Last updated: 22 October 2026
This privacy policy explains how Hikari Print B.V. processes your personal data when you visit the noids webshop (https://hhc-noids.com), create an account, place an order or contact us. We process personal data in accordance with the General Data Protection Regulation (GDPR, in Dutch: AVG).
1. Who is responsible?
The controller for the processing of your personal data is:
- Hikari Print B.V., trading as noids
- Address: Segment 3, Unit A7626, 6921 RC Duiven, the Netherlands
- Chamber of Commerce (KvK) number: 70711291
- VAT (BTW) identification number: NL858431269B01
- Email: office@hhc-noids.com
- Contact form: hhc-noids.com/contact-us
For any question about privacy, contact us at office@hhc-noids.com. We have not appointed a data protection officer, as this is not required for our organisation.
2. Which personal data do we process?
- Identity and contact details: name, delivery and billing address, email address and, if you provide it, telephone number.
- Date of birth: to verify that you are 18 or over.
- Account details: login email and password (stored only in encrypted form), addresses and preferences.
- Order details: products ordered, amounts, order reference, shipping method, tracking number and order history.
- Payment details: the name and IBAN of the account from which you pay, the amount and date of the payment, so that we can match your payment and make refunds.
- Communication: the content of emails and contact form messages, complaints and withdrawal notices.
- Proof of age: only if we ask for additional verification (see section 4).
- Technical data: IP address, browser type, date and time of visits and pages requested, recorded in the server logs and in the security and connection logs of the webshop.
- Newsletter: your email address and the date and proof of your subscription, if you subscribe.
We receive these data from you, except for payment details, which we receive from our bank, and delivery status data, which we receive from the carrier. Providing the data marked as required in the checkout is necessary to conclude and perform the contract; without them we cannot process your order.
3. Purposes, legal bases and retention periods
| Purpose | Legal basis (Article 6(1) GDPR) | Retention period |
|---|---|---|
| Processing, shipping and invoicing your order, matching payments, refunds, returns and the legal guarantee | Performance of the contract (b) | Order and invoice data: 7 years (statutory tax retention period) |
| Your customer account | Performance of the contract (b) | Until you delete your account; order data that we must keep for tax purposes are kept for 7 years |
| Age verification (date of birth and, if requested, proof of age) | Legal obligation (c), where a statutory minimum age applies, and legitimate interest (f) in not selling to minors | Date of birth: together with the order data. Proof of age: deleted immediately after verification; we only record that the verification took place, its date and outcome |
| Answering questions, handling complaints and withdrawals | Performance of the contract (b) or legitimate interest (f) in answering your question | As long as needed to handle your request and any follow-up; if related to an order, together with the order data |
| Accounting and tax obligations | Legal obligation (c) | 7 years |
| Security of the webshop and prevention of fraud and misuse | Legitimate interest (f) in a secure webshop | Server, security and connection logs: for a limited period, after which they are deleted automatically |
| Newsletter (only if you subscribe, with double opt-in) | Consent (a) | Until you unsubscribe; proof of consent for as long as needed to demonstrate it |
| Establishing, exercising or defending legal claims | Legitimate interest (f) | For the duration of the dispute and the applicable limitation period |
Where we rely on legitimate interest, we have weighed our interest against your privacy. You can object to this at any time (see section 9).
4. Age verification
We only sell to adults. When you enter the webshop, we ask you to confirm that you are 18 or over; this confirmation is stored on your device (see our Cookie policy). When you place an order, we ask for your date of birth. In individual cases we may ask for additional proof of age, such as a copy of an identity document. In that case, please mask all data except your photo, name and date of birth; always mask your citizen service number (BSN) or national identification number. We use the copy only for the verification and delete it immediately afterwards.
5. Newsletter
We only send you our newsletter if you have subscribed and confirmed your subscription through the link in our confirmation email (double opt-in). You can unsubscribe at any time through the link in every newsletter or in My account. Withdrawing your consent does not affect the lawfulness of processing before the withdrawal.
6. Who receives your data?
We only share your data with parties that need them for the purposes above:
- PostNL and DHL: name, address and, where needed for delivery notifications, email address and telephone number, to deliver your parcel. The carriers process these data as independent controllers for their delivery services.
- KoDDoS (Amarutu Technology Ltd): hosting of the webshop on servers in the Netherlands, as our processor.
- Our bank: to process incoming payments and refunds.
- Our tax adviser/accountant: for bookkeeping and tax returns.
- Customs authorities: for shipments outside the EU, the data required for the customs declaration.
- Government authorities: only if we are legally obliged to do so, for example to the tax authorities.
We do not sell your data and do not share them with advertising networks or social media.
7. Transfers outside the European Economic Area
Your data are stored on servers in the Netherlands. We do not transfer personal data outside the European Economic Area (EEA), with one exception: if you have your order delivered to a country outside the EEA, the carrier and the customs authorities in that country receive the data needed for delivery and customs clearance. That country may not offer the same level of data protection as the EEA. This transfer is necessary for the performance of the contract you have requested (Article 49(1)(b) GDPR).
8. Security
We take appropriate technical and organisational measures to protect your data against loss and unlawful processing. Among other things: the entire webshop uses an encrypted HTTPS connection, passwords are stored only in encrypted (hashed) form, access to the management environment and to personal data is restricted to authorised persons, and we keep our software up to date. If you suspect misuse, please contact us.
9. Your rights
You have the following rights regarding your personal data:
- the right of access to your data;
- the right to rectification of incorrect or incomplete data;
- the right to erasure of your data, unless we are legally obliged to keep them (for example invoice data);
- the right to restriction of processing;
- the right to data portability: to receive your data in a structured, commonly used format;
- the right to object to processing based on legitimate interest, and to object at any time to the use of your data for direct marketing;
- the right to withdraw your consent at any time, for example for the newsletter.
You can view and change many of your data yourself in My account. On the GDPR - Personal data page in your account, you can download your data or request their erasure. You can also send your request to office@hhc-noids.com. We respond within one month; for complex requests this period may be extended by two months, in which case we will inform you. We may ask you to verify your identity. Exercising your rights is free of charge.
10. Complaints
If you are not satisfied with how we handle your data, please contact us first. You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the supervisory authority in the EU country where you live.
11. Automated decision-making
We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
12. Minors
Our webshop is intended only for adults. We do not knowingly process personal data of persons under 18. If we discover that we have done so, we delete those data.
13. Cookies
We only use functional cookies and similar techniques that are necessary for the webshop. Read more in our Cookie policy.
14. Changes
We may amend this privacy policy, for example when our services or the law change. The current version is always available on this page, with the date of the last update at the top.