Privacy statement

Privacy statement for professional partners via bol

1. Who is responsible for processing personal data?
2. When does this privacy statement apply?
3. What is personal data?
4. Why do we use personal data?
5. How do we obtain this data?
6. Is this data shared with third parties?
7. Where do we store your data and how is your data secured?
8. What rights can you exercise regarding your data?

This privacy statement may change from time to time if new developments give cause for it. The most current privacy statement can be found on the Partnerplatform. We recommend that you consult this privacy statement regularly so that you are aware of these changes. You will always see the last modification date below.

This privacy statement was last modified on April 14, 2026.

Bol.com b.v. (“bol”), located at Papendorpseweg 100, 3528 BJ Utrecht, is responsible (the Controller) for processing your personal data as described in this privacy statement.

This privacy statement applies to the personal data that bol processes when you create a professional seller account via bol (“Professional Partner”). This privacy statement applies exclusively to the personal data that bol processes from you as a Professional Partner, and not to data related to your company or information about your customers.

Personal data is any data that can be traced back to an individual. This includes a name, phone number, address, or email address. But data such as an IP address and bank account number can also be traced back to a person.

Below, we explain in more detail why we collect certain personal data and what we use it for.

Bol has access to all information in the partner account to support professional partners as described in this privacy statement. We receive the data directly from you when you create a seller account, provide certain data yourself, or contact our Partnerservice.

In some cases, we receive data from others. For example, we use available data about your company as registered with the Chamber of Commerce. In addition, we may receive information from carriers (such as PostNL or DHL) about the status of sold or returned items.

We engage external service providers to help with various things. Sometimes they also need personal data for this.

We only share the data necessary for the assignment that the external service provider performs for us. We never sell data to these service providers or other third parties. We conclude agreements with all external service providers in which we agree on what they may do with the data.

The type of work that our external service providers perform for us in the context of

• supporting the delivery of our digital services such as the hosting, maintenance, and support of our websites and applications;

• supporting our Partnerservice;

• supporting our advertising and marketing campaigns;

• supporting partner research and obtaining ratings and reviews;

• providing financial services, such as payment services, collection agencies, and credit reporting agencies;

• supporting the facilitation of telephone contact between you and customers;

• supporting the conduct of research and analysis to improve our services;

• supporting compliance with legal obligations

Logistics partners

In addition, we work with various logistics partners, such as PostNL, BPost, Budbee, Ampère, and Dynalogic, for the delivery of orders. The logistics partner is involved as an independent responsible party in the execution of the agreement with you as a partner. For more information about the use of your data by the relevant logistics service provider, you can consult the privacy statement on the delivery service's website.

Government institutions

Sometimes we have to pass on personal data to the government. This can occur, first of all, if certain government institutions need this data for the performance of their duties, such as the Tax Authorities. The police or judicial authorities may also need certain data in the event of fraud or abuse. Finally, certain supervisory authorities may gain access to personal data in the context of an investigation.

Bol takes many measures to secure your personal data, both organizationally and technically. Through strict access controls, we ensure that your personal data is only accessible to employees for whom it is necessary to work with it. In addition, bol regularly has its security tested by external experts. If we share your data with someone else (e.g., processors)? Then we demand that that party handles your data with the same care as we do. We regularly check whether these parties actually comply with the agreed security requirements.

As a professional partner, you can contribute to data security yourself. For example, we offer two-step verification for extra security of your seller account. In addition, e-learnings are available on the safe use of your seller account. We also offer the possibility to add users with different rights, so that you maintain control over who has access to which data within your seller account.

Transfer of personal data

We store your data as much as possible within the European Economic Area (“EEA”). It may happen that certain data we collect is transferred to or stored at a destination outside the EEA, for example, because one of our external service providers is located there. When this is the case, we ensure that this happens in a safe and lawful manner. This means that bol will, as much as possible, choose parties located in countries with a comparable level of protection as in Europe. The European Commission (EC) decides which countries meet this requirement via a so-called 'adequacy decision'. For example, the EC has decided that there is at least a good level of data protection for organizations located in the United States and participating in the Data Privacy Framework. Some of the parties bol.com works with are located in the United States and are affiliated with this framework.

If a party bol works with is located in a country where the level of data protection is not equal to that in Europe, we take measures to ensure that your data is safe. Bol does this, among other things, by agreeing to a standard contract with the recipients of your data. These standard contracts have been drawn up by the European Commission (EC) and contain agreements on the protection of your data. You can find these standard contracts at the end of the Implementing Decision (EU) 2021/914 of the EC.

We monitor developments regarding international transfers and regularly check whether your personal data is still sufficiently protected.

If you have any questions about how bol handles personal data, please feel free to contact our Partnerservice. We are happy to help you.

We share your data with the parties listed below if you have given your consent. For more information about these parties, please refer to the statements on their respective websites.

• DPG - DPG Privacy Portal (dpgmedia.be)
• Alphabet/Google - Privacy Policy – Privacy & Terms – Google
• Meta/Facebook/Instagram - Meta Privacy Policy - How Meta collects and uses user data | Privacy Center (facebook.com) & Data Policy | Instagram Help Center
• Microsoft - Microsoft Privacy Statement – Microsoft privacy
• Mediahuis Nederland - Privacyverklaring Mediahuis Nederland