Privacy policy

Last updated: 15 July 2026

STACH respects your privacy and handles your personal data with care. This Privacy Policy explains what data we process, why we process it and what rights you have.

1. Who is responsible?

STACH B.V., located at Jan Pieter Heijestraat 141, 1054 MG Amsterdam, the Netherlands, and registered with the Dutch Chamber of Commerce under number 52390810, is the data controller responsible for the processing of personal data through stach-food.nl.

For privacy-related questions, please contact hello@stach-food.nl.

2. What data do we process?

  • Name, delivery address and place of residence: to deliver your order.
  • Email address and telephone number: for order confirmations, track & trace and customer service.
  • Payment status and transaction ID: payments are processed through our payment provider. We do not see or store your bank account or card details.
  • Order history: for customer service, handling returns and, with your consent, relevant offers.
  • Account details: if you create an account.
  • Email address: when you subscribe to our newsletter.
  • Technical data collected through cookies, such as your IP address, browser type and browsing behaviour. See our Cookie Policy for more information.

3. Why do we process your data and on what legal basis?

Performance of a contract: to process and deliver your order, handle payments and returns, and provide customer service (Article 6(1)(b) GDPR).

Legal obligation: to comply with the statutory seven-year retention period for financial records (Article 6(1)(c) GDPR).

Legitimate interests: for fraud prevention, security and limited marketing to existing customers about similar products (Article 6(1)(f) GDPR).

Consent: for newsletters, non-essential cookies and personalised advertising (Article 6(1)(a) GDPR). You can withdraw your consent at any time.

4. How long do we keep your data?

  • Order and invoice details: 7 years, in accordance with statutory tax retention requirements.
  • Account details: for as long as your account remains active. After your account is deleted, your data will be anonymised within 3 months, except for information we are legally required to retain for tax purposes.
  • Newsletter details: until you unsubscribe. Every newsletter contains an unsubscribe link.
  • Customer service correspondence: for a maximum of 2 years.

5. Who do we share your data with?

We only share your data with parties necessary to provide our services, each on the basis of a data processing agreement:

  • Shopify: webshop platform, payment processing (Shopify Payments), order confirmations and, if you opt in, newsletters.
  • PostNL: delivery of your order, including your name, address and email address for track & trace.
  • Accounting software provider / accountant: for financial administration.

We never sell your personal data. If your data is processed outside the European Economic Area (EEA), we ensure appropriate safeguards are in place in accordance with the GDPR.

6. Security

We protect your personal data using measures including SSL encryption, access controls and regular updates. We never store your payment details.

7. Your rights

You have the right to access, rectify or erase your personal data, restrict its processing, object to processing and request data portability. You can also withdraw your consent at any time.

Send your request to hello@stach-food.nl. We will respond within one month. We may ask you to provide additional information to verify your identity.

8. Complaints

If we are unable to resolve your concern, you have the right to submit a complaint to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

9. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The latest version will always be available at shop.stach-food.nl/en/policies/privacy-policy, together with the date it was last updated.