Privacy Policy

Who is responsible for your data

MAD Vintage (sole proprietorship, KVK 98178822, VAT NL005313243B43), De Marowijne 49, 1689 AR Zwaag, the Netherlands, is the controller for the personal data described on this page. You can reach us at info@madvintage.nl.

What we collect, why, and on what legal basis

• Orders. Name, e-mail, phone (optional), shipping address and order details, so we can accept, process, ship and invoice your order. Legal basis: performance of the contract with you.
• Account. If you create an account: your name, contact details and an encrypted (hashed) password, so you can log in and see your orders. Legal basis: performance of the contract / your request.
• Wishlist. The pieces you save to your wishlist, linked to your account. Legal basis: performance of the contract / your request.
• Reviews. Your rating, review text, the name display you choose and — only if you upload one — a photo. Reviews are published on the site. Legal basis: your consent, given when you submit the review.
• Newsletter (VIP list). Your e-mail address, plus the moment and the page where you signed up, so we can send you news about new drops and prove your consent. Legal basis: your consent.
• Contact form. Your name, e-mail and message, so we can answer you. Legal basis: our legitimate interest in handling your question, or the contract if your question is about an order.
• Withdrawals and returns. Order number, e-mail and the reason you state, so we can process your return. Legal basis: legal obligation and performance of the contract.
• Administration. Orders, invoices and payment records, because we are legally required to keep them. Legal basis: legal obligation.

We do not use your data for automated decision-making or profiling, and we do not ask for your date of birth.

Who we share it with

We never sell or rent your data. We do use a small number of service providers ("processors"), each of whom only receives what they need:

• Mollie B.V. (Netherlands) — payment processing. Mollie handles your payment details directly; we never see your card or bank credentials.
• PostNL (Netherlands) — shipping. Receives your name and delivery address so your parcel arrives.
• Intuit Mailchimp (United States) — newsletter mailings. Your e-mail address is stored in the United States. This transfer is covered by the EU-US Data Privacy Framework and/or the European Commission's standard contractual clauses.
• Microsoft 365 (EU data centres) — our e-mail. Any message you send us is stored in our mailbox.
• TransIP B.V. (Netherlands) — hosting. This website and its database run on a server in the Netherlands.

Apart from these providers, we only share data when the law requires it (for example with the tax authorities).

How long we keep it

• Orders, invoices and payment records: 7 years, because Dutch tax law requires it.
• Account data: until you ask us to delete your account.
• Newsletter subscription: until you unsubscribe; we keep a record of your unsubscribe so we don't mail you again.
• Contact form messages: 1 year after your question is answered.
• Reviews: for as long as they are published, or until you withdraw your consent.

Your rights

You have the right to access your data, to have it corrected, to have it deleted, to restrict or object to its processing, and to receive it in a portable format. Where we rely on your consent (newsletter, reviews), you can withdraw that consent at any time — this does not affect processing that already took place. Every newsletter contains an unsubscribe link.

To exercise a right, e-mail info@madvintage.nl. We answer within one month. If you are not happy with our response, you have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Cookies

We only use strictly functional cookies: a session cookie that keeps you logged in and remembers the pieces in your bag, and the security token that protects our forms. These are necessary for the site to work, so no cookie consent banner is required. We do not use analytics, advertising, tracking or social media cookies, and there is no tracking pixel on this site.

Our fonts are loaded from Google Fonts (Google Ireland Ltd.). This means your IP address and browser details are sent to Google when a page loads. No cookie is placed. If you would rather avoid this, ask us to host the fonts on our own server instead.

Security

The site runs over an encrypted HTTPS connection, passwords are stored hashed, and access to the shop's back office is limited to the owner.

Changes

If we start using a new tool that processes personal data, we update this page and change the date at the top.