Legal

Privacy Policy

Effective: October 7, 2026

Kittie Me Ceramics · KVK 84031743 · www.kittieme.com

We keep only what we need to make, ship, and support your order, and to answer your messages. We don’t use tracking or analytics, and we never sell your data.

Kittie Me Ceramics (“Kittie Me”, “we”, “us”) is registered in the Netherlands with the Chamber of Commerce (KVK) under number 84031743. We are the controller of the personal data described in this policy, which means we decide how and why it is used.

This policy covers the website at www.kittieme.com, orders placed through the cart, workshop bookings, and messages you send us through the inquiry form.

  • When you order: your name, email address, phone number, shipping address, and billing address if it is different. You enter these on the Stripe checkout page and Stripe passes them on to us. We also keep the pieces you ordered, the amounts paid, the order status, Stripe’s payment reference, and, once your parcel has been sent, its PostNL Track & Trace code.
  • When you book a workshop: your name and email address, which you enter on the Stripe checkout page. We also keep which workshop you booked, the number of seats, the amount paid, the booking status, and Stripe’s payment reference.
  • Payment details: card and other payment details are entered on Stripe’s checkout page and handled by Stripe. We never see or store full card numbers.
  • When you send an inquiry: your name, email address, your message, and, if you asked about a specific piece, which piece it was. The message is delivered to our email inbox.
  • Your cart: a random cart ID stored in a cookie, linked to the pieces in your cart in our database. The cart doesn’t contain your name or contact details.
  • Technical data: when your browser connects to the website, our hosting providers process your IP address, browser type, and the time of the request to deliver the website and keep it secure.
  • Other messages: anything else you send us, for example about a return or a delivery.
  • You don’t need an account to shop with us, so we don’t store usernames or passwords for customers.
  • We don’t use analytics, advertising, or tracking tools, and we don’t build profiles of visitors.
  • We don’t currently send newsletters. If we start one, you will only receive it if you sign up for it yourself.
  • To handle your order: processing your payment, packing and shipping your pieces, and arranging delivery. Legal basis: performing our contract with you.
  • To contact you about your order: questions about delivery, delays, damaged parcels, returns, and refunds. Legal basis: performing our contract with you.
  • To handle your workshop booking: confirming your seats, sending you a confirmation with a calendar invite, and contacting you about changes to the workshop, cancellations, and refunds. Legal basis: performing our contract with you.
  • To answer your inquiries: replying to your questions and discussing custom orders. Legal basis: taking steps at your request before a contract, and our legitimate interest in answering the messages people send us.
  • For accounting and tax: keeping records of sales, payments, and refunds. Legal basis: our legal obligations under Dutch tax law.
  • To keep the website and payments secure: preventing fraud, abuse, and attacks. Legal basis: our legitimate interest in running a safe shop.

We don’t use your data for marketing without your consent, we don’t sell it, and we don’t make decisions about you based only on automated processing.

We only share your data with providers that help us run the shop, and only as far as they need it:

  • Stripe: the checkout page, payments, refunds, and calculating VAT. Stripe also uses payment data for its own fraud prevention and legal obligations, under the Stripe Privacy Policy.
  • Supabase: the database that stores orders, workshop bookings, carts, and product information.
  • Vercel: hosting the website.
  • Resend: sending order and workshop booking confirmation emails, and delivering messages sent through the inquiry form to our email inbox.
  • Google: our email service (Gmail), where inquiry form messages arrive and the emails we exchange with you are stored.
  • PostNL: we ship every order with PostNL. PostNL receives your name and shipping address, and where needed your email address or phone number, to deliver your parcel and send you delivery updates. For international parcels, PostNL passes the details needed for delivery to the postal service in your country.
  • Customs authorities: for shipments to the United Kingdom, Switzerland and Norway, the recipient details and contents that a customs declaration requires, submitted through PostNL.
  • Our accountant and the Dutch Tax Administration: order and payment records, as far as needed for bookkeeping and tax.

We may also share data when the law requires it, for example with a court or a government authority.

Some of our providers may process data outside the European Economic Area, for example in the United States. When they do, the transfer is protected by safeguards such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

If we ship to the United Kingdom, Switzerland or Norway, your shipping details naturally travel with the parcel to that country. These countries are recognised by the EU as offering an adequate level of data protection, or are part of the European Economic Area.

We use one cookie for shoppers: a cart cookie that remembers which cart is yours, so your pieces are still there if you come back. It contains only a random ID, can’t be read by scripts on the page, and expires after 24 hours. Because it is needed for the shop to work, we don’t ask for consent for it.

We don’t use analytics, advertising, or social media cookies. Our fonts are served from our own website, so loading a page doesn’t send your data to font providers.

When you pay, you are taken to Stripe’s checkout page. Stripe may set its own cookies there, for example to prevent fraud, under its own privacy policy.

  • Orders, workshop bookings, invoices, and payment records: seven years after the end of the financial year, as required by Dutch tax law.
  • Inquiries and other messages: as long as we need them to answer you and follow up, and no longer than 12 months after our last contact. If an inquiry leads to an order, we keep it together with that order.
  • Carts: the cart cookie expires after 24 hours. Unfinished checkouts are deleted when they expire. Carts don’t contain personal data.
  • Technical logs: for a short period, as set by our hosting providers, for security and troubleshooting.

Stripe keeps payment data for as long as it is required to under its own legal obligations.

Under the GDPR, you have the right to:

  • access the personal data we hold about you and get a copy of it
  • have incorrect data corrected
  • have your data deleted, unless we have to keep it, for example for tax reasons
  • restrict how we use your data, or object to it when we rely on our legitimate interests
  • receive your data in a commonly used format so you can take it elsewhere
  • withdraw any consent you gave, at any time

To use any of these rights, send us a message through the inquiry form. We may ask you to confirm your identity, for example by replying from the email address you ordered with. We reply within one month at the latest.

If you’re not happy with how we handle your data, please let us know. You also have the right to complain to the Dutch Data Protection Authority, Autoriteit Persoonsgegevens, or to the data protection authority in your own country.

All connections to the website use HTTPS. Payments are handled by Stripe, which is certified to the highest level of the payment card industry security standard (PCI DSS). Only the studio can sign in to see the order overview.

No system is completely secure, but we take reasonable technical and organisational measures to protect your data.

Our shop is not intended for children under 16. We don’t knowingly collect data from children. If you are under 16, please ask a parent or guardian to order for you.

We may update this policy, for example when we start working with a new provider. The latest version is always on this page, with its effective date.

Questions about your data or this policy? Send us a message through the inquiry form.