Privacy Policy

Last updated: 24 September 2026

TOLS Clothing (“TOLS”, “we”, “us” or “our”) operates the websites tols.store and talesofalostspecies.com (together, the “Site”). We are a sole proprietorship based in the Netherlands. This Privacy Policy explains how we collect, use and share your personal data when you visit or buy from the Site, in accordance with the EU General Data Protection Regulation (GDPR) and Dutch privacy law.

1. Who Is Responsible for Your Data

TOLS Clothing is the data controller for the personal data collected through the Site. Our business details are listed in our Terms and Conditions.

We have not appointed a Data Protection Officer (DPO). For any privacy question or request, please contact us through our contact form: contact us here

2. Personal Data We Collect

a. Device information

•       Examples: browser type, IP address, time zone, cookies, pages viewed, search terms and interactions with the Site.

•       Purpose: to make the Site work properly and, with your consent, to analyse usage and show relevant advertising.

•       Source: collected automatically using cookies, log files, tags and pixels.

•       Shared with: Shopify and, only if you consent, Google Analytics and our advertising partners (Meta, TikTok and Google Ads).

b. Order information

•       Examples: name, billing and shipping address, email address, phone number and payment information.

•       Purpose: to process and deliver your order, handle payments, returns and withdrawals, and send you order and shipping updates.

•       Source: provided by you at checkout.

•       Shared with: Shopify (our e-commerce platform), our production partner, our carriers and the payment service provider you choose at checkout. Payment details are processed by the payment service provider; TOLS does not store or have access to your full card details.

c. Withdrawal requests

•       Examples: name, order number, email address and the date and time of your withdrawal.

•       Purpose: to process your withdrawal and send you a confirmation of receipt, as required by law.

•       Source: provided by you through the withdrawal button on our Site or through our contact form.

d. Customer support information

•       Examples: order details, email conversations and enquiries.

•       Purpose: to help you, resolve issues and improve our service.

•       Source: provided by you through our contact form or in replies to our emails.

e. Newsletter and email marketing

•       Examples: email address, name (if provided) and whether you open or click our emails.

•       Purpose: to send you our newsletter and offers, only if you have signed up.

•       Source: provided by you when you subscribe.

•       Shared with: Klaviyo, our email marketing platform.

f. Information from third parties

We may receive information from advertising platforms and analytics providers about your interactions with our Site or marketing materials, where you have consented to this.

3. Legal Bases for Processing

You may withdraw your consent at any time, for example by changing your cookie settings or unsubscribing from our emails. Withdrawing consent does not affect processing that took place before. Where we rely on legitimate interest (such as fraud prevention), we have balanced our interests against your rights, and you may object to that processing at any time.

4. How Long We Keep Your Data

•       Order and withdrawal data: 7 years, to comply with Dutch tax law.

•       Customer support correspondence: up to 2 years.

•       Newsletter data: until you unsubscribe or withdraw your consent.

•       Analytics data: 14 months (the retention period configured in Google Analytics 4), after which it is deleted or anonymised.

After the applicable period, data is deleted or irreversibly anonymised.

5. Who We Share Your Data With

We only share your personal data where needed to run our business. Service providers that process data on our behalf (processors) are bound by data processing agreements under the GDPR.

•       Shopify (e-commerce platform)

•       StyriaShirts, a brand of Rogač d.o.o., Maribor, Slovenia (our production partner, which prints and ships your order)

•       Carriers that deliver your order

•       Payment service providers offered at checkout. Some payment providers, such as buy-now-pay-later services, process your data as independent controllers under their own privacy policies, for example to carry out credit checks.

•       Klaviyo (email marketing)

•       The provider of our withdrawal button app (processing withdrawal requests)

•       Google Analytics (site analytics, only with your consent)

•       Meta, TikTok and Google Ads (advertising, only with your consent). For data collected through their pixels, these platforms may act as joint or independent controllers.

We may also disclose your personal data:

•       to comply with legal obligations (for example, tax inspections or court orders);

•       to protect our legal rights and prevent fraud.

Third-party links

Our Site may contain links to third-party websites or services. We are not responsible for their privacy practices or content. Please review their policies before providing any data.

International transfers

Some of our service providers, including Shopify, Klaviyo, Google, Meta and TikTok, may process personal data outside the European Economic Area (EEA), for example in the United States or Canada. We only allow this where the transfer is protected by an adequacy decision of the European Commission (such as the decisions for Canada and the EU–US Data Privacy Framework, for US companies certified under it) or by the European Commission’s Standard Contractual Clauses.

For TikTok specifically: data may be transferred to TikTok entities outside the EEA, including the United States, and may be accessed from other countries where TikTok group companies operate. These transfers rely on the Standard Contractual Clauses. Given ongoing regulatory scrutiny of TikTok’s data flows by European data protection authorities, we periodically review this arrangement.

6. Behavioural Advertising

With your consent, we use cookies and pixels to show you relevant ads and to measure our campaigns. You can opt out at any time through our cookie banner or through:

•       Meta (Facebook/Instagram) ad settings

•       TikTok ad settings

•       Google ad settings and the Google Analytics opt-out browser add-on

•       YourOnlineChoices.eu (general opt-out for EEA users)

Advertising cookies are only activated after you have given consent through our cookie banner.

7. Cookies and Tracking

Our cookie banner lets you:

•       accept or reject non-essential cookies;

•       keep using the Site if you reject cookies;

•       change or withdraw your consent at any time through the banner or your browser settings.

Types of cookies we use:

•       Essential cookies: needed for the cart, checkout and login.

•       Analytics cookies: help us understand how visitors use the Site.

•       Marketing cookies: used to show relevant ads through platforms such as Meta, TikTok and Google.

Google Analytics 4 (GA4): GA4 always requires your explicit consent. It does not qualify for the exemption for limited analytics under Article 11.7a(3) of the Dutch Telecommunications Act, because Google also processes analytics data for its own purposes. GA4 only loads after you have accepted analytics cookies; no GA4 cookies or scripts are activated before that.

8. Automated Decision-Making

We use Shopify’s automated fraud detection tools to identify potentially fraudulent orders. These tools may flag an order for manual review. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Article 22 GDPR). If your order is affected by a fraud check, you may ask for a manual review.

9. Your Rights

You have the right to:

•       access the personal data we hold about you;

•       correct inaccurate or incomplete data;

•       have your data erased (“right to be forgotten”);

•       restrict or object to processing;

•       data portability;

•       withdraw your consent at any time;

•       lodge a complaint with a supervisory authority.

To exercise any of these rights, contact us. We will respond without undue delay and in any event within one month of receiving your request (Article 12(3) GDPR). For complex or numerous requests, we may extend this by two further months; we will tell you about the extension and the reasons within the first month. We may ask you to verify your identity, and if someone acts on your behalf, we may ask for proof of authorisation.

You can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): https://autoriteitpersoonsgegevens.nl

10. Children’s Privacy

Our Site is not intended for children under 16. In line with Article 5 of the Dutch GDPR Implementation Act (UAVG), 16 is the age from which a person can give consent without parental permission. We do not knowingly collect personal data from children under 16. If we become aware that we have done so, we will delete it promptly. If you are a parent or guardian and believe your child has given us personal data, please contact us.

11. Data Breaches

If a data breach is likely to put your rights and freedoms at risk, we will notify the Dutch Data Protection Authority within 72 hours of becoming aware of it. If the risk is high, we will also inform you without undue delay.

12. Security

We use technical and organisational measures, such as encryption and access controls, to protect your data. However, no method of online transmission is completely secure, so please do not send sensitive information through unencrypted channels.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our services or legal obligations. The “Last updated” date at the top shows the current version.

14. Contact Us

For questions about this Privacy Policy or your personal data, please contact us through our contact form: contact us here