Datenschutzerklärung

Global privacy notice for the AVALAIR website, store and customer services
Last updated: 10 October 2026

Company details

Seller / data controller: LEVELUPSPORTS  trading as AVALAIR

Chamber of Commerce (KvK): 93358814

VAT ID: NL005019246B50

Email: info@avalair.store

Website: www.avalair.store

Return address: Please send an e-mail to info@avalair.store

1. Scope and who is responsible

This Privacy Policy explains how AVALAIR collects and uses personal data when you visit our website or online store, create an account, place an order, contact us, subscribe to marketing, interact with our content or otherwise use our services. It also explains your privacy rights.

For the purposes of the EU General Data Protection Regulation (GDPR) and, where applicable, similar privacy laws, the company identified above is the controller of the personal data described in this Policy. Shopify and other service providers may also act as processors or, for certain functions, as independent controllers under their own privacy notices.

This Policy does not replace the privacy notices of third parties that you choose to use, such as payment providers, social media platforms or external websites.

2. Personal data we collect

Category

Examples

Identity and contact data

Name, billing and delivery address, email address, telephone number and other contact details.

Order and transaction data

Products viewed or purchased, order history, returns, refunds, delivery status, discounts used and related transaction records.

Payment data

Payment method, payment status, transaction reference and limited payment information received from our payment providers. We do not normally receive or store your full payment-card number when payment is processed by Shopify or another payment provider.

Account data

Login and account identifiers, saved preferences, addresses, wish lists and account settings, if account functionality is available.

Customer-service data

Messages, support requests, warranty or product-safety enquiries, return information and any information you choose to provide to us.

Device and usage data

IP address, browser and device type, operating system, approximate location derived from IP, pages viewed, interaction data, referral information and similar technical information.

Marketing and preference data

Newsletter subscription status, communication preferences, campaign interactions and, where permitted, advertising preferences.

Reviews and content

Product reviews, ratings, photos, videos or other content you submit to us or publish through features we provide.

We ask you not to send us special-category or highly sensitive personal data unless it is genuinely necessary for a specific request and we have asked you to provide it.

3. How we collect personal data

·         Directly from you, for example when you place an order, create an account, join a mailing list, contact customer service or submit a return request.

·         Automatically when you use our website or store, through essential technologies and, where you have consented, analytics, advertising cookies and similar technologies.

·         From service providers and partners that support payments, fulfilment, delivery, fraud prevention, analytics, advertising, customer support and ecommerce operations.

·         From publicly available sources or business partners where permitted by law and relevant to fraud prevention, product safety, customer service or marketing.

4. Why we use personal data and our legal bases

Purpose

Data used

Legal basis

Process and deliver orders; take payment; provide order updates; handle returns and refunds

Identity/contact, order, transaction, limited payment data

Performance of a contract; steps requested before entering a contract

Customer service, complaints, warranty and statutory conformity rights

Identity/contact, order, customer-service data

Contract; legal obligations; legitimate interests in providing support and resolving claims

Product safety, recalls, traceability and regulatory compliance

Identity/contact, order and product data

Legal obligation; substantial public/safety interests where applicable

Accounting, tax, audit and record keeping

Order, transaction, invoice and contact data

Legal obligation

Fraud prevention, security and abuse detection

Identity/contact, payment status, device/usage and transaction data

Legitimate interests in protecting customers, our business and the integrity of our services; legal obligations where applicable

Operate, troubleshoot and improve our website and services

Device/usage data, service interactions, aggregated transaction data

Legitimate interests where the impact on your rights is limited; consent where required for cookies or similar technologies

Email/SMS marketing and launch updates

Contact and marketing-preference data

Consent where required; otherwise another lawful basis permitted by applicable electronic-marketing law. You can opt out at any time.

Personalised advertising / targeted advertising

Device/usage, identifiers, marketing interactions

Consent where required. In certain U.S. jurisdictions this may also constitute “sale”, “sharing” or targeted advertising and may be subject to an opt-out right.

Establish, exercise or defend legal claims

Relevant account, order, transaction and communications data

Legitimate interests; legal obligations

Where we rely on legitimate interests, we assess whether our interests are proportionate and whether your rights and freedoms require stronger protection. Where we rely on consent, you may withdraw it at any time without affecting processing that took place before withdrawal.

5. Cookies and similar technologies

We use technologies that are necessary for the operation of the store, such as shopping-cart, security and checkout functionality. We may also use analytics, personalisation and advertising technologies. Where consent is required, non-essential cookies and similar technologies are not activated until you make a valid choice.

You can manage your choices through COOKIE CONSENT. Withdrawing consent must be as easy as giving it. More detailed information about individual cookies, providers, purposes and retention periods should be kept in the cookie settings or a separate Cookie Policy.

6. Marketing communications

If you subscribe to AVALAIR marketing, we may send product launches, travel content, brand updates and related offers. You can unsubscribe at any time using the link in a marketing email or by contacting us. Opting out of marketing does not stop transactional or service messages about an order, return, safety notice or account.

We do not use pre-ticked boxes for newsletter consent. Where local law allows marketing to existing customers without separate consent, we will provide a clear opt-out and use that exception only within its legal limits.

7. How we share personal data

We may disclose personal data only where necessary for the purposes described above, including to the following categories of recipients:

·         Shopify and ecommerce infrastructure providers;

·         payment processors, banks and fraud-prevention providers;

·         warehouses, fulfilment providers, shipping carriers, customs brokers and logistics partners;

·         email, customer-service, review and communication providers;

·         analytics and advertising partners, but only subject to the consent and opt-out rules that apply to you;

·         IT, cloud-hosting, cybersecurity and professional advisers such as accountants, insurers and lawyers;

·         government, customs, tax, product-safety, law-enforcement or regulatory authorities where disclosure is required or legally justified;

·         a buyer, investor or successor in connection with a genuine corporate transaction, subject to appropriate confidentiality and legal safeguards.

We do not sell personal data for money. Certain advertising disclosures may nevertheless be defined as “sale” or “sharing” under some U.S. state privacy laws; where that applies, we provide the legally required opt-out mechanism.

8. International data transfers

Because we operate an international ecommerce business and use global service providers, personal data may be processed outside the Netherlands, the EEA, the United Kingdom or your country of residence. Where the GDPR or equivalent transfer rules apply, we use an approved transfer mechanism, such as an adequacy decision, the European Commission Standard Contractual Clauses, or another legally recognised safeguard. Where appropriate, we assess supplementary technical and organisational measures.

You may contact us for information about the relevant transfer safeguards, subject to legitimate confidentiality restrictions.

9. Data retention

Data / purpose

Retention approach

Orders, invoices and accounting records

Generally 7 years where Dutch fiscal law requires it; up to 10 years where a longer VAT/OSS/IOSS or other statutory period applies.

Customer account data

For as long as the account is active and thereafter only as long as reasonably necessary for legal, security and service purposes. AVALAIR should configure and document an inactivity/deletion period before publication.

Customer-service, return and warranty records

Generally up to 2 years after the request is closed, or longer where needed for statutory guarantee, limitation periods, product safety or a dispute.

Marketing subscription data

Until you unsubscribe or we stop the relevant marketing activity. We may retain a minimal suppression record afterwards so that we can respect your opt-out.

Cookie and advertising data

According to the periods shown in the cookie settings / cookie list and subject to consent requirements.

Security and fraud records

For as long as proportionate to investigate and prevent fraud, abuse or security incidents and to establish or defend legal claims.

We may retain information for longer if required by law, if a dispute or investigation is ongoing, or if necessary to establish, exercise or defend legal claims. When data is no longer required, we delete it, anonymise it or isolate it in accordance with our retention procedures.

10. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration or disclosure. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security. If we become aware of a personal-data breach, we will assess and notify regulators and affected individuals where required by law.

11. Your privacy rights

Depending on where you live and subject to legal conditions and exceptions, you may have rights to:

·         access personal data we hold about you;

·         correct inaccurate or incomplete data;

·         request deletion of data;

·         restrict certain processing;

·         object to processing based on legitimate interests and object at any time to direct marketing;

·         receive certain data in a portable format;

·         withdraw consent at any time where processing is based on consent;

·         lodge a complaint with a competent data-protection authority;

·         where applicable, opt out of sale, sharing or targeted advertising and appeal certain privacy-request decisions.

To exercise a right, contact us using the details above. We may need to verify your identity and authority before acting on a request. We will respond within the time required by applicable law and will not discriminate against you for exercising a privacy right.

For GDPR complaints, you may contact the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) or the supervisory authority in the EEA country where you live, work or believe an infringement occurred.

12. Automated decision-making

AVALAIR does not intend to make decisions based solely on automated processing that produce legal effects or similarly significant effects for customers, unless we tell you otherwise and provide the safeguards required by law. Automated fraud-screening tools may flag transactions for review, but material decisions should involve appropriate human review where required.

13. Children

Our store is not directed to children. We do not knowingly collect personal data from children for independent use of the store where parental consent or another legal basis would be required. If you believe a child has provided personal data to us unlawfully, please contact us.

14. Shopify and third-party services

Our ecommerce store is powered by Shopify. Shopify processes data to provide, secure and improve its platform and may process some information under its own privacy notice. Payment providers, shipping carriers and other partners may likewise process data under their own notices where they act as independent controllers. We encourage you to review those notices when you use those services.

15. Changes to this Policy

We may update this Policy to reflect changes in our business, technology, legal requirements or service providers. We will post the current version on our website, update the “Last updated” date and provide additional notice where legally required.

16. Contact

Privacy enquiries and rights requests: info@avalair.store

If you contact us about privacy, please include enough information for us to understand the request, but do not send sensitive identity documents unless we specifically ask for them through a secure channel.