privacy policy

Last updated: 28 October 2026

Sumi Matcha respects your privacy. This Privacy Policy explains how we collect and use personal data when you visit https://sumimatcha.com, place an order, contact us, or interact with our online store. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Dutch law.

1. Who is responsible for your data?

Controller: Sumi Matcha, a sole proprietorship (eenmanszaak) owned by Morsal Amin

Chamber of Commerce (KVK): 42101110

VAT ID: NL005492462B85

Address: Zandstraat 31, 6432 LD Hoensbroek, The Netherlands

Email: [email protected]

Telephone: +31 6 34784130

Website: https://sumimatcha.com

Please contact us at [email protected] for any privacy questions or requests.

2. Personal data we collect

When you buy from us or contact us, we may process your name, email address, billing and delivery addresses, phone number if you give it, order information, products purchased, amounts paid, refund and payment status, shipping details, and your messages to us.

When you visit the website, technical systems may process your IP address, device and browser information, approximate location based on your IP address, cookie and device identifiers, pages visited, and how you use the online store.

If you consent to analytics or advertising cookies, Google Analytics and Meta Pixel may also collect information about your website activity and shopping events, as described below.

We do not receive your full card number. Payment providers process card and other payment details directly, and we receive a payment confirmation and transaction reference.

3. Do you have to give us your data?

To place an order, we need your name, email address and delivery address. Without these we can't process or deliver your order. Giving us other information, such as a phone number, is optional.

4. Purposes and legal bases

Order fulfilment and customer service: to accept orders, process payments, arrange delivery, send order and shipping confirmations, handle withdrawals and returns, and answer questions about your order. Legal basis: performance of a contract (GDPR Article 6(1)(b)) and, for follow-up questions, our legitimate interest in helping our customers (Article 6(1)(f)).

Accounting and legal compliance: to keep the tax and administrative records the law requires. Legal basis: legal obligation (Article 6(1)(c)).

Security and fraud prevention: to protect payments, prevent misuse and keep the website secure. Legal basis: our legitimate interest in a safe store and in preventing financial loss (Article 6(1)(f)).

Analytics: to understand how the website is used and improve our store, using Google Analytics. Legal basis: your consent (Article 6(1)(a)).

Advertising: to measure our ads and, if enabled, show relevant ads on Facebook and Instagram, using Meta Pixel. Legal basis: your consent (Article 6(1)(a)).

Marketing emails: we send newsletters only if you signed up for them. If you bought from us, we may also email you about similar products, as Dutch law allows. Every email has an unsubscribe link, and you can also unsubscribe by emailing us. Legal basis: your consent (Article 6(1)(a)) or, for emails to existing customers, our legitimate interest (Article 6(1)(f)).

Launch notifications: if you ask us to let you know when a matcha launches, we use your email address only to send you that message, not for our newsletter. Legal basis: your consent (Article 6(1)(a)). You can withdraw it at any time by emailing us.

5. Shopify and Shopify Payments

Our online store runs on Shopify, which provides our storefront, checkout, order management and security. Shopify processes personal data on our behalf. For some of its own services, such as fraud prevention across its network, Shopify may also act as an independent controller under its own privacy policy.

Payments are handled by Shopify Payments and its payment partners. The information used depends on the payment method you choose and may include details needed to approve a payment, prevent fraud and issue refunds.

To protect our forms against spam, Shopify uses hCaptcha. hCaptcha may process your IP address and information about your browser and how you use the form.

More information: Shopify Consumer Privacy Policy.

6. Google Analytics

We use Google Analytics to understand how people find and use sumimatcha.com, such as which pages are viewed, where visitors come from and how they move through the store. Google Analytics may process online identifiers, device and browser information, IP-based location and usage events.

Google Analytics only collects this information after you have accepted analytics cookies. You can withdraw your consent at any time through our cookie settings.

More information: Google Privacy Policy.

7. Meta Pixel (Facebook and Instagram)

We use Meta Pixel to measure how our ads perform and, if enabled, to show relevant ads on Facebook and Instagram. Meta Pixel may process browser and device identifiers, your IP address, the pages you visit and events such as viewing a product or completing a purchase.

Meta Pixel only runs after you have accepted marketing cookies. You can withdraw your consent at any time through our cookie settings.

For collecting this data on our website and sending it to Meta, we and Meta Platforms Ireland Ltd. are joint controllers. Meta is responsible for what it does with the data afterwards. You can exercise your rights with us or directly with Meta.

More information: Meta Privacy Policy.

8. Cookies and similar technologies

Our website uses three kinds of cookies and similar technologies:

Essential: needed for the store to work, such as keeping items in your cart, secure checkout, fraud prevention and remembering your cookie choice. These do not require consent.

Analytics: help us understand how visitors use the website (Google Analytics). Only with your consent.

Marketing: help us measure and personalise ads (Meta Pixel). Only with your consent.

You can accept, reject or customise optional cookies in our cookie banner. You can change your choice at any time via the "Your privacy choices" link at the bottom of every page. Rejecting optional cookies does not stop you from shopping with us.

9. Who receives your personal data?

We only share personal data when needed, with:

  • Shopify and Shopify Payments, and their payment and fraud-prevention partners;
  • our delivery partners, to deliver your order;
  • our email service, to send order emails and, if you agreed, newsletters;
  • our bookkeeping software and accountant, for our tax records;
  • Google and Meta, only if you consented to analytics or marketing cookies;
  • government authorities, if the law requires it.

We never sell your personal data.

10. International transfers

Shopify, Google and Meta may process data outside the European Economic Area, for example in Canada or the United States. Canada has an EU adequacy decision. For transfers to the United States, Google and Meta are certified under the EU-US Data Privacy Framework. Where no adequacy decision applies, transfers are protected by EU Standard Contractual Clauses.

11. How long we keep your data

  • Order and invoice data: 7 years, as required by Dutch tax law.
  • Customer service messages: up to 2 years after your last contact, unless we need them longer for a complaint or legal claim.
  • Newsletter data: until you unsubscribe. After that we only keep your email address on a "do not email" list, so we can respect your choice.
  • Launch notification requests: until we have sent the launch email, or earlier if you ask us to delete them.
  • Google Analytics data: 14 months.
  • Your cookie choice: 12 months, after which we ask again.

When we no longer need your data, we delete or anonymise it.

12. Your rights

You have the right to access, correct or delete your personal data, to restrict its use, and to receive it in a portable format. You can object to processing based on our legitimate interests, and you can always object to marketing. Where we rely on your consent, you can withdraw it at any time. This does not affect processing that already happened. We do not make automated decisions about you that have legal or similarly significant effects.

To make a request, email [email protected]. We may ask you to confirm your identity first. We respond within one month.

You can also file a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens, or with the authority in the EU country where you live.

13. Children, security and changes

Our store is not aimed at children under 16. We take appropriate technical and organisational measures to protect your data, but no online service is completely risk-free.

We may update this policy when our practices, our service providers or the law change. The latest version is always on this page. If a change matters for you, we will let you know and, where needed, ask for your consent again.

14. Contact

Sumi Matcha
Zandstraat 31
6432 LD Hoensbroek
The Netherlands

KVK: 42101110
VAT ID: NL005492462B85

Email: [email protected]
Telephone: +31 6 34784130