Privacy policy

Last updated: July 14, 2026

Pombo Studio is a one-person leather goods studio based in the Netherlands. This Privacy Policy explains how we collect, use, and protect your personal information when you visit our website or place an order with us.

We collect only what we need. We share nothing we don't have to. And we are always reachable at hello@pombo.studio if you have questions about how we handle your data.

Personal Information We Collect

We may collect the following categories of personal information depending on how you interact with the Services:

  • Contact details including your name, address, billing address, shipping address, phone number, and email address.
  • Order information including items purchased, payment confirmation, and transaction details.
  • Communications with us including information you include when contacting us for customer support or other inquiries.
  • Device and usage information including information about your device, browser, IP address, and how you interact with the Services. We collect this information using functional cookies necessary for the store to operate.

How We Collect Personal Information

  • Directly from you, when you place an order, subscribe to our Journal via Substack, or contact us.
  • Automatically through our website, from your device, through the use of functional cookies strictly necessary for the store to operate.
  • From Shopify, as our hosting and commerce platform, which processes certain information on our behalf.

How We Use Your Personal Information

To provide the Services. We use your information to process your payments, fulfill your orders, arrange shipping, facilitate returns and exchanges, and send notifications related to your purchase. Legal basis: performance of contract (Art. 6.1.b GDPR).

To send our Journal. If you have subscribed explicitly via Substack, we use your email address to send one entry per month. You can unsubscribe at any time directly from Substack. We will not send marketing communications without your explicit consent. Legal basis: consent (Art. 6.1.a GDPR).

For security and fraud prevention. We use your information to detect and investigate possible fraudulent or malicious activity and to keep our store secure. Legal basis: legitimate interest (Art. 6.1.f GDPR).

To communicate with you. We use your information to respond to your inquiries and provide customer support. Legal basis: legitimate interest (Art. 6.1.f GDPR).

To comply with legal obligations. We use your information to comply with applicable law, including Dutch tax and accounting obligations. Legal basis: legal obligation (Art. 6.1.c GDPR).

What We Do Not Do

Pombo Studio does not sell, rent, or share your personal information with third-party marketing partners. We do not use your data for targeted advertising, retargeting, or profiling. We do not use Meta Pixel, Google Ads tracking, or similar advertising technologies.

Cookies

We use only functional cookies — those strictly necessary for the store to operate. These include session cookies, shopping cart cookies, and language preference cookies. These cookies do not require your consent under applicable law.

We do not use analytical or marketing cookies without your explicit consent. If we introduce analytics tools in the future, we will update this policy and request your consent before any non-functional cookies are placed on your device.

For information about cookies used by Shopify to power our store, see shopify.com/legal/cookies.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services. Information you submit will be transmitted to and shared with Shopify as necessary to provide the Services. To learn more about how Shopify uses your personal information and any rights you may have, visit privacy.shopify.com.

Shop Pay

Our store supports Shop Pay, a Shopify accelerated checkout service. If you use Shop Pay, Shopify processes your payment and order information to enable fast checkout. Shopify is responsible for the processing of your personal information in these circumstances. To learn more, visit privacy.shopify.com.

How We Disclose Personal Information

We may disclose your personal information only in the following circumstances:

  • With Shopify and service providers who perform services on our behalf, such as payment processing, shipping, and cloud storage.
  • With MyParcel and their shipping partners to fulfill and track your order.
  • When required by law, to comply with legal obligations or respond to valid legal process.
  • In connection with a business transaction such as a merger or transfer of assets, subject to confidentiality obligations.

We do not disclose your personal information to business or marketing partners.

International Transfers

Your personal information may be transferred to and processed in countries outside the European Economic Area, including by Shopify and its infrastructure providers. Where we transfer personal information outside the EEA, we rely on recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses to ensure your information receives adequate protection.

Children's Data

The Services are not intended for use by children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with their personal information, please contact us and we will delete it promptly.

Security and Retention

We take reasonable measures to protect your personal information from unauthorized access, loss, or misuse. We retain your personal information for as long as necessary to provide the Services, comply with our legal obligations (including Dutch tax law, which requires retention of financial records for 7 years), resolve disputes, and enforce our agreements.

Your Rights

If you reside in the European Economic Area, you have the following rights regarding your personal information:

  • Right to access: you may request access to the personal information we hold about you.
  • Right to correct: you may request that we correct inaccurate information.
  • Right to delete: you may request that we delete your personal information, subject to legal retention obligations.
  • Right to portability: you may request a copy of your personal information in a structured, commonly used format.
  • Right to object or restrict processing: you may object to or request restriction of processing in certain circumstances.
  • Right to withdraw consent: where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at hello@pombo.studio. We will respond within 30 days as required by applicable law. If you are not satisfied with our response, you have the right to lodge a complaint with the Dutch data protection authority: Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the revised policy on this page and update the Last updated date.

Contact

Pombo Studio · hello@pombo.studio

[Dirección física NL — pendiente agosto 2026]

Chamber of Commerce: [pendiente agosto 2026]

VAT: [pendiente agosto 2026]

For the purpose of applicable data protection laws, Pombo Studio is the data controller of your personal information.