Privacy policy

Introduction

Last updated: October 5, 2026

Tout’ Douce (“we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Statement explains how we collect, use, and protect personal data in connection with our website at www.toutdouce.com (the “Website”) and the online sales platform accessible through the Website, on which a curated selection of consumer goods from external brands is offered for sale, including sleepwear, loungewear, bedding, and related home and sleep accessories (together, the “Platform”). It also describes your rights under applicable data protection law and how you can exercise them.

We are committed to processing your personal data securely and in accordance with applicable data protection law, including Regulation (EU) 2016/679 (the “GDPR”). Unless stated otherwise, terms used in this Privacy Statement that are defined in the GDPR have the same meaning here.

Tout’ Douce operates the Platform, on which products of external brands (“Partners”, as defined in our General Terms and Conditions of Sale) are offered for sale to consumers. Tout’ Douce sells these products to you in its own name, as the sole contractual counterparty of the customer under the General Terms and Conditions of Sale, and is the sole controller of the personal data processed in connection with your use of the Website and the Platform and your orders. Tout’ Douce engages a limited number of third-party service providers, including Shopify (for hosting and payment processing), Droppery B.V. (to route orders to the relevant Partner), the Partners themselves (for delivery of the products you order), and the carriers engaged by those Partners to carry out that delivery, each of which processes personal data on Tout’ Douce’s behalf and only to the extent necessary to provide their respective service. Further detail on the personal data shared with each of these parties is set out under “Third-Party Services” below.

Tout’ Douce does not otherwise share your personal data with the Partners beyond what is necessary for the delivery of your order, and does not use your personal data for any purpose other than those described in this Privacy Statement, including operating and securing the Website and the Platform, managing its commercial relationships, sending its own communications (such as newsletters), developing and improving the Platform, and carrying out analytics on aggregate Platform usage. Those processing activities are also described in this Privacy Statement.

We encourage you to read this Privacy Statement carefully. If you have any questions, please contact us using the details provided below. This document can also be saved or printed for your own reference using your browser’s print or save function.

Data Controller

The controller responsible for the processing of your personal data in connection with the Website and the Platform is:

ID Nest BV (trading as “Tout’ Douce”)
CBE 1025.686.413
General contact: contact@toutdouce.com
Privacy-related enquiries: contact@toutdouce.com

If you have any questions about this Privacy Statement or about how we handle your personal data, please contact us at the address above.

How We Collect and Use Your Personal Data

The personal data we collect and how we use it depends on how you interact with us, whether through our Website, our Platform, or in a business context. This section describes our data processing activities for each category of data subject. For each category, we identify the personal data collected, the purpose of the processing, and the legal basis under the GDPR.

Visitors to the website

Personal data collected	When you visit our Website, we may collect information such as your IP address, browser type and version, the pages you view, the date and time of your visit, the duration of your visit, and device identifiers. This may also include technical data, such as city-level location data (derived from your IP address), needed for website statistics and security monitoring. Where we use cookies or similar technologies for analytics or advertising, we may also collect tracker identifiers and usage patterns.
Purpose	To manage the technical and functional operation of our Website, to improve the user experience, and to protect its security. Where we use cookies or similar technologies for purposes that are not strictly necessary, we will ask for your prior consent. You can find more information in our cookie statement displayed on the Website, to be found via the button on the down left bottom of the Website.
Legal basis	Our legitimate interest in providing a secure and properly functioning Website (Art. 6(1)(f) GDPR). Where consent is required – for example for non-essential analytics or advertising cookies – we only process this personal data where you have given your consent (Art. 6(1)(a) GDPR).

Newsletter and marketing recipients

Personal data collected	When you subscribe to our newsletter or otherwise agree to receive marketing communications from us, we process personal data such as your name, e-mail address, language preference, and (where applicable) mobile number. We may also process information about your interactions with our communications, such as whether you opened an e-mail or clicked on a link.
Purpose	To send you our newsletter, informational communications about the Platform, and promotional messages relating to Tout’ Douce’s own products and offers, as well as to measure the performance of those communications and tailor them to your interests. You can unsubscribe from such communications at any time using the unsubscribe link included in each message or by contacting us.
Legal basis	Your consent (Art. 6(1)(a) GDPR), where consent is required under applicable law. Where permitted by applicable law, we may also rely on our legitimate interest in promoting Tout’ Douce’s own products and services to existing Customers (Art. 6(1)(f) GDPR). You may withdraw your consent, or object to such processing, at any time by using the unsubscribe link in our communications or by contacting us directly, without this affecting the lawfulness of processing carried out before withdrawal.

Persons who contact us

Personal data collected	When you submit a contact form, get in touch with our customer service, or otherwise contact us (for example, in relation to an order, a delivery or return, an account issue, or a partnership proposal from a brand), we process personal data such as your name, e-mail address, phone number, your order or account details (where relevant), and any other information you include in your message or request.
Purpose	To respond to your enquiry, to provide information about the Platform and our services, to provide support in relation to your order, delivery, return, or account, and to handle your request. Where your request relates to a potential brand partnership with Tout’ Douce, we also use this data to take pre-contractual steps at your request.
Legal basis	Your consent (Art. 6(1)(a) GDPR) and our legitimate interest in responding to enquiries and managing prospective and existing Customer and Partner relationships (Art. 6(1)(f) GDPR). Where your request relates to a potential contract with us, or to the performance of an existing contract (for example, the processing of your order), the processing is also necessary to take steps prior to entering into, or to perform, that contract (Art. 6(1)(b) GDPR).

Suppliers, subcontractors, and other business relations

Personal data collected	When you act as our supplier, subcontractor, or other business relation – including as a brand offering products through the Platform (a “Partner” as defined in our General Terms and Conditions of Sale) – or when you are employed by or act on behalf of one of these parties, you provide us with personal data such as your name, contact details, professional role, and correspondence.
Purpose	To manage our relationship with the organization you represent, to enter into, perform, and manage our agreements, to communicate about our cooperation, and to comply with our legal and contractual obligations.
Legal basis	Performance of our agreement with the relevant organization (Art. 6(1)(b) GDPR), and our legitimate interest in managing our relationships with suppliers, subcontractors, and Partners (Art. 6(1)(f) GDPR).

Applicants

Personal data collected	When you apply for a position with us, you provide personal data such as your name, contact details (email address, postal address, phone number), CV, cover letter, and any other information you include in your application.
Purpose	To assess your application and to contact you regarding the recruitment process. With your consent, we may also retain your application data to inform you of future opportunities that may be of interest to you.
Legal basis	Your consent (Art. 6(1)(a) GDPR), pre-contractual steps at your request prior to entering into an employment contract (Art. 6(1)(b) GDPR), and our legitimate interest in conducting an efficient recruitment process (Art. 6(1)(f) GDPR). If we retain your data for future opportunities, we do so on the basis of your consent, which you may withdraw at any time.

Customers of the Platform

The following processing activities apply when you create an account, place an order, or otherwise use the Platform as a customer, whether by using an account or as a guest. Customers can place an order as a guest, without creating an account. For these activities, Tout’ Douce acts as the sole controller, as further described in the introduction to this Privacy Statement.

Personal data collected	Depending on how you interact with the Platform, we may process the following categories of personal data: (i) identification and contact details (such as your name, e-mail address, and phone number); (ii) delivery and billing address; (iii) account data (such as your account credentials, language, and communication preferences), where you create an account; (iv) order data (such as the products ordered, order value, order history, and delivery and return status); (v) payment-related data processed on our behalf by our payment service provider, Shopify (we do not ourselves store your full payment card details); (vi) confirmation that you are at least 18 years old; (vii) any product review, rating, photo, or other feedback you choose to submit, together with the first name or display name shown with the review; (viii) correspondence relating to your order, delivery, or return; and (ix) technical data about your use of the Platform (see “Visitors to the website” above).
Purpose	To create and manage your account (where applicable), to process and fulfil your orders, including by sharing the relevant data with Shopify, Droppery B.V., and the relevant Partner(s) strictly as necessary for payment processing and delivery, to manage withdrawals, returns, and refunds, to send you transactional and informational communications about your order or account (such as order and shipping confirmations and return updates), to handle your requests and complaints, to enable you to submit and publish product reviews on the Platform (with your consent), to verify your age where required, to prevent fraud and protect the security of the Platform, and to comply with our legal and regulatory obligations, including consumer protection and accounting and tax law.
Legal basis	Performance of the contract concluded with you when you place an order or, where applicable, create an account, or steps taken at your request prior to entering into that contract (Art. 6(1)(b) GDPR). Compliance with our legal obligations, including consumer protection, accounting, and tax law (Art. 6(1)(c) GDPR). Our legitimate interest in preventing fraud, securing the Platform, and managing our relationship with Customers (Art. 6(1)(f) GDPR). Your consent (Art. 6(1)(a) GDPR), where required by applicable law, for example for the publication of a product review or for certain marketing communications.

We do not sell your personal data. As described above, we share personal data with Shopify, Droppery B.V., and the relevant Partner(s) only to the extent necessary to process and fulfil your order, and we contractually limit the Partners to using the data we share with them solely for delivery purposes. See “Third-Party Services” below for further detail.

Business transfers

Where Tout’ Douce transfers all or part of its business to another party (for example through a sale, merger, restructuring, or transfer of activities), personal data may be transferred to the successor business where necessary to ensure continuity of the Website and the Platform. Tout’ Douce will ensure that any such transfer takes place in accordance with applicable data protection law.

Third-Party Services

We use a number of third-party services that process personal data on our behalf in connection with the Website and the Platform, including hosting, payment, order fulfilment, analytics, communication, and support services. The main categories of such services are described below. Where these services act as our processors, they are bound by data processing agreements that require them to process personal data only on our instructions and to apply appropriate safeguards. The services we currently use are listed in this section. Where we add, replace, or remove a service between two updates of this Privacy Statement, an up-to-date list, together with the relevant privacy policies of the providers concerned, is available on request from contact@toutdouce.com.

Platform Hosting, Payment, and Order Fulfilment

The services in this section allow us to host the Website and the Platform, to process your payment, and to have the products you order delivered to you.

Shopify

Shopify hosts the Website and the Platform and processes payments made through the Platform (Shopify Payments).

Personal data processed: identification and contact details, delivery and billing address, order data, and payment data.

Place of processing: European Union

Droppery B.V.

Droppery B.V. operates the platform that connects Tout’ Douce with the Partners and routes orders to the relevant Partner for fulfilment.

Personal data processed: name, delivery address, and e-mail address.

Place of processing: In principle, your personal data will not be passed on to parties or countries outside the European Economic Area (EEA). Should it be necessary to transfer personal data to parties or countries outside the EEA, we will do so in compliance with the legal requirements.

The Partner(s) whose product(s) you order

Each Partner delivers the products you order directly to you, on behalf of Tout’ Douce, via its own warehouses and shipping partners, and handles the physical return of its own products.

Personal data processed: name and delivery address only. Partners do not receive your e-mail address or payment data. Each Partner engages its own carriers (such as postal and parcel delivery services) to deliver your order; those carriers receive your name and delivery address for that purpose only, as sub-processors.

Place of processing: within the European Union.

Analytics

The services in this section allow us to monitor and analyse traffic and user behaviour on the Website and the Platform, with the aim of improving the performance and usability of our services.

Google Analytics

Google analytics is a web analytics service provided by Google Ireland Limited. It helps us understand how visitors use our website, so we can improve it. It only runs after you give consent.

Personal data processed: online identifiers (cookies), pages visited, interactions, device and browser information, and approximate location. IP addresses are not stored.

Place of processing: EEA. Data may be transferred to Google LLC in the United States, which is certified under the EU-US Data Privacy Framework.

Tag Management

The service in this section allows us to manage third-party scripts and tags on the Website and the Platform from a single interface. Data may flow through this service as part of loading those scripts

Google Tag manager

Google Tag Manager is a tag management service provided by Google Ireland Limited. It controls when other tools on our website, such as analytics or advertising tags, are loaded.

Personal data processed: IP address, browser and device information, and the time of your visit.

Place of processing: EEA. Data may be transferred to Google LLC in the United States, which is certified under the EU-US Data Privacy Framework.

Advertising

The services in this section allow us to measure the results of our advertising campaigns and to show relevant ads to visitors of the Website and the Platform on other websites and social media. These services are only used after you give consent.

Google ads

Google Ads is an advertising service provided by Google Ireland Limited. It measures the results of our ads and shows our ads to people who visited our website. It only runs after you give consent.

Personal data processed: online identifiers (cookies), ad click data, pages visited, and purchases made on our website.

Place of processing: EEA. Data may be transferred to Google LLC in the United States, which is certified under the EU-US Data Privacy Framework.

Meta Pixel and Conversions API

Meta Pixel and Conversions API are advertising services provided by Meta Platforms Ireland Limited. They measure the results of our ads on Facebook and Instagram, and show our ads to people who visited our website. Data is shared through your browser and directly from our webshop. This only happens after you give consent.

Personal data processed: online identifiers (cookies), IP address, device and browser information, pages visited, purchases made on our website, and hashed e-mail address and phone number.

Place of processing: EEA. Data may be transferred to Meta Platforms, Inc. in the United States, which is certified under the EU-US Data Privacy Framework.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Data category / processing activity	Retention period
Order and invoice data (incl. delivery address, order history, and payment confirmation)	7 years from the date of the invoice, in accordance with Belgian accounting and tax retention obligations
Account data	For as long as your account remains active, and for a reasonable period thereafter
Product reviews	For as long as the review remains published on the Platform, and for a reasonable period thereafter for record-keeping purposes
Contact and support enquiries	3 years after resolution of the enquiry, unless a longer period is required to establish, exercise, or defend a legal claim
Website and Platform analytics data	14 months, in line with the data retention setting in our Google Analytics account
Website and Platform system logs	12 months, unless a longer period is required to investigate a security incident

We may retain personal data for longer where this is necessary to comply with a legal obligation, to resolve a dispute, or to enforce our agreements. We may also retain usage data for internal analysis purposes; such data is generally retained for a shorter period, unless it is needed to improve the security or functionality of our Website or we are legally required to retain it for longer.

Where personal data has been collected on the basis of your consent, we will retain it until you withdraw that consent, unless we are otherwise required by law to retain it for longer.

Once the applicable retention period has expired, personal data will be securely deleted or anonymized. Please note that once data has been deleted, rights of access, rectification, erasure, and portability can no longer be exercised in relation to that data.

Security

We have implemented appropriate technical and organizational measures to process your personal data in accordance with applicable data protection law and to protect it against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

Where we engage third-party processors or sub-processors, we enter into appropriate data processing agreements with them to ensure that they apply adequate safeguards to the personal data they process on our behalf. This includes Shopify, Droppery B.V., and each Partner that processes your name and delivery address on our behalf for delivery purposes. Payments made through the Platform are processed by Shopify in accordance with the applicable card scheme security standards (PCI DSS); we do not ourselves store your full payment card details. Within our organization, we enforce confidentiality obligations and apply access restrictions to ensure that personal data is accessible only to those who need it.

These measures include, among others, encryption of data in transit and at rest where appropriate, strict access controls based on the principle of least privilege, monitoring of systems and networks, regular back-ups, and periodic review of our security measures.

International Data Transfers

Tout’ Douce is a Belgian company. The Website and the Platform are hosted by Shopify, and personal data is otherwise processed by the third-party service providers described under “Third-Party Services” above.

Certain of these providers, or their sub-processors, may transfer personal data to countries outside the European Economic Area (EEA). Where such transfers are made to a country that does not benefit from an adequacy decision by the European Commission, we ensure, or require the relevant provider to ensure, that appropriate safeguards are in place, such as:

· Standard Contractual Clauses (SCCs) approved by the European Commission; or

· Other legally recognized transfer mechanisms.

You may contact us using the details above for more information about the safeguards applicable to a specific transfer, or to obtain a copy of the relevant safeguards where applicable.

Your Rights

As a data subject under the GDPR, you have the following rights in relation to your personal data:

Right	What it means
Access	You have the right to obtain confirmation of whether we process personal data about you and, if so, to receive a copy of that data together with information about how it is processed.
Rectification	You have the right to have inaccurate personal data corrected and incomplete personal data completed without undue delay.
Erasure	You have the right to request the deletion of your personal data where, for example, it is no longer necessary for the purposes for which it was collected, or where you have withdrawn your consent.
Restriction	You have the right to request that we restrict the processing of your personal data in certain circumstances – for example, while the accuracy of the data is being contested.
Data portability	Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
Objection	You have the right to object to processing carried out on the basis of our legitimate interests. Where personal data is processed for direct marketing purposes, you have an unconditional right to object at any time.
Withdraw consent	Where processing is based on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
Lodge a complaint	You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

Right to object – further information

Where we process your personal data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you may object to such processing by providing grounds relating to your particular situation. We will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where the processing is necessary for the establishment, exercise, or defense of legal claims.

Where personal data is processed for direct marketing purposes, you may object at any time and free of charge, without giving any reason. We will stop processing your personal data for direct marketing purposes immediately upon receipt of your objection.

How to Exercise Your Rights

To exercise any of the rights described above, please contact us by e-mail at contact@toutdouce.com. There is no charge for making a request.

We will respond to your request within one month of receipt. In cases of complexity or where we receive multiple requests simultaneously, we may extend this period by a further two months; in such cases, we will inform you of the extension and the reasons for it within one month of receiving your request.

Where we are unable to identify you from the information provided, we may ask for additional information solely for the purpose of verifying your identity. We will not use such information for any other purpose.

Any rectification or erasure of personal data, or restriction of processing, will be communicated to any third parties to whom the data has been disclosed, unless this is impossible or would involve a disproportionate effort. Upon request, we will inform you of the identity of those recipients.

Supervisory Authority

If you consider that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority. As Tout’ Douce is established in Belgium, the lead supervisory authority is:

Gegevensbeschermingsautoriteit / Autorité de Protection des Données (GBA/APD)
Rue de la Presse 35 / Drukpersstraat 35
1000 Brussels, Belgium
Website: www.gegevensbeschermingsautoriteit.be / www.autoriteprotectiondonnees.be
Tel: +32 (0)2 274 48 00
E-mail: contact@apd-gba.be

You also have the right to lodge a complaint with the supervisory authority of your habitual residence or place of work within the EU.

Additional Information

Automated decision-making and profiling

We do not use your personal data for automated decision-making processes that produce legal effects or similarly significant effects on you within the meaning of Article 22 GDPR.

Age requirement

The Platform is intended for consumers aged 18 and over, in line with our General Terms and Conditions of Sale. By placing an order, you confirm that you are at least 18 years old. Tout’ Douce does not knowingly collect personal data from individuals under the age of 18 through the Platform. Where Tout’ Douce becomes aware that it has inadvertently collected personal data from a person under the age of 18, it will take appropriate steps to delete such data.

Links to third-party websites

Our Website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to review their privacy statements independently.

Changes to this Privacy Statement

We may update this Privacy Statement from time to time. When we do, we will update the date shown at the top of this document. We encourage you to review this Statement regularly. If we make significant changes, we will let you know, for example by posting a notice on our Website.

Where a change affects processing activities carried out on the basis of your consent, we will seek your renewed consent before the change takes effect.

Your cart is empty

Privacy policy