1. Who we are
Madame Croissant Amsterdam is a trading name of M&C Franchise B.V., Hartenstraat 29H, 1016 CA Amsterdam, NL. For privacy questions contact amsterdam@madamecroissant.de.

2. What personal data we collect

• Name, address, phone number, e-mail (for order fulfilment)
• Payment details (processed securely by our payment provider; we do not store card numbers)
• IP address and browsing data (via functional and analytical cookies)

3. Why we process your data
We use your data to

• process and deliver orders,
• contact you about your booking,
• improve our website and services, and
• send marketing updates when you give explicit consent
  

4. Legal basis
Data is processed on the basis of (a) contractual necessity, (b) legal obligation (tax records) and (c) consent (newsletter).

5. Storage period
Order data is kept for seven years in line with Dutch tax law; newsletter consent is stored until you unsubscribe.

6. Sharing with third parties
We only share data with logistics partners, payment processors and IT providers when required to complete your order or comply with the law. No data is sold to third parties.

7. Your rights
You may request access, correction, deletion or transfer of your personal data at any time, and you may withdraw consent for marketing. Send requests to amsterdam@madamecroissant.de; we will respond within four weeks. 

8. Security
We employ SSL encryption, secure backups and role-based access controls to protect your information. If you suspect misuse, please contact us immediately.

9. Changes
We may update this policy; the latest version will always be available on our website, with revision date indicated.