Last updated: May 13, 2026

1. INTRODUCTION

This Privacy Policy explains how Dutch Business Sales Company B.V., trading under the name Banditos Exclusive Beverage and operating under the brand Banditos Energy (“Banditos”, “we”, “us” or “our”), collects, uses, stores, discloses, transfers and otherwise processes personal data when individuals visit or use our website, purchase products, create customer accounts, participate in the Banditos Insiders Program, interact with our affiliate systems, communicate with us, or otherwise use any of our ecommerce, marketing or digital services.

This Privacy Policy applies to all personal data processed through the website located at banditosenergy.shop, including all associated webpages, Shopify-powered ecommerce environments, customer account systems, checkout environments, affiliate portals, referral systems, communication systems and related digital services (collectively referred to as the “Services”).

For the purposes of this Privacy Policy, the terms “you” and “your” refer to any individual whose personal data may be processed by us, including customers, website visitors, affiliates, ambassadors, applicants to the Banditos Insiders Program, newsletter subscribers, business contacts and any other individuals interacting with our Services.

Banditos processes personal data in accordance with applicable data protection and privacy legislation, including but not limited to Regulation (EU) 2016/679 (General Data Protection Regulation or “GDPR”), the Dutch General Data Protection Regulation Implementation Act (“UAVG”), applicable ecommerce and consumer protection legislation, and other privacy laws that may apply depending on the jurisdiction in which individuals are located.

By accessing or using the Services, creating an account, placing an order, participating in the Banditos Insiders Program or otherwise interacting with us, you acknowledge that your personal data may be processed in accordance with this Privacy Policy.

2. CONTROLLER DETAILS

The controller responsible for the processing of personal data under this Privacy Policy is:

Dutch Business Sales Company B.V.
Trading as: Banditos Exclusive Beverage
Brand: Banditos Energy
Address: Prinses Irenelaan 79, 2273 DH Voorburg, The Netherlands

Website: banditosenergy.shop

General support and privacy contact: customer@banditosenergy.shop

Affiliate and Insiders Program contact: insiders@banditosenergy.shop

Where required under applicable law, Banditos may appoint additional representatives, processors or compliance contacts.

3. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies to all processing activities relating to personal data carried out by Banditos in connection with the operation of its ecommerce, affiliate and digital platform activities.

This includes processing relating to the Shopify-powered webshop, customer accounts, checkout systems, payment processing, shipping and fulfilment, customer service operations, newsletters, marketing communications, promotional activities, analytics systems, cookies and tracking technologies, social media interactions, the Banditos Insiders Program, affiliate tracking systems operated through GoAffPro, referral attribution systems, affiliate dashboards, commission calculations, affiliate payouts and all related administrative, financial, legal and operational processes.

This Privacy Policy does not apply to third-party websites, applications or services that may be accessible through links or integrations on our Services and which operate under their own privacy policies and legal terms.

4. DEFINITIONS

For the purposes of this Privacy Policy, the following definitions apply.

“Personal Data” means any information relating to an identified or identifiable natural person.

“Processing” means any operation performed on personal data, whether or not by automated means, including collection, recording, storage, organization, structuring, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, deletion or destruction.

“Controller” means the natural or legal person determining the purposes and means of the processing of personal data.

“Processor” means a natural or legal person processing personal data on behalf of the controller.

“Affiliate” means any individual or entity participating in the Banditos Insiders Program or related referral, ambassador or commission-based activities.

“Cookies” means cookies, pixels, web beacons, tags, local storage objects, SDKs and similar technologies used to collect or store information relating to website interactions and user activity.

“EEA” means the European Economic Area.

“SCCs” means the Standard Contractual Clauses approved by the European Commission for international transfers of personal data.

5. CATEGORIES OF PERSONAL DATA WE COLLECT

The categories of personal data processed by Banditos depend on the nature of the relationship with the individual concerned and the manner in which the Services are used.

5.1 INFORMATION PROVIDED DIRECTLY BY YOU

We may collect personal data that you provide directly to us when using the Services, including when placing an order, creating an account, subscribing to marketing communications, participating in the Banditos Insiders Program, contacting customer support, completing forms, communicating with us or otherwise interacting with the Services.

Such information may include your full name, company name, billing address, shipping address, telephone number, email address, language preferences, customer account information, affiliate account information, usernames, passwords, communication preferences, support requests and any other information voluntarily provided by you.

5.2 ECOMMERCE AND TRANSACTION INFORMATION

When purchases are made through the webshop, we may process information relating to orders and transactions, including purchased products, order values, invoice details, payment confirmations, transaction references, shipping details, return requests, refund history, discount usage and customer service interactions connected to the transaction.

5.3 AFFILIATE AND REFERRAL INFORMATION

Where you participate in the Banditos Insiders Program, we may process affiliate-related personal data, including affiliate identifiers, referral links, referral attribution data, click and session tracking information, conversion data, dashboard statistics, commission history, payout information, performance analytics, social media profile information, communication history and referral-related activity.

5.4 PAYMENT AND PAYOUT INFORMATION

We may process payment-related data necessary for webshop transactions and affiliate payouts. This may include billing details, payment confirmations, transaction identifiers, bank account information for SEPA transfers, PayPal account information, payout history and related accounting or compliance information.

Banditos generally does not store complete payment card details directly. Payment card processing is typically handled through third-party payment service providers operating under their own compliance obligations.

5.5 TECHNICAL AND USAGE INFORMATION

We may automatically collect technical and usage information relating to the use of the Services. Such information may include IP addresses, device identifiers, browser type, operating system, session identifiers, website interaction data, cookie identifiers, approximate geolocation information derived from IP addresses, traffic information, browsing behavior and interaction data relating to the Services.

5.6 MARKETING AND COMMUNICATION INFORMATION

Where individuals subscribe to newsletters, participate in campaigns or otherwise interact with our marketing activities, we may process communication preferences, campaign interactions, newsletter subscriptions, email engagement information, promotional participation history and related communication records.

5.7 SECURITY AND FRAUD PREVENTION INFORMATION

We may process personal data necessary to detect, investigate and prevent fraud, abuse, unauthorized access, affiliate misuse, suspicious transactions, technical attacks, platform misuse or violations of applicable terms and policies.

This may include IP analysis, login records, device analysis, order pattern analysis, affiliate traffic analysis, fraud indicators and security-related records.

6. SOURCES OF PERSONAL DATA

Banditos may collect personal data from multiple sources depending on the nature of the Services used. Personal data may be collected directly from individuals when they create accounts, place orders, communicate with customer support, subscribe to newsletters, participate in the Banditos Insiders Program, complete forms or otherwise provide information voluntarily.

We may also automatically collect technical and usage information through cookies, pixels and similar technologies when individuals visit or interact with the Services.

In addition, personal data may be received from third-party providers and business partners supporting our operations, including Shopify, GoAffPro, payment processors, PayPal, shipping providers, marketing providers, analytics providers, fraud prevention providers, customer support systems and social media platforms.

Where legally permitted, we may also receive information from publicly available sources or from third parties involved in business, marketing or referral relationships with Banditos.

7. PURPOSES OF PROCESSING

Banditos processes personal data for legitimate operational, contractual, administrative, marketing and compliance purposes.

Personal data may be processed to operate and maintain the webshop and related ecommerce systems, manage customer accounts, process orders and payments, arrange shipping and delivery, provide customer support, manage returns and refunds, operate affiliate systems, process affiliate applications, administer referral tracking, calculate affiliate commissions, process affiliate payouts and maintain affiliate dashboards.

We may also process personal data to send transactional communications, manage newsletters and promotional campaigns, analyze website usage, improve website performance, personalize user experiences, optimize marketing effectiveness, conduct analytics, prevent fraud, secure our systems, enforce legal terms and policies, protect the rights and security of Banditos and its users, comply with legal obligations and defend legal claims where necessary.

8. LEGAL BASES FOR PROCESSING UNDER ARTICLE 6 GDPR

Where the GDPR applies, Banditos processes personal data based on one or more legal grounds under Article 6 GDPR.

8.1 CONSENT — ARTICLE 6(1)(A) GDPR

Certain processing activities are based on consent where required by law. This may include newsletter subscriptions, marketing communications, certain analytics technologies, marketing cookies, affiliate attribution cookies and optional profile-related processing activities.

Individuals may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

8.2 CONTRACT PERFORMANCE — ARTICLE 6(1)(B) GDPR

Personal data may be processed where necessary for the performance of a contract or in order to take steps prior to entering into a contract.

This includes processing necessary to operate customer accounts, process webshop orders, facilitate payments, deliver products, process returns and refunds, administer affiliate participation, calculate affiliate commissions, process affiliate payouts and provide customer or affiliate support.

8.3 LEGAL OBLIGATIONS — ARTICLE 6(1)(C) GDPR

Banditos may process personal data where necessary to comply with legal obligations, including tax obligations, accounting requirements, financial administration obligations, ecommerce obligations, consumer protection obligations, fraud prevention obligations, regulatory requirements and legal requests from authorities.

8.4 LEGITIMATE INTERESTS — ARTICLE 6(1)(F) GDPR

Banditos may process personal data where necessary for legitimate business interests, provided such interests are not overridden by the rights and freedoms of the individual concerned.

Legitimate interests may include operating and improving the Services, managing ecommerce systems, operating affiliate and referral systems, conducting analytics, improving website functionality, preventing fraud and misuse, securing systems, managing communications, measuring marketing effectiveness, enforcing agreements and protecting the business interests, legal rights and operational integrity of Banditos.

Where processing is based on legitimate interests, Banditos assesses whether such interests are proportionate and balanced against the rights and expectations of the individuals concerned.

9. ECOMMERCE PROCESSING

Banditos operates a Shopify-powered ecommerce environment through which individuals may browse products, create accounts, place orders, make payments, request returns and interact with customer support.

Personal data processed in connection with ecommerce activities may include account details, billing information, shipping details, payment confirmations, order history, customer communications and technical usage data necessary to operate the webshop and fulfil contractual obligations.

Shopify may process personal data both as a processor acting on behalf of Banditos and, in certain circumstances, as an independent controller under its own legal obligations and privacy policies.

Failure to provide certain personal data required for ecommerce processing may result in the inability to complete transactions, process payments, provide deliveries or operate customer account functionality.

10. BANDITOS INSIDERS PROGRAM AND AFFILIATE PROCESSING

Banditos operates the “Banditos Insiders Program” using GoAffPro affiliate software and related referral tracking technologies.

Personal data may be processed to review affiliate applications, create affiliate accounts, generate referral links, attribute referrals, calculate commissions, manage affiliate dashboards, process affiliate payouts, communicate with affiliates and enforce affiliate program terms.

Referral attribution may involve cookies, click identifiers, session tracking, referral identifiers, conversion tracking technologies and related systems designed to connect referred purchases to affiliate accounts.

The affiliate system may use a ninety (90) day attribution period whereby qualifying purchases may be attributed to affiliates where technically and legally possible.

Referral tracking functionality may depend on browser settings, consent preferences, cookie acceptance, device continuity, session duration and technical limitations.

Blocking or deleting cookies, using privacy-focused browsers, switching devices or rejecting consent requests may affect referral attribution functionality and may prevent affiliate commissions from being correctly tracked.

Banditos reserves the right to investigate suspected misuse of the affiliate program, including fraudulent referrals, self-referrals, artificial traffic generation, misleading advertising practices, unauthorized use of brand assets, abuse of discount codes or other violations of affiliate program rules and applicable terms.

11. COOKIES AND TRACKING TECHNOLOGIES

Banditos uses cookies and similar technologies through Shopify, GoAffPro and integrated third-party systems in order to operate, maintain, improve and secure the Services.

11.1 ESSENTIAL COOKIES

Certain cookies are strictly necessary for the functioning of the webshop and related Services. These cookies support functions such as shopping cart functionality, checkout processing, login sessions, authentication, fraud prevention, website stability and security.

Because these cookies are necessary for the operation of the Services, they generally cannot be disabled without affecting website functionality.

11.2 SHOPIFY COOKIES

Shopify-related cookies may be used to operate ecommerce functionality, maintain customer sessions, process checkouts, support secure transactions, detect fraud, improve store functionality and optimize webshop performance.

Additional information regarding Shopify cookies may be found in Shopify’s own Cookie Policy.

11.3 AFFILIATE ATTRIBUTION COOKIES

GoAffPro and related systems may use referral cookies and tracking technologies to attribute referrals, connect purchases to affiliate accounts, calculate commissions and generate affiliate statistics.

Where legally required under applicable ePrivacy and GDPR legislation, affiliate attribution cookies are only placed after valid consent has been obtained.

11.4 ANALYTICS TECHNOLOGIES

Analytics technologies may be used to understand website usage, traffic patterns, session behavior, interaction flows, conversion metrics and website performance in order to improve the Services and optimize the ecommerce environment.

11.5 MARKETING AND ADVERTISING TECHNOLOGIES

Marketing technologies, pixels and related tracking systems may be used for advertising measurement, campaign attribution, audience targeting, retargeting activities, social media integrations and marketing optimization purposes.

Where required by law, such technologies are only activated after obtaining valid consent.

11.6 BROWSER CONTROLS AND COOKIE PREFERENCES

Most browsers allow users to manage cookie settings, including blocking or deleting cookies.

Disabling cookies may negatively impact certain functionalities of the Services, including customer account access, checkout functionality, shopping cart persistence, affiliate referral tracking, saved preferences and certain ecommerce or marketing features.

11.7 DO NOT TRACK SIGNALS

Certain browsers support “Do Not Track” signals. Because there is currently no universally accepted legal or technical standard governing such signals, the Services may not respond to all Do Not Track requests.

12. MARKETING AND COMMUNICATIONS

Banditos may process personal data for marketing and communication purposes, including newsletters, promotional campaigns, product announcements, affiliate communications, event communications and related marketing activities.

Marketing communications may be sent based on consent where legally required or based on legitimate interests where permitted under applicable law.

Individuals may unsubscribe from marketing communications at any time through unsubscribe mechanisms included in communications or by contacting Banditos directly.

Opting out of marketing communications does not affect the delivery of transactional, service-related or legally required communications, including order confirmations, shipping updates, account notices, affiliate payout communications or legal notices.

13. PAYMENT PROCESSING

Payments relating to webshop transactions and affiliate payouts may be processed through external payment providers integrated into Shopify and related ecommerce systems.

Such providers may include Shopify Payments, PayPal, banking providers and other authorized payment processors.

Payment providers may process personal data in accordance with their own privacy policies, compliance obligations and financial regulations.

Affiliate payouts may be processed through SEPA bank transfer, PayPal or other approved payout methods.

14. FRAUD PREVENTION AND SECURITY

Banditos processes personal data to detect, investigate and prevent fraudulent, unauthorized or harmful activities affecting the Services, customers, affiliates or the business operations of Banditos.

This may include processing relating to suspicious transactions, fake referrals, account abuse, unauthorized access attempts, payment fraud, artificial affiliate traffic, technical attacks, security incidents and violations of legal terms or policies.

Security-related processing may involve automated and manual review systems, IP analysis, device analysis, risk scoring, login monitoring, behavioral analysis, transaction monitoring and related security measures.

15. DISCLOSURE OF PERSONAL DATA

Banditos may disclose personal data where necessary for operational, contractual, legal or legitimate business purposes.

Recipients may include ecommerce providers, Shopify, GoAffPro, payment processors, PayPal, hosting providers, IT providers, shipping and fulfilment partners, marketing providers, analytics providers, fraud prevention providers, customer support providers, accountants, auditors, legal advisors, insurers, regulators, governmental authorities and other service providers supporting the operation of the Services.

Personal data is disclosed only where reasonably necessary and subject to appropriate contractual, technical and organizational safeguards where applicable.

16. INTERNATIONAL DATA TRANSFERS

Banditos operates internationally and may transfer personal data outside the European Economic Area where necessary for ecommerce, affiliate operations, payment processing, analytics, infrastructure, marketing or operational purposes.

This may involve transfers connected to Shopify, GoAffPro, PayPal, cloud infrastructure providers, analytics providers, marketing providers and related service providers operating internationally.

Where personal data is transferred to jurisdictions not recognized by the European Commission as providing an adequate level of protection, Banditos implements appropriate safeguards in accordance with applicable data protection law.

Such safeguards may include Standard Contractual Clauses approved by the European Commission, supplementary contractual safeguards, technical and organizational security measures and transfer impact assessments where appropriate.

17. DATA RETENTION

Banditos retains personal data only for as long as necessary for the purposes described in this Privacy Policy unless longer retention is required or permitted by law.

Customer account information is generally retained for the duration of the customer relationship and may thereafter be retained where necessary for legal, accounting, fraud prevention or dispute resolution purposes.

Order, invoice and payment-related information may be retained for up to seven years where necessary to comply with Dutch tax and accounting obligations.

Affiliate account information, commission history and payout-related records may be retained for up to seven years for accounting, fraud prevention, compliance and legal defense purposes.

Marketing consent records may be retained until consent is withdrawn or the data is no longer necessary for marketing purposes.

Customer support communications may be retained for up to three years after resolution unless a longer retention period is necessary for legal, fraud prevention or compliance reasons.

Security logs and fraud prevention data may be retained for as long as reasonably necessary to protect the Services, investigate incidents and prevent repeated abuse.

When personal data is no longer necessary, it will be securely deleted, anonymized or otherwise restricted in accordance with applicable law and internal retention procedures.

18. SECURITY MEASURES

Banditos implements appropriate technical and organizational measures designed to protect personal data against unauthorized access, disclosure, misuse, alteration, destruction or accidental loss.

Such measures may include access controls, authentication procedures, encrypted communications where appropriate, secure hosting environments, infrastructure monitoring, role-based access restrictions, internal confidentiality obligations, backup systems and incident response procedures.

Despite these measures, no system or transmission method can guarantee absolute security. Individuals remain responsible for maintaining the confidentiality of their account credentials and devices used to access the Services.

19. CHILDREN AND MINORS

The Services are not intended for children below the age required under applicable law to provide valid consent for data processing activities.

Banditos does not knowingly collect personal data from children without appropriate legal authorization.

Participation in the Banditos Insiders Program or related ambassador activities by minors may require age verification, parental or guardian consent and additional approval procedures before participation is permitted.

If Banditos becomes aware that personal data has been collected from a child without appropriate authorization, reasonable steps will be taken to delete such information.

20. YOUR RIGHTS UNDER GDPR

Subject to applicable law, individuals may have rights relating to their personal data under the GDPR.

These rights may include the right to request access to personal data, request rectification of inaccurate information, request erasure of personal data, request restriction of processing, object to processing activities based on legitimate interests, withdraw consent where processing is based on consent, request portability of certain personal data and lodge complaints with competent supervisory authorities.

Before responding to requests, Banditos may require reasonable identity verification to protect personal data against unauthorized access.

Individuals may also appoint authorized representatives to submit requests on their behalf, subject to appropriate verification requirements.

For the Netherlands, the competent supervisory authority is the Autoriteit Persoonsgegevens.

21. THIRD-PARTY WEBSITES AND SOCIAL MEDIA

The Services may contain links to third-party websites, platforms and social media services operated independently from Banditos.

Banditos is not responsible for the privacy practices, security standards, content or data processing activities of such third parties.

Individuals are encouraged to review the privacy policies of external platforms before interacting with them.

Information shared publicly on social media platforms may become visible to other users and may be processed by third parties outside the control of Banditos.

22. CHANGES TO THIS PRIVACY POLICY

Banditos may update this Privacy Policy from time to time to reflect operational, legal, regulatory, technological or business-related developments.

Updated versions of the Privacy Policy will be published on the website together with the revised “Last updated” date.

Where required by applicable law, additional notifications or renewed consent requests may be provided.

23. CONTACT INFORMATION

Questions relating to this Privacy Policy, privacy practices or personal data processing may be directed to:

Dutch Business Sales Company B.V.
Trading as: Banditos Exclusive Beverage
Brand: Banditos Energy
Address: Prinses Irenelaan 79, 2273 DH Voorburg, The Netherlands

Website: banditosenergy.shop

General support and privacy contact: customer@banditosenergy.shop

Affiliate and Insiders Program contact: insiders@banditosenergy.shop

Ambassadors contact: ambassadors@banditosenergy.shop