This page explains which personal data Hoptimaal uses, why, which cookies we set and what your rights are. Version 17 October 2026.
1. Who we are
Hoptimaal is a trade name of Tuyll, the sole proprietorship of Tjapco Epskamp. We are responsible (the controller) for processing your personal data.
- Tuyll trading as Hoptimaal, Leeghwater 5, 3825 MR Amersfoort, the Netherlands
- Chamber of Commerce (KvK) 60512377, VAT NL002262723B37
- Email: info@hoptimaal.nl (also for all privacy questions)
- Phone: +31 85 130 1591 (Monday to Saturday, 12:00 to 18:00 CET)
This statement applies to the webshop at hoptimaal.com (including /en and /de) and hoptimal.de, to our shop at the same address and to the emails we send. We do not have a data protection officer. You can contact us about anything at info@hoptimaal.nl.
2. What data we use and why
We only use data we need. For each purpose, the table shows which data it is, the legal basis under the GDPR (Article 6) and how long we keep it. After that we delete or anonymise it.
| What | Which data | Why | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|---|---|
| Ordering and delivery | Name, address, email address, phone number, your order, choice of home delivery or a DPD pickup point, shipping status | To process, pack and ship your order. To send you a confirmation, a shipping email with tracking and, if you return something, a return label by email. | Performance of the contract (1)(b). Keeping records for the tax authorities: legal obligation (1)(c). | 7 years (tax retention obligation) |
| Payment | Payment method, amount, payment status, limited card details (such as the last 4 digits) | To handle your payment, issue refunds and prevent fraud. We never see your full card number. The payment provider processes it. | Contract (1)(b). Fraud prevention: legitimate interest (1)(f). | 7 years |
| Age verification | By placing an order, you declare that you are 18+. On delivery, DPD checks your age using your ID; we do not receive a copy of it. | We may only sell and deliver alcohol to people aged 18 and over. | Legal obligation (1)(c), Dutch Alcohol Act (Alcoholwet), Article 20a | With your order, 7 years |
| Customer service and contact form | Name, email address, phone number, order number, your message and our reply. The contact form uses hCaptcha against spam. This processes technical data such as your IP address. | To handle your question, complaint or report of a defect. To keep out spam. | Contract (1)(b) if it concerns an order. Otherwise legitimate interest (1)(f): helping you properly and keeping our form free of spam. | 2 years after we have dealt with it |
| Account | Name, email address, addresses, order history | So you can log in, see your orders and check out faster. | Contract (1)(b) | As long as your account exists. Order data 7 years. |
| Beer Club and gift subscription | Name, address, email address, payment method (stored by the payment provider), billing date, your boxes, pauses and cancellation. For a gift subscription also the name and address of the recipient. | To run your subscription: charge and ship every month, let you pause and cancel, and email confirmations. | Contract (1)(b). For the gift recipient's data: legitimate interest (1)(f), delivering the gift. | As long as the subscription runs. After that, order and payment data 7 years. |
| Points and beer passport | Email address or customer number, orders, points, redemptions, the beers you bought from us by style, country and brewery | To track and redeem your points, warn you before points expire and show your beer passport. | Contract (1)(b): the points programme | As long as your account exists. Points expire 12 months after your last order. If you ask us to delete them or you delete your account, we erase your points and passport data within one month. |
| Newsletter | Email address, first name if you give it, language and country, when and where you signed up, which emails you open and click, your purchases. Our signup forms are for people aged 18+ only. | To send you news, new beers and offers that suit you. You get 100 points when you sign up. | Consent (1)(a) | Until you unsubscribe. After that we keep only your email address on a suppression list, so you really get nothing more. |
| Emails to customers about similar products | Email address, name, what you bought and when, whether your order was delivered | A review request after delivery, an email if you have not ordered for a while (winback) and tips on beers similar to what you bought. | Legitimate interest (1)(f): telling customers about our own similar products. Article 11.7(4) of the Dutch Telecommunications Act allows this, because you can unsubscribe for free with one click in every email, or by emailing us. | Until you unsubscribe |
| Abandoned cart reminder | Email address, the contents of your cart or checkout, time | To send you one or a few reminders if you did not complete an order. | Consent (1)(a) if you signed up for emails. If you are already a customer, legitimate interest as above (1)(f). | Until you unsubscribe |
| Back-in-stock alert | Email address, the product | To let you know a beer is back in stock. | Consent (1)(a): you ask for it yourself | Until the alert is sent or you unsubscribe |
| Taste Finder (Smaakwijzer) | Your answers (taste direction, who it is for) and your email address | To send you a welcome email with beers that match your answers. We only store your answers if you sign up for emails. | Consent (1)(a) | Until you unsubscribe |
| Withdrawal notices | Name, email address, order number, which products, date of your notice | To process your withdrawal, send you an immediate acknowledgement, arrange the return and refund you. | Legal obligation (1)(c) and contract (1)(b) | 7 years, with your order |
| Website statistics | Cookie ID, pages and products viewed, clicks, device, browser, IP address | To understand how visitors use the site so we can improve it (Google Analytics and Shopify). | Consent (1)(a) via the cookie banner | Cookies: see the cookie overview. Data in Google Analytics: for as long as set in Google Analytics, at most 14 months. |
| Advertising | Cookie IDs, products viewed, cart, purchases and amount. With an order, encrypted (hashed) contact details may also be shared, so Meta and Google can link a purchase to an ad. | To measure which ads work and show ads on Facebook, Instagram and Google. To show our products in Google Shopping. | Consent (1)(a) via the cookie banner | Cookies: see the cookie overview. After that, Meta and Google keep data under their own policies. |
| Shop and till | What you buy, payment method and amount, gift card used. If you wish, we link your purchase to your account, for example to earn points. Card payments go through the payment terminal of our card payment provider. | To process your purchase in our shop (Shopify POS) and keep our records. | Contract (1)(b) and legal obligation (1)(c) | 7 years |
Do you have to give us this data? For an order we need your name, address and email address. Without them we cannot deliver. By placing an order, you declare that you are 18+. Emails and cookies for statistics and advertising are always your free choice.
Legitimate interest. Where we rely on legitimate interest, we have checked that our interest does not outweigh your privacy. You can always object to this (see section 8).
3. Emails from us
- Service emails about your order, your Beer Club, your withdrawal or your points are always sent. They are part of the service.
- The newsletter is only sent if you signed up. You do that yourself with a tick box or form.
- As a customer you may receive emails about similar beers, a review request or a winback email. If you do not want them, unsubscribe via the link in the email or let us know.
- Every email has an unsubscribe link at the bottom. Unsubscribing is free and takes one click.
We only email people aged 18 and over. Our emails are sent by Klaviyo. Klaviyo records whether you open an email and what you click, so we can see what interests you.
4. Profiling
We group the recipients of our emails based on what you bought, what you viewed (only with consent via the cookie banner), how often you order and your answers in the Taste Finder. This way you get emails about beers that suit your taste. We do not make decisions on that basis that have legal effects for you or affect you in a similar way. You can always object to this grouping. Unsubscribe from emails or send us an email and we will stop.
5. Who receives your data
We never sell your data. We only share it with parties we need to run the webshop. With processors working on our behalf we have agreements on security and confidentiality.
| Party | Purpose | Country |
|---|---|---|
| Shopify (Shopify International Ltd.) | Webshop, checkout, customer accounts, Shopify Payments, Shop Pay, the cookie banner and the till in our shop (Shopify POS) | Ireland, with processing in Canada and the US |
| Klaviyo, Inc. | Email (newsletter, welcome, cart reminder, review request, winback, back in stock, Beer Club, Taste Finder), signup forms and customer profiles. Tracking on the site only with consent. | US |
| Meta Platforms Ireland Ltd. | Ads on Facebook and Instagram via the Meta pixel, only with consent | Ireland, with transfer to the US |
| Google Ireland Ltd. | Google Ads (conversions), Merchant Center and Shopping, Google Analytics (only with consent), Google Workspace (our email at info@hoptimaal.nl). Some pages load fonts from Google Fonts; Google then sees your IP address. Links to Google Maps load nothing until you click them. | Ireland, with transfer to the US |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Paying with PayPal | Luxembourg, with transfer to the US |
| Coinbase and Stripe, the partners of Shopify Payments for USDC | Paying with USDC (crypto) | US |
| DPD Nederland B.V. and DPD partners in the country of delivery | Delivery, tracking, pickup points, age check at the door | The Netherlands and the country of delivery |
| WebShopAssist (app "WSA DPD Integration") | Link between Shopify and DPD | Romania |
| PostNL and its partners in the destination country (such as Royal Mail in the UK) | Delivery and track & trace of shipments to the United Kingdom, Norway and Switzerland, customs clearance | Netherlands and the destination country |
| MyParcel | Shipping labels and customs data for PostNL shipments | Netherlands |
| Seal Subscriptions | Beer Club subscriptions | Canada (servers in Toronto) |
| hCaptcha (Intuition Machines, Inc.) | Spam filter on the contact form | US |
| Hetzner Online GmbH | Our own server: points and beer passport, shipping labels, pickup point choice, withdrawal notices and links between our systems | Germany (Nuremberg) |
| Our accountant | Our accounts and tax returns | The Netherlands |
| Authorities | Only if the law requires it, for example the Dutch tax authorities | The Netherlands |
Some parties also use data for their own purposes. Meta and Google do so with advertising data. For the collection through the pixel on our site we are jointly responsible with them. What they do afterwards is covered by their own privacy policies. PayPal, DPD and Shopify (for Shop Pay) are also partly responsible themselves.
Transfers outside the EEA
Shopify, Klaviyo, Meta, Google, PayPal, Coinbase, Stripe and hCaptcha also process data in the US. This is only allowed with proper safeguards. We rely on the EU-US Data Privacy Framework, for parties certified under it, and/or the European Commission's standard contractual clauses. For Canada (Shopify and Seal Subscriptions), the European Commission has decided that the protection there is adequate. Would you like a copy of the safeguards? Email us.
6. Security
- The webshop and checkout only work over an encrypted connection (https).
- Payments go through the payment providers. Your full card number never reaches us.
- Our own server is hosted by Hetzner in Germany. We only manage it over a secure connection.
- We only give access to customer data to people who need it for their work.
- If something goes wrong with your data, we report it to the Dutch Data Protection Authority and to you where required.
7. Retention
We do not keep data longer than needed. The period for each purpose is in the table in section 2. We must keep order and invoice data for 7 years for the tax authorities. Your account exists until you close it. Marketing data is kept until you unsubscribe.
8. Your rights
You have these rights:
- Access: you may know what data we hold about you.
- Rectification: if something is wrong, we correct it. You can change a lot yourself in your account.
- Erasure: you may ask us to delete your data. What we must keep by law, such as invoices, we keep until the period ends.
- Restriction: you may ask us to stop using your data for a while, for example while we look into a question from you.
- Portability: you may receive the data you gave us in a common file format, to pass it on to someone else.
- Objection: you may object when we use data on the basis of legitimate interest. You can always object to direct marketing and the profiling for it. We then stop immediately.
- Withdrawing consent: if you gave consent, you can always withdraw it. For email via the unsubscribe link, for cookies via Cookie preferences. What we did before remains lawful.
Email your request to info@hoptimaal.nl. You will get a reply within one month. It is free. Sometimes we ask you to show that the data is really yours, so it does not end up with someone else.
9. Complaints
Not happy with how we handle your data? Let us know first and we will sort it out together. You can always lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens. If you live in another EU country, you can also go to the data protection authority there.
10. 18+ only
Hoptimaal sells beer and is only for people aged 18 and over. We do not knowingly process data of younger people. If someone turns out to be under 18, we do not deliver and we delete their data, except what we must keep by law.
11. Cookies
Cookies are small files a website places in your browser. Pixels and local storage work in a similar way; for simplicity we call all of this cookies here.
- Necessary cookies are needed for the webshop to work, for example for your cart, your country and a secure checkout. We always set them. They do not require consent.
- Analytics cookies and marketing cookies are only set when you click "Accept" or switch them on under "Manage preferences". If you click "Decline", we do not load Meta, Google Analytics, Google Ads or Klaviyo tracking.
Changing your cookie preferences
On your first visit you see the cookie banner with "Accept", "Decline" and "Manage preferences". Declining is as easy as accepting. We remember your choice in a necessary cookie. You can change your choice at any time via Cookie preferences. In the checkout you find the same choice under "Cookies". You can also delete or block cookies in your browser. If you delete them, we ask for your choice again.
Cookie overview
The retention period is the maximum. Some browsers, such as Safari, delete cookies sooner.
| Name | Party | Purpose | Retention | Category |
|---|---|---|---|---|
| _shopify_essential | Shopify | Keeps track of your session and checkout and protects against misuse | 1 year | Necessary |
| localization | Shopify | Remembers your country and language | 1 year | Necessary |
| cart_currency | Shopify | Remembers the currency of your cart | 2 weeks | Necessary |
| cart | Shopify | Remembers what is in your cart | 2 weeks | Necessary |
| discount_code | Shopify | Keeps a discount code from a link until you check out | Session | Necessary |
| shopify_pay | Shopify | Logs you in to Shop Pay if you use it in the checkout | 1 year | Necessary |
| _shopify_analytics | Shopify | Statistics on the use of the webshop and checkout | 1 year | Analytics |
| _ga | Google Analytics | Distinguishes visitors for statistics | 2 years | Analytics |
| _ga_19N708Z2J0 | Google Analytics | Remembers your session for statistics | 2 years | Analytics |
| _shopify_marketing | Shopify | Marketing data on the webshop and checkout | 1 year | Marketing |
| _fbp | Meta | Recognises your browser to measure and show ads on Facebook and Instagram | 90 days | Marketing |
| _fbc | Meta | Remembers that you came from a Meta ad (only set then) | 90 days | Marketing |
| _gcl_au | Google Ads | Measures whether a visit or purchase came from a Google ad | 90 days | Marketing |
| _gcl_aw | Google Ads | Remembers that you clicked a Google ad (only set then) | 90 days | Marketing |
| __kla_id | Klaviyo | Links what you view on the site to your email profile, so emails suit you better | Up to 2 years | Marketing |
With your consent, Meta and Google may also use cookies on their own domains. Read more in the Meta cookie policy and the Google cookie policy.
12. Changes
If something changes, for example because we start using a new service, we update this statement. The version date is always at the top. For an important change we let you know on the site or by email.
Version 17 October 2026. This version replaces the privacy statement of 23 May 2018.
Questions about this? Email info@hoptimaal.nl or call 085 130 1591.
