Privacy Policy

This page explains how TEI Ceramics processes your personal data when you visit teiceramics.com, place an order, or get in touch. We follow the EU General Data Protection Regulation (GDPR) and the Dutch Uitvoeringswet AVG.

Who is the controller

TEI Ceramics · KvK 98959964 · BTW NL005363781B34 · Amsterdam, Netherlands · hello@teiceramics.com. The studio has fewer than 250 employees and processes data on a small, transactional scale, so we are not required to appoint a Data Protection Officer.

What we collect

We only collect what we need to fulfil your order and run the studio:

• Order data: name, email address, shipping address, items ordered, total paid, payment timestamps. Collected at checkout.
• Payment data: handled directly by Mollie. We never see your full card number, IBAN, or bank credentials — only a Mollie payment ID and status.
• Withdrawal & refund data: if you withdraw an order, we store the reason you give (if any) and an IBAN if you provide one for the refund.
• Contact form messages: name, email, and the content of your message. Used solely to reply.
• Studio admin sessions: a single HMAC-signed session cookie used by the two studio operators to log in. Not used for tracking visitors.

We do not use analytics, advertising trackers, fingerprinting scripts, social pixels, or third-party cookies. You will not see a cookie banner because we do not place any non-essential cookies.

Why we process it (lawful bases)

• Contract performance (GDPR Art. 6(1)(b)) — to take and ship your order, send the receipt, and handle returns.
• Legal obligation (Art. 6(1)(c)) — Dutch tax law (Algemene Wet inzake Rijksbelastingen art. 52) requires us to keep invoices and order records for 7 years.
• Legitimate interests (Art. 6(1)(f)) — protecting against fraudulent orders and operating the studio's secure admin area.

Who else sees your data

We use a small number of EU-based service providers:

• Mollie B.V. (Amsterdam, NL) — processes your payment as an independent controller. See mollie.com/legal/privacy.
• Resend — sends transactional emails (receipts, shipping notices, withdrawal confirmations).
• Cloudflare — hosts the website and CDN.
• Neon — managed Postgres database where orders are stored.
• Cloudflare R2 — stores product images (no customer data).

None of these providers receive your data for marketing. We do not sell or share your data with anyone else. Where any provider operates servers outside the EEA, transfers rely on the Standard Contractual Clauses approved by the European Commission.

How long we keep it

• Order records and invoices: 7 years from the end of the year of the transaction (Dutch tax retention).
• Withdrawal requests: kept alongside the linked order for the same 7-year period.
• Contact form messages: deleted within 12 months unless they relate to an active order or warranty matter.
• Admin session cookies: 30 days, on the studio operators' devices only.

Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Have your data erased (subject to the 7-year tax retention above)
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw any consent you've given (where consent is the basis)

Email privacy@teiceramics.com and we'll respond within 1 working day. If you're not satisfied, you can lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

No automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects for you.

Security

Traffic to the site is encrypted with TLS. Payments are tokenised by Mollie. Database access is restricted to the two studio operators behind a cryptographically signed admin session and strict per-request connection isolation.

Changes to this policy

If we change anything material we'll update the "last updated" date and, where required, notify you by email.