Privacy policy
FOREFACT privacy policy
Version: 2 November 2026
In this privacy policy, you can read which personal data FOREFACT processes, why we do so, which parties we work with, how long we keep data and what rights you have. We only process personal data for the purposes set out below and no more data than is necessary for those purposes.
1. Who is responsible?
FOREFACT is a trade name of a Dutch sole proprietorship (eenmanszaak). The owner of this sole proprietorship is the controller for the personal data processed via forefact.eu.
- Name: FOREFACT
- Address: Soestdijksekade 694, 2574 EA 's-Gravenhage, the Netherlands
- KvK number (Dutch Chamber of Commerce): 95379606
- VAT identification number: NL005149033B41
- Email: info@forefact.nl
- Phone: +31 6 14908591
- Website: https://forefact.eu
For questions about privacy or to exercise your rights, email info@forefact.nl. FOREFACT does not have a data protection officer; this is not mandatory for us.
2. Which personal data do we process, and why?
2.1 Orders and digital delivery
When you buy something, we process:
- your email address;
- your name and billing address (country, address, postcode and town or city);
- your phone number, if you enter it (this is not mandatory);
- your order number, the products purchased, the amounts and any discount code;
- the payment method and the payment status;
- your consent to immediate digital delivery: the box you tick in the basket, with the consent text (and version) and the time at which you did so;
- data about making your files available and downloading them.
We deliver your files via the Shopify app Digital Products. We automatically check whether your consent to immediate delivery has been recorded with your order. If it is missing, the order receives an internal flag and we receive a notification. This never automatically leads to cancellation or a refund.
Purpose: to process your order, deliver your files, send you a confirmation, answer questions about your order and demonstrate that you consented to immediate delivery.
Legal basis: performance of the contract and legal obligations (such as the tax retention obligation and the right of withdrawal).
Retention period: 7 years, because of the tax retention obligation. If we pay the VAT on sales to consumers in other EU countries through the EU One Stop Shop Union scheme (OSS), we keep the data on those sales for 10 years, as required by law.
If you choose ‘Remember me’ or Shop Pay at checkout, or use the Shop app, you are using Shop, a service of Shopify. Shopify processes that data in accordance with its own privacy policy.
2.2 Payments
You pay using one of the payment methods shown at checkout:
- Shopify Payments for payment cards (Visa, Mastercard, American Express, Maestro and UnionPay), Apple Pay, Google Pay, Shop Pay, Bancontact and Klarna. Shopify Payments is provided by Shopify International Limited (Ireland), which uses payment service providers such as Stripe Payments Europe, Limited for this purpose.
- iDEAL | Wero via Mollie B.V., Keizersgracht 121, 1015 CJ Amsterdam.
- PayPal via PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg.
Depending on your payment method, data is processed such as your name, email address, payment method, transaction ID, amount, payment status, any refunds and the account or card details needed for the payment. FOREFACT does not receive full card numbers.
Mollie, PayPal and Klarna (Klarna Bank AB (publ), Stockholm) process your data for the payment and for their own legal obligations as financial service providers. They are themselves responsible for this, in accordance with their own privacy statements. If you choose to pay later with Klarna, Klarna may carry out a credit check.
- Mollie: https://www.mollie.com/nl/privacy
- PayPal: https://www.paypal.com/nl/legalhub/paypal/privacy-full
- Klarna: https://www.klarna.com/nl/privacy/
Apple Pay and Google Pay are offered by Apple and Google, under their own terms. Payment providers use automated checks to prevent fraud. If a payment is declined as a result, please contact us.
Purpose: to process payments, make refunds, prevent fraud and keep the financial records.
Legal basis: performance of the contract, legal obligations and our legitimate interest in preventing fraud.
Retention period: 7 years (financial records), or 10 years for sales through the Union scheme (OSS). Payment providers also apply their own statutory retention periods.
2.3 Withdrawing from a purchase
You can withdraw from a purchase via the ‘Withdraw from contract’ link at the bottom of every page of forefact.eu. For this, we use the Shopify app EU Widerruf Button (EW: EU Withdrawal Button & Form) from 401layers UG (haftungsbeschränkt), Dorothea-Erxleben-Str. 1a, 40721 Hilden, Germany. This party processes the data on our behalf; we have concluded a data processing agreement with it. For this purpose, the app has access to customer and order data in our shop.
We then process:
- your name and email address;
- your order number, if you enter it (this is not mandatory);
- the products your withdrawal relates to and the content of your statement;
- the date and time of receipt and the withdrawal ID;
- technical data needed to make the form work, such as your IP address and browser data.
You automatically receive an acknowledgement of receipt by email, sent via the app from noreply@euwiderrufsbutton.com. We receive a copy of your request at info@forefact.nl.
Purpose: to receive, confirm and process your withdrawal, including any refund.
Legal basis: legal obligation and performance or termination of the contract.
Retention period: in the app, withdrawal requests are automatically deleted after 6 months. 401layers keeps technical logs and a record of that deletion in accordance with its own periods. We keep the copy in our mailbox for up to 2 years after the request has been dealt with, unless we need it longer for a dispute. If your withdrawal leads to a refund, that refund forms part of our financial records and we keep it for 7 years (10 years for sales through the Union scheme (OSS)).
We never use a withdrawal for marketing.
2.4 Contact and customer service
You can reach us by email (info@forefact.nl), via the contact form at forefact.eu/pages/contact or via the chat on the website. In doing so, we process your name, email address, your phone number if you enter it, the content of your message and, where relevant, your order details. This also applies if you request research via the contact form.
The contact form and the chat (Shopify Inbox) are services of Shopify. Our email is hosted by Mijndomein (the Netherlands).
Purpose: to answer your question, handle your request or solve a problem.
Legal basis: performance of the contract or our legitimate interest in answering questions properly.
Retention period: up to 2 years after the matter has been dealt with, unless we need the data longer for a dispute or a legal obligation.
2.5 Newsletter and welcome discount
You can sign up via the sign-up form on the website or with the ‘Email me with news and offers’ checkbox at checkout. We then process your email address, the date and method of sign-up and your subscription status. We send the newsletter with Shopify Messaging, from info@forefact.nl.
What you may receive from us:
- after signing up, a welcome email with a discount code;
- newsletters about new guides, programmes, Founder Stories and offers;
- if you have signed up and do not complete an order: a reminder, about 10 hours later. If you have not signed up for the newsletter, you will not receive that reminder.
We measure which links in our emails are clicked. We only measure whether you open an email if you give permission for this in the email itself. Shopify also uses this data to determine which subscribers receive emails first.
Purpose: to inform you about new products and offers and to improve our emails.
Legal basis: consent. You can withdraw your consent at any time via the unsubscribe link at the bottom of every email.
Retention period: for as long as you are subscribed. After you unsubscribe, we keep a record of your unsubscription so that we no longer send you the newsletter. If you also want us to delete your email address and other data, email us; data we are required by law to keep, such as orders, will be retained.
2.6 Review invitations via Trustpilot
About a day after your payment, we send you an invitation via Trustpilot to review your experience with FOREFACT. You receive at most one invitation per order, without reminders. For this, we share your name, email address, order number and the date of your order with Trustpilot A/S, Pilestræde 58, 1112 Copenhagen K, Denmark. Trustpilot sends the invitation on our behalf and may record whether you open the invitation.
Don’t want to receive an invitation? Email us at info@forefact.nl and we won’t send you one. If you post a review yourself, Trustpilot is responsible for it, in accordance with its own privacy policy.
Purpose: to collect customer experiences and improve our service.
Legal basis: our legitimate interest in collecting customer feedback. We point this out to you in the basket, and you can always object.
Retention period: under its agreements with us, Trustpilot keeps invitation data for a maximum of 2 years.
2.7 Website use, statistics and advertising
On their first visit, we ask visitors from Europe via a cookie notice whether they allow cookies for statistics and marketing. You can accept everything, refuse everything or choose for yourself. You can change your choice at any time via ‘Cookie preferences’ at the bottom of every page. Refusing has no consequences for ordering.
We always use strictly necessary technologies, for example for the basket, the checkout, security and remembering your cookie choice. This involves processing technical data, such as your IP address and browser data.
Only if you consent to statistics do we use:
- Google Analytics 4 from Google Ireland Limited, to see how the website is used (pages visited, device, referring website and similar data). Event data is deleted after 2 months, user-level data after 14 months.
- Shopify’s statistics on the use of the online shop.
Only if you consent to marketing do we use:
- the Meta pixel and the Conversions API from Meta Platforms Ireland Limited (Facebook and Instagram);
- the TikTok pixel and the Events API from TikTok Technology Limited (Ireland).
Through these technologies, we share what you do on forefact.eu, such as viewing products, searching, adding something to the basket, checking out and completing a purchase. We also share data you enter at checkout or in a form, such as your email address, phone number, first and last name, town or city, province, postcode and country. This data is first converted into a code (hash), which Meta and TikTok can match with data they already hold. Meta and TikTok use this to measure ads, link you to your account with them and target ads better. They also use the data for their own purposes, in accordance with their own privacy policies.
We are jointly responsible with Meta for collecting and transmitting this data via the Meta pixel and the Conversions API. We take care of the information in this privacy policy and of your consent. Meta is itself responsible for what it does with the data afterwards and for requests about that processing: https://www.facebook.com/privacy/policy
Purpose: to make the website work and keep it secure, analyse its use and measure and improve ads.
Legal basis: our legitimate interest for strictly necessary technologies; your consent for statistics and marketing.
Retention period: see the cookie table in section 5 and the Google Analytics periods above. Meta and TikTok also apply their own retention periods.
2.8 Use of data by Shopify (Shopify Network Intelligence)
Our shop uses Shopify Network Intelligence. With it, Shopify uses customer data from our shop, together with other data Shopify holds, to improve its services, ad targeting and personalisation. Other shops cannot see your data in the process. This feature is required for, among other things, our newsletter and automated emails via Shopify Messaging, the Shop app and the payment methods Shopify offers at checkout.
Purpose: to be able to use these Shopify features. Shopify also uses the data for its own purposes, including advertising and personalisation; Shopify is itself responsible for this, in accordance with its privacy policy: https://www.shopify.com/legal/privacy
Legal basis: our legitimate interest in using these Shopify features.
Retention period: Shopify determines the retention period for its own use. If you want to object to this, email us at info@forefact.nl. We can then, for example, delete your customer data from our shop, to the extent that we are not required by law to keep it.
2.9 Help with managing the online shop: Claude from Anthropic
We use Claude, an AI assistant from Anthropic, as a tool for managing the online shop. Claude is connected to our Shopify shop and can therefore view customer and order data, such as name, email address, phone number, address, order details and technical data (IP address, browser and location). We do not use Claude to make decisions about you.
Purpose: to manage and check the online shop efficiently.
Legal basis: our legitimate interest in managing the online shop efficiently.
Retention period: we only let Claude view data that is needed for the task. Anthropic keeps conversations in accordance with its own retention periods.
3. Who do we share personal data with?
FOREFACT does not sell personal data. We only share data if this is necessary for our services, if you have consented to it or if the law requires us to do so.
| Party | Purpose | Role |
|---|---|---|
| Shopify International Limited (Ireland) | online shop, checkout, order management, digital delivery (Digital Products), sign-up form (Forms), contact form, chat (Inbox), email and newsletter (Messaging), automated checks (Flow), statistics | processor; independently responsible for Shop, Shop Pay and Shopify Network Intelligence |
| Shopify Payments (Shopify International Limited with Stripe Payments Europe, Limited and other payment service providers) | card, Apple Pay, Google Pay, Shop Pay, Bancontact and Klarna | processor; the payment service providers are partly independently responsible |
| Mollie B.V. (the Netherlands) | iDEAL | Wero | independently responsible |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) | PayPal | independently responsible |
| Klarna Bank AB (publ) (Sweden) | Klarna | independently responsible |
| 401layers UG (haftungsbeschränkt) (Germany) | withdrawal function | processor |
| Trustpilot A/S (Denmark) | review invitations | processor; independently responsible for posted reviews |
| Google Ireland Limited (Ireland) | Google Analytics 4 | processor |
| Meta Platforms Ireland Limited (Ireland) | ad measurement and advertising | jointly responsible with us for collection and transmission; independently responsible thereafter |
| TikTok Technology Limited (Ireland) | ad measurement and advertising | independently responsible for its own use of the data |
| Anthropic (Ireland and United States) | help with managing the online shop | in accordance with Anthropic’s terms |
| Mijndomein (the Netherlands) | hosting of our email | processor |
| Dutch Tax Administration (Belastingdienst) and other competent authorities | if the law requires us to do so | independently responsible |
4. Processing outside the European Economic Area
Shopify stores our shop’s data in the European Union. Some parties have establishments or service providers outside the European Economic Area (EEA), mainly in the United States and Canada. For parties working on our behalf, we agree a safeguard. Parties that are independently responsible arrange their own safeguard; we list these below based on their own information.
- Shopify: the European Commission’s adequacy decision for Canada and, for other countries, Binding Corporate Rules and standard contractual clauses.
- Google and Meta: the EU-US Data Privacy Framework, under which Google LLC and Meta Platforms, Inc. are certified.
- Mollie: standard contractual clauses.
- PayPal: Binding Corporate Rules.
- TikTok: according to its own statement, standard contractual clauses. Data may also be accessed from countries outside the EEA, including China. In 2025, the Irish supervisory authority ruled that the transfer to China did not comply with the GDPR; those proceedings are still ongoing.
- Anthropic: according to its own statement, the European Commission’s standard contractual clauses.
- 401layers and Trustpilot: they also use service providers outside the EEA, with an adequacy decision or standard contractual clauses as a safeguard.
Would you like to know more about these safeguards? Email us at info@forefact.nl.
5. Cookies and similar technologies
Below are the main cookies on forefact.eu. Statistics and marketing cookies are only placed after you consent to them.
| Cookie | From | Purpose | Duration |
|---|---|---|---|
| _shopify_essential | Shopify | session, checkout and security | 1 year |
| _shopify_cmp | Shopify | remembering your cookie choice | 1 year |
| cart, cart_currency | Shopify | your basket | 2 weeks |
| localization | Shopify | country and language | 1 year |
| _shopify_analytics | Shopify | statistics (only with consent) | 1 year |
| _ga, _ga_NBJWRWRE3W | Google Analytics | statistics (only with consent) | 2 years |
| _shopify_marketing | Shopify | marketing (only with consent) | 1 year |
| _fbp, _fbc | Meta | ad measurement (only with consent) | up to 90 days |
| _ttp, ttcsid, ttcsid_[pixelcode], ttclid and similar TikTok cookies | TikTok | ad measurement (only with consent) | 13 months after last use |
If you use Shop Pay or log in with Shop, Shopify places its own Shop cookies for this. You can also delete cookies at any time via your browser settings.
6. Security
We take appropriate technical and organisational measures to protect your data, such as:
- secure connections via HTTPS;
- two-step verification where available;
- restricted access to our management systems;
- only the access rights needed for connected services;
- regular checks of our integrations.
No system is completely secure. Do you think something is wrong with security? Then email us at info@forefact.nl.
7. Your rights
Depending on the situation, you have the right to:
- access your data;
- have incorrect data corrected;
- have your data deleted;
- have the processing restricted;
- object to processing based on legitimate interest, including the invitations via Trustpilot;
- object to direct marketing;
- have your data transferred;
- withdraw your consent. This does not affect what we have done with your consent up to that point.
Send your request to info@forefact.nl. We may ask you to confirm that the request comes from you. We respond within one month. For complex or numerous requests, we may extend that period by two months; we will let you know within one month if we do. We cannot delete data that is subject to a statutory retention obligation, such as our financial records, before that obligation allows.
8. Required data and automated decision-making
To carry out your order, we need at least a working email address, your name and billing address (among other things for the invoice and the correct VAT rate) and the payment details. Without this data, we cannot carry out your order. Signing up for the newsletter and consenting to statistics and marketing cookies are voluntary.
FOREFACT does not take decisions about you that are based solely on automated processing and that have legal effects or similarly significant effects on you. The payment providers’ fraud checks and Klarna’s credit check are described in section 2.2.
9. Children
Our products are not intended for children under the age of 16. We do not ask children under 16 for consent without the consent of a parent or legal guardian. If it turns out that we are nevertheless processing data of a child under 16 on the basis of consent, we will delete it, unless we are required by law to keep it.
10. Complaints
Do you have a question or complaint about how we handle your data? Email us at info@forefact.nl. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): https://autoriteitpersoonsgegevens.nl
11. Changes
We update this privacy policy when our services, the systems we use or the law change. The current version is always available on forefact.eu, with the version date at the top.