Privacy Notice

Last updated: 26 May 2026

Carmo Electronics (registered office: Berenbroek 3, 5707DB Helmond, The Netherlands; Dutch Chamber of Commerce number 94492816; VAT number NL866797154B01) places great importance on the protection of your personal data. This privacy statement explains what data we process, for what purpose, on what legal basis and what rights you have under the EU General Data Protection Regulation (GDPR).

1. What personal data do we process?

Depending on your use of our website and services, we may process the following data:

  • Name and address details (name, address, city, country)
  • Contact details (e-mail address, phone number)
  • Company details and VAT number (for business customers)
  • Order details (products, quantities, prices, delivery date)
  • Payment details (bank account, transaction ID; full card data is processed exclusively by our payment service providers)
  • Login credentials for your customer account
  • IP address, browser data and browsing behaviour on our website
  • Repair and service requests, correspondence and customer service tickets

2. Purpose and legal basis

  • Performance of a contract (Art. 6(1)(b) GDPR) – processing orders, deliveries, returns, warranty and service.
  • Legal obligation (Art. 6(1)(c) GDPR) – bookkeeping and tax retention obligations.
  • Legitimate interest (Art. 6(1)(f) GDPR) – service improvement, security, fraud prevention and general website analytics.
  • Consent (Art. 6(1)(a) GDPR) – non-functional cookies and newsletter mailings.

3. Retention periods

We do not keep your personal data longer than necessary for the purpose for which it was collected:

  • Order and invoice data: 7 years (statutory tax retention)
  • Warranty and service records: 7 years after the last service event (parallel to the statutory tax retention period and the limitation periods for warranty claims under Art. 7:23 of the Dutch Civil Code)
  • Customer account: up to 3 years after last activity, after which anonymised or deleted
  • Correspondence and support tickets: 5 years after closure (in line with the general limitation period for contractual claims under Art. 3:307 of the Dutch Civil Code)
  • Analytical cookies: maximum 26 months
  • Job application data: up to 4 weeks after the procedure ends, or longer with your consent

4. Who do we share data with?

To deliver our services we work with processors with whom we have signed data processing agreements. These may include:

  • Carriers and shipping partners (e.g. PostNL, DPD, DHL, UPS) and our shipping integration Sendcloud
  • Payment service providers (Pay.nl for online payments, including iDEAL, credit-card, PayPal and other methods) for processing payments
  • Hosting provider and server infrastructure
  • Accounting software (Exact Online) for administrative processing and invoicing
  • Cloudflare for security and distribution of our website (CDN, e-mail obfuscation)
  • Google (Google Analytics) for measuring website visits
  • Customer service and ticketing system (FreeScout)
  • XCover insurer for optional shipping insurance

We do not sell your data to third parties. We only share data when this is necessary for the performance of a contract, due to a legal obligation, or with your explicit consent.

5. Transfers outside the European Economic Area

Some of our processors (such as Google and Cloudflare) are based in the United States. We only transfer data on the basis of valid transfer mechanisms, such as the EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (SCCs) or an adequacy decision by the European Commission. We assess supplementary measures where necessary (Transfer Impact Assessment).

6. Cookies

Our website uses several types of cookies:

  • Functional cookies – necessary for website operation (shopping cart, session, language preference, login status). These do not require consent.
  • Analytical cookies – through Google Analytics we measure website usage to improve our services. Your IP address is anonymised wherever technically possible.
  • Marketing/tracking cookies – Google Ads conversion tracking and remarketing; only placed after your explicit consent. Retention: maximum 13 months.

You can manage or delete cookies at any time via your browser settings or via the cookie banner on our website.

7. Your rights

Under the GDPR you have the following rights:

  • Right of access – to know what personal data we process about you.
  • Right to rectification – correction of inaccurate or incomplete data.
  • Right to erasure – “right to be forgotten” where legally possible.
  • Right to restriction of processing.
  • Right to data portability – to receive your data in a common file format.
  • Right to object to processing based on legitimate interest.
  • Right to withdraw consent (without affecting the lawfulness of prior processing).

You can exercise these rights by sending a request to [email protected]. We will respond within 30 days. We may ask you to identify yourself to prevent abuse.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl. You may also contact the supervisory authority in your country of residence.

8. Security

We take appropriate technical and organisational measures to protect your data against loss, misuse or unauthorised access. These include encrypted connections (HTTPS/TLS), access control, periodic security updates and logging of access to personal data.

9. Changes

We may amend this privacy statement from time to time, for example when our services expand or when laws and regulations change. The most recent version is always available on this page. The date at the top of this document indicates when the last change was made.

10. Contact

For questions or requests regarding your personal data, please contact:

Carmo Electronics
Attn: Privacy
Berenbroek 3
5707DB Helmond
The Netherlands
Phone: +31 492-565220
E-mail: [email protected]

This privacy statement is not a substitute for specific legal advice. For formal legal enquiries please contact us via the address above.