Privacy Policy

1. Data controller

The data controller for your personal data is:

Atelier MAUDÉ
Represented by: Aude and Mathilde
Email: lateliermaude@gmail.com
Address: [To be completed after registration]

2. Data collected

When placing an order

• First and last name
• Email address
• Delivery address
• Payment data (processed directly by Stripe — we have no access to it)

When subscribing to the newsletter

• Email address only

When sending a message via the contact form

• First name, last name, email address, message content

Automatically when browsing

• Technical cookies necessary for the site to function (see section 7)
• No browsing data is collected without your consent

3. Purposes of processing

Your data is used exclusively for:

• Order processing — preparation, dispatch, tracking, after-sales service
• Transactional communication — order confirmation, tracking number
• Newsletter — sending emails about our new pieces and news (only if you have consented)
• Returns management — processing return and refund requests
• Legal obligations — retention of accounting and tax records

We never engage in unsolicited commercial prospecting or advertising profiling.

4. Retention periods

• Order data — retained for 3 years from the last order (statutory accounting obligation: 10 years for invoices)
• Newsletter — until unsubscription or 3 years without interaction
• Contact messages — 1 year after the request is closed
• Cookies — maximum 13 months (in accordance with data protection authority guidelines)

5. Data sharing

Your data is never sold to third parties. It may be shared only with:

• Stripe (payment provider) — for secure payment processing. Stripe is PCI-DSS certified. Stripe Privacy Policy
• Logistics provider — delivery address only, for the purpose of shipping your order
• Klaviyo (if you have subscribed to our newsletter) — email address only. Klaviyo Privacy Policy

These providers act as data processors and are contractually bound to protect your data in accordance with the GDPR.

6. Your rights

Under the General Data Protection Regulation (GDPR — EU Regulation 2016/679), you have the following rights:

• Right of access — obtain a copy of your personal data
• Right of rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion of your data ("right to be forgotten")
• Right to data portability — receive your data in a structured format
• Right to object — object to the processing of your data for marketing purposes
• Right to restriction — restrict the processing of your data
• Right to withdraw consent — withdraw your consent at any time (e.g. unsubscribe from newsletter)

You also have the right to lodge a complaint with the Data Protection Authority (APD/GBA) if you believe your rights have not been respected.

7. Cookies

Technical cookies (required)

These cookies are essential for the website to function. They cannot be disabled.

• Cookie preferences — remembers your acceptance or refusal choice (localStorage)
• Newsletter session — prevents the pop-up from appearing multiple times in the same session (sessionStorage)

Analytics cookies (opt-in)

We use Google Analytics 4 (GA4) to measure website audience (pages visited, session duration, traffic source). GA4 is configured with Google Consent Mode v2: no analytics data is collected until you have accepted cookies via the consent banner. If you decline or ignore the banner, GA4 remains inactive.

GA4 is provided by Google Ireland Limited. Google Privacy Policy.

Advertising cookies

We use no advertising cookies (retargeting, cross-site tracking). No data is shared with advertising networks.

Managing your preferences

You may change your choice at any time by clearing your browser data (localStorage). You may also configure your browser to refuse cookies; this may affect certain features of the website.

8. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure:

• Secure HTTPS connection across the entire website
• Payments processed exclusively via Stripe (PCI-DSS Level 1 certified)
• No banking data stored by Atelier MAUDÉ
• Access to data restricted to the two founders (Aude and Mathilde)

9. Updates

We may update this policy at any time to reflect legal, regulatory, or operational changes. The date of the last update is shown at the top of this page.

In the event of a material change, we will notify you by email if you are subscribed to our newsletter.

10. Contact

For any question relating to this policy or the exercise of your rights:

Supervisory authority: Data Protection Authority (APD/GBA) — Rue de la Presse 35, 1000 Brussels.