Legal
Privacy Policy
Last updated: 27 June 2026 · Version 1.0
Atelier Gabuu (“we”, “us”, “our”) respects your privacy. This policy explains what personal data we collect when you use ateliergabuu.com (the “Site”), why we collect it, how long we keep it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act.
1. Data Controller
The controller of your personal data is:
Atelier Gabuu, [[Legal entity name TBD]]
[[Registered address, Copenhagen, Denmark]]
CVR: [[TBD]] · VAT: [[TBD]]
Email: contact@ateliergabuu.com
We have not appointed a Data Protection Officer because our processing does not meet the mandatory thresholds in GDPR Art. 37. You can address any privacy question to the email above.
2. What Data We Collect & Why
We only collect data you give us directly. We do not buy data, scrape it, or run advertising trackers. The table below maps each data category to its purpose and the legal basis under GDPR Art. 6.
| When you... | We collect | Purpose | Legal basis |
|---|---|---|---|
| Submit the contact form | Name, email, subject, message | Respond to your enquiry | Art. 6(1)(b), pre-contractual steps |
| Book a consultation | Name, email, phone, service type, preferred date/time, shoe size, optional notes | Schedule and prepare the consultation; sync to our calendar | Art. 6(1)(b), pre-contractual steps |
| Place a ready-to-wear order | Name, email, phone, shipping address, payment reference | Fulfil the purchase contract, ship the goods, handle returns, comply with tax law | Art. 6(1)(b), contract performance; Art. 6(1)(c) for tax records |
| Visit any page | IP address (in server access logs), browser user-agent | Security, abuse prevention, debugging | Art. 6(1)(f), legitimate interest in keeping the Site secure |
Providing the data marked above is required to receive the corresponding service. If you don’t provide it, we can’t respond, schedule, or ship. We do not use your data for automated decision-making or profiling within the meaning of GDPR Art. 22.
3. How Long We Keep It
- Contact enquiries: up to 3 years after our last exchange, then deleted.
- Bookings: up to 3 years after the consultation, then deleted.
- Orders & invoices: 5 years from the end of the relevant financial year, in compliance with Danish bookkeeping law (Bogføringsloven).
- Server access logs: up to 90 days, then deleted or aggregated.
- Admin accounts: for the duration of the working relationship plus 1 year.
4. Who We Share It With
We never sell your data. We share it only with the following sub-processors, each strictly for the purpose listed and under a written data processing agreement.
- Stripe Payments Europe, Ltd., processes card payments for ready-to-wear orders. Receives name, email, billing address, and card details (the card number is collected directly by Stripe, not by us). Stripe is GDPR-compliant; transfers to the United States are covered by Standard Contractual Clauses.
- Google LLC (Google Calendar), we sync confirmed consultations to our internal calendar. Receives your name, email, and the consultation time. SCCs in place.
- Google LLC (Google Fonts), serves the Playfair Display and Inter typefaces from a US CDN. When you load the Site your IP address is briefly visible to Google. No identifying account data is sent.
- Our hosting provider, the Site and database are hosted in an EU data centre. The provider has no access to user data beyond what is required to operate the infrastructure.
- Our transactional email provider, relays booking and order confirmations to you. Receives your name, email, and the message content.
5. International Transfers
Where a sub-processor is located outside the European Economic Area (notably Stripe and Google in the United States), the transfer is protected by the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
6. Cookies & Local Storage
We use only what is strictly necessary to operate the Site:
- An authentication token stored in local storage when an administrator signs in to the back office. Customers do not receive this token.
- Standard session cookies set by our hosting layer for load balancing.
We do not run analytics, advertising, or social-media tracking cookies, so no consent banner is required for visiting the Site. If we add any non-essential tracking in the future, we will request your consent first and update this policy.
7. Your Rights
Under GDPR Articles 15–22 and 77, you have the right to:
- Access, ask for a copy of the data we hold about you.
- Rectification, ask us to correct anything inaccurate.
- Erasure (“right to be forgotten”), ask us to delete your data, subject to legal retention obligations.
- Restriction, ask us to pause processing while a dispute is resolved.
- Portability, receive your data in a structured, machine-readable format (e.g. JSON).
- Objection, object to processing based on legitimate interest.
- Withdraw consent, where processing is based on consent, withdraw it at any time without affecting prior processing.
To exercise any of these rights, email contact@ateliergabuu.com. We will respond within one month (GDPR Art. 12(3)). You may also lodge a complaint with the Danish Data Protection Authority, Datatilsynet.
8. Security
Data is transmitted over TLS, stored on servers in the EEA, and encrypted at rest where the platform supports it. Access to the production database is restricted to a small number of named personnel and protected by two-factor authentication. We do not store raw payment card details, those are tokenised by Stripe.
9. Changes to This Policy
We may update this policy as the Site evolves. The “Last updated” date at the top reflects the most recent change. Material changes will be announced on the home page or by email to customers with an active order.
Questions about this policy? Write to us , we read every message.