PRIVACY POLICY
Draft for review — not yet legally binding. Bracketed details are pending.
This policy explains what personal data [LEGAL ENTITY NAME] ("the Maison", "we") processes when you use this online boutique, why we process it, and the rights you hold under the GDPR.
Who is responsible for your data
The controller is [LEGAL ENTITY NAME], [REGISTERED ADDRESS], Chamber of Commerce [KVK NUMBER], VAT [VAT NUMBER]. For any privacy question, write to [PRIVACY CONTACT EMAIL].
What we collect
Identity and contact details you give us (name, email, postal address, telephone); order, payment and delivery details; appointment requests; newsletter subscriptions; and the technical data needed to serve the site securely, such as IP address and browser type.
Why we process it, and on what basis
To perform a contract with you (orders, delivery, returns, appointments); to comply with legal obligations such as tax and accounting records; on the basis of your consent for the newsletter and analytics cookies, which you may withdraw at any time; and on our legitimate interest in securing the site and preventing fraud.
Who we share it with
Only with processors acting on our instructions: [PAYMENT PROVIDER], [SHIPPING CARRIER], [EMAIL PLATFORM] and our hosting provider. Each is bound by a data processing agreement. We do not sell personal data.
Transfers outside the EEA
The site is hosted on infrastructure that may process data outside the EEA. Where that happens we rely on the European Commission’s Standard Contractual Clauses. [CONFIRM HOSTING REGION AND TRANSFER MECHANISM.]
How long we keep it
Order and invoice records for the statutory retention period of seven years; appointment and enquiry correspondence for [RETENTION PERIOD]; newsletter data until you unsubscribe; technical logs for [RETENTION PERIOD].
Your rights
You may request access to your data, correction, erasure, restriction and portability, and you may object to processing based on legitimate interest. Where processing rests on consent you may withdraw it at any time without affecting processing already carried out. Write to [PRIVACY CONTACT EMAIL]; we answer within one month.
Complaints
If you believe we process your data unlawfully you may lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens, or with the authority in your country of residence.
Automated decision-making
We do not use automated decision-making or profiling that produces legal effects concerning you.