Consumer privacy policy

Pago Nederland · Green Acres B.V.

Version dated 20 September 2026

This policy explains how Green Acres B.V. uses personal data when you visit the Pago Nederland online shop, place personal orders, make payments, receive deliveries and contact customer service. It describes the data we need, who we share it with, how long we keep it and how you can exercise your privacy rights.

1 Who is responsible

Green Acres B.V. determines why and how personal data is processed for the business activities described here. Pago Nederland is the name of our online shop; Green Acres B.V. remains your point of contact.

Green Acres B.V.
Gooiland 38, 1948 RC Beverwijk, the Netherlands
Chamber of Commerce 72042273 · VAT NL858959859B01
Email: contact@greenacrefoods.nl
Telephone: +31 6 21412366

2 The data we receive

When you place an order, we receive your name, billing and delivery addresses, email address, products ordered, quantities, amounts and order number. If you provide a telephone number, we use it to contact you about your order or delivery. You do not need to include sensitive personal data, a Dutch citizen service number (BSN) or a copy of your identity document with your order.

For payments and refunds, we receive information including the payment status, amount, payment method, transaction references and, where necessary, account details. Your bank or payment provider processes the information you use to authorise payment. Never share PINs, banking passwords or security codes with our customer service team.

For an enquiry, complaint, return or cancellation, we process your contact details, correspondence, order details and the information you send us. For damage, please send only photographs needed to assess the problem. If you use a customer account, we also process the associated account information.

The shop and its technical service providers also process technical data, such as IP addresses, browser and device details, pages visited, basket information and your privacy choices. The additional data that may be collected depends on the function used and your consent.

3 How we use data

Ordering and delivery. We use your order and contact details to fulfil your purchase, process payment, send parcels, keep you informed about your order and arrange returns or refunds. The legal basis is performance of the contract or steps you request before a purchase. Without the necessary information, we cannot process or deliver your order.

Enquiries and service. For questions about an order, the legal basis is performance of the contract. For general enquiries, we rely on our legitimate interest in being accessible and responding carefully to your request. A legal obligation may also apply in relation to statutory consumer rights.

Administration and legal obligations. We process the necessary data for our bookkeeping, tax records and compliance with legal requests. The legal basis is a legal obligation. We do not automatically retain all technical or marketing data for this purpose.

Security and disputes. We use necessary technical data and correspondence to investigate misuse, protect payments and the shop, and handle legal claims. Our legal basis is our legitimate interest in operating securely and protecting our rights. We limit processing to what is reasonably necessary and take your interests into account.

4 Who receives data

Shopify provides the platform for the shop, basket, checkout and order processing. Shopify processes customer and technical data for these purposes. Depending on the service used, Shopify acts as our data processor or as an independent controller. Shopify’s privacy information describes its own services and any additional data processing: https://www.shopify.com/legal/privacy/consumers.

The payment provider and bank involved in your chosen payment method receive the data needed to process the payment, check for fraud and issue any refund. These parties may act as independent controllers for their statutory payment and verification responsibilities. The payment method used is visible before you confirm payment.

Green Acres packs your order itself. For delivery, we share your name, delivery address and necessary contact and shipping details with the carrier and, if used, the shipping-label service. The carrier may use these details to deliver your parcel, send a delivery notification and investigate a problem with your parcel.

Our email and IT service providers may process data to send messages and provide storage, maintenance and security. We use accounting software for our administration, and our bookkeeper or accountant may receive the necessary data. Public authorities, advisers or insurers receive data only when a legal obligation or a specific need exists.

We give service providers only the access needed for their tasks and enter into data-processing agreements where required. We do not sell your customer data.

5 Processing outside Europe

Shopify and other international service providers may also process data outside the European Economic Area. Shopify identifies Canada and Singapore among these locations. These services use the applicable safeguards for transfers, such as an adequacy decision, binding corporate rules or European standard contractual clauses, with additional measures where necessary.

The arrangements concerning Shopify and international transfers are set out at https://www.shopify.com/legal/dpa. You can contact contact@greenacrefoods.nl for information about the safeguards that apply to your data and how to obtain a copy.

6 How long we keep data

We retain data for as long as it is needed for the purpose for which it was collected. We then delete or anonymise it, unless a legal obligation or an ongoing dispute requires longer retention.

We retain invoices and data forming part of our basic tax records for the statutory retention period, generally seven years. That period starts when the statutory retention obligation begins; we do not apply it indiscriminately to all shop data.

We retain general customer enquiries and correspondence that are not part of our accounts or a dispute for up to two years after resolution. We retain return, complaint and dispute data while the matter is ongoing, and afterwards only for as long as needed for legal obligations or to substantiate legal claims.

We retain account information while the account is in use. If you ask us to delete the account, we delete data that is no longer needed; any invoice data remains subject to its own retention period. We assess abandoned orders, technical logs and security data for necessity and delete them once their original purpose no longer applies. For security incidents, we retain only data relevant to investigation and resolution.

Cookies and similar storage are subject to the duration of the technology concerned. Shopify describes its cookies at https://www.shopify.com/legal/cookies. Your browser may remove stored data sooner. We retain consent records for as long as necessary to respect your choice and demonstrate that processing was lawful.

7 Cookies and your choices

Essential cookies and similar technologies support functions including the basket, checkout, security and remembering privacy choices. We do not ask for consent for this essential operation. For advertising tracking and other technologies that require consent, we ask before using them.

You can reject optional cookies and change your choice later through ‘Cookie preferences’ in the shop footer. Withdrawing consent is as easy as giving it. Rejecting optional cookies does not prevent a normal order. You can also delete cookies in your browser; completely blocking essential storage may disrupt checkout.

8 Marketing and other websites

Order confirmations, payment messages and delivery updates are part of your purchase. We do not treat your order as consent to newsletters or advertising tracking. If we ask for marketing consent, that choice is separate and you can unsubscribe later. Unsubscribing from marketing does not stop necessary messages about an ongoing order.

If you open the Green Acres contact form from the shop, Green Acres B.V. remains your point of contact. Additional information about that form, storage and transmission through the Green Acres website is available at https://www.greenacrefoods.nl/en/privacy/. This policy continues to apply to the processing of your Pago order.

When you open an external service yourself, such as WhatsApp, Instagram or a payment service, that service processes data under its own privacy information. Using such a service does not constitute consent to receive unsolicited marketing through our shop.

9 Security and payment checks

We restrict access to customer data to people who need it for their work and use appropriate technical and organisational security measures. No system can guarantee complete security. If you suspect misuse of your data or a security problem, please report it to contact@greenacrefoods.nl.

Banks and payment providers may carry out automated security and fraud checks. A payment may therefore require additional verification or be declined. If this affects your order, contact us so we can assess the situation. You can also contact the bank or payment provider about its decisions; its privacy information describes its checks and your rights.

10 Your privacy rights

You can ask us to let you access, correct or delete your data, or restrict its use. Subject to the statutory conditions, you can have your data transferred. You may object to processing based on our legitimate interest. You can always object to direct marketing. You can withdraw consent at any time; earlier lawful processing remains valid.

Send your request to contact@greenacrefoods.nl. We normally respond within one month. If the complexity or number of requests requires an extension, we will tell you within that month and explain why. We ask for additional identity information only when necessary to protect your data; do not send an unsolicited copy of your identity document.

Immediate deletion is not always possible, for example where a statutory retention obligation applies. We will explain which data we must keep and why. You can also lodge a complaint directly with the Dutch Data Protection Authority at https://autoriteitpersoonsgegevens.nl or with the competent data protection authority in your country of residence.

11 Changes

We update this policy when our shop or data processing changes. The version date is shown at the top. Where necessary, we will inform you separately of significant changes. If a new use requires consent, we will ask for it beforehand.