Privacy Policy

Who is responsible

MAFF vof, Braziliëstraat 23, 2000 Antwerpen, Belgium — KBO 0898.114.288, VAT BE 0898.114.288 is the controller for the personal data described here. Questions and requests: shop@maff.be.

What we collect

Merch orders: your name, email address, shipping address, and the items you bought.

Event reservations: your name, email address, guest count, and optionally your phone number.

There are no customer accounts and no marketing list — we only email you about your own order or reservation.

Site visits: technical logs (IP addresses) kept for security, and analytics data — see the analytics note below.

Why we may process your data

To fulfil your order or reservation and send you transactional email about it (performance of a contract).

To keep order records for bookkeeping (legal obligation under Belgian accounting law).

To understand visitor traffic on the site in aggregate (see the analytics note below).

Service providers and recipients

Stripe (payments — your card details go directly to Stripe, which processes them under its own privacy policy, and never reach our servers), Resend (transactional email), Neon (database hosting), Cloudflare (media storage), and GitHub (build and deployment infrastructure).

Analytics: the site uses Google Analytics 4 to measure visitor traffic. Google may set cookies for this purpose.

Some of these providers are US companies. Where your data leaves the European Economic Area, it is protected by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. Email us for details of the safeguard that applies to a specific provider.

How long we keep it

Order records and paid-reservation records: 7 years, as required by Belgian accounting law.

Free reservation requests: deleted or anonymized within 1 year after the event.

Technical logs: rotated within 30 days.

Your rights

You can ask for access to, correction, deletion, or a copy of your data, and object to or restrict its processing — email shop@maff.be and we will respond within one month (complex requests can take up to two months longer — we would tell you).

You can also complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit): gegevensbeschermingsautoriteit.be.

What we never do

We never sell your data, and we do not build marketing profiles of you.