Privacy policy
Last updated: 19 October 2026 (previous version: 1 October 2026)
Purple Race Labs B.V. ("Purple Race Labs", "we", "our", "us") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains what data we collect, how we use it, and the rights you have.
Article 1. Who we are
Purple Race Labs B.V.
Handelskade Noord 1,
7547 AV Enschede
The Netherlands
Email: contact@purpleracelabs.nl
We act as the data controller for personal data collected through our website.
Article 2. What data we collect
We collect only the data necessary to provide our services.
a) Information you provide directly
- Name
- Address
- Email address
- Payment details (processed securely by third-party processors, not stored by us)
- Order history
- Support communications
b) Data collected automatically
- IP address
- Device type and browser information
- Website usage data (cookies; analytics)
c) Optional data
- Newsletter subscription preferences
- Feedback or reviews
Article 3. How we use your data
We use your data for:
- Processing and delivering orders
- Providing customer support
- Handling warranty or return requests
- Improving our website and products
- Preventing fraud and ensuring security
- Sending optional marketing emails (only with your consent)
- Legal and compliance obligations (tax, bookkeeping)
We do not sell personal data. We only disclose personal data to third parties where this is necessary for the purposes listed above, and only to the recipients and on the legal bases described in Article 4 and Article 5.
Article 4. Legal basis for Processing (EU GDPR)
We process your data under one or more of the following legal bases:
- Performance of a contract (e.g., shipping your order)
- Compliance with legal obligations
- Legitimate interests (e.g., fraud prevention, IT security)
- Your consent (e.g., newsletter signup, optional cookies)
Article 5. Sharing your data
We only disclose your data to the following recipients, and only where this is necessary for the purposes described in Article 3:
- Shopify International Limited (Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, Ireland) – operation of our online shop, checkout and order processing (processor under Art. 28 GDPR)
- Shopify Payments (provided by Shopify International Limited together with its licensed payment partners) – processing of card and other payments made via Shopify Payments
- PayPal (Europe) S.à r.l. et Cie, S.C.A. (22–24 Boulevard Royal, L-2449 Luxembourg) – processing of your payment if you choose PayPal; PayPal acts as an independent controller
- Shipping carriers: DHL, DHL Express and UPS – delivery of your order, depending on the shipping method selected (name, address, and email or phone number if needed for delivery notifications)
- Judge.me – display and collection of product reviews
- IT and customer service tools, professional advisers (legal, tax, accounting), and authorities where we are legally required to do so
All service providers act on our behalf under data processing agreements, unless they are independent controllers (e.g. payment providers, carriers or authorities).
Transfers outside the EU/EEA: Shopify International Limited may transfer data to Shopify Inc. (Canada) and to sub-processors in other countries, including the USA. Canada is covered by an adequacy decision of the European Commission (Art. 45 GDPR). For the USA, transfers are based on the EU-U.S. Data Privacy Framework, where the recipient is certified, or on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). We do not transfer your data outside the EU/EEA for any other purpose. You can request a copy of these safeguards via privacy@purpleracelabs.nl.
Article 6. Cookies
Cookies are small text files that are stored on your device. When you first visit our shop, a cookie banner informs you about the cookies used. Strictly necessary cookies are set without consent (Art. 6(1)(f) GDPR; Art. 11.7a Dutch Telecommunications Act; Section 25(2) German TDDDG). All other cookies are only set after you have given your consent (Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time with effect for the future via "Cookie preferences" in the footer of the shop. Further information is available in our Legal Notice (https://purpleracelabs.com/legal-notice/) and our Cookie Policy (https://purpleracelabs.com/cookie-policy/).
Strictly necessary cookies (provider: Shopify)
- _shopify_essential – keeps your session, cart and checkout working – 1 year
- cart_currency – stores the currency of your cart – 14 days
- localization – stores your country and language – 1 year
- _tracking_consent – stores your cookie choice – 1 year
- keep_alive – keeps your session active during checkout – 30 minutes
Analytics cookies (only with consent)
- _shopify_analytics, _shopify_y, _shopify_s – Shopify – statistics on how our shop is used – up to 1 year / 30 minutes
- Judge.me – statistics on the use of the review widget – as stated in Judge.me's privacy policy
Marketing cookies (only with consent)
- _shopify_marketing – Shopify – measuring the effect of marketing activities – 1 year
Article 7. Data retention
We retain data only as long as necessary:
- Order data: up to 7 years (Dutch tax retention requirement under Dutch Tax Decree 2021)
- Customer support data: up to 3 years (Dutch civil law limitation period)
- Marketing data: until you unsubscribe
- Cookies: as stated in Article 6
Article 8. Your rights
Under GDPR, you have the right to:
- Access your data
- Correct your data
- Delete your data ("right to be forgotten")
- Restrict processing
- Data portability
- Object to processing
- Withdraw consent at any time
- File a complaint with your local data authority
To exercise these rights, please contact us at: privacy@purpleracelabs.nl
Article 9. Children's privacy
Our products and website are not intended for children under 16. We do not knowingly collect children's data.
Article 10. Data security
We use technical and organizational measures to protect your data, including:
- Encrypted website traffic (HTTPS)
- Secure payment processing via certified providers
- Access restrictions
- Regular monitoring and updates
Article 11. Changes to this policy
We may update this Privacy Policy in accordance with Article 15 of our General Terms and Conditions. For material changes — in particular changes that affect the purposes for which we process your personal data or the legal basis for processing — we will notify you in advance by email. Changes that introduce new processing purposes or alter the legal basis for processing require your separate, active consent under the GDPR; a contractual change notification does not substitute for that consent. The updated version will always indicate the "last updated" date and will be made available on our website.