Privacy Policy

1. Who is responsible for your information?

AlphaChain B.V., trading as Chemical Collective (“Chemical Collective”, “we”, “us”), is the controller for the personal data described in this policy. This policy covers our online shop, customer accounts and related services on chemical-collective.com where this policy is displayed.

Postal address: Gageldijk 2, C10, 3602 AL Maarssen, Netherlands
Chamber of Commerce (KvK): 76121712
Privacy contact: staff@chemical-collective.com. Please use the subject “Privacy request”.

External services and independently operated websites have their own privacy notices. This policy does not cover another organisation’s activities merely because we link to its website.

2. Information we collect

The information we process depends on how you use our services:

• Accounts and contact details: your name, username, email address, account registration details, saved billing and delivery addresses, telephone number where provided, and account preferences.
• Orders and payments: products and quantities ordered, prices, discounts and coupons, billing and shipping details, payment method, transaction references and payment status, delivery information, order notes, refunds and correspondence. Payment providers may collect further information under their own notices.
• Newsletter subscriptions: your email address, your name where supplied, subscription and unsubscribe status, signup or activity dates, newsletter open and link-click events, and a newsletter coupon where one is generated. Checkout can also record your newsletter opt-in against your order and customer account.
• Support and communications: the information you send through contact forms or email, including the content of your message and related order information.
• Comments, reviews and community features: your chosen name, email address, comment or review, rating, publication and moderation details, and technical information used to prevent abuse.
• Rewards and affiliates: account and referral identifiers, points or reward transactions, referral visits and orders, commission and payout details, and information needed to administer a programme you join.
• Website and security information: IP address, browser and device information, language, access times, pages requested, referrer and campaign information, cookie identifiers, and security or error logs. The information collected through optional tracking depends on the tools and permissions in use.

Please avoid including unnecessary sensitive information in order notes, support requests, comments or reviews. Content you choose to publish may be visible to other people.

3. Where information comes from

We receive information directly from you when you browse, register, order, subscribe, contact us or submit content. Some information is collected automatically by your browser or our systems. We may receive payment confirmations, delivery updates, fraud or spam signals, referral information and review-related information from the providers involved in those services.

If someone places an order for delivery to you, we may receive your name and delivery/contact details from that person. We use those details for the delivery and related enquiries, not as permission to send you a newsletter.

4. Why we use information and our legal bases

• Orders, payments, delivery, returns and accounts: to perform a contract with you or take steps you request before entering one (Article 6(1)(b) GDPR).
• Accounting and legal duties: to comply with legal obligations (Article 6(1)(c) GDPR).
• Enquiries, correspondence and disputes: to respond to you, run the business and establish or defend claims, based on contract or legitimate interests (Article 6(1)(b) or 6(1)(f) GDPR).
• Rewards and affiliate arrangements: to provide the programme you join, prevent misuse and keep required financial records.
• Security, spam and fraud prevention: to keep accounts and services secure and reliable, based on legitimate interests (Article 6(1)(f) GDPR), subject to applicable rules for access to your device.
• Newsletters and promotional email: with your consent (Article 6(1)(a) GDPR).
• Optional analytics and attribution: with consent where required. See the Cookie Policy.
• Comments and reviews: to publish and moderate content you submit, based on legitimate interests (Article 6(1)(f) GDPR), unless separate consent is required for a particular feature.

We send post-purchase review invitations through TrustSpot/RaveCapture. These are service communications related to a completed purchase, not promotional newsletters. Promotional newsletters and optional tracking remain separate choices.

Information needed to fulfil an order must be provided for us to process it. Optional newsletter signup, comments and optional tracking are not a condition of buying from us. If you do not provide information needed for a particular optional service, we may be unable to provide that service.

5. Newsletters, coupons and your choices

We use a self-hosted Sendy system to maintain newsletter subscriptions and associated coupon information. Email delivery also involves our hosting and email-delivery providers. An email-only signup can generate a coupon associated with that email address; a checkout subscription can include your billing first name.

You may withdraw newsletter consent at any time using the unsubscribe link in a promotional email or by contacting us. Withdrawal does not affect processing lawfully carried out on the basis of valid consent before withdrawal. It does not stop necessary order, security or service messages that are not promotional.

A generated newsletter coupon can be derived from your email address, so it may identify you if you share it.

We may keep a limited record of your withdrawal so that you are not added back to marketing accidentally. We do not treat a generated coupon, purchase history or a saved email address as sufficient evidence of permission for every marketing purpose.

Our Sendy campaign records show open and link-click tracking enabled for campaigns. We use this information only to measure campaign performance. We do not use these events to target individual subscribers, resend campaigns to non-openers or trigger personalised follow-up emails. The exact event-retention period and deletion job were not identified in the inspected Sendy configuration.

Where newsletter engagement measurement is used, it is limited to operating and improving the newsletter service and is stopped or anonymised when no longer needed. You can unsubscribe from promotional email at any time.

6. Who receives information?

We do not sell your personal data. We disclose information needed for the services below to the providers involved, and to authorised staff or contractors who support those services:

• Hosting, content delivery and security: TransIP for website hosting, and Cloudflare for delivery and protection of website traffic.
• Email and customer support: Proton Mail for business email. We use a self-hosted Sendy application to manage newsletter subscribers, campaigns and newsletters. Amazon Simple Email Service (Amazon SES) delivers newsletter messages and necessarily receives the recipient email address, message content/headers and delivery, bounce and complaint metadata.
• Payments: ABN AMRO for bank transfers and CoinToPay (cointopay.com) for cryptocurrency payments. Information needed to process or reconcile your chosen payment is handled by the relevant provider.
• Fulfilment and delivery: We provide the delivery details needed to fulfil an order to the carrier selected for the shipment, such as DHL, Mondial, Packeta or PostNL. The carrier may process that information under its own privacy notice.
• Analytics and optional website tools: Google Analytics and Google Tag Manager remain on the website behind an analytics-consent gate. Google reCAPTCHA is used for anti-abuse checks. Sourcebuster remains a first-party WooCommerce attribution component; its order-attribution data is not treated as anonymous merely because the browser cookie is first-party.
• Reviews and moderation: TrustSpot/RaveCapture may be used to send post-purchase review invitations and collect reviews, together with anti-spam services where a submission is checked. Those services process the information needed for the invitation or submission and have their own privacy notices.
• Affiliate programme: AffiliateWP records referrals, qualifying orders and commission information where you participate in or interact with the affiliate programme.
• Professional and legal recipients: accountants, legal advisers, auditors and public authorities where needed for their work, a legal duty, or the establishment or defence of claims. Any disclosure for a proposed business transaction must be limited to what is necessary and appropriately protected.

Some providers process information on our instructions. Others, such as certain payment providers or carriers, may be responsible for their own processing. Their role depends on the service and the applicable arrangement, not just the software brand.

Public comments and reviews can be seen by other visitors and indexed by search engines. We do not intend to publish the contact email or technical anti-abuse details as part of a public review.

7. Processing outside the European Economic Area

Some providers or their subprocessors may process or access personal data outside the European Economic Area (EEA). A provider’s European address or a European website server does not establish that all processing stays within the EEA.

Transfers outside the EEA must have an applicable transfer mechanism, such as a European Commission adequacy decision or appropriate safeguards such as standard contractual clauses, with additional measures where needed. An adequacy framework can only be relied on where the actual recipient and processing are covered.

Where a transfer outside the EEA is necessary, we use an applicable transfer mechanism and safeguards required by data-protection law, such as an adequacy decision or standard contractual clauses where appropriate.

You can contact us for information about the safeguards applicable to a transfer and how to obtain a copy, subject to lawful protection of confidential information.

8. How long we keep information

We retain information for the periods below, deleting or anonymising it when no longer needed. Statutory retention applies only to the records it covers, not automatically to all customer data.

Specific records may be retained longer for a documented legal obligation, unresolved dispute or investigation, with access restricted and continued necessity reviewed. Valid deletion requests may require earlier deletion where no overriding retention basis applies.

9. Your rights

Depending on the processing and the applicable conditions, you can request access, correction, erasure, restriction or a portable copy of your personal data. You may object to processing based on legitimate interests and may always object to the use of your personal data for direct marketing, including related profiling. You can withdraw consent where we rely on it.

Send a request to staff@chemical-collective.com. We may ask for proportionate information to verify your identity. Do not send an unredacted identity document unless we explain why it is necessary.

We respond within one month as required by the GDPR. Where the permitted extension is necessary, we explain the reason within that first month. Requests are normally free; the GDPR allows limited exceptions for manifestly unfounded or excessive requests. If a right does not apply to particular information, we explain why rather than promising that every record can be deleted.

You can complain to the Dutch Autoriteit Persoonsgegevens or another competent supervisory authority, including in the EEA country where you live or work or where an alleged infringement occurred. You may also seek a judicial remedy.

10. Security, age restrictions and updates

We use account permissions and access controls to limit who can use personal data. Security also depends on maintaining the systems and providers involved. No internet service can be guaranteed completely secure. Please contact us if you suspect misuse of your account or personal information.

Our shop is intended for adults aged 18 or over. If you believe a child has provided personal data through our services, please contact us so we can assess the information and the appropriate action.

We may update this policy when our processing changes. The published policy will show its effective or last-updated date. A policy update is not a substitute for obtaining new consent where that is required.

For information about cookies, browser storage and similar technologies, read our Cookie Policy.