⚠️ Draft for review — this is a starting template, not legal advice.
It's built from the Dutch Data Protection Authority's (Autoriteit Persoonsgegevens) published requirements for a privacy statement, but every business's data handling is slightly different. Before publishing, fill in the bracketed placeholders and have it checked — either by a legal professional or using the Autoriteit Persoonsgegevens' own free privacy statement generator (autoriteitpersoonsgegevens.nl) — since getting the retention period and legal basis wrong is the kind of mistake that actually matters if a customer complains.
Privacy Policy — Atelier Kharita
Last updated: [date]
1. Who we are
This website is operated by:
Atelier Kharita is the data controller for the personal data described in this policy.
2. What personal data we collect
When you use our booking form, we collect:
- Your name
- Your phone number
- The type of clothing/item you're booking a repair for
- Your preferred drop-off time
- The service(s) you've selected
- Any extra description you provide
- The date and time you submitted the booking
We do not currently use tracking or analytics cookies on this website. [Update this section if you later add Google Analytics, Meta Pixel, or similar tools — those require separate cookie consent under Dutch/EU law.]
3. Why we collect it and our legal basis
We use this information to:
- Schedule and carry out the alteration/repair service you've requested (legal basis: performance of a contract with you)
- Contact you about your booking — confirmations, questions about the item, or pickup timing (legal basis: performance of a contract / legitimate interest in delivering the service you asked for)
We do not use your data for marketing or send you promotional messages unless you separately opt in to that.
4. Who we share it with
We do not sell or rent your personal data to third parties. We may share limited data with:
- Service providers who help us run this website and receive bookings (e.g., our website hosting provider, our email provider) — only to the extent needed for them to provide that service to us
- Authorities, if required by law
[If you use any specific third-party tools — booking software, an accountant, invoicing software — list them here once decided.]
5. How long we keep it
We keep booking information for [proposed default: 12 months after the service is completed, unless a longer period is required for tax/accounting purposes]. Data relating to invoices or payments, if any, is kept for 7 years as required by Dutch tax law. [Confirm this retention period reflects what you actually do — this is a placeholder default, not a legal requirement for booking data specifically.]
6. Your rights
Under the GDPR (AVG), you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data
- Restrict or object to our processing of your data
- Request a copy of your data in a portable format
- Withdraw consent at any time, where processing is based on consent
To exercise any of these rights, contact us at atelierkharita@gmail.com. If you're not satisfied with how we've handled your data, you have the right to lodge a complaint with the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
7. Security
We take reasonable technical and organizational measures to protect your personal data against loss or unauthorized access. [If you want to describe anything specific — e.g., “data is stored on secure servers within the EU” — add it here once your hosting setup is finalized.]
8. Changes to this policy
We may update this privacy policy from time to time. The date at the top reflects the most recent update.
9. Contact
Questions about this policy or your data: atelierkharita@gmail.com / 06 44469920.