I'TEA Supply B.V.
Version 1.0 · Effective 10 August 2026
Privacy at a glance
We use personal data to operate our website, manage customer accounts, process orders and payments, arrange delivery, provide after-sales support, meet legal obligations, protect our business, and — where permitted — communicate about our products and services.
We do not sell personal data. You may contact info@iteasupply.com to exercise your privacy rights or ask a question about this Policy.
1. Who we are and when this Policy applies
I'TEA Supply B.V. is the controller responsible for the personal data described in this Privacy Policy (the Policy):
I'TEA Supply B.V.
Schieweg 87G
2627 AT Delft
The Netherlands
KVK: 83925279
Email: info@iteasupply.com
Telephone / WhatsApp: +31 6 25491808
This Policy applies when you visit our website, create or use an account, request a quotation, place an order, make a payment, receive a delivery, contact us, submit an after-sales claim, subscribe to communications, or otherwise interact with us. Although our webshop is primarily intended for business customers, information about an individual business owner, employee, contact person, recipient, or website visitor can still be personal data protected by the General Data Protection Regulation (GDPR).
2. Personal data we collect
Depending on how you interact with us, we may process:
- Identity and business contact data: name, job title, company name, KVK and VAT details, billing and delivery address, email address, telephone number, and authorised contact details.
- Account data: login identifier, encrypted or securely stored authentication information, account settings, language, customer type, and account activity.
- Order and transaction data: quotations, products, quantities, prices, discounts, purchase history, invoices, credit notes, returns, delivery status, and related correspondence.
- Payment data: payment method, payment status, transaction reference, invoice status, and fraud-control results. Full card or bank credentials are generally collected directly by the relevant payment service provider and are not made available to us.
- Delivery data: recipient name, address, telephone number, delivery instructions, tracking information, proof of delivery, and carrier correspondence.
- Support and claim data: messages, call notes, technical details, product or machine serial numbers, batch or lot numbers, photographs, videos, attachments, fault reports, return information, and requested remedies.
- Website and device data: IP address, device and browser type, operating system, language, referring pages, pages viewed, timestamps, session identifiers, security logs, and cookie or consent preferences.
- Marketing and preference data: newsletter status, communication preferences, campaign interactions, and interests inferred from your relationship with us where permitted by law.
We do not intentionally request special-category data, such as health, biometric, religious, political, or trade-union information. Please do not include unnecessary sensitive information in free-text fields, photographs, videos, or support messages.
3. How we obtain personal data
We collect personal data:
- directly from you, for example through forms, orders, emails, telephone calls, WhatsApp messages, account settings, or claim submissions;
- automatically when you use our website, subject to your cookie choices;
- from your employer, colleague, customer, or another person who lists you as a contact or recipient;
- from payment providers, carriers, distributors, service partners, fraud-prevention providers, and other parties involved in a transaction; and
- from public business registers and other lawful public sources where needed to verify a company, authority, VAT status, or business contact.
If you provide personal data about another person, you must be authorised to do so and, where appropriate, inform that person about this Policy.
4. Why we process personal data and our legal bases
| Purpose | Typical data | GDPR legal basis |
|---|---|---|
| Respond to enquiries, prepare quotations, register accounts, and take steps before an agreement | Identity, contact, company, account, product requirements, and correspondence | Steps at your request before entering a contract; legitimate interests in responding to business enquiries |
| Accept, fulfil, deliver, invoice, and administer orders and services | Account, order, billing, delivery, payment status, and communications | Performance of a contract; legitimate interests where the contract is with your organisation rather than with you personally |
| Process payments, refunds, credit, and debt collection | Transaction, invoice, payment status, bank or provider reference, and correspondence | Performance of a contract; legal obligations; legitimate interests in receiving payment and managing financial risk |
| Provide customer service, technical support, warranties, returns, and after-sales claims | Contact, order, product, technical, photos, videos, claim evidence, and communications | Performance of a contract; legal obligations; legitimate interests in resolving issues and protecting legal rights |
| Maintain accounts, improve our website and services, and understand customer needs | Account activity, purchase history, feedback, device and usage data, preferably aggregated where possible | Legitimate interests in operating and improving our business; consent where required for non-essential cookies |
| Secure our systems and prevent fraud, misuse, unauthorised access, and other incidents | Login, device, IP address, transaction, security logs, and risk indicators | Legitimate interests in security and fraud prevention; legal obligations where applicable |
| Send service messages and relevant business marketing | Contact details, account or order status, preferences, and campaign interaction | Performance of a contract for service messages; legitimate interests or consent for marketing, as required by applicable law |
| Maintain tax, accounting, compliance, recall, and legal records and handle disputes | Invoices, transactions, product traceability, claims, identity, and communications | Legal obligations; legitimate interests in establishing, exercising, or defending legal claims |
Where we rely on legitimate interests, we consider the necessity of the processing and balance our interests against your rights and reasonable expectations. Where processing is based on consent, you may withdraw that consent at any time without affecting processing that took place before withdrawal.
5. When providing data is required
Some information is required to create an account, prepare a quotation, conclude or perform an agreement, deliver products, issue a valid invoice, or meet legal obligations. If required information is not provided, we may be unable to open an account, accept or fulfil an order, process a payment or refund, deliver goods, or assess a claim. Optional form fields will be treated as optional.
6. Who receives personal data
We disclose personal data only where reasonably necessary and may share it with:
- website, ecommerce, customer-management, cloud-hosting, communications, and IT-support providers;
- payment service providers, banks, insurers, credit-control, fraud-prevention, and debt-collection providers;
- warehouses, suppliers, installers, service partners, carriers, customs agents, and delivery providers;
- accountants, auditors, tax advisers, legal advisers, and other professional advisers;
- analytics, advertising, and marketing providers, but only subject to applicable consent and communications rules;
- public authorities, regulators, courts, law-enforcement bodies, or other recipients where disclosure is required by law or necessary to protect legal rights; and
- a prospective buyer, investor, lender, or successor in connection with a genuine corporate transaction, subject to appropriate confidentiality and data-protection safeguards.
Service providers acting on our behalf may process personal data only for the agreed purposes and under appropriate contractual safeguards. Some recipients, such as payment providers, carriers, banks, and public authorities, may also act as independent controllers for their own legally defined purposes. Their own privacy notices may apply. We do not sell personal data.
7. International transfers
We aim to use providers that process personal data within the European Economic Area (EEA). Some providers or their support operations may nevertheless be located outside the EEA. Where personal data is transferred to a country without an applicable European Commission adequacy decision, we use a lawful transfer mechanism, such as the European Commission's Standard Contractual Clauses, together with supplementary safeguards where appropriate. You may contact us for further information about the safeguards relevant to your data.
8. Cookies and similar technologies
Our website may use cookies, local storage, pixels, or similar technologies for the following purposes:
- Strictly necessary: security, network management, shopping-cart functions, checkout, authentication, session continuity, language, and consent settings. These are required for the website or a service you request.
- Preferences: remembering choices that improve convenience.
- Analytics: measuring website use and performance so we can improve the website.
- Marketing: measuring campaigns or presenting relevant advertising across websites.
Where consent is legally required, analytics and marketing technologies are not activated until you consent through the cookie banner. You can accept, refuse, or change non-essential cookie choices through the website's cookie controls. You may also manage cookies in your browser; blocking necessary cookies may prevent parts of the website, account, cart, or checkout from working correctly. The cookie banner or cookie settings available on the website provide the current list and duration of cookies in use.
9. How long we keep personal data
We retain personal data only as long as necessary for the relevant purpose, including contractual, tax, product-safety, warranty, security, and legal-claim requirements. Our general retention criteria are:
| Data or record | General retention period |
|---|---|
| Quotations and enquiries that do not lead to an order | Usually up to 2 years after the last meaningful contact, unless a longer period is needed for a dispute or you ask us to retain an active quotation |
| Customer account and ordinary relationship data | For the active relationship and generally up to 2 years after account closure or the last meaningful interaction, except data retained under another category below |
| Orders, invoices, payments, credit notes, and core tax or accounting records | At least 7 years, or 10 years where a longer statutory period applies, including certain EU VAT One Stop Shop records |
| Delivery, support, warranty, return, and after-sales claim records | For the agreement or warranty period and then as reasonably necessary for product traceability, disputes, and applicable legal limitation periods |
| Security, access, and technical logs | Normally for a limited period appropriate to the security purpose, unless an incident requires longer preservation |
| Marketing subscription and consent records | Until you unsubscribe, withdraw consent, or we end the relevant activity; a minimal suppression record may be retained to ensure we respect your opt-out |
| Cookie data | As stated in the website's current cookie settings and subject to your consent choices where applicable |
We may retain specific records longer where required by law, where a complaint, investigation, recall, chargeback, or dispute is ongoing, or where necessary to establish, exercise, or defend legal claims. When data is no longer required, it is deleted or anonymised.
10. Your privacy rights
Subject to the conditions and exceptions in the GDPR, you may have the right to:
- receive information about how we process your personal data;
- request access to and a copy of your personal data;
- correct inaccurate or incomplete personal data;
- request deletion of personal data;
- restrict particular processing;
- receive certain data in a structured, commonly used, machine-readable format and transmit it to another controller;
- object to processing based on legitimate interests and object at any time to direct marketing; and
- withdraw consent at any time where consent is the legal basis.
To exercise a right, email info@iteasupply.com and state which right you wish to exercise. We may request information needed to verify your identity and protect personal data against unauthorised disclosure. We normally respond within one month; the GDPR allows an extension for complex or numerous requests, in which case we will inform you. Rights are not absolute, and we will explain if a lawful exception applies.
11. Marketing communications
We may send existing or prospective business contacts relevant information about I'TEA products, services, stock, events, or offers where permitted by law. Where consent is required, we will ask for it. You can stop marketing emails at any time by using the unsubscribe link or contacting us. An opt-out does not stop transactional or service messages needed for an account, quotation, order, delivery, safety notice, invoice, or support request.
12. Automated decision-making
We do not currently make decisions based solely on automated processing that produce legal effects or similarly significant effects for you. Automated tools may flag security, payment, or fraud risks, but material decisions are subject to human review where required. If this changes, we will provide the information and safeguards required by law.
13. Security
We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, misuse, or disclosure. These measures may include role-based access, authentication, secure connections, system updates, backups, monitoring, staff instructions, and contractual controls for service providers. No website, transmission, or storage system can be guaranteed completely secure. Please protect your login credentials and contact us promptly if you suspect unauthorised account use or a data-security incident involving our services.
14. Children
Our website and business services are not directed to children, and we do not knowingly collect personal data directly from children for marketing or account registration. If you believe a child has provided personal data to us without appropriate authorisation, please contact us so we can assess and, where required, delete it.
15. Third-party websites and services
Our website may link to third-party websites, platforms, payment pages, maps, social media, or other services. Those parties determine their own processing and privacy practices. This Policy does not govern an independent third party's website or service, and we encourage you to read the relevant privacy notice.
16. Changes to this Policy
We may update this Policy when our website, services, providers, or legal obligations change. The current version will be published on this page with its effective date. If a change materially affects how we use personal data, we will take reasonable steps to provide additional notice where required.
17. Contact and complaints
For privacy questions or requests, contact:
Email: info@iteasupply.com
Telephone / WhatsApp: +31 6 25491808
Address: I'TEA Supply B.V., Schieweg 87G, 2627 AT Delft, The Netherlands
You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or, where applicable, the supervisory authority in your country of residence or work. We would appreciate the opportunity to address your concern directly first, but this does not affect your right to complain to a supervisory authority.
When contacting us about a privacy request, please do not send identity documents or other sensitive information unless we specifically request an appropriate verification method.