Privacy Policy

Last updated: 16 May 2026

ROVESS ("we", "our", "us") is committed to protecting your privacy. This policy explains what data we collect, why we collect it, and how we use it.

1. Who are we?

ROVESS is an online clothing store, operated from the Netherlands. You can reach us at [email protected].

We collect only the data necessary to fulfil your order and improve your experience:

Account data: name, email address, and an encrypted password when you register.
Order data: delivery address, order contents, and payment reference.
Reviews: your name and the text of any review you submit.
Cart data: products you add to your cart, stored temporarily to prevent loss.

To process and ship your orders (legal basis: contract performance).
To provide you with an account and order history (legal basis: contract performance).
To send transactional emails such as order confirmations (legal basis: contract performance).
To improve our store based on aggregated, anonymous analytics (legal basis: legitimate interest).

We do not sell your data. We share it only where necessary:

Account data — kept as long as your account is active. Deleted within 30 days of an account deletion request.
Order data — kept for 7 years to comply with Dutch tax law (Belastingdienst).
Cart data — stored temporarily in your browser (localStorage); cleared automatically after 90 days of inactivity.
Review data — kept as long as your account is active or until you request removal.
Analytics data — anonymised after 14 months (if Google Analytics is active).
Email logs — kept for 90 days for troubleshooting purposes.

We use cookies in three categories:

Essential — required for the shop to work (session, cart, login). Always active.
Analytics — help us understand how visitors use the site. Only active if you accept analytics cookies.
Marketing — personalised content. Only active if you explicitly accept marketing cookies.

You can change your cookie preferences at any time by clearing your browser storage and revisiting the site.

Under the GDPR you have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Request deletion of your data ("right to be forgotten").
Object to processing or request restriction.
Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

To exercise any right, email us at [email protected]. We will respond within 30 days.

We take appropriate technical measures to protect your data, including encrypted password storage (bcrypt) and HTTPS-only connections in production.

We may update this policy from time to time. The "Last updated" date at the top of this page will always reflect the most recent version.