Privacy Policy

This Privacy Policy explains how GPAX collects, uses, and protects your personal data when you visit or place an order through our website. We treat your data confidentially and process it only in accordance with this policy and applicable data protection law, including the General Data Protection Regulation (GDPR).

Who We Are GPAX is operated by GPAX, a Dutch general partnership (Vennootschap Onder Firma), registered in the Netherlands under Chamber of Commerce (KvK) number 94397287, with its registered address at Lindberghstraat 22 d, 7903 BN Hoogeveen, the Netherlands. For any questions about this policy or your personal data, contact us at hello@gpax.co. For the purposes of the GDPR, we are the controller of your personal data.

Data We Collect When you browse our site as a guest, we collect limited usage data only. When you create an account or place an order, we collect the information needed to identify you and fulfil your order, including your name, email address, telephone number, and shipping and billing address. We also collect usage data automatically, such as your IP address, browser type, the pages you visit, and the date and time of your visit, through cookies and similar technologies. We do not store or collect your payment card details; these are handled directly by our payment processors.

How We Use Your Data We use your personal data to provide our services, including processing and delivering your orders, responding to your questions, maintaining your shopping cart, and carrying out security and verification checks on payments. We also use it to manage your account, to improve and analyse our website, and to comply with our legal obligations. Where you are an existing customer or have given consent, we may send you news, special offers, and promotions by email; you can unsubscribe at any time through the link in any marketing email.

Legal Basis for Processing If you are in the European Economic Area, our legal basis for processing your personal data depends on the data concerned and the context. We process data because it is necessary to perform our contract with you, because you have given consent, because processing is in our legitimate interests and not overridden by your rights, in order to process payments, and to comply with the law.

Cookies We use cookies and similar tracking technologies to operate our site, remember your preferences, maintain security, and analyse how our site is used. You can set your browser to refuse some or all cookies, but parts of our site may then not function properly.

Sharing Your Data We share your personal data only with service providers who process it on our behalf to help us run our business, and they may not use it for any other purpose. These include our e-commerce platform (Shopify), our fulfillment and shipping partners, our payment processors, and analytics providers such as Google Analytics. We may also disclose your data where required by law, in response to a lawful request by a public authority, or to protect our rights, property, or the safety of others. If GPAX is involved in a merger, acquisition, or sale of assets, your data may be transferred, and we will notify you beforehand.

International Transfers As our products are shipped internationally and our service providers may be located outside your country, your personal data may be transferred to and processed in countries with different data protection laws. Where this happens, we take reasonable steps to ensure appropriate safeguards are in place.

Data Retention We retain your personal data only for as long as necessary for the purposes set out in this policy, including to comply with our legal obligations, resolve disputes, and enforce our agreements. Usage data is generally kept for a shorter period unless needed for security or to meet legal requirements.

Your Rights If you are resident in the European Economic Area, you have the right to access, correct, update, or request deletion of the personal data we hold about you. You also have the right to object to or restrict our processing, the right to data portability, and the right to withdraw consent at any time where we rely on it. To exercise any of these rights, contact us at hello@gpax.co; we may ask you to verify your identity first. You also have the right to lodge a complaint with your local data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens.

Data Security The security of your data matters to us, and we use commercially reasonable measures to protect it. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

Children Our service is not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

Changes to This Policy We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date, and where appropriate we will notify you by email or a notice on our site. We encourage you to review this page periodically.

By using our website, you acknowledge that you have read and understood this Privacy Policy.