Privacy statement

Last updated: October 2026

This privacy statement explains which personal data we process when you visit www.hidalgobagsandmore.de and when you place an order or send an enquiry, for what purposes, on what legal basis, and what rights you have.

1. Controller

RuLe Holding B.V., trading as Hidalgo Bags & More
Platinastraat 52
2718 RZ Zoetermeer
The Netherlands
Phone: +31 (0)79 33 101 33
E-mail: info@hidalgo.nl
Trade register: Kamer van Koophandel (KvK) 69454159

Our contact person for data protection is R. J. A. Blommers, who can be reached at info@hidalgo.nl. Further details can be found in the legal notice (Impressum).

2. Legal bases

We process personal data on the basis of the General Data Protection Regulation (GDPR), in particular:

Art. 6(1)(a) GDPR (consent), for example for statistics and marketing cookies;
Art. 6(1)(b) GDPR (contract and pre-contractual measures), for example for orders, quotations and your customer account;
Art. 6(1)(c) GDPR (legal obligation), for example for tax and commercial retention obligations;
Art. 6(1)(f) GDPR (legitimate interests), for example for the secure operation of the website and communication with business customers.

Where storing or accessing information on your device (cookies and similar technologies) is not technically necessary, we ask for your consent in accordance with Section 25(1) of the German TDDDG.

3. Hosting and server log files

This website runs on our own server, located with OVH SAS (2 rue Kellermann, 59100 Roubaix, France) in a data centre in Frankfurt am Main (Germany). When you visit the website, the server automatically stores information sent by your browser: IP address, date and time of access, page requested, referrer URL, browser type and operating system. We need this data to deliver the website, resolve faults and fend off attacks (Art. 6(1)(f) GDPR). Log files are deleted after 14 days at the latest, unless they are needed to investigate a specific security incident. We have a data processing agreement with the hosting provider.

Fonts and scripts of this website are loaded from our own server. No connection is made to Google Fonts or other font or script services when a page is loaded.

4. Orders, quotations and customer account

When you order from us, request a quotation or create a customer account, we process the data required for this: company name, name of the contact person, billing and delivery address, e-mail address, phone number, VAT identification number, ordered items and print requirements, and any logos or print files you upload. We use this data to answer your enquiry, prepare proofs, carry out, deliver and invoice the order (Art. 6(1)(b) GDPR).

Where necessary for carrying out the order, we pass data on to:

suppliers and printers who produce or print your order (items, quantity, print data and, where applicable, delivery address);
parcel services for delivery (name, delivery address and, where applicable, e-mail address or phone number for shipment notifications);
our accounting and tax advisers.

We retain invoice and order data for as long as statutory retention periods require (in the Netherlands generally 7 years, Art. 6(1)(c) GDPR). You can have your customer account deleted at any time.

5. Payment processing

Payments by credit card, SEPA direct debit, iDEAL, Bancontact, EPS or Link are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland (“Stripe”). You enter your payment details directly with Stripe; we do not receive complete card details. Stripe processes your data for payment processing and fraud prevention (Art. 6(1)(b) and (f) GDPR). Data may be transferred to the USA; Stripe is certified under the EU-US Data Privacy Framework. More information: stripe.com/privacy.

Payments with PayPal are processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (“PayPal”). For this purpose we transfer the data required for payment (name, billing address, e-mail address, order number and amount) to PayPal (Art. 6(1)(b) GDPR). PayPal processes your data under its own responsibility, including for fraud prevention. More information: paypal.com/de/legalhub/privacy-full.

For payment on invoice, we process the invoice data ourselves.

6. Contacting us

If you contact us by e-mail, phone, WhatsApp or via a form on this website, we process your details in order to handle your enquiry (Art. 6(1)(b) or (f) GDPR). Form enquiries are stored on our server and forwarded to us by e-mail. We delete the data once the enquiry has been dealt with and no retention obligations apply. If you contact us via WhatsApp, the privacy policy of WhatsApp Ireland Ltd. also applies.

7. Cookies and consent management

We use technically necessary cookies, for example for the shopping cart, logging in to your customer account, language selection and storing your cookie settings. These cookies are required to operate the shop (Section 25(2) TDDDG, Art. 6(1)(b) and (f) GDPR).

We only set statistics and marketing cookies if you have consented via our cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). To manage your consent we use the Complianz plugin, which runs on our own server. Your choice is stored in a cookie for 12 months. You can change or withdraw your consent at any time with effect for the future, via the “Manage consent” link on every page. An overview of all cookies used can be found in our cookie policy.

We use Google’s consent mode. As long as you have not given consent, Google services do not set statistics or advertising cookies. In that case Google services can only receive cookieless signals that cannot be traced back to you (for example, that a page was viewed).

8. Google Tag Manager

We use Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Tag Manager is a tool we use to integrate and control other services such as Google Analytics and Google Ads on the website. Tag Manager itself does not set cookies or analyse data, but does retrieve your IP address in order to deliver the scripts. The integrated services only become active in accordance with your consent.

9. Google Analytics 4

With your consent (category “Statistics”) we use Google Analytics 4, a web analytics service from Google. Google Analytics records how visitors use our website, for example pages viewed, time spent, device used, approximate location and origin of the visit. IP addresses are not stored by Google Analytics 4. We use the reports to improve our offering. Usage data is retained in Google Analytics for a maximum of 14 months.

Google may also transfer data to the USA. Google is certified under the EU-US Data Privacy Framework. More information: policies.google.com/privacy.

10. Google Ads and conversion tracking

With your consent (category “Marketing”) we use Google Ads with conversion tracking. If you reach our website via a Google ad and then complete an order or quotation request, we and Google learn that the ad led to this transaction, together with the order value. This allows us to measure the success of our advertising and manage our ads.

Enhanced conversions: When you place an order or request a quotation, and provided you have consented to marketing, we transmit your e-mail address to Google in encrypted form (SHA-256 hash). Google matches this value against signed-in Google accounts in order to attribute conversions more accurately and then deletes it. We do not receive any information about you in the process.

With your consent, Google may also use your use of our website to show you relevant ads later (personalised advertising). The legal basis is your consent (Art. 6(1)(a) GDPR). Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. You can also deactivate personalised advertising at adssettings.google.com.

11. Microsoft Advertising (Bing) and conversion tracking

With your consent (category “Marketing”) we use Microsoft Advertising with Universal Event Tracking (UET) from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (“Microsoft”). If you reach our website via an ad in the Bing search engine or other Microsoft services and then complete an order or quotation request, we and Microsoft learn that the ad led to this transaction, together with the order value. This allows us to measure the success of our advertising and manage our ads. Without your consent, Microsoft does not set advertising cookies, thanks to its consent mode.

With your consent, Microsoft may also use your use of our website to show you relevant ads later. The legal basis is your consent (Art. 6(1)(a) GDPR). Data may be transferred to the USA; Microsoft is certified under the EU-US Data Privacy Framework. More information: privacy.microsoft.com. You can deactivate personalised advertising from Microsoft at account.microsoft.com/privacy/ad-settings.

12. Origin of orders

Our shop system WooCommerce records, when an order is placed, how you arrived at our website (for example search engine, ad or direct visit) and on which page you entered. If you came via an ad, we also store the ad’s click ID (gclid or msclkid). This information is stored with the order on our own server. We use it to understand which channels are effective for our business (Art. 6(1)(f) GDPR). Only if you have consented to marketing may the click ID be transmitted together with the order value to the advertising provider concerned in order to attribute the conversion (see sections 10 and 11); otherwise this information is not passed on to third parties.

13. Links to social networks

On our website we link to our profiles on Facebook, Instagram, LinkedIn and YouTube. These are simple links; no data is transferred to these networks when you visit our website. Only when you click a link are you taken to the provider’s page, where its privacy policy applies.

14. Retention period

We only store personal data for as long as is necessary for the respective purpose or as required by statutory retention periods. After that, the data is deleted or anonymised.

15. Your rights

Under the GDPR you have the right to:

access the data we process about you (Art. 15 GDPR);
rectification of inaccurate data (Art. 16 GDPR);
erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR);
data portability (Art. 20 GDPR);
withdraw consent given, with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. You may object to the use of your data for direct marketing at any time without giving reasons.

To exercise your rights, an e-mail to info@hidalgo.nl is sufficient.

Right to lodge a complaint: You can lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence or place of work. The authority responsible for us is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

16. Data security

Transmission between your browser and our website is encrypted using TLS (shown by the padlock symbol in the address bar). We take technical and organisational measures to protect your data against loss and unauthorised access.