Privacy policy

Last updated: 19 October 2026

Karpet24 is a webshop of CNL Handel BV. This privacy policy explains which personal data we process, why, who we share it with, how long we keep it and what rights you have. We comply with the General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (UAVG).

1. Who is responsible?

CNL Handel BV, trading as Karpet24, is the controller.

CNL Handel BV
Vareseweg 135, 3047 AT Rotterdam, Netherlands
KvK 82820228, VAT NL8626.15.756.B01
Email: info@karpet24.nl
Phone: +31 (0)10 299 08 60

2. What data do we process?

2.1 Data you give us

When you place an order, create an account, sign up for the newsletter or contact us, we process:

  • your name;
  • email address and phone number;
  • billing and delivery address;
  • order details: which rugs, prices, date and order number;
  • payment details: the payment method and the transaction. We don't see your full card or bank details; the payment provider processes them;
  • the content of your emails, messages, withdrawals and complaints;
  • your review, if you write one.

2.2 Data we collect automatically

When you visit our website, we and our service providers collect technical data, such as your IP address, browser and operating system, the type of device, the pages you view and when, and the website you came from. This is done with cookies and similar technologies; see section 9.

2.3 Orders via bol

If you buy a rug from us via bol, bol gives us your name, delivery address and order details so that we can deliver your order. What bol itself does with your data is governed by bol's privacy policy.

3. Why do we process your data?

Purpose Legal basis (Art. 6(1) GDPR)
Fulfilling your order: payment, shipping, delivery by our supplier, customer service Performance of the contract (point (b))
Sending order confirmations, tracking information and messages about your order Performance of the contract (point (b))
Handling withdrawals, returns, complaints and guarantee claims Performance of the contract (point (b)) and legal obligation (point (c))
Keeping our records for the Dutch Tax Administration Legal obligation (point (c))
Preventing and investigating fraud and misuse, including the packing records described in section 4 Legitimate interest (point (f))
Asking you by email for a review about two weeks after shipping (no more than three emails for several rugs in one order) Legitimate interest (point (f)); you can unsubscribe via the link in the email
Improving our website and services with anonymised or aggregated data Legitimate interest (point (f))
Sending the newsletter and offers by email Consent (point (a))
Placing and reading analytics and marketing cookies Consent (point (a)) and Article 11.7a of the Dutch Telecommunications Act

Where we process your data on the basis of legitimate interest, you may object to this (see section 8). We don't make decisions about you based solely on automated processing. If you pay later with Klarna, Klarna itself assesses, partly automatically, whether that's possible; see Klarna's privacy policy.

4. Packing records and camera surveillance

For orders we ship ourselves from our warehouse in Rotterdam, we record the packing process to prevent fraud and to have evidence if a parcel is damaged, empty or lost (legitimate interest):

  • photos and video of the packing and the weight of the parcel, linked to your order number. We keep these until your order has been fully completed, including the withdrawal period and any complaint;
  • camera footage of the packing area and the dispatch area. We keep this for no more than 4 weeks, unless we need it for an ongoing investigation.

In a specific investigation, we may share this data with the carrier, our insurer and, if a criminal offence is suspected, the police.

5. Who do we share your data with?

We don't sell your data. We only share it with parties we need to fulfil your order or to comply with the law, or if you have given your consent:

  • Shopify (Shopify International Ltd., Ireland): the platform our webshop and checkout run on, including Shop Pay and Shopify Messaging, which we use to send our newsletter.
  • Payment providers for the payment methods at checkout (iDEAL | Wero, Bancontact, Klarna, PayPal, Apple Pay, Google Pay, Shop Pay, Visa, Mastercard and American Express). Klarna and PayPal also process your data as independent controllers, under their own privacy policies.
  • Medipa Handels GmbH (Merinos), Junkersring 51, 53844 Troisdorf, Germany: our supplier, which ships some orders directly to you. For this, Medipa receives your name, your delivery address, your order number and, if the carrier needs it, your phone number.
  • UPS and GLS: our carriers. Which carrier delivers your parcel depends on the destination and the size of your rug.
  • Judge.me: our review service. On our behalf, about two weeks after we've shipped your order, Judge.me sends the email asking you for a review (for several rugs, no more than three emails, five days apart) and displays reviews on our website. For this, Judge.me receives your name, your email address and which rugs you bought.
  • TikTok, Meta (Facebook and Instagram), Google and beslist.nl: advertising and analytics services. Only if you accept the cookies for this; see section 9.
  • Our bookkeeper and accountant, for our accounts and tax returns.
  • IT service providers who manage and secure our systems.
  • Government authorities, where the law requires us to share it.

We conclude a data processing agreement with parties that process data on our behalf.

6. Transfers outside the European Economic Area

Some service providers, including Shopify, Google and Meta, also process data outside the EEA, for example in the United States or Canada. They do so on the basis of an adequacy decision of the European Commission (for the US, the EU-US Data Privacy Framework, if the service provider is certified under it) or the standard contractual clauses approved by the European Commission.

7. How long do we keep your data?

  • Order and invoice data: 7 years, as required by the statutory tax retention obligation.
  • Account data: as long as your account is active, and for no more than 2 years after that.
  • Newsletter: until you unsubscribe. We then remove you from the mailing list straight away.
  • Emails and contact forms: no more than 2 years after we've dealt with your question.
  • Packing records and camera footage: see section 4.
  • Analytics cookies: no more than 26 months.
  • Advertising platforms: according to the platform's own policy. TikTok keeps this data for no more than 18 months.

After that, we delete your data or make it irreversibly anonymous.

8. Your rights

You have the right to:

  • see what data we hold about you (access);
  • have incorrect data corrected;
  • have your data deleted, unless we are legally required to keep it;
  • have the processing restricted;
  • receive your data in a common digital format (portability);
  • object to processing based on legitimate interest, and always to direct marketing;
  • withdraw your consent at any time, via the unsubscribe link in the email or via "Cookie preferences" at the bottom of every page. Anything we did before you withdrew it remains lawful.

Email your request to info@karpet24.nl. We'll respond within one month. To prevent someone else from requesting your data, we may ask you to prove your identity.

Not happy with how we handle your data? Let us know first and we'll look for a solution together. You can also always lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

9. Cookies

A cookie is a small text file that our website stores on your device.

9.1 Which cookies we use

  • Functional cookies (always active): needed to make the website work, for example for your cart, your language choice and your login. We don't ask for consent for these.
  • Analytics cookies (only with consent): to measure how visitors use our website. For this we use Google Analytics and Judge.me's statistics.
  • Marketing cookies (only with consent): to show ads on other websites and social media and to measure how well our ads perform. These cookies and pixels are from TikTok, Meta, Google and beslist.nl.

9.2 Managing your choice

On your first visit, a cookie banner asks which cookies you accept. You can change your choice at any time via "Cookie preferences" at the bottom of every page. You can also delete or block cookies in your browser; some parts of the website may then stop working properly.

9.3 Advertising and measurement via TikTok, Meta, Google and beslist.nl

On our website we use the TikTok Pixel, the Meta Pixel (Facebook and Instagram) and the Google tag (Google Analytics and Google Merchant Center). Through them, data about your visit is sent to these platforms: which pages you view, what you add to your cart and what you buy, your IP address and information about your device and browser. In addition, the TikTok and Meta apps in our Shopify store send data about visits and orders directly to TikTok and Meta (TikTok Events API and Meta Conversions API). For an order, this can also include your email address, phone number, name and address. These are hashed first, so that the platform can only match them to an existing account. We do this to measure which ads work, to show ads to people who have visited our store and to decide who an ad is shown to.

When this happens. The TikTok and Meta pixels only load in your browser if you have accepted marketing cookies. The Google tag only sends data to Google once you have accepted analytics or marketing cookies. If you have only accepted analytics cookies, the Google tag tells Google that no advertising cookies may be set and that your visit may not be used for personalised advertising. Only when you accept marketing cookies is data also sent to Google's advertising services. The beslist.nl tag measures which orders come in via their comparison site and only sends data if you have accepted marketing cookies. For all these pixels and tags, we ask for your consent in advance (Art. 6(1)(a) GDPR and Article 11.7a of the Dutch Telecommunications Act).

Joint controllership with TikTok and Meta. For collecting this data on our website and passing it on, we are joint controllers within the meaning of Article 26 GDPR together with TikTok (TikTok Technology Limited, Ireland, and TikTok Information Technologies UK Limited) and with Meta (Meta Platforms Ireland Limited). What TikTok and Meta then do with the data, for example to personalise ads, is their own responsibility. We have made arrangements with TikTok and with Meta about who does what. We give you this information and ask for your consent via the cookie banner. TikTok and Meta make sure you can exercise your rights of access, rectification, erasure, restriction and portability (Articles 15 to 20 GDPR) for the data they keep after receiving it. How TikTok uses your data, on what legal basis, and how to exercise your rights with TikTok is explained in TikTok's privacy policy: tiktok.com/legal/page/eea/privacy-policy/en. You can also contact TikTok via tiktok.com/legal/report/privacy. For Meta, this is set out in Meta's privacy policy: facebook.com/about/privacy. You can read how Google uses the data for statistics and advertising at policies.google.com/technologies/partner-sites.

Your choice and your right to object. You can change your choice at any time via "Cookie preferences" at the bottom of every page. If you withdraw your consent, the pixels and tags stop sending data from the next page you open. You can read more about advertising based on your browsing behaviour, and how to turn it off, at youronlinechoices.eu. Want to object or exercise another right? Email info@karpet24.nl. If your request concerns the data that TikTok or Meta have received, we'll forward it (to Meta within 7 days), or you can contact TikTok or Meta directly.

10. Security

We protect your data with appropriate technical and organisational measures, including:

  • an encrypted connection (HTTPS) across the whole website;
  • access to customer data only for staff who need it;
  • regular updates to our systems;
  • payment data processed only by PCI DSS-certified parties.

If something does go wrong, we report the data breach to the Dutch Data Protection Authority where this is required and, if necessary, to you as well.

11. Changes

We update this privacy policy when the law or our services change. The latest version is always on this page, with the date at the top. We announce major changes on the website and, where appropriate, by email.

12. Contact

Questions about this privacy policy or about your data? Email info@karpet24.nl, call +31 (0)10 299 08 60 or write to CNL Handel BV, Attn. Privacy, Vareseweg 135, 3047 AT Rotterdam.

Karpet24 is a trade name of CNL Handel BV, Vareseweg 135, 3047 AT Rotterdam. KvK 82820228, VAT NL8626.15.756.B01.