Privacy Policy

liebeling sells one-of-a-kind vintage pieces online. We only collect the personal data we need to run the shop, we never sell it, and we don’t use advertising trackers. This policy explains how we handle your data under the EU General Data Protection Regulation (GDPR).

Who is responsible

The controller of your personal data is liebeling:

You can reach us through the contact form.

What we collect and why

Orders

When you order we collect your name, email address, shipping address, optional phone number and the pieces you bought. We use this to process payment, ship your order, send order and shipping emails and handle returns. Legal basis: performance of the contract (art. 6(1)(b) GDPR) and our legal obligation to keep financial records (art. 6(1)(c)).

Accounts

If you create an account we store your email address, an encrypted (hashed) password, the pieces you save to your archive and your order history. Legal basis: performance of the contract.

Contact messages

When you use the contact form we receive your name, email address and message so we can reply. Legal basis: our legitimate interest in answering your questions (art. 6(1)(f)).

Technical data

Our hosting providers process technical data such as IP addresses in server logs to keep the site secure and working. We limit sign-in attempts and contact-form submissions to prevent abuse. Legal basis: legitimate interest.

Cookies and local storage

We don’t use advertising or analytics cookies. Your browser’s local storage keeps your bag and, as a guest, the pieces you heart; when you sign in it also holds the session that keeps you signed in. These are strictly necessary for the features you use, so no consent banner is needed. You can clear them at any time in your browser settings.

Who processes data for us

We use a small number of service providers (processors) who act only on our instructions under a data processing agreement:

• Convex — database and backend hosting (EU region, Ireland).
• Railway — website hosting (EU region, Amsterdam).
• Mollie (Amsterdam, the Netherlands) — payment processing. Mollie receives the data needed to process your payment and is itself responsible for payment data under financial regulation.
• Resend — sending order, shipping and account emails.

Where a provider processes data outside the European Economic Area, such as in the United States, the transfer is protected by the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework.

How long we keep it

• Order and invoice data: 7 years, as required by Dutch tax law.
• Accounts: until you ask us to delete your account.
• Contact messages: up to 12 months after our last reply.
• Server logs: a short period, typically a few weeks.

Your rights

You have the right to access, correct or delete your personal data, to restrict or object to its processing, and to receive it in a portable format. To exercise a right, contact us through the contact form. We respond within one month.

If you’re unhappy with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority where you live.

Changes

We may update this policy when the shop changes. The date at the top shows when it was last revised.