Privacy Policy

1. What Personal Data We Collect

• Account & order data: name, email address, shipping and billing address, phone number, order history.
• Payment data: processed directly by Stripe (see Section 4). We do not store your full card details.
• Communications: messages you send us via email, contact forms, or social media.
• Technical & usage data: pages visited, general location (country/city level), device and browser type, collected via Umami analytics (see Section 3).
• Marketing preferences: if you subscribe to a newsletter, your email address and subscription status.

2. How We Use Your Data and Legal Basis

We do not sell your personal data to third parties.

3. Cookies & Analytics

We use Umami Cloud, a privacy-focused analytics tool that does not use cookies to track individual visitors, does not collect personally identifiable information, and does not create cross-site profiles. Data collected is aggregated and anonymized (e.g. page views, referral source, general device type).

The Site may use strictly necessary cookies required for core functionality (e.g. shopping cart, checkout session). These do not require consent under Dutch cookie law as they are essential to the service you request. If we introduce non-essential cookies (e.g. for marketing) in the future, we will request your consent via a cookie banner and update this policy.

4. Payment Processing

Payments are processed by Stripe, a PCI-DSS compliant payment processor. When you check out, your payment details are transmitted directly to Stripe and are not stored on our servers. Stripe's own privacy policy governs how they handle your payment data: stripe.com/privacy.

5. Sharing Your Data

We share personal data only with:

• Stripe — payment processing
• Umami Cloud — anonymized website analytics
• Shipping carriers (e.g. PostNL, DHL) — to deliver your order, limited to name, address, and contact details
• Tax and legal authorities — where required by Dutch or EU law

We do not share your data with third parties for their own marketing purposes.

6. International Data Transfers

Some service providers (e.g. Stripe) may process data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses, as required by GDPR.

7. Data Retention

• Order and invoice data for 7 years, in line with Dutch tax record-keeping law.
• Account data for as long as your account is active, or until you request deletion.
• Marketing consent records until you unsubscribe.

8. Your Rights Under GDPR

You have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data (“right to be forgotten”), subject to legal retention requirements
• Restrict or object to certain processing
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at thesaffronfashion@gmail.com. We will respond within one month as required by law.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), autoriteitpersoonsgegevens.nl, if you believe your data has been mishandled.

9. Data Security

We take appropriate technical and organizational measures to protect your data, including encrypted connections (HTTPS), restricted access to personal data, and use of reputable, GDPR-compliant service providers.

10. Children's Privacy

The Site is not directed at children under 16. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last updated” date.