Last updated: 15 October 2026
This Privacy Policy explains how JHA Porcelain collects and uses personal data when you visit jhaporcelain.com, buy from our online shop, book a course or contact us. We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Italian data protection law (Legislative Decree 196/2003, as amended).
1. Who is responsible for your data
The data controller is:
JHA Porcelain di Jacqueline Harberink
Via Primo Settembre, 2
50014 Fiesole (Florence), Italy
VAT number: IT07121780485
Email: info@jhaporcelain.com
Atelier: Via dei Pandolfini, 5/r, 50122 Florence, Italy.
For any question about this policy or about your personal data, please write to the email address above.
2. What data we collect and why
2.1 Orders in the online shop
When you place an order we collect your name, billing and shipping address, email address, phone number, order details and payment status. We use this data to process and deliver your order, send order and shipping updates, handle returns and comply with our tax and accounting obligations.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).
2.2 Customer account
If you create an account, we store your login details, contact details, addresses and order history so you can log in and view your orders.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
2.3 Payments
Payments (iDEAL, Mastercard, Visa and other methods) are processed by our payment service provider MultiSafepay B.V. (the Netherlands). Your card or bank details are entered on the payment provider’s systems and are not stored by us. We only receive confirmation of whether the payment succeeded, plus limited transaction data. MultiSafepay processes payment data under its own privacy policy.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and legal obligations (Art. 6(1)(c) GDPR).
2.4 Courses and events
When you book a course or event, we use your name, contact details and booking details to organise your participation and contact you about it (for example about schedule changes).
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
2.5 Contact form and email
When you contact us through the contact form or by email, we use your name, email address and the content of your message to answer your question or handle your request.
Legal basis: steps taken at your request prior to a contract, or our legitimate interest in answering your enquiries (Art. 6(1)(b) and (f) GDPR).
2.6 Newsletter
If you ask to be added to our newsletter, we use your email address to send you news about new work, courses and events. You can unsubscribe at any time by replying to any newsletter or writing to info@jhaporcelain.com.
Legal basis: your consent (Art. 6(1)(a) GDPR).
2.7 Website statistics
With your consent, we use Google Analytics, loaded through Google Tag Manager (both provided by Google Ireland Limited), to understand how visitors use our website, for example which pages are visited and how visitors arrived. This involves cookies and data such as a shortened IP address, device and browser information and pages visited. These tools are only activated after you have given consent in the cookie banner.
Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time through the cookie settings on our website.
2.8 Technical data and security
When you visit the website, our server automatically processes technical data such as your IP address, browser type, date and time of access and the pages requested. This is necessary to deliver the website and to protect it against abuse and attacks. For this purpose we use a security plugin (Wordfence, by Defiant Inc.), which may check IP addresses against lists of known threats.
Legal basis: our legitimate interest in a secure and properly functioning website (Art. 6(1)(f) GDPR).
3. Cookies
Our website uses technical cookies that are necessary for it to function, for example to keep the contents of your shopping cart and to keep you logged in. These do not require consent. Analytics cookies and other non-essential cookies are only placed after you have given consent via the cookie banner. More information is available in our Cookie Policy.
4. Third-party content
- Fonts: we use Adobe Fonts (Adobe Inc.) to display our typography. When a page loads, your browser connects to Adobe’s servers, which receive your IP address.
- Instagram: our website shows recent posts from our Instagram account. When you click a post, you are taken to Instagram (Meta Platforms Ireland Ltd.), where Meta’s privacy policy applies.
- Links to social media: links to Facebook, Instagram, Pinterest and Vimeo are plain links. No data is sent to these platforms unless you click on them.
5. Who receives your data
We only share personal data where this is necessary for the purposes described above, with:
- our hosting provider, which hosts the website and its data on servers within the EU;
- the payment service provider (MultiSafepay);
- shipping and courier companies, which receive your name, address and phone number to deliver your order;
- our accountant and tax authorities, where required by law;
- Google, Adobe and Defiant, as described above.
We do not sell your personal data.
6. Transfers outside the EU
Some of our service providers (such as Google, Adobe, Meta and Defiant) are based in, or may transfer data to, the United States. Where this happens, the transfer is based on the EU–US Data Privacy Framework, for providers certified under it, or on the European Commission’s Standard Contractual Clauses.
7. How long we keep your data
- Orders and invoices: 10 years, as required by Italian tax and accounting law.
- Customer account: until you delete your account or ask us to delete it; order records are then kept only as long as required by law.
- Contact messages: as long as needed to handle your request, and no longer than 2 years afterwards.
- Newsletter: until you unsubscribe.
- Analytics data: up to 14 months.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have incorrect data corrected;
- have your data deleted, unless we are legally required to keep it;
- restrict or object to certain processing, including processing based on legitimate interest;
- receive your data in a portable format;
- withdraw your consent at any time, without affecting processing that took place before.
To exercise any of these rights, write to info@jhaporcelain.com. We will reply within one month.
You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country where you live.
9. Minors
Our shop is intended for adults. We do not knowingly collect personal data from children under 14 without the consent of a parent or guardian.
10. Changes to this policy
We may update this Privacy Policy when our services or the law change. The latest version is always available on this page, with the date of the last update at the top.
