Privacy and cookie policy

Atelier Sainte Catherine attaches great importance to the protection of your personal data. This policy explains, in accordance with Regulation (EU) 2016/679 ("GDPR") and the Belgian law of 30 July 2018, what data we process when you visit the Site or contact us, and what your rights are.

Data controller

• CACAO INVEST SRL
• Quai aux Briques 36, 1000 Brussels, Belgium
• CBE 0887.514.168
• Email: info@ateliersaintecatherine.be · Phone: +32 2 512 77 12

No data protection officer (DPO) has been appointed, as this is not required given the size and nature of our activities. Any request about your data is handled directly by the data controller.

What data we process

• Contact form: first name, last name, email address, phone number if you give it, and your message. Nothing is kept on the Site: your message is forwarded to us by email through our sending provider, then handled in our mailbox.
• Direct exchanges: when you write to us, call us or contact us on social media, we process your details and the content of your messages.
• Technical data: our host Cloudflare automatically processes connection data (IP address, browser, pages viewed, time) for the security and proper operation of the Site.
• We collect no sensitive data, do no audience measurement or profiling, and the Site is not aimed at children under 16.

Why, and on what legal basis

• Answering your questions, special orders and corporate gift requests: pre-contractual steps taken at your request (Art. 6.1.b GDPR) or our legitimate interest in answering you (Art. 6.1.f).
• Securing the Site and preventing abuse: legitimate interest (Art. 6.1.f).
• Meeting our legal obligations, notably accounting ones, when a request leads to an order: legal obligation (Art. 6.1.c).

Who we share your data with

Your data is never sold. It may be processed by providers who act on our instructions and are bound by contractual safeguards:

• Cloudflare, Inc. (USA): Site hosting, content delivery network and security.
• Resend, Inc. (USA): delivering to our mailbox the messages sent from the Site's form.
• Meta Platforms Ireland Ltd (Ireland) and TikTok Technology Ltd (Ireland): when you follow our Instagram, Facebook or TikTok accounts, under their own policies.
• Cubix Advertising (Belgium): design, technical hosting and maintenance of the Site, as processor.
• Public authorities: where the law requires it.

Some providers are established outside the European Union, notably in the United States. The transfer then relies on an adequacy decision (EU-US Data Privacy Framework for certified companies, such as Cloudflare) or on the European Commission's standard contractual clauses.

How long we keep your data

• Contact requests: 12 months after the last exchange, unless they lead to an order.
• Documents relating to an order: 10 years for accounting and tax records (legal obligation).
• Host technical logs: a few days to a few weeks, depending on Cloudflare's security settings.

Your rights

You have the following rights over your data: access, rectification, erasure, restriction of processing, objection, portability, and withdrawal of your consent at any time, without affecting the lawfulness of earlier processing.

To exercise these rights, write to info@ateliersaintecatherine.be stating your request; proof of identity may be asked for in case of reasonable doubt. We answer within one month, extendable by two months for complex requests.

If you believe your rights are not respected, you may lodge a complaint with the Belgian Data Protection Authority (APD/GBA), Rue de la Presse 35, 1000 Brussels · contact@apd-gba.be · www.dataprotectionauthority.be.

Security

The Site is fully encrypted (HTTPS) and protected by the Cloudflare network; access to our mailboxes is limited to the people who need it. In the event of a data breach likely to result in a high risk to you, we will inform you as the law requires.

Cookies and trackers

A cookie is a small file placed on your device when you visit a site; other techniques, such as the browser's local storage, have the same effect. In accordance with Article 5.3 of Directive 2002/58/EC, the Belgian law of 13 June 2005 on electronic communications and the recommendations of the Belgian Data Protection Authority, only strictly necessary trackers may be used without your consent.

• The Site sets no audience measurement or advertising cookie and stores nothing in your browser. Only our host Cloudflare may, where needed, set a technical security cookie (__cf_bm, 30 minutes) that tells visitors from bots apart; strictly necessary, it is exempt from consent.
• All its resources (pages, photographs, videos, fonts, the Contact page map drawn from OpenStreetMap data) are served by the Site itself, without calling any third-party service.
• Social networks and directions: Instagram, Facebook and Google Maps are only reachable through links. Nothing is loaded or stored by these services until you click.

No consent banner is therefore needed. Should we ever add a service that sets non-essential trackers, this policy will be updated and your consent will be asked beforehand.

Changes

We may adapt this policy to reflect changes to the Site or to the regulations. The version in force is the one published on the Site, with its update date.

Contact

For any question about your personal data: info@ateliersaintecatherine.be · Quai aux Briques 36, 1000 Brussels, Belgium.