Privacy Policy | Mycotrop

Last updated: 2 October 2026

This privacy policy explains which personal data Mycotrop collects when you visit mycotrop.com, create an account, sign in with Google, place an order or contact us, why we use it, who receives it and which rights you have. It applies to the whole shop, in every language.

1. Who is responsible for your data

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Mycotek B.V.
Stadsplateau 33
3521 AZ Utrecht
The Netherlands
Chamber of Commerce (KvK): 33149868
VAT: NL001197903A007
E-mail: [email protected]

Mycotek B.V. operates the shop under the name Mycotrop. For any question about this policy or your data, write to the address above or use the contact form.

2. Data we collect

Data you give us

• Customer account: first and last name, e-mail address, password (stored only in hashed form), and, if you choose to provide them, title and date of birth. We also record your newsletter choice and the date and IP address of that choice.
• Addresses: name, company and VAT number (optional), street address, postcode, city, country and telephone number for delivery and invoicing.
• Orders: products ordered, prices, discounts and gift items, order and invoice numbers, delivery method, tracking number and the status of your order, returns and refunds. You can also order as a guest; we then store the same order and address data without a password.
• Payment: the payment method, amount and payment status. For bank transfers we receive the name, account number (IBAN) and reference of the payer as they appear on our bank statement, which we use to match the payment to your order. Card details are entered on the page of our payment provider; we never see or store your full card number.
• Messages: what you write to us through the contact form (including any attachment), by e-mail or in the live chat, and the reviews you publish on product pages.
• Stock alerts: your e-mail address and the product concerned when you ask to be told that a product is back in stock.
• Sign-in with Google: the data described in section 4.

Data collected automatically

• Technical data: IP address, browser and operating system, language, the page that referred you and the date and time of your visit. PrestaShop records these visits for its built-in shop statistics.
• Marketing events: the pages and products you view and the contents of your cart, which the Klaviyo and Omnisend scripts on our pages send to these e-mail marketing services (see section 6 and section 10).
• Cookies: see section 10.
• Security data: signals used by our spam and bot protection (Google reCAPTCHA) on the contact and registration forms, and the connection data processed by our content delivery and protection network (Cloudflare).

You do not have to give us any personal data to browse the shop. To order, we need your name, e-mail address and delivery address; without them we cannot deliver.

3. Why we use your data and on which legal basis

Where we rely on legitimate interest, you may object at any time (see section 9). We do not take decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Signing in with Google

You can create a Mycotrop account or sign in with your Google account instead of a password. This is optional: you can always register with your e-mail address instead.

What happens when you use it

When you click Continue with Google, you are sent to Google, where you sign in and agree to share your data with Mycotrop. You then return to mycotrop.com, signed in. Google only tells us who you are; we never receive your Google password.

What we receive and keep

Google sends us your name, your e-mail address (we accept only addresses that Google has verified), your Google account identifier and, as part of the standard profile, a link to your profile picture. We store your first name, last name, e-mail address and the Google account identifier. We do not store your profile picture.

We also record that you used Google and when the link was created and last used. We do not request access to your contacts, files or any other Google data, and we never post anything on your behalf.

If an active Mycotrop account already exists with the same e-mail address, your Google sign-in is linked to that account. Otherwise a new customer account is created with your name and e-mail address, and we send you a welcome e-mail.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR), because you ask us to create or open your customer account this way. Google processes your data under its own privacy policy.

How to unlink Google

• In your Mycotrop account: open My account > Connection with Social Networks and click Unlink next to Google. Set a password first (My account > Information or Forgot your password?) so you can still sign in.
• At Google: go to myaccount.google.com/connections, select Mycotrop and remove access.

Removing access at Google stops future sign-ins with Google. It does not delete your Mycotrop account or your orders. To have your data deleted, see the next section.

5. Deleting your data (including data received via Google)

You can ask us at any time to delete the personal data we hold about you, including the data we received when you signed in with Google.

How to request deletion

1. Send an e-mail to [email protected] with the subject Data deletion request, from the e-mail address linked to your account. Say whether you signed in with Google. Do not send us your password.
2. Or, when signed in, open My account > GDPR - Personal data, where you can download your data and reach the contact form for a deletion request.

If we cannot link the request to an account with certainty, we will ask you to confirm it from the e-mail address on file. We do not ask for identity documents unless there is no other way to confirm your identity.

What we delete

• the link between your Mycotrop account and Google, including the Google account identifier;
• your customer account: name, e-mail address, password, date of birth, preferences and saved addresses;
• your newsletter subscription and your contact record at our e-mail marketing services (Sendy, Klaviyo, Omnisend);
• your contact form and chat messages, your stock alerts and your reviews, unless they are needed for an open order or dispute;
• your shopping carts and visit statistics linked to your account.

Orders and invoices must be kept for seven years under Dutch tax law. We keep only what that obligation requires and remove your account and the links to it; these records are not used for any other purpose and are deleted when the period ends. If an order is still open, we finish it first.

Timeframe

We answer on business days and aim to reply within one business day. We carry out the deletion within one month of your request at the latest and confirm by e-mail once it is done. Copies of deleted data remain only in our server backups until those backups are replaced or deleted.

To also remove Mycotrop from your Google account, follow the steps in section 4; Google deletes the data it holds itself under its own policy.

6. Who receives your data

We do not sell your data. We share it only with the service providers we need to run the shop. They act as processors under a data processing agreement and may use your data only on our instructions, or, where indicated, as independent controllers.

7. Transfers outside the European Economic Area

Some providers listed above are based in, or use sub-processors in, countries outside the European Economic Area, in particular the United States (Cloudflare, Google, Klaviyo, tawk.to, and sub-processors of Omnisend). We transfer data to them only where an adequate level of protection is ensured: under the EU-US Data Privacy Framework for certified companies, or under the European Commission's standard contractual clauses with additional safeguards where needed. New Zealand (SMTP2GO) is covered by an adequacy decision of the European Commission. You can ask us for a copy of the safeguards used.

8. How long we keep your data

• Customer account: as long as your account exists. We do not delete inactive accounts automatically; you can ask us to delete yours at any time (section 5).
• Orders, invoices and payment records: 7 years from the end of the financial year, as required by Dutch tax and accounting law.
• Google link: until you unlink it or your account is deleted.
• Newsletter: until you unsubscribe or withdraw your consent; we then keep only a record of your unsubscription so that we do not write to you again.
• Omnisend: only customers who registered or ordered in the last 240 days are kept there; older contacts are removed automatically.
• Messages, chats, stock alerts, carts and visit statistics: kept with your customer record; they are not deleted automatically and are deleted with your account or earlier on request, unless needed for an open order or dispute.
• Consent records: as long as needed to show that consent was given.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• rectification of incorrect or incomplete data (you can change most of it yourself in My account);
• erasure of your data (section 5);
• restriction of processing, for example while we check a disputed point;
• data portability: receive the data you gave us in a structured, machine-readable format (in My account > GDPR - Personal data you can download it as a PDF or CSV file);
• object to processing based on our legitimate interests, and to direct marketing at any time;
• withdraw your consent at any time, without affecting processing carried out before the withdrawal.

To exercise these rights, write to [email protected]. We reply within one month. This period can be extended by two months for complex requests, in which case we tell you why within the first month. Exercising your rights is free of charge.

You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens. You can also contact the authority of the EU country where you live or work, for example the CNIL in France or the data protection authority of your federal state in Germany. We would appreciate the chance to address your concern first.

10. Cookies and similar technologies

Cookies are small files stored by your browser. The following are used on mycotrop.com:

On your first visit a cookie notice is shown. It is an information notice: the Klaviyo and Omnisend scripts and their cookies are loaded with the page whether or not you click Accept, and clicking Accept only hides the notice. The live chat (tawk.to) is loaded only when you click Chat. You can block or delete cookies in your browser settings at any time; the shop also works without the marketing cookies. To object to the use of your data for marketing, write to us or use the unsubscribe link in any of our e-mails.

11. Security

All pages are served over an encrypted HTTPS connection. Passwords are stored only in hashed form, access to customer data is limited to the people who need it, and our providers are bound by confidentiality and security obligations. If a data breach occurs that is likely to put your rights at risk, we will inform you and the supervisory authority as required by law.

12. Age requirement

Mycotrop sells only to adults. You must be at least 18 years old to create an account or place an order. We do not knowingly collect data from anyone under 18; if we learn that we have, we delete it.

13. Changes to this policy

We update this policy when our services or the law change. The date at the top shows the latest version. If a change significantly affects how we use your data, we will inform you by e-mail or on the website.