Privacy Policy
Effective date: 20 July 2026
Last updated: 20 July 2026
This Privacy Policy explains how Mara Bloomhuis (“we”, “us”, “our”) processes personal data when you visit lovingnestle.mom, contact us, place an order, or visit our atelier. We process personal data in accordance with the EU General Data Protection Regulation (GDPR / AVG) and the Dutch Uitvoeringswet AVG.
1. Controller
- Business name: Mara Bloomhuis
- Address: Voorstraat 68, 3512 AK Utrecht, Netherlands
- Email: [email protected]
- Phone: 030 737 1842
For privacy questions or requests, contact us using the details above.
2. Personal data we collect
- Identity and contact data — name, email address, phone number, delivery and billing address
- Order data — products ordered, occasion notes, card messages, delivery instructions, payment status
- Communication data — messages sent via our contact form, email or telephone
- Technical data — IP address, browser type, device information, pages visited, and cookie identifiers where applicable (see our Cookie Policy)
We do not intentionally collect special categories of personal data. If you include sensitive information in a free-text message (for example in a sympathy card), we process it only to fulfil your request.
3. Purposes and legal bases
- Contract performance — to take and deliver orders, arrange collection, and provide customer service (Art. 6(1)(b) GDPR)
- Legitimate interests — to keep our website secure, improve our services, and respond to general enquiries (Art. 6(1)(f) GDPR)
- Legal obligation — to keep records required under Dutch tax and accounting rules (Art. 6(1)(c) GDPR)
- Consent — for non-essential cookies and, where used, optional marketing emails (Art. 6(1)(a) GDPR). You may withdraw consent at any time
4. Sharing of data
We do not sell personal data. We may share data with:
- Delivery partners and couriers, only as needed to deliver an order
- IT and hosting providers who process data on our instructions
- Payment service providers for online or in-shop payments
- Professional advisers (accountant, lawyer) where necessary
- Public authorities where required by Dutch or EU law
Where a processor is used, we put in place appropriate contractual safeguards.
5. International transfers
Where personal data is transferred outside the European Economic Area, we ensure an appropriate safeguard is in place, such as an adequacy decision or Standard Contractual Clauses, unless a GDPR derogation applies.
6. Retention
- Order and invoice data: generally kept for up to 7 years as required for Dutch tax administration
- Contact form messages: typically up to 24 months after the last correspondence, unless a longer period is needed for a dispute
- Cookie preference data: according to the periods described in the Cookie Policy
7. Security
We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. No method of transmission over the internet is completely secure.
8. Your rights
Under the GDPR/AVG you may have the right to:
- access your personal data
- rectify inaccurate data
- erase data in certain cases
- restrict or object to processing
- data portability where processing is based on consent or contract and carried out by automated means
- withdraw consent where processing is based on consent
To exercise these rights, email [email protected] or write to Voorstraat 68, 3512 AK Utrecht. We may need to verify your identity.
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): www.autoriteitpersoonsgegevens.nl.
9. Children
Our services are directed at adults. We do not knowingly collect personal data from children under 16 without appropriate authorisation.
10. Changes
We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Significant changes will be indicated on this page.
11. Contact
Mara Bloomhuis, Voorstraat 68, 3512 AK Utrecht, Netherlands
[email protected] · 030 737 1842