Privacy Policy
Last update: June 2025
Privacy is important to us. Please read the following sections carefully.
This Privacy Policy (hereinafter referred to as the "Policy") governs how Atelier Spatz – Johanna De Santis, a Luxembourg registered company with its registered office at 23 rue Jean Baptiste Fresez, 2738 Luxembourg (Grand Duchy of Luxembourg), registered with the Luxembourg Trade and Companies Register under number A43417, (hereinafter referred to as "ATELIER SPATZ") collects, uses, stores and discloses information obtained from buyers, sellers or general users (hereinafter "User(s)") of the Atelier Spatz platform (hereinafter the "Website"), accessible via the domain atelierspatz.com.
1. Compliance with Data Protection Laws
Atelier Spatz acknowledges and undertakes to comply with all applicable laws and regulations concerning the protection of personal data, including but not limited to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation – "GDPR").
2. Contact Details
Atelier Spatz acts as the data controller and has appointed a Data Protection Officer ("DPO") who may be contacted via email at: info@atelierspatz.com
3. Purpose of Data Collection
Personal data is not required to simply browse the Website. Collection occurs when a User registers, purchases products or services online, or offers products for sale through the platform ("Services").
4. Types of Data Collected
Atelier Spatz may collect and process the following data:
- Identity and contact information (surname, first name, address, email, phone number)
- Login credentials (email and password, encrypted)
- IP address, navigation and session data
- Order history, preferences, product views, delivery incidents, and complaints
- Payment information (collected by a third-party payment provider, not stored by Atelier Spatz)
Data marked with an asterisk is mandatory. Some data is collected automatically through User activity on the Website.
5. Use of Personal Data
Personal data is used solely to deliver Services and ensure the smooth operation of the Website. The purposes include:
(i) Service Fulfilment
- User registration: Email and password may be required.
- Purchases: Contact and delivery details are collected and shared with the relevant seller post-payment confirmation.
- Click & Collect: Phone number and email are used for pick-up notifications.
(ii) Service Improvement
Feedback and analytics are used to enhance offerings.
(iii) Marketing Communications
With consent, Users may receive newsletters and promotional messages. Opt-out is available via each message.
6. Lawful Basis for Processing
|
Processing Activity |
Data Processed |
Retention Period |
Legal Basis |
Subcontractors |
|
Order as registered user |
Name, address, email, phone, password (encrypted), session ID, order and payment details |
Up to 10 years (varies per data type) |
Art. 6(1)(b) GDPR – Contract performance; Art. 6(1)(a) GDPR – Consent |
Stripe Payments Europe, Ltd; PayPal Europe Ltd |
|
Order as guest |
Same as above, excluding password |
Same as above |
Same as above |
Same as above |
|
Newsletter distribution |
Email address |
Until unsubscription |
Art. 6(1)(a) GDPR – Consent |
Odoo S.A. |
|
Seller management |
Identity, contact details, Stripe KYC documents, session ID, password (encrypted) |
Until account termination |
Art. 6(1)(b) GDPR – Contract performance |
Odoo S.A. |
7. Data Accuracy and Minimisation
Atelier Spatz takes reasonable steps to:
- Maintain the accuracy and currency of personal data;
- Limit data collection to what is necessary for the stated purposes;
- Obtain express consent for data used beyond the scope defined herein (e.g., promotional use).
8. Data Disclosure
Atelier Spatz does not disclose Users’ data to third parties without express consent, except:
- To approved subcontractors assisting in service delivery;
- When required by law, to protect rights, enforce terms, or prevent harm.
Authorised Subcontractors:
- Stripe Payments Europe, Ltd
- PayPal Europe Ltd
Third-Country Data Transfers:
Some cookies may result in data transfers to third countries (e.g., the United States) via tools like Google Analytics and Facebook Pixel. These cookies are disabled by default and require User consent.
9. Data Protection Measures
Atelier Spatz employs industry-standard technical and organisational measures to secure data against unauthorised access, disclosure, alteration, and destruction. Subcontractors must also comply with these safeguards.
10. Data Transmission & International Transfers
Personal data processed via Stripe Payments Europe, Ltd may be transferred outside the EU. Stripe’s compliance with the EU-U.S. Privacy Framework ensures appropriate safeguards are in place.
11. Data Retention
If a User closes their account, all related personal data will be deleted or irreversibly anonymised. Specific retention durations are outlined in Article 5.
12. User Rights
Under the GDPR, Users have the following rights, which may be exercised at any time and free of charge:
- Access, rectification, and erasure of personal data
- Objection and restriction of processing
- Data portability
- Withdrawal of consent (including by account closure)
- Complaint to the Luxembourg CNPD: https://cnpd.public.lu/fr.html
Requests should be sent to: info@atelierspatz.com
13. Amendments to the Privacy Policy
Atelier Spatz reserves the right to modify this Policy. Users will be notified of any significant changes via email. The latest version is always available on the Website.
14. Consent
Use of the Services implies acceptance of this Policy. Consent is confirmed during account creation or guest purchase. Without consent, use of the Website’s Services is not permitted.
15. Cookies
Atelier Spatz uses cookies to enhance the browsing experience. Cookies store data on the User’s device to personalise Website features.
Users are presented with a cookie banner offering the choice to accept or decline non-essential cookies. Only essential cookies are activated by default.
Cookie Categories and Consent
Cookies not essential to the Website’s operation require explicit consent. These include:
- Advertising & Analytics: Facebook Pixel, Google Analytics
- Multimedia & Engagement: Vimeo, YouTube, Instagram
- User Interaction Tracking: Odoo
- Geolocation & Maps: Google Maps, Google Virtual Tour
Users may manage cookie settings via the Privacy Settings page.
Privacy Settings Options Include:
- External Data Embeds
- Google Analytics 4
- Google Tag Manager
- Recaptcha
- Session Cookies
- Stripe
- Odoo S.A.
- Various third-party services (Facebook Pixel, etc.)
For further details on how cookies are used, and for a complete list of tools and technologies, please refer to the Cookies section of the Website or contact info@atelierspatz.com
Impressum
Johanna De Santis
32 rue Jean Baptiste Fresez
1542 Luxemburg
Luxemburg
Chambre des Metiers Luxembourg - Niederlassungsgenehmigung 10138075:0-5
E-Mail: info@atelierspatz.com
Plattform der EU-Kommission zur Online-Streitbeilegung: https://ec.europa.eu/odr
We are neither obliged nor willing to participate in dispute resolution proceedings before a consumer arbitration board.