Privacy policy

This Privacy Policy explains what personal data we collect when you visit this website or buy from us, why we collect it, who we share it with, how long we keep it, and what rights you have over it. We have tried to write it in plain language rather than legal shorthand.

1. Who We Are

Netto is a brand of Peaksta B.V., a private limited liability company (besloten vennootschap) incorporated under the laws of the Netherlands. Peaksta B.V. is the data controller responsible for the personal data described in this policy.

Because Netto and Peaksta are operated by the same legal entity, the data practices described here are consistent across both brands. Where you have bought from both, your data is handled by the same controller under the same standards.

You can contact us about anything in this policy at hello@nettoculture.com.

2. Quick Summary

The short version, for those who want it:

• We collect what we need to take your order, deliver it, support you afterwards, and run the website.
• We do not sell your personal data.
• We use cookies for essential site function, analytics, and advertising. You can refuse everything except the strictly necessary ones.
• Marketing emails are opt in, and every one has an unsubscribe link.
• We keep order records for 7 years because Dutch tax law requires it. Most other data is kept for much less.
• You have rights over your data, including access, correction, deletion, and objection. Section 10 explains how to use them.

The rest of this policy sets out the detail behind each of these points.

3. Information We Collect

3.1 Information You Provide Directly

• Order and contact details: name, email address, billing address, delivery address, and telephone number where you provide one.
• Payment information: processed by our payment providers. We receive confirmation of payment, the payment method type, and the last four digits of a card. We never see or store your full card number or security code.
• Account details: where you create an account, your login credentials in encrypted form, saved addresses, and order history.
• Customer support correspondence: the content of emails and messages you send us, including any photographs you attach to a return or guarantee claim.
• Reviews and submissions: anything you choose to publish, such as a product review or a photograph.
• Marketing preferences: whether you have subscribed, and to which channels.

3.2 Information Collected Automatically

• Device and browser information: device type, operating system, browser, screen resolution, and language setting.
• Network information: IP address and approximate location derived from it, usually no more precise than city level.
• Usage information: pages viewed, products viewed, time spent, referring website, search terms used on the site, items added to cart, and checkout steps completed or abandoned.
• Cookie identifiers: see section 6.

3.3 Information from Third Parties

• Payment and fraud providers: payment confirmation, chargeback notifications, and fraud risk indicators.
• Shipping carriers: delivery status, tracking events, and delivery confirmation.
• Advertising and analytics platforms: aggregated campaign performance and, where you have consented, information about how you reached our site.
• Social platforms: where you interact with us publicly or contact us through a social channel, the information that platform makes visible to us.

3.4 Sensitive Personal Information

We do not seek to collect special category data as defined by the General Data Protection Regulation, meaning data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation.

We sell sunglasses, not prescription eyewear, and we do not collect optical prescriptions or any other health information. Please do not send us health information in support correspondence. If you do, we will delete it once the matter is resolved.

4. How We Use Your Information

4.1 To Provide Our Services and Fulfil Your Orders

To take payment, dispatch your order, keep you informed of its progress, handle returns and refunds, assess and honour guarantee claims, and answer your questions. The legal basis is performance of our contract with you.

4.2 To Run, Improve, and Secure Our Website

To keep the site working, diagnose faults, understand which pages and products people find useful, test improvements, and detect and prevent fraud, abuse of our return policy, and attacks on our systems. The legal basis is our legitimate interest in operating a secure and functional store, balanced against your interests.

4.3 To Market and Advertise Our Products

To send you marketing where you have subscribed, to show advertising on other platforms, and to measure whether that advertising works. The legal basis is your consent for email and SMS marketing and for advertising cookies, and our legitimate interest for marketing to existing customers about similar products, which you can object to at any time.

4.4 To Comply With Legal Obligations

To keep accounting and tax records, to respond to lawful requests from authorities, to handle consumer law claims, and to establish, exercise, or defend legal claims. The legal basis is compliance with a legal obligation and, where relevant, our legitimate interest in defending claims.

5. Who We Share Your Information With

5.1 Business Partners

We share personal data with service providers who process it on our behalf, under contract, and only on our instructions. These fall into the following categories:

• Ecommerce platform and hosting
• Payment processing and fraud prevention
• Warehousing and order fulfilment
• Shipping carriers and delivery tracking
• Email and SMS marketing platforms
• Customer support tooling
• Analytics and advertising platforms
• Review collection platforms
• Accounting and professional advisers

We do not sell your personal data, and we do not share it with third parties for their own independent marketing purposes.

5.2 Legal and Safety Disclosures

We may disclose personal data where we are required to by law, where we receive a valid request from a public authority, where necessary to enforce our Terms of Service, or where necessary to protect our rights, property, or safety, or those of our customers or the public. We assess each request and disclose only what is necessary.

5.3 Business Transfers

If Peaksta B.V. is involved in a merger, acquisition, restructuring, or sale of assets, personal data may be transferred as part of that transaction. We will notify you and any acquirer will remain bound by this policy or a policy no less protective of your rights.

6. Cookies and Tracking Technologies

6.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. Similar technologies include pixels, tags, local storage, and software development kits. We use the word "cookies" in this section to cover all of them.

6.2 Why We Use Cookies

To keep you logged in, remember your cart between visits, remember your language and currency, understand how the site is used so we can improve it, and where you consent, to measure and target advertising.

6.3 Categories of Cookies We Use

• Strictly necessary. Required for the site to function, including cart, checkout, security, and fraud prevention. These cannot be switched off and do not require consent.
• Performance and analytics. Tell us which pages are visited and where people encounter problems, in aggregate. Set only with your consent.
• Functional. Remember preferences such as language, currency, and recently viewed products. Set only with your consent.
• Marketing and advertising. Used to show relevant advertising on other sites and to measure campaigns. Set only with your consent.

6.4 First-Party and Third-Party Cookies

First party cookies are set by this website. Third party cookies are set by our analytics and advertising partners and may allow them to recognise your device across other websites. Those partners process data under their own privacy policies as well as our instructions.

6.5 Managing Your Cookie Preferences

You can set your preferences through the cookie banner when you first visit, and change them at any time through the cookie settings link on the site. You can also block or delete cookies through your browser settings, though blocking strictly necessary cookies will prevent checkout from working.

6.6 Do Not Track and Global Privacy Control

Where your browser sends a Global Privacy Control signal and you are in a jurisdiction that recognises it, we treat that as a valid request to opt out of the sale or sharing of personal data and of targeted advertising for that browser. We do not currently respond to older Do Not Track headers, which lack a common standard.

6.7 How Long Cookies Last

Session cookies are deleted when you close your browser. Persistent cookies remain for a defined period, typically between 30 days and 24 months depending on their purpose, unless you delete them sooner. Analytics identifiers are retained for no more than 26 months.

7. Marketing Communications

7.1 Email Marketing

We send marketing email only where you have subscribed, or where you have bought from us and we are contacting you about similar products, as permitted by law. Every marketing email contains an unsubscribe link that takes effect immediately. Unsubscribing does not stop transactional email such as order confirmations and shipping notifications, which are necessary to perform our contract with you.

7.2 SMS and Text Marketing

Where we offer SMS marketing, it is strictly opt in and separate from email consent. You can stop it at any time by replying STOP. Message and data rates set by your mobile operator may apply.

7.3 Push Notifications and In-App Messages

Where offered, push notifications require permission from your device and can be revoked at any time in your device or browser settings.

7.4 Advertising

Where you consent to advertising cookies, we may show you advertising on social platforms and across the web, including advertising based on products you have viewed. We may share hashed identifiers such as an email address with advertising platforms to build audiences or to exclude existing customers from acquisition campaigns. You can opt out through our cookie settings and through the privacy settings of the relevant platform.

8. International Data Transfers

We are based in the Netherlands and most processing takes place within the European Economic Area. Some of our service providers operate outside it, including in the United States.

Where personal data is transferred outside the EEA or the United Kingdom, we rely on a lawful transfer mechanism, which is either an adequacy decision by the European Commission covering the destination country, or Standard Contractual Clauses approved by the European Commission together with any supplementary measures the transfer requires. You may request a copy of the safeguards applied by contacting us.

9. Your Rights and Choices

9.1 Rights Available Across Most Jurisdictions

• Access. Ask what personal data we hold about you and receive a copy.
• Correction. Ask us to correct data that is inaccurate or incomplete.
• Deletion. Ask us to delete data we no longer have a lawful basis to keep.
• Marketing opt out. Withdraw consent to marketing at any time.

9.2 Additional Rights for EU and UK Residents

Under the General Data Protection Regulation and the UK GDPR you also have:

• Right to object. Object to processing based on legitimate interests, including profiling, and to direct marketing at any time.
• Right to restrict processing. Ask us to pause processing while a dispute about accuracy or lawfulness is resolved.
• Right to data portability. Receive the data you gave us in a structured, commonly used, machine readable format, and have it transmitted to another controller where technically feasible.
• Right to withdraw consent. Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint. Complain to your national supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl.

9.3 Additional Rights for California Residents

Under the California Consumer Privacy Act as amended, California residents have rights to know, delete, correct, and to opt out of the sale or sharing of personal information and of targeted advertising, together with a right not to be discriminated against for exercising them. We do not sell personal information for money. Where advertising cookies are used, this may constitute "sharing" under that law, and you can opt out through our cookie settings.

9.4 Rights for Other United States Residents

Residents of other states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, and Texas, have broadly equivalent rights of access, correction, deletion, portability, and opt out of targeted advertising, together with a right to appeal a refused request. Contact us and we will apply the rights available in your state.

9.5 Rights in Other Jurisdictions

Where you are resident elsewhere, including Singapore, Malaysia, the Philippines, Australia, and Canada, we will honour the rights available to you under your local data protection law. Where we are unsure which regime applies, we default to the GDPR standard, which is generally the most protective.

10. How to Exercise Your Rights

Email hello@nettoculture.com with the request you want to make. To protect your data we may ask you to verify your identity, usually by confirming details of a recent order, and we will not ask for more information than is needed to do so.

We respond within one month. Where a request is complex or you have made several, we may extend by a further two months and will tell you if so. Requests are free unless manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline, and will explain why.

You may use an authorised agent, in which case we will require proof of authorisation and may still verify your identity directly.

11. Data Retention

We keep personal data only as long as we need it for the purpose it was collected, or as long as the law requires.

• Order and transaction records: 7 years from the end of the financial year, as required by Dutch tax law.
• Account information: for as long as your account is open, then deleted or anonymised on closure, subject to the order record above.
• Customer support correspondence: 3 years from the last contact.
• Guarantee claim records: retained for the life of the guarantee, since the claim history is what allows us to honour it.
• Marketing subscriber data: until you unsubscribe, plus a suppression record kept indefinitely so we do not contact you again by mistake.
• Analytics data: up to 26 months.
• Cookie data: as set out in section 6.7.

Where data is no longer needed we delete it or irreversibly anonymise it, in which case it is no longer personal data and may be retained in aggregate.

12. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls limiting staff access to what their role requires, use of vetted processors under contract, and payment handling through PCI DSS compliant providers so that card data never reaches our systems.

No system is perfectly secure, and we cannot guarantee absolute security. Please use a strong, unique password if you create an account, and do not send confidential information such as full card details by email. If we become aware of a breach likely to result in a risk to your rights, we will notify the supervisory authority and, where the risk is high, you directly, within the timeframes the law requires.

13. Children's Privacy

This store is not directed at children and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it. Orders may only be placed by adults, as set out in our Terms of Service.

14. Third-Party Websites and Links

Our site links to third party websites and embeds third party content. We are not responsible for their privacy practices, and this policy does not apply to them. Please read their privacy policies before providing them with personal data.

15. Automated Decision-Making

We use automated fraud screening at checkout, which may flag or decline an order based on risk indicators such as address mismatch or unusual ordering patterns. This is necessary to enter into and perform our contract with you and to prevent fraud.

We do not carry out automated decision making that produces legal effects concerning you or similarly significantly affects you, beyond this fraud screening. Where an order is declined by automated screening you may contact us for human review, and we will look at it manually and explain the outcome.

16. Changes to This Policy

We may update this policy to reflect changes in our practices, our service providers, or the law. The current version is always on this page with the date it was last updated. Where a change materially affects your rights, we will give you notice by email or a prominent notice on the site before it takes effect.

17. Contact Us

For questions about this policy, to exercise your rights, or to raise a concern about how we handle your data:

Netto, a brand of Peaksta B.V.
Data controller: Peaksta B.V., Netherlands
Email: hello@nettoculture.com

We respond to most enquiries within 24 hours on business days, and to formal data rights requests within one month.

If you are not satisfied with our response, you have the right to complain to your national data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

This policy was last updated on 2 August 2026.