Privacy policy

Burnt Group EU B.V. takes your privacy seriously. That is why we will only use your personal information to provide you with the products and services you have requested, as well as to administer your account. We do not sell your personal information. We will only share it where necessary to comply with legal obligations, except as otherwise described in this policy, and we will never use your personal data for any reason other than the reasons described within this policy.

About our privacy policy

Our privacy policy outlines your relationship with our company and explains in detail how we use the information that you provide us with.

About Burnt Group EU B.V.

BURNT STUDIOS is the trading name of Burnt Group EU B.V., registered in the Netherlands (registered office: Zuidplein 116, Tower H, Level 14, 1077XV Amsterdam; Dutch Chamber of Commerce (KVK) number: 42108752). We are your data controller and encourage you to get in touch with any questions you may have.

You can reach us by: Post: Burnt Group EU B.V., Zuidplein 116, Tower H, Level 14, 1077XV Amsterdam, Netherlands Email: support@burnt.co

Changing your preferences

If you'd like to change your web, contact or marketing preferences, you can do so at any time. Simply contact us at support@burnt.co to request the necessary amendments.

How we do business

Burnt Group EU B.V. is committed to upholding and maintaining your personal rights. We operate our business in line with the EU General Data Protection Regulation (GDPR) and observe your rights to change or withdraw your opt-in options at any time. As part of our ongoing commitment to uphold your rights, we will also advise you on how to raise a formal complaint with the relevant supervisory authority, such as the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Sensitive data

Burnt Group EU B.V. does not collect any special category data about you. Special category data includes (but is not limited to) information about your race or ethnic background, religious or political affiliations, trade union membership, sexual orientation, criminal record, or health information.

Children's privacy

Our products and services are intended for adults, and we do not knowingly collect personal information from anyone under the age of 16. If we become aware that we have inadvertently collected personal data from a person under the age of 16 without appropriate parental or guardian consent, we will take steps to delete that information as soon as reasonably possible. If you believe a child under the age of 16 has provided us with personal data, please contact us at support@burnt.co so that we can address it.

Who our privacy policy applies to

This privacy policy has been developed to inform users of Burnt Group EU B.V. how we use their data. We are an online retailer of activewear and active jewellery, and we need to process the data of individuals to offer our products and/or services. This policy applies to any individual registered with us as a user, customer, administrator, or in any other capacity.

What information this policy applies to, and our lawful basis for processing it

The information this policy applies to includes information that you:

Provide as part of any registration process Provide as part of any campaign creation activity Provide in the form of numerical data, metadata, or communications Give us as part of our ongoing relationship

This policy also applies to information that we:

Collect relating to how you interact with our website Must process to complete purchases and other transactions

We rely on the following lawful bases, depending on the activity:

Performance of a contract — to process your order, deliver products or services, and manage your account. Legal obligation — to meet accounting, tax, and other regulatory requirements. Legitimate interests — for fraud prevention, IT security, and improving our products and services, balanced against your rights and interests. Consent — for marketing communications and any other activity where we specifically ask for your consent. Where consent is our legal basis, this is freely given, specific, and can be withdrawn at any time as described below.

Opting out

Where our processing is based on your consent (for example, marketing), you are free to withdraw that consent at any time. You also have the right to object to processing based on our legitimate interests. To opt out, change your preferences, or withdraw consent, simply email support@burnt.co.

Data processing and storage

We store your data for a period of 5 years after your last recorded login attempt unless otherwise stated, and no longer than is necessary for the purposes it was collected for.

We store data relating to transactions, payments, and orders for up to seven years, in line with our legal and accounting obligations. This period may be extended where required by law.

We use carefully selected, recognised third parties to help us take payments, provide commerce services, and manage company accounts. This includes Shopify, which hosts our website and online store, and Shopify Payments, which we use to process payments. Some of these third parties may operate outside the EU/EEA.

Marketing and communications

We may send you marketing communications if you have given us your contact details and opted in to marketing communications. Where you have provided this consent, we use third-party providers, including Klaviyo and Shopify, to help us deliver marketing communications to you. You can opt out of these communications and manage your preferences at any time.

Our company obligations

As a data controller, Burnt Group EU B.V. is legally responsible for the data you provide us with. In honouring that responsibility, we pledge to uphold our obligations under the GDPR.

We will only ever use your data:

In ways that are fair and lawful As described within this policy In ways that are necessary for the purposes described

We take all reasonable precautions to secure the personal data we collect, process, and store.

We may occasionally use your data for marketing, relationship management, or account management activities, to keep you informed about products or services we believe may interest you. You can opt out of these activities at any time.

Third parties

Burnt Group EU B.V. never shares your personal data with third parties unless those parties have been explicitly mentioned within this privacy policy, or we are required to do so by law.

Our security

We will notify the relevant supervisory authority of any qualifying personal data breach without undue delay and, in any event, within 72 hours of becoming aware of it, in accordance with GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.

Legitimate interests / third-party sharing for non-marketing purposes

We may share selected information with third parties that use data for non-marketing purposes, such as credit assessment, identification, or fraud prevention services, where this is necessary for our legitimate interests or a legal obligation.

International data transfers

Your personal data may be transferred to, and processed in, countries outside the EU/EEA, including South Africa, for the purposes described in this policy.

South Africa does not currently benefit from an adequacy decision from the European Commission. Where we transfer your personal data to South Africa or any other country without an adequacy decision, we put appropriate safeguards in place — such as the European Commission's Standard Contractual Clauses — to ensure your data continues to receive an equivalent level of protection. You can request further details, or a copy of the relevant safeguard, by emailing support@burnt.co.

By submitting your information to us, you acknowledge that this transfer will take place on the basis described above.

Additionally, your personal information may be shared with our giveaway partners, including One&Only Cape Town, Aquila Safaris, and Inverdoorn Private Game Reserve, solely to facilitate and manage giveaways. These partners are contractually obligated to protect your information and to use it only for that purpose, and the international transfer safeguards above apply equally to these disclosures.

Your data protection rights

You have the following rights over your personal data, subject to certain exceptions:

The right to access, update, or delete the information we hold about you The right of rectification, where your data is inaccurate or incomplete The right to object to our processing of your personal data The right to restrict the processing of your personal data The right to data portability, to receive your data in a structured, machine-readable format The right to withdraw consent at any time, where consent is our legal basis for processing

To exercise any of these rights, please email us at support@burnt.co. We may ask you to verify your identity before responding. Please note we may not be able to provide our services without certain necessary data.

You have the right to lodge a complaint with your local data protection authority, or with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), given Burnt Group EU B.V. is established in the Netherlands.

Contact us

Burnt Group EU B.V. is committed to upholding your rights. If you have any questions, comments, or concerns about this privacy policy, or wish to exercise your rights over your personal data, please contact support@burnt.co.

We will respond to any request within one month of receipt, in line with GDPR. This period may be extended by a further two months where a request is particularly complex, in which case we will let you know within the first month. Subject Access Requests are usually free of charge, but we may charge a reasonable fee for requests that are manifestly unfounded, excessive, or repetitive.