Privacy Policy

1. Who we are

AtlasMadeAtelier (“we”, “us”) sells handcrafted Moroccan lighting online. We are the data controller for personal data processed through this website. Contact our privacy team through the contact page.

2. Data we collect

• Account data: name, email, password (stored hashed by our authentication provider), phone.
• Order data: shipping address, items purchased, wiring notes, order history.
• Payment data: card details are entered directly into our payment processor's secure fields. We never see or store full card numbers; we keep only a payment reference and status.
• Communications: messages you send us and newsletter subscriptions.
• Technical data: device, browser and, with consent, anonymous analytics events.

3. Why we use it (legal bases)

• To fulfil your order, produce, wire and ship your piece — performance of contract.
• To send receipts, production and dispatch updates — contract.
• To prevent fraud and secure the store — legitimate interests.
• To send atelier letters and measure analytics — consent, withdrawable at any time.
• To keep tax and accounting records — legal obligation.

4. Cookies

Strictly necessary cookies and local storage keep your cart, sign-in session and cookie choices. Analytics and marketing cookies are set only if you opt in via our cookie banner. You can change your choice anytime from “Cookie Preferences” in the footer.

5. Sharing

We share data only with processors needed to run the business: our hosting and database provider, our payment processor, our email delivery provider, and freight carriers and customs brokers for delivery. We do not sell personal information as defined by the CCPA.

6. International transfers

Our workshop is in Morocco and some providers operate in the US and EU. Transfers are protected by Standard Contractual Clauses or equivalent safeguards.

7. Retention

Order records are kept for 10 years for tax purposes. Account data is kept while your account is active. Newsletter data is kept until you unsubscribe.

8. Your rights

Under GDPR you may access, rectify, erase, restrict, port or object to processing of your data, and lodge a complaint with a supervisory authority. California residents may request to know, delete or correct personal information and will not be discriminated against for exercising these rights. Contact us to make a request; we respond within 30 days.

9. Security

Data is encrypted in transit, access is restricted by role, and payment information is handled by a PCI-DSS Level 1 certified processor.