Vorm & Flow Logo

Privacy Policy

Version 1.0 — 28 March 2026


Vorm & Flow is committed to protecting your personal data and respecting your right to privacy. This privacy policy explains what data we collect, why we collect it, how long we retain it, and what rights you have.

This policy applies to all activities of Vorm & Flow, including the webshop and workshop registrations at www.vormflow.be.


Article 1 — Data Controller

The data controller within the meaning of the GDPR is:


Vorm & Flow — trade name of MAKER BV

Ledebergstraat 109, 9050 Ghent, Belgium

VAT number: BE0847226011

Email: [email protected]

Website: www.vormflow.be


For all questions or requests regarding your personal data, please contact us at the email address above.


Article 2 — What Personal Data Do We Process?

2.1 Data you provide directly

When placing an order or registering for a workshop, we process the following data:

  • First and last name
  • Email address
  • Delivery address and, where applicable, billing address
  • Phone number (optional, for delivery communication)
  • Payment details — we do not store full payment card data; payments are handled by our payment provider
  • Content of your messages when contacting customer service


2.2 Data collected automatically via website visits

We use Plausible Analytics, a privacy-friendly analytics tool that we self-host on our own server. Plausible Analytics:

  • does NOT place any cookies on your device;
  • does NOT collect any personally identifiable information;
  • does NOT track you across multiple websites or sessions;
  • does NOT use fingerprinting techniques;
  • does NOT share any data with third parties.


Plausible Analytics collects only aggregated, anonymous statistics such as the number of page visits, device type, browser, operating system and country of origin (based on IP address, which is immediately discarded after processing and never stored). This data cannot be traced back to any individual.

Because Plausible Analytics uses no cookies and processes no personal data, no cookie banner or consent mechanism is required for its use.


2.3 Data we do not collect

We do not place any third-party tracking cookies (such as Google Analytics, Facebook Pixel or similar tools). We do not use remarketing pixels or social media plugins that track your behaviour.


Article 3 — Purposes and Legal Basis for Processing

We process your personal data only for specified, explicit and legitimate purposes:


3.1 Performance of a contract (Art. 6.1.b GDPR)

  • Processing and delivery of your order
  • Registration and communication management for workshops
  • Invoicing and payment processing
  • Customer service and handling of complaints


3.2 Legal obligation (Art. 6.1.c GDPR)

  • Compliance with accounting and tax obligations (retention period: 7 years)


3.3 Legitimate interest (Art. 6.1.f GDPR)

  • Anonymous website statistics via Plausible Analytics to improve the user experience and content of our website
  • Security and fraud prevention


3.4 Consent (Art. 6.1.a GDPR)

  • Sending newsletters or promotional communications — only if you have given explicit consent. You may withdraw your consent at any time via the unsubscribe link in any email or by contacting us at [email protected].


Article 4 — Retention Periods

We do not retain your personal data for longer than is necessary for the purpose for which it was collected:

  • Customer and order data: 7 years after the last transaction (statutory accounting retention obligation)
  • Workshop registration data: 2 years after the workshop date
  • Customer service communications: 2 years after the case is closed
  • Marketing data (newsletter): until you withdraw your consent
  • Anonymous website statistics (Plausible): indefinitely, as no personal data is processed


Article 5 — Transfers to Third Parties

We do not transfer your personal data to third parties, except in the following cases:

  • Shipping services: your name and delivery address are shared with our shipping partner(s) for the fulfilment of your order.
  • Payment providers: payment transactions are processed by Mollie B.V., a certified payment provider established in the Netherlands and operating within the EEA. We do not have access to your full payment card details. Mollie's privacy policy is available at www.mollie.com/be/privacy.
  • Legal obligation: when we are required to do so by law, court order or government authority.


We do not use external analytics services such as Google Analytics. Our analytics tool (Plausible) is fully self-hosted on our own server within the European Economic Area. No transfer of data outside the EEA takes place.


Article 6 — Cookies and Similar Technologies

We use only functional, strictly necessary cookies required for the operation of the webshop, such as:

  • Session cookies for shopping cart management
  • Cookies for maintaining your login status (where applicable)


We do not place any analytical, advertising or third-party tracking cookies. Plausible Analytics, our self-hosted analytics tool, uses no cookies and requires no consent.

Because we use only strictly necessary cookies and place no third-party tracking cookies whatsoever, a cookie banner is not required under current Belgian and European regulations. We inform you of this fully in this privacy policy.


Article 7 — Security of Your Data

We take appropriate technical and organisational measures to protect your personal data against loss, unauthorised access, disclosure or misuse. These include:

  • Encrypted connections (HTTPS/TLS) for all data transfers
  • Access to personal data restricted to strictly necessary personnel
  • Regular backups of system data


Despite these measures, no method of transmission over the internet or electronic storage can be fully guaranteed. In the event of a security breach that seriously endangers your rights, we will notify you and the competent authority (GBA/APD) in accordance with our legal obligations.


Article 8 — Your Rights as a Data Subject

Under the GDPR, you have the following rights with regard to your personal data:


  • Right of access (Art. 15 GDPR): you have the right to know what data we process about you.
  • Right to rectification (Art. 16 GDPR): you can have inaccurate or incomplete data corrected.
  • Right to erasure (Art. 17 GDPR): you can request the deletion of your data, subject to statutory retention obligations.
  • Right to restriction of processing (Art. 18 GDPR): you can request that the processing of your data be restricted in certain circumstances.
  • Right to data portability (Art. 20 GDPR): you have the right to receive your data in a structured, commonly used format.
  • Right to object (Art. 21 GDPR): you can object to processing based on legitimate interest, including direct marketing.
  • Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal.


To exercise your rights, please send an email to [email protected] stating your name and enclosing a copy of your identity document (for verification purposes). We will handle your request within 30 days.


If you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Belgian Data Protection Authority (GBA/APD):


Article 9 — Changes to This Privacy Policy

Vorm & Flow reserves the right to amend this privacy policy at any time, for example as a result of changes in legislation or in our services. The most recent version is always available at www.vormflow.be.

In the event of significant changes, we will notify you by email or by a prominent notice on the website.

This policy was last updated on 28 March 2026.