Privacy Policy

Who is responsible for your data

The data controller for personal data collected via this site is Melisa Altikat, self-employed individual (indépendante complémentaire — personne physique) operating under the commercial names MADDE / MADDE Atelier, 1083 Brussels, Belgium — VAT BE 1019.114.464. For any question regarding your personal data, contact maddeatelier@gmail.com.

What we collect and when

• Contact details (name, email, message content) when you reach out via email or Instagram DM.
• Order information (name, email, phone, recipient and delivery details) when you place an order.
• Newsletter email if you subscribe to receive updates from the atelier. Stored by Brevo (EU). Unsubscribe anytime.
• Payment information processed exclusively by Stripe. MADDE never accesses, sees, or stores your card data.
• Browsing data (anonymized IP, pages visited, device type, referrer) via Google Analytics — only with your explicit consent.

Purposes of processing

• To respond to your inquiries and provide our floral services.
• To process, confirm, and deliver your orders and bookings.
• To improve the website experience and understand how it is used (analytics, with consent only).
• To comply with legal obligations (invoicing, accounting, Belgian tax law).

GDPR article 6

• Consent — for analytics cookies and any future marketing communications.
• Contract — for order processing, bookings, and deliveries.
• Legitimate interest — for responding to your inquiries and basic functional cookies.
• Legal obligation — for invoicing, accounting, and tax records.

Sub-processors we work with

We share minimal data with the following GDPR-compliant partners:

• Stripe Payments Europe (payments) — stripe.com/privacy
• Google Analytics 4 (analytics) — policies.google.com/privacy
• Brevo (newsletter, EU-based) — brevo.com/legal/privacypolicy
• Hostinger International (hosting) — hostinger.com/privacy-policy

We never sell your data. We never share it with advertisers.

How long we keep your data

• Emails and contact data: 3 years after last interaction.
• Invoices and tax records: 7 years (Belgian legal requirement).
• Analytics data: 14 months (Google Analytics default retention, anonymized).
• Cookie consent choice: 12 months (or until you change it).

Under GDPR, you can ask us to

• Access the personal data we hold about you.
• Correct any inaccurate or incomplete information.
• Delete your data (right to be forgotten), subject to legal retention obligations.
• Restrict processing in certain circumstances.
• Port your data in a structured, machine-readable format.
• Object to processing based on legitimate interest.
• Withdraw consent at any time, without affecting prior lawful processing.

To exercise any of these rights, email maddeatelier@gmail.com. We respond within 30 days.

Right to file a complaint

If you believe your rights have been violated, you may file a complaint with the Belgian Data Protection Authority (Autorité de Protection des Données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels. autoriteprotectiondonnees.be

Updates to this policy

This policy may be updated to reflect changes in our practices or legal requirements. The most recent version is always available on this page. Substantial changes will be communicated via the site or by email where appropriate.