Privacy Policy

EvelyneBoutique is a small online art studio operating from the Netherlands, selling handmade paper-cut cards and framed pieces. For the personal data described in this policy, we act as the data controller.

If you have any question about your data or wish to exercise a right below, you can reach us using the contact details at the end of this policy.

We only collect what we need to take your order, deliver your artwork, and support you afterwards:

• Account details — your name, email address, and a securely hashed password.
• Delivery and billing addresses you save to your account.
• Order and request history — the pieces you have bought or requested, their options, and the status of each.
• Optional contact details, such as a phone number, when you provide one for delivery.
• Basic technical data (such as your browser type) needed to run the site securely.

Card payments are handled entirely by Stripe, our payment processor. Your full card number is entered directly with Stripe and is never seen or stored on our servers.

We receive only what we need to confirm your order — for example the result of the payment and a masked reference. Stripe processes this data as an independent controller under its own privacy terms.

We process your personal data on the following legal bases under the GDPR:

• To perform our contract with you — taking payment, preparing and shipping your order, and handling returns or requests.
• To meet legal obligations — for example keeping invoices for the period required by tax law.
• For our legitimate interests — keeping the site secure and answering your enquiries — balanced against your rights.

We use functional cookies only — the small amount needed to keep you signed in, remember your basket, and apply your preferences. We do not use advertising cookies, and we do not track you across other websites.

We never sell your personal data. We share it only with the service providers we rely on to run the shop — such as Stripe for payments and our delivery partner for shipping — and only to the extent they need it to do their job.

We may also disclose data where the law requires us to.

We keep your account for as long as it is active. Order and invoice records are retained for the period required by Dutch and EU law (generally seven years for tax purposes). When data is no longer needed, we delete or anonymise it.

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Ask us to erase your data, where no legal duty requires us to keep it.
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

To exercise any of these rights, or if you have a question about how we handle your data, please get in touch and we will respond within the timeframe the law allows.