Privacy Policy

Last updated: September 17, 2026
Effective date: September 17, 2026

1. INTRODUCTION

This Privacy Policy explains how Dutch Business Sales Company B.V., trading as Banditos Exclusive Beverage under the Banditos Energy brand (“Banditos”, “Company”, “we”, “us”, or “our”), collects, uses, stores, discloses, transfers, and otherwise processes personal data.

This Privacy Policy applies when you visit or use our website, browse or purchase products, create or use a customer account, communicate with us, subscribe to marketing communications, participate in a giveaway or event, submit a business or partnership enquiry, apply for or participate in the Banditos Insiders Program, use an affiliate referral link, or otherwise interact with our online or offline services.

Our services include the website located at https://banditosenergy.shop, our Shopify-powered webshop and checkout, customer accounts, communication and marketing systems, review functionality, advertising and analytics technologies, the Banditos Insiders Program, GoAffPro affiliate functionality, referral systems, event and giveaway administration, and related services (collectively, the “Services”).

For the purposes of this Privacy Policy, “you” and “your” refer to any individual whose personal data we process, including website visitors, customers, customer-account holders, newsletter subscribers, giveaway and event participants, affiliate applicants, approved Participants in the Banditos Insiders Program, business contacts, and partnership applicants.

This Privacy Policy provides information about our processing of personal data. It is not a contract and does not create consent to processing merely because you visit or use the Services. Where consent is legally required, we will request it separately through an appropriate consent mechanism.

2. CONTROLLER DETAILS

The controller responsible for the processing of personal data described in this Privacy Policy is:

Dutch Business Sales Company B.V.
Trading as: Banditos Exclusive Beverage
Brand: Banditos Energy

Prinses Irenelaan 79
2273 DH Voorburg
The Netherlands

Chamber of Commerce (KvK) number: 89632931
VAT identification number: NL865047765B01

Website: https://banditosenergy.shop

General support and privacy enquiries: customer@banditosenergy.shop

Affiliate and Insiders Program enquiries: insiders@banditosenergy.shop

Privacy enquiries and requests concerning personal data may be submitted using the contact details above.

3. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies to personal data processed by or on behalf of Banditos in connection with:

• the Shopify-powered webshop, customer accounts, shopping carts, checkout, orders, payments, deliveries, returns, refunds, and customer support;
• marketing communications, newsletters, abandoned-cart or abandoned-checkout messages, product recommendations, advertising, campaign measurement, and audience creation;
• website analytics, cookies, pixels, referral identifiers, and comparable technologies;
• customer reviews and automated review requests administered through Judge.me;
• applications for and participation in the Banditos Insiders Program;
• affiliate accounts, GoAffPro dashboards, referral links, referral attribution, performance calculations, commissions, bonuses, and PayPal payouts;
• giveaways, competitions, events, and related registrations;
• business, creator, supplier, collaboration, sponsorship, and partnership enquiries; and
• fraud prevention, account security, technical administration, legal compliance, and dispute resolution.

This Privacy Policy does not govern the independent processing activities of third-party websites, platforms, payment providers, social media services, or other external services that operate under their own privacy policies.

Where we select or engage a service provider to process personal data on our behalf, we remain responsible for that processing to the extent required by applicable law. Certain third parties may process personal data as independent controllers for their own purposes and legal obligations. Their processing is governed by their respective privacy notices.

4. CATEGORIES OF PERSONAL DATA WE PROCESS

The personal data we process depends on how you interact with Banditos and which Services you use.

4.1 Identity and contact information

We may process your name, company name, billing address, delivery address, country, telephone number, email address, language preference, customer number, affiliate identifier, social media handle, and other contact or identification information you provide.

4.2 Customer-account information

When you create or use a customer account, we may process your account identifier, email address, saved addresses, account preferences, login and authentication information, order history, and other information associated with your account.

We do not normally receive or store your password in readable form. Authentication and account-security functionality may be provided through Shopify or another authorized service provider.

4.3 Order and transaction information

We may process information concerning products viewed or purchased, shopping-cart contents, order numbers, order values, applicable taxes, discounts, statiegeld or other deposit charges, delivery methods, payment status, transaction references, invoices, cancellations, returns, refunds, chargebacks, complaints, and related customer-service communications.

4.4 Payment information

Payments may be made using the payment methods made available during checkout, which may include iDEAL, payment cards, PayPal, Shop Pay, and Klarna or another available deferred-payment method.

Shopify Payments and other payment providers may process payment details, billing information, transaction information, authentication information, and fraud indicators.

Banditos does not normally receive or retain complete payment-card numbers or card-security codes. Payment providers may process information as independent controllers or service providers in accordance with their own legal obligations and privacy notices.

4.5 Delivery and fulfilment information

To prepare, manage, track, and deliver orders, we may process your name, delivery address, email address, telephone number, order information, delivery preferences, tracking number, and delivery status.

This information may be shared with shipping and delivery providers such as PostNL, DHL, DPD, and UPS, and with Sendcloud for shipping administration, label generation, tracking, and related logistical services.

The provider used for a particular order may depend on the destination, selected delivery method, availability, operational requirements, and the nature of the shipment.

4.6 Affiliate and Insiders Program information

If you apply for or participate in the Banditos Insiders Program, we may process:

• application, identity, age, contact, and account information;
• social media profile information and information supplied about promotional activities;
• affiliate identifiers, referral links, referral cookies, clicks, sessions, attributed orders, conversions, and traffic-source information;
• commission levels, qualifying revenue, performance progress, bonuses, adjustments, reversals, and payout history;
• PayPal account information and information required for payment, tax, accounting, fraud-prevention, or compliance purposes;
• communications, campaign participation, compliance records, and investigation information; and
• information concerning the use of personal Insider purchase benefits and associated customer-account eligibility.

Participation in the Banditos Insiders Program is limited to individuals who are at least eighteen (18) years old.

We may request information reasonably necessary to verify age, identity, payment details, tax status, eligibility, account security, or authority to represent a legal entity.

4.7 Website, device, and usage information

When you visit or interact with the Services, we or authorized service providers may process your IP address, approximate location derived from your IP address, browser type, device type, operating system, language, cookie identifiers, advertising identifiers, session identifiers, pages viewed, links clicked, referral source, shopping and checkout interactions, timestamps, and other technical or usage information.

4.8 Marketing and advertising information

We may process newsletter subscriptions, marketing preferences, consent records, email engagement, abandoned-cart or abandoned-checkout activity, product interests, product recommendations, campaign interactions, advertising identifiers, conversion events, audience membership, and information used to measure or personalize advertising.

Subject to applicable law and any required consent, Meta and Google technologies may be used to:

• measure sales and conversions;
• analyze campaign performance;
• personalize advertisements;
• retarget website visitors; and
• create or use audiences based on shared or similar characteristics.

These activities may involve profiling, as explained further in this Privacy Policy.

4.9 Review information

If you receive or respond to a review request or submit a review through Judge.me, we may process your name or display name, email address, order or product information, review content, rating, photographs or other material voluntarily included in the review, verification status, and related communications.

Published reviews may be visible to the public. You should not include information in a public review that you do not want to make publicly available.

4.10 Giveaway and event information

If you enter a giveaway, competition, event, activation, or related activity, we may process your name, contact details, eligibility information, entry, responses, preferences, attendance information, prize information, and communications necessary to administer the activity.

Additional privacy information or participation terms may be provided where a particular giveaway, competition, or event involves processing not adequately described in this Privacy Policy.

4.11 Business and partnership information

If you contact us concerning a business relationship, wholesale opportunity, supply arrangement, event, sponsorship, creator collaboration, or partnership, we may process your name, role, organization, business contact details, proposal, correspondence, meeting notes, and information necessary to assess or manage the relationship.

4.12 Customer service, security, and compliance information

We may process enquiries, complaints, communications, account records, login records, transaction patterns, referral patterns, device and IP information, fraud indicators, evidence submitted during an investigation, and other information reasonably necessary to:

• provide customer or affiliate support;
• secure accounts and systems;
• prevent or investigate fraud and misuse;
• enforce applicable terms and policies;
• resolve disputes; or
• establish, exercise, or defend legal claims.

4.13 Special categories of personal data and sensitive information

We do not ordinarily request or intentionally collect special categories of personal data, such as information concerning health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric identification, sex life, or sexual orientation.

Please do not provide such information through reviews, support requests, affiliate applications, event forms, business enquiries, or other free-text fields unless it is strictly necessary and you have been specifically asked to provide it through an appropriate and lawful process.

Where we unexpectedly receive special-category or other sensitive information, we will process it only where an appropriate legal basis and, where required, an additional condition under applicable law are available. Information that is unnecessary may be deleted or restricted.

5. SOURCES OF PERSONAL DATA

We may obtain personal data:

• directly from you when you place an order, create an account, submit an application or form, enter a giveaway or event, contact us, subscribe to communications, or otherwise provide information;
• automatically from your browser or device through cookies, pixels, referral identifiers, server logs, and similar technologies;
• from Shopify and services integrated with our Shopify environment;
• from GoAffPro in connection with affiliate applications, accounts, referral tracking, commissions, bonuses, and payouts;
• from payment providers, including Shopify Payments, PayPal, and Klarna, concerning payment status, transaction confirmation, disputes, or fraud indicators;
• from Sendcloud and delivery providers, including PostNL, DHL, DPD, and UPS, concerning shipment preparation, delivery, and tracking;
• from Judge.me in connection with review requests and submitted reviews;
• from Meta and Google services in connection with analytics, advertising, audience measurement, and campaign performance, subject to applicable consent requirements;
• from communication and email-marketing service providers used by Banditos; and
• from business partners, publicly available professional sources, or another person where legally permitted and relevant to a business, event, giveaway, fraud-prevention, or affiliate relationship.

If you provide personal data relating to another person, you are responsible for ensuring that you are authorized to provide that information and, where required, that the person has received appropriate privacy information.

Where we receive personal data from a source other than the individual concerned, we will provide any information required under applicable law within the applicable period, unless an exemption lawfully applies.

6. PURPOSES AND LEGAL BASES FOR PROCESSING

Where the GDPR applies, we process personal data only where an appropriate legal basis is available. The applicable legal basis depends on the purpose and circumstances of the processing.

6.1 Webshop, orders, and customer accounts

We process identity, contact, account, order, payment-status, and delivery information to:

• operate the webshop;
• provide requested customer-account functionality;
• process and fulfil orders;
• collect and verify payments;
• deliver products;
• provide order and delivery updates;
• handle cancellations, returns, refunds, complaints, and warranty-related matters; and
• provide customer support.

This processing is generally necessary for the performance of a contract or to take steps at your request before entering into a contract under Article 6(1)(b) GDPR.

6.2 Payments and fraud controls

Payment and transaction information may be processed to facilitate and authenticate payments, prevent payment fraud, manage disputes and chargebacks, maintain financial records, and resolve payment-related problems.

Depending on the processing concerned, the legal basis may be:

• performance of a contract under Article 6(1)(b) GDPR;
• compliance with a legal obligation under Article 6(1)(c) GDPR; or
• our legitimate interests in preventing fraud and protecting transactions under Article 6(1)(f) GDPR.

Payment providers may determine separate purposes and legal bases for processing required by financial, payment, anti-fraud, identification, or regulatory obligations.

6.3 Shipping and delivery

We process and disclose delivery information to prepare shipments, generate shipping labels, provide tracking, deliver orders, handle delivery problems, and manage returns.

This processing is generally necessary for the performance of the purchase contract under Article 6(1)(b) GDPR.

6.4 Affiliate and Insiders Program administration

We process affiliate application, account, tracking, performance, commission, bonus, payment, and communication information to:

• review applications and eligibility;
• establish and administer participation;
• provide referral links and dashboard functionality;
• attribute qualifying transactions;
• calculate and validate earnings;
• administer commission levels and performance bonuses;
• apply personal Insider purchase benefits;
• process PayPal payouts;
• communicate with Participants;
• investigate disputes, suspected fraud, and misuse; and
• enforce the applicable Program terms.

This processing is generally necessary to take pre-contractual steps or perform the applicable Program agreement under Article 6(1)(b) GDPR.

Security, fraud-prevention, and Program-integrity activities may also be based on our legitimate interests under Article 6(1)(f) GDPR. Tax, accounting, and legally required payment records may be processed under Article 6(1)(c) GDPR.

6.5 Transactional and service communications

We process contact, account, order, and transaction information to send:

• order confirmations;
• payment and delivery updates;
• customer-account notifications;
• responses to enquiries and complaints;
• affiliate account and payout communications;
• security messages; and
• material legal or operational notices.

These communications may be necessary for performance of a contract, compliance with a legal obligation, or our legitimate interests in administering and securing the Services.

Transactional and legally required communications are not marketing communications and may continue even where you have opted out of marketing.

6.6 Marketing communications

We may use your contact details, customer relationship, product interests, order history, and marketing preferences to send newsletters, product announcements, promotional offers, event information, and other direct marketing communications.

Where required by law, this processing is based on consent under Article 6(1)(a) GDPR.

Where legally permitted, communications concerning our own similar products or services may be based on our legitimate interests under Article 6(1)(f) GDPR, subject to applicable electronic-marketing requirements and your right to object at any time.

Every electronic marketing message will provide an appropriate method to unsubscribe or otherwise object to further marketing.

6.7 Abandoned carts, abandoned checkouts, and product recommendations

We may use account, cart, checkout, order-history, and product-interaction information to send permitted reminders concerning an incomplete purchase or to provide product recommendations.

Where required by applicable electronic-marketing law, abandoned-cart or abandoned-checkout messages and personalized product recommendations will only be sent with consent or where another legally permitted exception applies.

Depending on the circumstances, the applicable GDPR legal basis may be consent under Article 6(1)(a) GDPR or our legitimate interests under Article 6(1)(f) GDPR where the processing and communication are permitted by law.

You may unsubscribe from marketing-oriented reminders and recommendations at any time.

6.8 Analytics, advertising, and audience creation

Subject to any legally required consent, we may use Google and Meta technologies to:

• analyze use of the Services;
• measure sales and conversions;
• assess campaign effectiveness;
• personalize advertisements;
• retarget website visitors; and
• create or use audience segments based on shared or similar characteristics.

Where these activities use non-essential cookies, pixels, advertising identifiers, or comparable tracking technologies, processing is based on consent under Article 6(1)(a) GDPR.

You may withdraw or modify your consent through the available cookie-preference mechanism. Withdrawal does not affect processing lawfully carried out before consent was withdrawn.

6.9 Reviews and review requests

We may process order and contact information to send review requests and operate product-review functionality.

Review requests will only be sent where permitted under applicable electronic-communications and marketing law. The applicable legal basis may depend on the customer relationship, the nature of the message, and whether consent is required.

Where you voluntarily submit a review for publication, we process the review to provide the functionality requested by you and on the basis of our legitimate interests in operating an authentic and informative review system.

Where a review contains optional photographs or other personal material requiring consent, we may rely on your consent for that specific processing. You may contact us to request review of published personal material, subject to applicable law and legitimate record-keeping requirements.

6.10 Giveaways, competitions, and events

We process registration and participation information to administer giveaways, competitions, events, eligibility requirements, attendance, communications, winner selection, and prizes.

This processing may be necessary to perform the applicable participation terms under Article 6(1)(b) GDPR.

Legal and compliance records may be processed under Article 6(1)(c) GDPR. Reasonable organizational, security, and fraud-prevention activities may be based on our legitimate interests under Article 6(1)(f) GDPR.

Where participation is combined with optional marketing, marketing consent will be requested separately where required. Participation will not be made conditional on unnecessary marketing consent.

6.11 Business and partnership enquiries

We process business-contact information and correspondence to:

• review proposals;
• respond to enquiries;
• conduct negotiations;
• establish or administer commercial relationships; and
• maintain appropriate business records.

This processing may be necessary to take pre-contractual steps or perform an agreement under Article 6(1)(b) GDPR, or may be based on our legitimate interests in developing and managing commercial relationships under Article 6(1)(f) GDPR.

6.12 Legal compliance and record keeping

We process and retain information where necessary to comply with tax, accounting, consumer-protection, payment, regulatory, court-order, and other legal obligations under Article 6(1)(c) GDPR.

6.13 Security, fraud prevention, and enforcement

We may process account, device, transaction, referral, traffic, communication, and security information to detect and investigate:

• payment fraud;
• account abuse;
• prohibited self-referrals;
• artificial traffic or engagement;
• misuse of referral links or discounts;
• unauthorized account access;
• technical attacks;
• policy violations; and
• other unlawful or harmful activity.

This processing is generally based on our legitimate interests in protecting customers, Participants, the Services, and our business under Article 6(1)(f) GDPR.

Relevant information may also be processed or retained where necessary to establish, exercise, or defend legal claims.

7. REQUIRED INFORMATION AND CONSEQUENCES OF NOT PROVIDING IT

Certain personal data is necessary to:

• enter into or perform a contract;
• process an order or payment;
• deliver products;
• create or secure an account;
• process a return or refund;
• participate in the Banditos Insiders Program;
• validate a commission or bonus;
• receive a PayPal payout;
• participate in an event or giveaway; or
• comply with legal requirements.

Where required information is not provided, we may be unable to accept or fulfil an order, provide a requested account feature, process a payment or refund, complete a delivery, review an affiliate application, validate earnings, process a payout, administer an event or giveaway, or respond fully to a request.

Information identified as optional is not required unless it later becomes reasonably necessary for a requested service, verification, investigation, dispute, or legal obligation.

8. SHOPIFY E-COMMERCE ENVIRONMENT

Our webshop is hosted and supported by Shopify. Shopify processes personal data when individuals visit, interact with, create accounts on, or make purchases through our Shopify-powered store.

Depending on the Shopify services and settings we use, Shopify may process personal data to:

• host and operate the webshop, checkout, and customer accounts;
• process orders, payments, transactions, and refunds;
• provide Shop Pay and related customer functionality;
• maintain platform security and prevent fraud;
• provide analytics, reporting, personalization, and technical support; and
• provide other Shopify services enabled by Banditos or requested by the customer.

Shopify may process personal data as a service provider or processor acting for Banditos and, for certain purposes, as an independent controller under its own legal obligations and privacy policies.

Where Shopify Network Intelligence or another Shopify Enhanced Service is enabled, Shopify may use customer information together with information from interactions with Shopify and other Shopify merchants to provide services such as improved fraud protection, personalization, performance measurement, insights, and advertising functionality.

Where legally required, non-essential Shopify processing and advertising based on activity with Banditos, Shopify, or other merchants will only take place after valid consent has been obtained. You may withdraw or modify that consent through the available privacy or cookie-preference controls.

More information about Shopify’s processing practices and privacy rights is available through:

• Shopify’s Privacy Policy; and
• Shopify’s Privacy Portal.

Shopify and its service providers may process personal data in countries outside your country of residence, subject to applicable international-transfer safeguards.

9. BANDITOS INSIDERS PROGRAM AND GOAFFPRO

The Banditos Insiders Program uses GoAffPro and related technologies to administer affiliate accounts, referral links, referral attribution, performance levels, commissions, bonuses, dashboards, and related Program functionality.

Where you apply for or participate in the Program, personal data may be processed to:

• review and verify applications;
• create and maintain an affiliate account;
• generate referral links and identifiers;
• record eligible clicks, referrals, attributed orders, and conversions;
• calculate performance revenue, commission levels, commissions, and bonuses;
• administer personal Insider benefits;
• investigate tracking errors, disputes, fraud, self-referrals, or misuse;
• communicate with Participants; and
• validate and process affiliate earnings and PayPal payouts.

Referral attribution may involve referral identifiers, cookies, session information, order information, device or browser information, and transaction data necessary to connect an eligible purchase with the relevant affiliate account.

Under the current Program configuration, referral attribution generally operates on a last-valid-click basis and may remain active for up to ninety (90) days after the customer’s most recent valid referral visit, subject to consent, technical availability, transaction eligibility, and applicable Program rules.

The referral cookie is intended to be removed after an attributed order has been placed. A later order will therefore not automatically remain attributed to the same Participant and may require the customer to use a valid referral link again.

Where legally required, non-essential referral or affiliate-tracking technologies will only be activated after the customer has provided valid consent. Rejecting, blocking, limiting, or deleting the relevant tracking technologies may prevent referral attribution and may mean that no affiliate commission is generated.

Information displayed in an affiliate dashboard may be provisional and may be corrected where an order is refunded, cancelled, charged back, incorrectly attributed, duplicated, fraudulent, or otherwise non-qualifying.

10. COOKIES AND SIMILAR TECHNOLOGIES

We and authorized providers use cookies, pixels, tags, local storage, referral identifiers, and similar technologies to operate, secure, analyze, and improve the Services and, where permitted, to personalize and measure advertising.

10.1 Strictly necessary technologies

Strictly necessary technologies support essential functions such as:

• shopping-cart and checkout functionality;
• customer authentication and account security;
• payment and fraud-prevention functionality;
• network management and website stability;
• language, privacy, and security preferences; and
• other functionality specifically requested by the user.

These technologies may generally be used without consent where they are strictly necessary to provide a service requested by the user. Blocking them may prevent parts of the Services from functioning correctly.

10.2 Functional technologies

Functional technologies may remember choices and provide enhanced functionality, such as saved preferences or optional customer features. Where these technologies are not strictly necessary, they will be used only where an appropriate legal basis is available and consent is obtained where required.

10.3 Analytics technologies

Analytics technologies may help us understand website traffic, page use, customer journeys, checkout activity, technical performance, conversions, and interactions with the Services.

Where analytics technologies access or store information on a user’s device and are not strictly necessary or otherwise legally exempt, they will only be activated after valid consent has been obtained.

10.4 Marketing and advertising technologies

Meta Pixel, Google advertising technologies, and comparable tools may be used to measure advertising, attribute conversions, retarget website visitors, personalize advertisements, and create or use audience segments.

These technologies will only be activated where legally permitted and, where required, after valid consent has been obtained.

10.5 Affiliate attribution technologies

GoAffPro and related systems may use referral identifiers and cookies to connect visits and eligible purchases with affiliate accounts. Where such technologies are not strictly necessary, they will only be activated after legally required consent has been obtained.

10.6 Managing and withdrawing cookie consent

Where a cookie-preference mechanism is available, you can use it to accept, reject, or modify your preferences concerning non-essential technologies.

You may withdraw consent at any time. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal, but it will prevent future non-essential processing covered by that consent where the preference mechanism and integrated technologies operate correctly.

You may also manage or delete cookies through your browser or device settings. Deleting or blocking cookies may affect customer accounts, saved preferences, cart functionality, analytics, advertising personalization, and affiliate referral attribution.

The specific cookies and technologies used may change when providers, apps, settings, or features change. The available cookie-preference interface or separate Cookie Policy may provide additional current information concerning categories, providers, purposes, and durations.

11. MARKETING AND ELECTRONIC COMMUNICATIONS

We may send newsletters, product announcements, promotional offers, event information, abandoned-cart or abandoned-checkout reminders, product recommendations, and other permitted marketing communications.

Marketing communications will be sent only where an appropriate legal basis exists and in accordance with applicable electronic-marketing rules.

Where consent is required, marketing consent will be requested through a clear affirmative action. Consent will not be inferred from silence, inactivity, pre-selected options, or mere use of the Services.

Where legally permitted, we may contact existing customers concerning our own similar products or services, provided that the customer was offered an appropriate opportunity to object when the contact details were collected and in each subsequent communication.

You may unsubscribe or object to direct marketing at any time by:

• using the unsubscribe link included in a marketing email;
• changing any available account or communication preferences; or
• contacting us using the details in this Privacy Policy.

An objection to direct marketing does not prevent us from sending transactional, security-related, contractual, or legally required communications.

We may retain limited suppression information, such as your email address and opt-out status, to ensure that your marketing objection continues to be respected.

12. PROFILING AND AUTOMATED PROCESSING

We may use certain automated tools to analyze interactions, product interests, purchasing activity, campaign performance, referral patterns, transaction risks, and website behavior.

This processing may be used to:

• provide product recommendations;
• create or use marketing audience segments;
• personalize advertisements;
• retarget website visitors;
• measure campaign and affiliate performance;
• identify suspected fraud, abuse, or unusual account activity; and
• determine whether additional verification or manual review is appropriate.

Banditos does not ordinarily make decisions based solely on automated processing that produce legal effects or similarly significantly affect an individual.

Automated fraud indicators, payment warnings, affiliate irregularities, or security signals may result in a temporary restriction, additional verification, investigation, or manual review. Where required by applicable law, a materially adverse decision will be subject to appropriate human involvement and may be challenged by contacting us.

Payment providers and other independent controllers may conduct their own automated fraud, credit, identity, or payment assessments under their respective privacy policies and legal obligations. Klarna or another deferred-payment provider may perform eligibility or credit-related assessments independently from Banditos.

13. DISCLOSURE AND RECIPIENTS OF PERSONAL DATA

We may disclose personal data where reasonably necessary to operate the Services, perform agreements, fulfil orders, administer the Banditos Insiders Program, conduct permitted marketing, protect our systems, comply with legal obligations, or establish, exercise, or defend legal claims.

Depending on the relevant processing activity, recipients may include:

• Shopify, for webshop hosting, checkout, customer accounts, order processing, payments, security, analytics, and other enabled Shopify services;
• Shopify Payments, PayPal, Klarna, and other available payment providers, for payment processing, authentication, fraud prevention, refunds, disputes, chargebacks, and regulatory compliance;
• GoAffPro, for affiliate applications, accounts, referral tracking, dashboards, commissions, bonuses, and Program administration;
• Judge.me, for review requests, review verification, moderation, and publication;
• Sendcloud, for shipping administration, label generation, delivery tracking, and related logistical services;
• PostNL, DHL, DPD, UPS, and other applicable delivery providers, for shipment, delivery, tracking, returns, and delivery support;
• Google, for analytics, advertising, conversion measurement, campaign administration, and Merchant Center functionality, subject to applicable consent requirements;
• Meta, for advertising, conversion measurement, retargeting, audience creation, and campaign administration, subject to applicable consent requirements;
• email, communication, and marketing service providers, for newsletters, service communications, abandoned-cart or abandoned-checkout messages, and permitted product recommendations;
• hosting, IT, security, fraud-prevention, backup, and technical-support providers supporting the operation and security of the Services;
• accountants, auditors, insurers, tax advisers, legal advisers, and other professional advisers where access is reasonably necessary for their services;
• event, giveaway, collaboration, and business partners where necessary to administer a specific activity and where appropriate information has been provided;
• regulators, tax authorities, courts, law-enforcement bodies, governmental authorities, and other competent authorities where disclosure is legally required or reasonably necessary to protect legal rights; and
• prospective purchasers, investors, financiers, or professional advisers in connection with a proposed merger, acquisition, financing, reorganization, sale of assets, or similar corporate transaction, subject to appropriate confidentiality and data-protection safeguards.

We disclose only the personal data reasonably necessary for the relevant purpose.

Where a recipient processes personal data on our behalf, we seek to use appropriate contractual and organizational safeguards as required by applicable law. Where a recipient independently determines the purposes and means of its processing, that recipient is responsible for its own processing and privacy information.

We do not sell personal data in the ordinary meaning of selling personal information in exchange for money. Certain disclosures for targeted advertising may nevertheless be treated as “selling”, “sharing”, or “targeted advertising” under the laws of some jurisdictions. Where such laws apply, we will provide any required notice and opt-out mechanism.

14. INTERNATIONAL DATA TRANSFERS

Some of our service providers, their affiliated companies, or their infrastructure may be located outside the European Economic Area (“EEA”), the United Kingdom, or Switzerland. As a result, personal data may be processed in countries with data-protection laws that differ from those in your country of residence.

International processing may occur in connection with Shopify, GoAffPro, PayPal, Judge.me, Google, Meta, email and marketing providers, cloud infrastructure, technical support, fraud prevention, analytics, and other internationally operating services.

Where personal data is transferred from the EEA to a country that has not been recognized by the European Commission as providing an adequate level of data protection, we will rely on an appropriate transfer mechanism where required.

Such mechanisms may include:

• an adequacy decision adopted by the European Commission;
• the Standard Contractual Clauses approved by the European Commission;
• the EU–US Data Privacy Framework where the relevant recipient is validly certified and the framework lawfully applies;
• binding corporate rules or another transfer mechanism recognized by applicable law; or
• a permitted statutory exception where no other mechanism is reasonably available and the legal requirements for that exception are satisfied.

Where appropriate, supplementary contractual, technical, or organizational measures may be used to protect transferred personal data.

You may contact us for further information about the safeguards applicable to a relevant international transfer. Access to copies of contractual safeguards may be limited where necessary to protect confidential or commercially sensitive information.

15. DATA RETENTION

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including the performance of agreements, customer support, Program administration, fraud prevention, security, legal compliance, accounting, dispute resolution, and the establishment, exercise, or defence of legal claims.

The applicable retention period depends on the nature of the information, the processing purpose, the sensitivity of the information, legal requirements, operational necessity, and the existence of an actual or reasonably anticipated dispute or investigation.

We generally apply the following retention principles:

• Orders, invoices, payments, refunds, and tax records: information forming part of our legally required financial or tax administration may generally be retained for seven (7) years or for another period required by applicable law.
• Customer accounts: account information may be retained while the account remains active. Following closure or prolonged inactivity, information may be deleted, anonymized, or restricted unless continued retention is necessary for orders, legal obligations, fraud prevention, disputes, or account security.
• Shopping-cart and abandoned-checkout information: information may be retained for the period configured within Shopify or the relevant communication system and only for as long as reasonably necessary to restore the cart, administer checkout, send legally permitted reminders, measure performance, prevent misuse, or resolve technical problems.
• Affiliate and Insiders Program accounts: account, participation, communication, and compliance information may be retained during participation and for a reasonable period following account closure or termination where necessary for final validation, dispute resolution, fraud prevention, enforcement, or legal claims.
• Affiliate financial records: commission, bonus, payout, adjustment, invoice, and related financial information may generally be retained for seven (7) years where it forms part of legally required accounting or tax records.
• Referral and attribution information: referral identifiers, click information, attribution records, and related technical data may be retained for the duration required to operate the applicable attribution period, validate transactions, investigate discrepancies, prevent fraud, and resolve commission disputes. Information that is no longer required may be deleted or anonymized.
• Marketing information: subscription and marketing-preference information may be retained until consent is withdrawn, an objection is made, the purpose ends, or the information becomes inaccurate or inactive. Limited suppression records may be retained to ensure that an opt-out continues to be respected.
• Cookie and consent records: consent choices and evidence may be retained for as long as reasonably necessary to demonstrate compliance, respect preferences, and request renewed consent where appropriate. Individual cookies remain active only for the duration disclosed through the cookie-preference interface or applicable Cookie Policy.
• Reviews: published reviews may remain available while relevant to the product or Service, subject to moderation, removal requests, applicable law, and the legitimate interests of maintaining an authentic review history. Associated administrative information may be retained for verification, fraud prevention, disputes, and legal compliance.
• Customer-service communications: communications may be retained for a reasonable period following resolution, taking into account the nature of the enquiry, applicable limitation periods, recurring issues, complaints, and legal obligations.
• Giveaways, competitions, and events: participation information may be retained for the duration of the activity and for a reasonable period afterward to administer prizes, answer questions, demonstrate compliance, prevent fraud, and resolve disputes. Information used for separate marketing will be retained under the applicable marketing rules.
• Business and partnership records: enquiries and relationship records may be retained while the proposal or relationship remains active and afterward where reasonably necessary for follow-up, administration, legal claims, or legitimate business records.
• Security and fraud-prevention information: security logs, investigation records, fraud indicators, and evidence may be retained for as long as reasonably necessary to investigate incidents, prevent repeated misuse, secure the Services, enforce applicable terms, and establish, exercise, or defend legal claims.

Where personal data is subject to a dispute, legal hold, regulatory enquiry, fraud investigation, chargeback, or legal claim, relevant information may be retained until the matter and any applicable retention or limitation period have ended.

At the end of the applicable retention period, personal data will be deleted, anonymized, or securely restricted unless continued retention is legally required or permitted.

16. SECURITY OF PERSONAL DATA

We implement technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, misuse, or other unlawful processing.

Depending on the circumstances, these measures may include:

• access controls and account permissions;
• authentication and password-protection measures;
• encrypted transmission where appropriate;
• secure hosting and payment environments;
• logging, monitoring, and fraud-detection measures;
• backup, recovery, and incident-response procedures;
• confidentiality obligations;
• service-provider assessments and contractual protections; and
• restriction of access according to operational need.

No website, system, storage environment, or transmission method can be guaranteed to be completely secure. You are responsible for protecting your account credentials, devices, and access to your email and PayPal accounts.

If you believe that your account or personal data may have been compromised, please contact us without undue delay.

Where a personal data breach occurs, we will assess the incident and notify the competent supervisory authority and affected individuals where and within the period required by applicable law.

17. CHILDREN AND MINORS

The Services are not designed to knowingly collect personal data from children in circumstances where parental authorization is legally required and has not been obtained.

Where processing is based on consent and applicable law requires authorization from a parent or legal guardian because the individual is below the applicable digital-consent age, we will request the required authorization or will not carry out that processing.

Participation in the Banditos Insiders Program is strictly limited to individuals who are at least eighteen (18) years old. Parental or guardian consent does not replace this minimum age requirement.

We do not knowingly use children’s personal data for behavioral advertising or audience creation without any legally required authorization.

If we become aware that personal data from a child has been processed without an appropriate legal basis or required authorization, we will take reasonable steps to delete, restrict, or otherwise lawfully address that information.

A parent or legal guardian who believes that we have improperly processed a child’s personal data may contact us using the details in this Privacy Policy.

18. YOUR DATA-PROTECTION RIGHTS

Subject to the conditions, limitations, and exceptions contained in applicable law, you may have the following rights concerning your personal data:

18.1 Right of access

You may request confirmation as to whether we process your personal data and request access to that data and associated information.

18.2 Right to rectification

You may request correction of inaccurate personal data and completion of incomplete personal data.

18.3 Right to erasure

You may request deletion of personal data where a legal ground for erasure applies. This right does not require deletion where continued processing is necessary for a legal obligation, freedom of expression, public interest, or the establishment, exercise, or defence of legal claims.

18.4 Right to restriction

You may request restriction of processing in circumstances provided by applicable law, including while the accuracy of information or the lawfulness of certain processing is being assessed.

18.5 Right to data portability

Where processing is based on consent or contract and carried out by automated means, you may request certain personal data in a structured, commonly used, and machine-readable format and, where technically feasible, request transmission to another controller.

18.6 Right to object

You may object, on grounds relating to your particular situation, to processing based on our legitimate interests. We will stop the relevant processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms or the processing is necessary for legal claims.

18.7 Right to object to direct marketing

You may object to processing for direct-marketing purposes at any time, including related profiling. Following such an objection, we will stop using your personal data for the affected direct marketing.

18.8 Right to withdraw consent

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

18.9 Rights concerning automated decisions

Where applicable, you may have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects you, subject to statutory exceptions.

18.10 Right to complain

You have the right to lodge a complaint with the competent data-protection supervisory authority.

In the Netherlands, the supervisory authority is:

Autoriteit Persoonsgegevens
Website: https://autoriteitpersoonsgegevens.nl

If you live or work in another EEA country, or believe an infringement occurred there, you may also have the right to contact the competent supervisory authority in that country.

19. EXERCISING YOUR RIGHTS

To exercise a privacy right or submit a privacy enquiry, contact us at:

customer@banditosenergy.shop

Please describe your request clearly and provide sufficient information to enable us to identify the relevant records.

We may request reasonable information to verify your identity and protect personal data against unauthorized access or deletion. We will not request more verification information than reasonably necessary in the circumstances.

If an authorized representative submits a request for you, we may request evidence of that representative’s authority and may take reasonable steps to verify your identity directly.

We will respond without undue delay and generally within one (1) month after receiving a complete request. Where permitted by law, this period may be extended by up to two additional months because of the complexity or number of requests. If an extension is required, we will provide notice within the initial response period.

Privacy requests are generally handled free of charge. Where a request is manifestly unfounded or excessive, particularly because it is repetitive, we may charge a reasonable fee or refuse the request to the extent permitted by law.

We may refuse or limit a request where an applicable legal exception applies. Where legally required, we will explain the relevant reason and available complaint options.

20. THIRD-PARTY WEBSITES, PLATFORMS, AND SERVICES

The Services may contain links to, or integrations with, third-party websites, payment services, social media platforms, delivery services, or other external services.

Those third parties may independently collect and process personal data under their own privacy notices and legal terms. Banditos does not control and is not responsible for independent processing carried out by third parties outside our instructions or control.

You should review the privacy information of a third-party service before providing personal data or using its functionality.

Information you choose to publish publicly through a review, social media platform, event page, public profile, or another public channel may be visible to other users and may be copied or processed outside Banditos’ control.

21. PRIVACY CHOICES AND RECOGNIZED SIGNALS

You may use the available cookie-preference mechanism to manage non-essential cookies and similar technologies.

Where our Services provide a data-sharing opt-out page or another privacy-choice tool, you may use that tool to exercise the choices available in your jurisdiction.

Where required by applicable law and technically supported by Shopify or another integrated provider, recognized browser-based privacy signals such as Global Privacy Control may be treated as a request to opt out of processing regarded as selling, sharing, or targeted advertising under the relevant law.

Because no uniform legal or technical standard applies to every browser signal in every jurisdiction, the Services may not respond identically to all “Do Not Track” or comparable signals. This does not limit any right available to you under applicable law or through the privacy controls described in this Privacy Policy.

22. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect changes in our Services, processing activities, service providers, legal obligations, regulatory guidance, security practices, or business operations.

The current version will be published through our website and will display its “Last updated” date and “Effective date”.

Where a change materially affects your rights or the way we process personal data, we will provide additional notice where reasonably appropriate or legally required.

Where renewed consent is required for a changed processing activity, publication of an updated Privacy Policy or continued use of the Services will not replace that required consent.

We may retain previous versions for legal, evidentiary, compliance, and administrative purposes.