Privacy Policy

Last updated: August 2026

---

1. General

This privacy policy describes how Myra & Mush collects and processes personal data about you.

This policy applies to personal information you provide to us or that we collect through the Myra & Mush website, www.myramush.nl (and www.myramush.com).

Myra & Mush is the data controller for your personal data. Questions? Contact us via the details in section 9.

---

2. Personal Data We Collect

When you visit our website, we automatically collect technical information such as your browser type, IP address, search terms, and device information — to improve your shopping experience.

When you place an order, we collect your name, address, email address, and phone number, as well as information about your purchases and any returns, to fulfill your order and meet our accounting obligations.

When creating a profile or making a purchase, you may opt in to receive our newsletter. You can unsubscribe at any time via the link at the bottom of any marketing email.

---

3. Legal Basis for Processing

We process your personal data on the following legal bases:

• Contract performance — to process and fulfill your orders (Art. 6(1)(b) GDPR)
• Legal obligation — to comply with accounting and consumer law requirements (Art. 6(1)(c) GDPR)
• Consent — to send you marketing emails, SMS, or newsletters (Art. 6(1)(a) GDPR). You may withdraw consent at any time.
• Legitimate interest — to improve our website, analyze traffic, and prevent fraud (Art. 6(1)(f) GDPR), where this does not override your rights

---

4. Use of Personal Data

We use your personal data for:

• Processing orders in our online store
• Sending newsletters and marketing materials (with your consent)
• Managing your user account
• Collecting and displaying customer reviews
• Statistical analysis and website improvement
• Compliance with legal obligations

We maintain aggregated, anonymized statistics about website usage and product preferences. This data does not contain personal data and is not shared or sold to third parties.

---

5. Third-Party Processors

To operate our store, we share your data with trusted third-party service providers who process data on our behalf. These include:

All processors outside the EEA are bound by Standard Contractual Clauses (SCCs) as approved by the European Commission, ensuring an adequate level of data protection.

We do not sell your personal data to third parties.

---

6. International Data Transfers

Some of our service providers are based outside the European Economic Area (EEA), including in the United States. Where we transfer your personal data outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) pursuant to Article 46 GDPR. You may request a copy of the applicable safeguards by contacting us at hello@myramush.com.

---

7. Cookies & Tracking

Myra & Mush uses cookies to optimize your experience, analyze traffic, and enable targeted marketing.

Types of cookies we use:

• Strictly necessary cookies — required for the website to function. These do not require your consent.
• Analytical cookies — help us understand how visitors use our site (e.g., Google Analytics). These are only placed with your consent.
• Marketing cookies — used for targeted advertising and retargeting. These are only placed with your consent.

When you first visit our website, you will be asked for your consent to place non-essential cookies via our cookie banner. You can withdraw or adjust your consent at any time through the cookie settings link in the footer of our website.

You can also disable cookies in your browser settings, though this may affect website functionality.

---

8. Your Rights

Under GDPR, you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your data, subject to legal retention obligations
• Right to restriction — request that we limit processing of your data
• Right to data portability — receive your personal data in a structured, machine-readable format (e.g., CSV or JSON) and transfer it to another controller
• Right to object — object to processing based on legitimate interest, including for direct marketing
• Right to withdraw consent — withdraw consent for marketing at any time, without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at hello@myramush.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): Bezuidenhoutseweg 30, 2594 AV The Hague, Netherlands www.autoriteitpersoonsgegevens.nl

---

9. Retention of Personal Data

We retain your personal data for as long as necessary for the purposes described in this policy:

• Order data — retained for 7 years to comply with Dutch accounting law (Boekhouding)
• Marketing data — retained until you withdraw consent
• Account data — deleted after 1 year of inactivity
• Review data — retained as long as the review is published

---

10. Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or disclosure. Access to personal data is restricted to employees who require it to perform their duties.

---

11. Contact

Myra & Mush is the data controller responsible for personal data collected through our website.

Email: hello@myramush.com Address: Gedempte Gracht 403K, 2512AM The Hague, The Netherlands

---

12. Changes to This Policy

We reserve the right to update this policy at any time. Material changes will be communicated via a notice on our website. The date at the top of this policy reflects the most recent update.