Privacy Policy

Sparkling Mosaic respects your privacy. This policy explains what personal data we collect when you visit sparklingmosaic.com or book a workshop, why we collect it, and what you can ask us to do with it.

Sparkling Mosaic is the data controller for the data described here. Our business is registered with the Dutch Chamber of Commerce under number 84431946.

Who is responsible for your data

Entity	Details
Data controller	Sparkling Mosaic
Registered address	Funenpark 99, 1018 AK Amsterdam, Netherlands
Business registration	KVK 84431946 (Netherlands)
Workshop venue	Czaar Peterstraat 74, Amsterdam-Oost — sessions are hosted here with Heart-Garden Waffles & Coffee
Contact	our contact page
EU representative	Established in the Netherlands — no separate representative required

The categories of personal data we process

Depending on how you interact with us, we process the following categories. The detail below each heading explains the purpose and legal basis.

• Contact details — your name, email address and phone number.
• Booking and transaction details — the workshop you booked, the date, and the number of participants. Payment card details are handled by our ticketing providers and are never seen or stored by us.
• Communications — anything you send us through an enquiry form, private-event request, email or social media.
• Newsletter subscription — your email address and the date you subscribed.
• Preferences and consent records — your cookie choice, and your language preference (en or nl).
• Device and network information — IP address, browser type, and pages visited, recorded in our server logs.
• Usage information — how visitors move around this website, collected by Google Analytics only if you accept analytics.
• Accessibility and dietary requirements — for example a food allergy you ask us to accommodate during a session, or accessibility needs you tell us about. See the note on sensitive data below.

We do not collect special-category data about you except where you give it to us deliberately for a specific purpose.

Where your data comes from

• Directly from you — when you book, fill in a form, subscribe to the newsletter, or email us.
• Automatically from your device — technical data such as your IP address, browser type and the pages you visit, and your language-cookie preference.
• From our service providers — MijnEvent and Eventbrite pass us your booking confirmation and the contact details you entered with it.
• Aggregated or de-identified information — some analytics and log data is anonymised and cannot be linked back to you. We do not attempt to re-identify it.

What we collect, and why

Information you give us

When you book a workshop, request a private event, ask a question or join our mailing list, we collect the details you provide. This typically includes your name, email address, and phone number. For a private event we may additionally collect the number of participants and any dietary or allergy information you choose to share with us.

Why: to take bookings, contact you about your session, and provide the workshop. This is necessary to enter into and perform the contract with you (Article 6(1)(b) GDPR).

Booking and payment information

Payments for public workshops are processed by our ticketing providers, MijnEvent and Eventbrite. They act as independent controllers for the payment data and handle it under their own privacy policies. We receive the booking confirmation and the contact details you entered — we never see or store your full card number.

Newsletter

If you subscribe to our newsletter we store your email address so we can send you occasional updates about workshops and offers. Every email contains an unsubscribe link. You can also unsubscribe by emailing us.

Why: only with your consent (Article 6(1)(a) GDPR). Every newsletter is opt-in.

Website analytics

We use Google Analytics to understand in general terms how visitors use this website, so we can improve it — for example which workshops get looked at most.

Analytics is entirely optional. It is loaded only if you press "Accept analytics" on the cookie banner. If you decline, we set no analytics cookies and Google Analytics is not loaded at all, so we receive no analytics data from your visit.

Declining analytics does not stop the rest of the site working, and it does not stop the strictly necessary cookies described below — those are not analytics and cannot be switched off. You can change your decision at any time using the "Change cookie choice" link in the footer.

Where analytics is enabled we have disabled Google's advertising and signals features. (Google Analytics 4 processes IP addresses in truncated form by default, so there is no separate IP-anonymisation setting to switch on.)

Why: on the basis of your consent (Article 6(1)(a) GDPR). Google acts as a processor on our behalf under its own data processing terms.

Cookies and similar technologies

We keep data collection to a minimum. In practice this website uses the following:

Name	Purpose	Type	Duration
preferred-locale	Remembers whether you chose Dutch or English, so we stop redirecting you to the other language on every visit. Stores only the language (en or nl) — no identifier.	Strictly necessary	12 months
sm_consent_v1	Records your analytics choice (accepted or rejected) so we do not ask again. Set only when you press a button.	Strictly necessary (consent record)	Until you clear your browser data

Why we are allowed to set these without asking: they are strictly necessary for the site to work as intended and cannot be switched off without degrading it — the language choice would otherwise re-prompt you on every single page. On that basis they fall under the ePrivacy exemption and are processed on our legitimate interests (Article 6(1)(f) GDPR). They are not used for profiling or advertising.

We use no advertising cookies, no social-media tracking pixels and no cross-site remarketing on this website.

The booking widget

Workshop booking on this site is handled by MijnEvent, which loads its own widget script when a booking panel appears on a workshop page. That script is delivered by MijnEvent and is governed by their privacy policy, not ours — we have not independently audited what it sets. If you book a workshop, MijnEvent necessarily receives your booking and contact details in order to process it. If you would rather not have their widget load, please contact us and we will book you by email instead.

Content and enquiry forms

When you submit a form on this website or a private-event enquiry, the information you enter is sent to us by email and by our web host. Please do not include health information or other sensitive data in a form unless it is genuinely necessary — for example a food allergy you would like us to accommodate during a soap-making session.

Server logs

Like any website, our hosting provider records technical log data such as IP address, browser type and pages visited, for security and to keep the site running. This is our legitimate interest in maintaining a secure, functioning website (Article 6(1)(f) GDPR).

Social media and external links

We have profiles on Instagram, Facebook and YouTube. Those platforms have their own privacy practices, and anything you post or share there is governed by their policies, not this one. Our website links to external sites such as Learn with Farah, our online course platform, and to our ticketing providers — we are not responsible for the content or data practices of those sites.

How long we keep your data

Data	Retention
Booking records (name, contact, session)	7 years after the workshop — Dutch tax law requires this
Enquiry and private-event correspondence	2 years from last contact
Newsletter subscription	Until you unsubscribe
Analytics data	14 months, then deleted
Server logs	90 days

Who we share your data with

We do not sell your personal data and we do not share it for marketing purposes. We share it only where necessary to run the business:

• MijnEvent and Eventbrite — ticket sales and payment processing
• Our web host and email provider — hosting and sending emails you have asked for
• Google Analytics — only with your consent, as described above
• Government authorities — where we are legally required to disclose, for example tax authorities

International transfers

Some of the services we use are operated outside the European Economic Area. If you are in the EEA, your personal data is transferred to the following recipients, in these countries:

Recipient	Service	Located in
Netlify, Inc.	Website hosting and content delivery	United States
Google Ireland Limited / Google LLC	Google Analytics (only if you accept)	United States
Eventbrite, Inc.	Ticket sales and payment processing	United States
Cloudflare, Inc.	DNS and network security	Global, including the United States
MijnEvent	Ticket sales	Netherlands

Where a transfer leaves the EEA, we rely on a lawful transfer mechanism. We use the European Commission's Standard Contractual Clauses (Decision 2021/914) together with the UK Addendum where relevant, and we rely on adequacy decisions — including the EU-US Data Privacy Framework — where the recipient is certified for it. Each provider is also bound by its own contractual data-processing terms.

You can ask us which mechanism covers a particular recipient, and you can request a copy of the safeguards we rely on, by contacting us. You also have the right to lodge a complaint with the Dutch data protection authority if you consider our transfer unlawful.

Your rights under the GDPR

You have the right to:

• Access — ask what personal data we hold about you and get a copy (Article 15)
• Rectification — have inaccurate data corrected (Article 16)
• Erasure — have your data deleted ("right to be forgotten", Article 17)
• Restriction — limit how we use your data (Article 18)
• Portability — receive your data in a machine-readable format (Article 20)
• Object — object to processing based on legitimate interests, and to direct marketing at any time (Article 21)
• Withdraw consent — change your mind about the newsletter or analytics at any time, without this affecting anything done before

To exercise any of these rights, email us or use the contact page. We respond within 30 days.

We will not discriminate against you for exercising a right. You will not be treated less favourably or denied a service because you asked for access, deletion, correction or portability, or because you objected or withdrew consent.

We may ask you to verify your identity — for example by confirming control of the email address you used — before we can act on a request. We will only ask for what is necessary to confirm it.

You may appoint someone to make a request on your behalf (an authorised representative or "agent"). Before we accept a request from an agent we will ask them for written evidence that you authorised them, and we may need to verify your identity with you directly.

We do not sell your personal data and we do not share it for cross-context behavioural advertising. We do not respond to "Do Not Track" signals, but because we do not sell or share your data for targeted advertising, there is nothing for that signal to opt out of.

If you are not satisfied with our response you can lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch data protection authority (autoriteitpersoonsgegevens.nl). If you live in another EEA country, you can complain to the data protection authority there instead — a list of all EEA authorities is at edpb.europa.eu.

Security

We take reasonable technical and organisational measures to protect your data: HTTPS encryption in transit, restricted access to the systems that hold booking and contact details, and passwords protected administrative accounts. No system is perfectly secure, but we do not hold more data than we need.

Children

Our workshops are aimed at adults. Anyone booking for a child does so as the parent or guardian and remains responsible for that child's information. We do not knowingly collect data directly from children under 16.

Changes to this policy

We may update this policy to reflect changes in our services, our suppliers or the law. When we do, we will update the "Last updated" date at the top of this page. If a change materially affects your rights or how we use your data, we will tell you directly — by email if we have your address, or by a notice on this website before the change takes effect.