Privacy Policy
Last updated: August 2026
This policy explains what personal data Panda Media & Records collects when you use pandamediarecords.com, why we collect it, who we share it with, and what rights you have. We are a small independent shop and we keep data collection to what running the shop actually requires.
Who is responsible for your data
Panda Media & Records is the data controller for the personal data described in this policy.
- Trading name: Panda Media & Records
- KVK number: 99664593
- BTW number: NL005400479B37
- Email: info@pandamediarecords.com
We are registered in the Netherlands and ship from the Netherlands. Our registered postal address is stated in our Terms & Conditions.
What data we collect
When you place an order: your name, email address, billing address, shipping address, telephone number if you provide one, the items you ordered, the delivery method you chose, and the amount paid. If you choose a pickup point, we also receive the pickup location you selected.
When you pay: your payment is handled by our payment provider. We receive confirmation that a payment succeeded, the method used and a transaction reference. We never receive or store your card number, bank credentials or PIN.
When you simply browse: our server records your IP address, browser type, the pages you visit and the time of the visit. Our shop also stores a cart identifier so your basket survives between pages.
If you consent to analytics or marketing cookies: data about how you use the site, including pages viewed, products viewed and clicks. See the Cookies section below.
We do not ask for, and do not want, any special categories of data such as health, religion or political views. Please do not send us any.
Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Taking, processing, packing and shipping your order, and answering questions about it | Performance of a contract with you |
| Handling returns, withdrawals, refunds and warranty claims | Performance of a contract, and legal obligation |
| Keeping invoices and order records for tax and accounting | Legal obligation under Dutch tax law |
| Keeping the site secure, preventing fraud and abuse, and fixing faults | Our legitimate interest in running a functioning, secure shop |
| Analytics, advertising measurement, and inviting you to review your purchase | Your consent, which you can withdraw at any time |
We do not sell your personal data, and we do not send marketing email. We have no newsletter. The only email you receive from us relates to an order you placed.
Who we share it with
We share data only with the service providers we need in order to run the shop. Each of them processes your data on our instructions.
- Mollie B.V. (Netherlands) — payment processing. Mollie handles your payment data directly under its own privacy policy.
- MyParcel (Netherlands) — shipping labels and track & trace. Receives your name, address, email and order weight, and passes what is needed to the carrier.
- Sendcloud (Netherlands) — pickup point selection and shipping labels for pickup point deliveries. Receives your name, address, email and chosen pickup location.
- Carriers — PostNL, DHL and DPD, depending on the delivery method. They receive the name, address and contact details needed to deliver your parcel.
- Cloud86 (Netherlands) — website hosting. Your data is stored on servers in the Netherlands.
- Google — Google Analytics, Google Search Console and Google Merchant Center, and, if you opt in at checkout, Google Customer Reviews. Analytics and advertising data are only collected if you consent.
- TikTok — an advertising measurement pixel, which loads only if you consent to marketing cookies.
We may also disclose data where we are legally required to, for example to a tax authority or in response to a lawful order.
Google Customer Reviews
At checkout you may be offered the option to take part in Google Customer Reviews. This is entirely optional and the box is not ticked for you. If you opt in, your email address and order details are shared with Google so that Google can email you a survey about your purchase after delivery. If you do not opt in, nothing is shared.
Transfers outside the EU
Google and TikTok are established outside the European Economic Area, and data shared with them may be processed in the United States. Where that happens, the transfer relies on the European Commission’s adequacy decision for the EU–US Data Privacy Framework, or on standard contractual clauses approved by the European Commission. Our shop hosting, payment and shipping providers are all based in the Netherlands.
How long we keep it
- Order and invoice records: seven years, because Dutch tax law requires us to retain business administration for that period.
- Customer account details, if you created an account: until you ask us to delete the account.
- Email correspondence: up to two years after the matter is closed.
- Server logs: a short period set by our host, for security and troubleshooting.
- Analytics and advertising data: according to the retention settings of the provider concerned, and only for as long as your consent stands.
Cookies
We use a consent tool that blocks non-essential cookies until you choose. Cookies fall into three groups:
- Necessary — keep your basket, your session and the checkout working, and record your cookie choice. These are always active because the shop cannot function without them.
- Analytics — help us understand which pages and products people look at. Only set with your consent.
- Marketing — used to measure the effect of advertising. Only set with your consent.
You can change or withdraw your choice at any time through the cookie settings on the site, and you can delete cookies through your browser.
Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects for you.
Your rights
Under the GDPR (AVG) you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, where we are not required to keep it;
- ask us to restrict how we use your data;
- object to processing based on our legitimate interests;
- receive your data in a portable, machine-readable format;
- withdraw your consent at any time, without affecting anything done before you withdrew it.
To exercise any of these rights, email info@pandamediarecords.com. We will respond within one month. We may ask you to confirm your identity before acting on a request, so that we do not disclose your data to someone else.
Complaints
If you are not satisfied with how we have handled your data, please contact us first so we can try to put it right. You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Security
The site is served over an encrypted connection, access to the shop administration is protected, and we limit who can see order data to what is necessary to fulfil your order. No system is completely secure, but we take reasonable measures to protect your data.
Children
Our shop is not directed at children, and we do not knowingly collect data from anyone under 16.
Changes to this policy
We update this policy when the way we handle data changes, for example when we add a new service provider. The date at the top shows when it was last revised.