Privacy policy
Privacy Policy
This Privacy Policy describes how Studio Madebo / Maartje de Boer (“the Site”, “we”, “us” or “our”) collects, uses, and discloses your Personal Information when you visit or make a purchase from studiomadebo.com.
Introduction
We deeply value the trust you place in us, and we take your privacy seriously. This Privacy Policy outlines how we collect, use, and share your information when you interact with our services.
There are moments when we need to collect your information in order to serve you well. We believe you should know what happens with your information and how to share your preferences around its use. Know where your information is stored and for what purposes.
This policy also explains your rights regarding your information, and how you can exercise them. If you ever have concerns about how your data is used, you’re welcome to reach out using the contact details below.
Collecting Personal Information
When you visit our Site, we gather some information about your device, how you interact with the site, and anything needed to complete your purchases. We may also collect additional information if you contact us for customer support, use the contact form, sign up for the newsletter, or submit a return or withdrawal request.
Throughout this Privacy Policy, “Personal Information” refers to any data that can identify you directly or indirectly, including the examples listed below. Here’s a breakdown of what we collect and why.
Device information
Purpose of collection: To ensure the Site loads correctly for you, and to better understand how people use it, so we can keep improving your experience. This information is also used to help keep the website secure and functioning properly.
Examples of personal information collected: version of web browser, IP address, time zone, cookie information, what sites or products you view, search terms, and how you interact with the Site.
Source of collection: Collected automatically when you access our Site using cookies, log files, web beacons, tags, or pixels.
Disclosure for a business purpose: shared with our processor, e-commerce platform Shopify, and with service providers used for security, optimisation and analytics, where applicable.
Order information
Purpose of collection:
To fulfil your order and provide the product or service you’ve requested;
To process payments and arrange shipping;
To send you invoices and order confirmations;
To communicate with you and provide support;
To help prevent fraud or suspicious activity;
To share news or offers you’ve opted into.
Examples of personal information collected: name, billing address, shipping address, payment information, email address, and phone number.
Source of collection: collected from you during checkout or when you contact us.
Disclosure for a business purpose: shared with our processor, e-commerce platform Shopify, payment providers such as Shopify Payments and Mollie, shipping providers, and Meta for marketing purposes, when applicable.
Workshop and event information
Purpose of collection:
To register your booking;To organise and communicate about the workshop or event;
To send invoices or payment information;
Examples of personal information collected: name, email address, phone number, billing address, workshop or event date, booking details, payment status, and any relevant information you choose to share with us.
Source of collection: collected from you when you book a workshop or event, contact us about a booking, or provide information needed for the service.
Disclosure for a business purpose: shared with Shopify, payment providers, accounting or administrative service providers, where applicable.
Legal basis: performance of the contract between you and Studio Madebo, compliance with legal obligations, and our legitimate interest in organising and administering the workshop or event.
Marketing and email information
Purpose of collection:
To send you email updates you have signed up for;
To send automated email flows, such as welcome emails, early access emails, abandoned cart reminders, post-purchase emails or other Studio Madebo updates;
To understand how subscribers interact with our emails, so we can improve what we send.
Examples of personal information collected: email address, name if provided, language preference, sign-up source, email preferences, email engagement data such as opens and clicks, and shopping activity such as viewed products, abandoned carts or placed orders where this is connected to an email flow.
Source of collection: collected from you when you sign up for the newsletter, interact with our emails, browse the Site, add items to your cart, or place an order.
Disclosure for a business purpose: shared with Klaviyo, our email marketing provider, and Shopify, our e-commerce platform.
Legal basis: consent, where you have signed up to receive marketing emails; and legitimate interest or performance of contract where emails are directly related to your order, cart, customer relationship or requested services.
Contact form and newsletter
If you send us a message via the contact form, we process your name, email address and the content of your message so we can respond to your inquiry. This processing is based on the performance of a contract or pre-contractual communication, or our legitimate interest in responding to your message.
If you sign up for our newsletter, we use your email address to send you studio updates, new artwork, launch news, early access invitations and other emails related to Studio Madebo. We only do this based on your consent.
We use Klaviyo to manage newsletter sign-ups, email flows and email campaigns. This means your email address, name if provided, language preference, sign-up source and email engagement data may be processed in Klaviyo.
You can unsubscribe at any time via the link at the bottom of each newsletter.
Processing return and withdrawal requests
EU customers have the legal right to withdraw from an online purchase within 14 days. To facilitate this process, we use a specific EU withdrawal / return request app on our website.
When you submit a request through the return or withdrawal button or form, the data you enter, such as your name, order number, email address and details of your request, will be processed to handle your request administratively.
This processing is necessary for compliance with a legal obligation and to handle your return, refund or withdrawal request (Art. 6 para. 1 lit. c GDPR).
Payments
To process your order financially, we use payment services including Shopify Payments and Mollie B.V. Depending on your chosen payment method, such as iDEAL, Wero, Klarna Pay Later, credit card, Apple Pay, PayPal or other available payment options, your transaction data, name, address, order details and payment-related information will be shared with the relevant payment provider.
This is necessary for the performance of the purchase contract (Art. 6 para. 1 lit. b GDPR).
When using Klarna or another pay-later provider, the payment provider may also conduct a credit check based on their own terms and privacy policy.
Security and optimisation
Cloudflare
We use the services of Cloudflare Inc. on our website. Cloudflare acts as a security and performance layer for our website. It helps us detect and block malicious software, spam bots, suspicious automated access and unwanted automated access such as AI scrapers.
For this purpose, the data traffic between your browser and our website is routed through Cloudflare’s servers. Cloudflare analyzes this traffic, including your IP address, browser data and request information, to help keep the website secure, available and fast.
This processing is based on our legitimate interest in securing the website against cyberattacks, abuse, spam, content theft and unwanted automated activity (Art. 6 para. 1 lit. f GDPR).
Cloudflare is certified under the EU-US Data Privacy Framework, which means they comply with European privacy requirements for transferring data to the United States. For more information, please refer to Cloudflare’s privacy policy.
StoreLock
To help prevent our artworks from being downloaded or copied without permission, we use the StoreLock app on our website.
This software blocks certain user actions, such as right-clicking and specific keyboard shortcuts, to make it more difficult to directly save images from the website. This app generally does not process personally identifiable information of visitors and is aimed at the functional security of our content.
This processing is based on our legitimate interest in protecting our artwork and intellectual property (Art. 6 para. 1 lit. f GDPR).
Pixsy
We use the services of Pixsy Inc. to protect our artworks against unauthorized use and content theft.
Pixsy scans the internet based on images of our art. If a copyright infringement is detected, data such as the URL of the infringing website and evidence may be shared with Pixsy to pursue legal action.
This processing is based on our legitimate interest in protecting our intellectual property (Art. 6 para. 1 lit. f GDPR).
Minors
We do not knowingly or intentionally collect Personal Information from children. If you’re a parent or guardian and believe your child has shared personal data with us, please get in touch using the contact details below, and we’ll make sure it’s promptly removed.
Sharing Personal Information
We share your Personal Information with trusted service providers who help us run the shop and deliver your experience, as described above.
For example:
Our store runs on Shopify. You can read how Shopify handles Personal Information in their Privacy Policy here:
https://www.shopify.com/legal/privacy
We use payment providers, such as Shopify Payments, Mollie and PayPal, to process payments.
We use Klaviyo to manage newsletter sign-ups, email flows and email campaigns.
We use Cloudflare for website security and optimisation.
We use StoreLock and Pixsy to help protect our artwork and intellectual property.
We use Meta and Google for analytics or marketing purposes, where applicable.
In some cases, we may also share your information if we’re legally required to, such as in response to a subpoena, search warrant, or other lawful request for information we receive. This may also happen if it’s necessary to protect our legal rights.
Behavioural Advertising
As mentioned earlier, we sometimes use your Personal Information to share updates or promotions we think you might actually like.
We use Google Analytics to better understand how visitors use the site. You can see how Google handles your Personal Information here:
https://www.google.com/intl/en/policies/privacy/
You can also opt out of Google Analytics here:
https://tools.google.com/dlpage/gaoptout
We may also share details about your use of the Site, your purchases, and your interaction with our ads on other websites with our advertising partners who help us reach new audiences. We collect and share some of this information directly with our advertising partners, and in some cases through the use of cookies or other similar technologies, which you may consent to depending on your location, including Meta.
For more information about how targeted advertising works, you can visit the Network Advertising Initiative’s educational page at:
https://www.networkadvertising.org/understanding-online-advertising/how-does-it-work
You can opt out of targeted advertising by:
FACEBOOK - https://www.facebook.com/settings/?tab=ads
GOOGLE - https://www.google.com/settings/ads/anonymous
BING / Microsoft - https://optout.aboutads.info/
If you’d prefer not to see personalised ads, you can opt out of many services by visiting the Digital Advertising Alliance’s opt-out portal at:
https://optout.aboutads.info/
Using Personal Information
We use your Personal Information to offer and deliver our services, which includes: offering products for sale, processing your order and payment, arranging delivery, handling returns and withdrawal requests, responding to messages, sending emails you signed up for, keeping the website secure, protecting our artwork, and keeping you posted about new products, services and offers you might be interested in.
Lawful basis
If you live in the European Economic Area (EEA), we process your personal information according to the rules of the GDPR. That means we do so only when we have a valid legal reason, such as:
Your consent;
The performance of the contract between you and the Site;
Compliance with our legal obligations;
To protect your vital interests;
For our legitimate interests, which do not override your fundamental rights and freedoms.
Retention
When you place an order through the Site, we keep your Personal Information on file, unless and until you ask us to delete it.
Please note that we may need to keep certain information where this is necessary for legal, tax, accounting, fraud-prevention or dispute-resolution purposes.
You can read more about how to request deletion in the “Your rights” section below.
Automatic decision-making
If you live in the EEA, you have the right to object to processing based solely on automated decision-making, which includes profiling, especially if those decisions have legal or otherwise significant consequences for you.
To be transparent: we do not engage in fully automated decision-making that has a legal or otherwise significant effect using customer data.
Shopify, our processor and e-commerce platform, uses limited automated decision-making tools to detect and prevent fraud. These systems do not have a legal or otherwise significant effect on you.
Services that include elements of automated decision-making include:
Temporary denylisting of IP addresses after repeated failed transactions, which lasts a few hours;
Temporary denylisting of credit cards linked to those IPs, which lasts a few days.
Your rights
GDPR
If you live in the EEA, you have the right to:
Access the Personal Information we hold about you;
Ask us to correct, update, or delete it;
Transfer it to another service.
To exercise any of these rights, just get in touch using the contact details below.
Your information is first processed in Ireland, and then will be transferred outside of Europe for storage and further processing, including to Canada and the United States. Shopify, our platform, takes steps to keep these transfers GDPR-compliant. You can read more here: Shopify’s GDPR Whitepaper:
https://help.shopify.com/en/manual/your-account/privacy/GDPR
CCPA
If you’re in California, you have similar rights under the CCPA, like the right to know what data we hold, to request corrections or deletion, and to transfer your data elsewhere. Just contact us using the information below if you want to make a request.
You can also appoint someone to make these requests for you. Just let us know via the contact details below.
Cookies
Cookies are small bits of data that get stored on your device when you visit our Site. They help us remember things, like your login, your location or what you had in your cart, and they let us understand how visitors move through the site, so we can make your experience better for you.
We use a number of different cookies, including functional, performance, advertising, and social media or content cookies. Cookies make your browsing experience better by allowing the website to remember your actions and preferences, such as login and region selection. This means you don’t have to re-enter this information each time you return to the site or browse from one page to another.
Cookies also provide information on how people use the website, for instance whether it’s their first time visiting or if they are a frequent visitor.
We use the following cookies to optimize your experience on our Site and to provide our services.
Cookies Necessary for the Functioning of the Store:
Name Function Duration
_ab Used in connection with access to admin. 2y
_customer_account_shop_sessions Used in combination with the _secure_account_session_id cookie to track a user's session for new customer accounts 30d
_secure_account_session_id Used to track a user's session for new customer accounts 30d
_secure_session_id Used to track a user's session through the multi-step checkout process and keep their order, payment and shipping details connected. 24h
_shopify_country For shops where pricing currency/country set from GeoIP, that cookie stores the country we've detected. This cookie helps avoid doing GeoIP lookups after the first request. session
_shopify_m Used for managing customer privacy settings. 1y
_shopify_tm Used for managing customer privacy settings. 30min
_shopify_tw Used for managing customer privacy settings. 2w
_storefront_u Used to facilitate updating customer account information. 1min
_tracking_consent Used to store a user's preferences if a merchant has set up privacy rules in the visitor's region. 1y
_cmp_a Used for managing customer privacy settings. 1d
c Used in connection with checkout. 1y
cart Used in connection with shopping cart. 2w
cart_currency Set after a checkout is completed to ensure that new carts are in the same currency as the last checkout. 2w
cart_sig A hash of the contents of a cart. This is used to verify the integrity of the cart and to ensure performance of some cart operations. 2w
cart_ts Used in connection with checkout. 2w
cart_ver Used in connection with shopping cart. 2w
checkout Used in connection with checkout. 4w
checkout_token Used in connection with checkout. 1y
customer_account_locale Used in connection with new customer accounts 1y
dynamic_checkout_shown_on_cart Used in connection with checkout. 30min
hide_shopify_pay_for_checkout Used in connection with checkout. session
keep_alive Used in connection with buyer localization. 2w
master_device_id Used in connection with merchant login. 2y
previous_step Used in connection with checkout. 1y
discount_code Used in connection with checkout. session
remember_me Used in connection with checkout. 1y
secure_customer_sig Used to identify a user after they sign into a shop as a customer so they do not need to log in again. 1y
shopify_pay Used in connection with checkout. 1y
shopify_pay_redirect Used in connection with checkout. 1 hour, 3w or 1y depending on value
shop_pay_accelerated Used in connection with checkout. 1y
source_name Used in combination with mobile apps to provide custom checkout behavior, when viewing a store from within a compatible mobile app. session
storefront_digest Stores a digest of the storefront password, allowing merchants to preview their storefront while it's password protected. 2y
tracked_start_checkout Used in connection with checkout. 1y
checkout_session_lookup Used in connection with checkout. 3w
checkout_prefill Used in connection with checkout. 5m
checkout_queue_token Used in connection with checkout. 1y
checkout_queue_checkout_token Used in connection with checkout. 1y
checkout_session_token Used in connection with checkout. 3w
checkout_session_token_<<token>> Used in connection with checkout. 3w
order Used in connection with order status page. 3w
identity-state Used in connection with customer authentication 24h
identity-state-<<token>> Used in connection with customer authentication 24h
identity_customer_account_number Used in connection with customer authentication 12w
card_update_verification_id Used in connection with checkout. 20m
customer_account_new_login Used in connection with customer authentication 20m
customer_account_preview Used in connection with customer authentication 7d
customer_payment_method Used in connection with checkout. 1h
customer_shop_pay_agreement Used in connection with checkout. 20m
pay_update_intent_id Used in connection with checkout. 20m
localization Used in connection with checkout. 2w
profile_preview_token Used in connection with checkout. 5m
login_with_shop_finalize Used in connection with customer authentication 5m
preview_theme Used in connection with the theme editor session
shopify-editor-unconfirmed-settings Used in connection with the theme editor 16h
wpm-test-cookie Used to ensure our systems are working correctly. session
Reporting and Analytics
Name Function Duration
_landing_page Track landing pages. 2w
_orig_referrer Track landing pages. 2w
_s Shopify analytics. 30min
_shopify_d Shopify analytics. session
_shopify_fs Shopify analytics. 30min
_shopify_s Shopify analytics. 30min
_shopify_sa_p Shopify analytics relating to marketing & referrals. 30min
_shopify_sa_t Shopify analytics relating to marketing & referrals. 30min
_shopify_y Shopify analytics. 1y
_y Shopify analytics. 1y
_shopify_evids Shopify analytics. session
_shopify_ga Shopify and Google Analytics. session
customer_auth_provider Shopify analytics. session
customer_auth_session_created_at Shopify analytics. Session
The length of time that a cookie remains on your computer or mobile device depends on whether it is a “persistent” or “session” cookie. Session cookies last until you stop browsing and persistent cookies last until they expire or are deleted. Most of the cookies we use are persistent and will expire between 30 minutes and two years from the date they are downloaded to your device.
You’re in control. You can manage or block cookies through your browser settings. Please keep in mind that removing or blocking cookies can negatively impact your user experience and parts of our website may no longer be fully accessible.
Most browsers accept cookies by default, but you can always change your settings. For help, check your browser’s help menu or visit:
www.allaboutcookies.org
Additionally, please note that blocking cookies may not completely prevent how we share information with third parties such as our advertising partners. If you’d like to opt out of certain uses of your information by these parties, please follow the instructions in the “Behavioural Advertising” section above.
Do Not Track
Please note that some browsers send a “Do Not Track” signal, but because there’s no standard way to respond to these signals yet, we don’t currently make changes to our data collection practices when we see them.
Changes
We may update this Privacy Policy occasionally, whether to reflect changes in how we work, adjust to legal or operational requirements, or improve clarity. When we do, we’ll update the date at the bottom so you know what’s current.
Contact
If you have questions about this policy, want more details on how your data is handled, want to exercise your privacy rights, or need to file a complaint, feel free to reach out.
You can email us at maartje@studiomadebo.com or write to us at:
Studio Madebo / Maartje de Boer
Bosberg 29
7271 LE Borculo
The Netherlands
KVK Nr. 66761565
Data protection complaints
If you believe we have not handled your personal information correctly, you can raise a data protection complaint directly with us using the contact details above — by email, post, or phone, however suits you best.
We will acknowledge your complaint within 30 days of receiving it, investigate it without undue delay, and keep you updated on our progress. Once we’ve completed our investigation, we will write to you with the outcome.
If you’re not satisfied with our response, you have the right to contact a data protection authority.
If you live in the Netherlands, you can contact the Dutch Data Protection Authority, Autoriteit Persoonsgegevens:
https://autoriteitpersoonsgegevens.nl/nl/contact-met-de-autoriteit-persoonsgegevens/tip-ons
If you live elsewhere in the EEA, you may contact your local data protection supervisory authority. You can find the list of EEA data protection authorities here:
https://www.edpb.europa.eu/about-edpb/about-edpb/members_en
If you live in the UK, you can complain to the Information Commissioner’s Office, the UK’s data protection regulator:
https://ico.org.uk/make-a-complaint/
Helpline: 0303 123 1113
Last updated: July 11 2026