We may request additional information to verify your identity. We do not request more information than is necessary for this. We respond in principle within one month. In the case of complex or multiple requests, this period may be extended in accordance with the law; we will inform you of this in good time.

A privacy request is in principle free of charge. In the case of manifestly unfounded or excessive requests, we may, within the legal limits, charge a reasonable fee or refuse the request.

16. Right to object based on legitimate interest

When we process personal data based on a legitimate interest, you can object to that processing because of your specific situation. This also applies to the processing and transfer of personal data in the context of a business transaction as described in article 7.

After an objection, we stop the relevant processing, unless we can demonstrate compelling legitimate grounds that outweigh your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defense of legal claims.

You can always object to processing for direct marketing. In that case, we stop using your personal data for that purpose.

17. Complaints

Do you have a complaint about the way we handle your personal data? Please contact us first at privacy@winkelstraat.nl, so that we can look for a solution.

You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority):

Autoriteit Persoonsgegevens
Website: www.autoriteitpersoonsgegevens.nl

If you live in another country of the European Economic Area, you can also contact the privacy supervisory authority in that country.

18. Children

Our services are not intended to be used independently by children under the age of sixteen. We do not knowingly collect personal data from children under the age of sixteen without the consent of a parent or legal representative when that consent is legally required.

Do you think we are processing a child's personal data without valid consent? Please contact us at privacy@winkelstraat.nl.

19. Changes to this privacy statement

We may amend this privacy statement when our services, business operations or legislation change. The date this statement was last updated is stated at the top of this statement.

In the case of important changes, we will inform you in an appropriate and prominent manner, for example via our website, your account or by email. When consent is required for a new processing activity, we will ask for that consent before we begin the processing.

A change to this privacy statement does not give us a new legal basis for processing that has already taken place.

20. Contact

Do you have questions about this privacy statement or about the processing of your personal data? Please contact us: