Privacy Policy

Last updated: 2 July 2026

This privacy policy applies to all services of Thornby & Co, reachable at info@thornbyco.com and located at Kanaalstraat 229bs, 3531CJ, Utrecht, the Netherlands. We respect the privacy of our customers and treat the personal information you provide to us confidentially and in accordance with the General Data Protection Regulation (GDPR).

1. What data we collect

We collect personal data that you provide to us when placing an order, creating an account, or contacting our customer service, including:

•      Full name

•      Address and billing information

•      Email address

•      Phone number

•      Payment information (processed through our payment providers, not stored on our servers)

•      IP address and device/browser information

•      Order and transaction history

•      Information about your activity and behaviour on our website (via cookies)

2. Purposes of processing

•      Processing, shipping, and invoicing your orders.

•      Providing customer service and support.

•      Sending order updates, tracking information, and relevant information.

•      Improving our services, website, and product range.

•      Preventing and detecting fraud and abuse.

•      Sending marketing communications, only where you have given your consent.

3. Legal bases

We process your data on the basis of the performance of the contract (your order), your consent (for example, marketing), a legal obligation (such as tax recordkeeping), and our legitimate interest (such as fraud prevention and improving our services).

4. Sharing data with third parties

Your data is shared with third parties only to the extent necessary for our services, including:

•      Our payment providers: AMEX, Apple Pay, Google Pay, Mastercard, Dpay and VISA.

•      Our shipping and delivery partners: Royal Mail and Evri.

•      Our supplier(s) for the purpose of processing and shipping your order.

•      Providers of analytics and marketing services (where applicable and in accordance with your cookie preferences).

Where required, we have entered into data processing agreements with all of these parties. We never sell your data to third parties. Because part of our shipping takes place directly from a supplier outside the EEA (China), a transfer outside the EEA may occur; in such cases, we apply appropriate safeguards.

5. Retention period

We do not retain your data longer than necessary for the purposes for which it was collected, or as long as legally required (such as a 7-year tax retention obligation for recordkeeping).

6. Cookies

Our website uses cookies to improve functionality, analyse visitor behaviour, and support marketing. See our separate Cookie Policy for more information. You can adjust your preferences at any time via the cookie banner or your browser settings.

7. Security

We take appropriate technical and organisational measures to protect your data against loss, misuse, and unauthorised access. All payments are processed via a secure SSL connection.

8. Your rights (GDPR)

You have the right to access, correct, delete, or restrict your personal data. You may also object to the processing, withdraw your consent, and submit a request for data portability. To do so, please contact us at info@thornbyco.com. You also have the right to file a complaint with the supervisory authority (in the Netherlands: the Dutch Data Protection Authority, "Autoriteit Persoonsgegevens").