Privacy Policy

This Privacy Policy explains how MAAH processes personal data when you use maah.nl, create or use an account, place an order, request a quotation, apply for a business account, contact customer service, subscribe to marketing, or otherwise interact with MAAH.

MAAH is the controller for the processing described here unless another party is identified as an independent controller. MAAH's current legal entity name, registered/contact address and privacy contact details are published with the website's company/contact information. Privacy requests can be sent through the published contact channels.

Depending on how you use MAAH, we may process:

• identity and contact data, such as name, email address and telephone number;
• account and authentication data;
• billing, delivery and saved-address data;
• order, cart, quotation, promotion, invoice, refund, payment-status and shipment information;
• business-account data, including organisation details, VAT number and VAT-validation information, account approval, price-list assignment, invoice terms and credit-related account data;
• customer-service messages, contact-form submissions and related correspondence;
• marketing preferences and records of consent or withdrawal;
• technical and security data reasonably required to operate and protect the service, such as session/security information and relevant request or audit records;
• food-safety, batch, traceability and compliance information where it is linked to a transaction or legally required record.

MAAH does not need your card credentials to be stored in its application when payment is completed on a payment provider's hosted or secured payment flow. The payment provider may process payment credentials under its own responsibilities and notices.

Most personal data is provided directly by you. Transaction and fulfilment data can also be generated through use of the website or received from service providers involved in payment, delivery, VAT validation, security or customer support. Business information may also be checked against official or otherwise appropriate sources where necessary to validate a business transaction.

MAAH processes personal data where necessary:

• to take steps at your request before entering into a contract and to perform a contract, including account operation, quotations, checkout, payment administration, delivery, returns and refunds;
• to comply with legal obligations, including tax/accounting, food-safety, traceability, product-compliance and other applicable record-keeping duties;
• for legitimate interests such as securing the website, preventing abuse and fraud, maintaining business records, improving operations, handling disputes and supporting customers, where those interests are not overridden by your rights;
• on the basis of consent where consent is the appropriate legal basis, including marketing or privacy-sensitive optional technologies when applicable.

Where processing is based on consent, you may withdraw it at any time without affecting processing already lawfully carried out before withdrawal.

For an order, MAAH processes the information required to calculate prices and VAT, accept and administer payment, reserve inventory, create invoices where applicable, fulfil shipments, communicate order events and handle refunds.

Online payment may be processed by Mollie or another payment provider enabled at checkout. MAAH exchanges the information necessary to initiate, identify and reconcile the payment. Bank-transfer payments are manually or operationally reconciled using the order/payment reference and payment status.

For business accounts, MAAH may process organisation and contact details, VAT information and validation results, account approval status, quotations, account-specific prices, invoice terms, credit limit and current credit exposure. These data are used to administer the business relationship, determine transaction terms, apply VAT rules, assess whether invoice payment is available and manage outstanding commercial obligations.

MAAH shares the delivery information needed by carriers and fulfilment providers to deliver an order, provide tracking, investigate delivery incidents and, where necessary, support chilled/perishable-goods handling. Shipment and batch information may be retained where required for traceability or recall obligations.

If you contact MAAH, we process your contact details and message so we can answer, investigate the issue and keep an appropriate service record. Transactional emails such as activation, order, payment, shipment and refund messages are sent because they are necessary to operate the requested service or transaction.

MAAH sends electronic marketing only where an appropriate legal basis exists. Marketing consent is separate from accepting the Terms & Conditions and is not required to purchase. You can withdraw marketing consent or use the unsubscribe mechanism provided with applicable communications.

MAAH uses technologies necessary for functions such as session security, authentication, cart state and language/site operation. Optional analytics, advertising or personalization technologies are governed by the Cookie Policy and, where consent is required, must not be activated before valid consent.

Personal data may be disclosed where necessary to categories of recipients such as:

• payment providers;
• banks for bank-transfer administration where relevant;
• carriers, fulfilment and logistics providers;
• hosting, infrastructure, email and security providers;
• professional advisers, accountants, auditors and insurers where necessary;
• competent authorities where disclosure is legally required.

MAAH does not sell personal data.

If a service provider processes personal data outside the European Economic Area, MAAH will use an applicable lawful transfer mechanism where required, such as an adequacy decision or appropriate safeguards. Information about applicable safeguards can be requested through MAAH's privacy contact channel.

MAAH keeps personal data only for as long as necessary for the relevant purpose and applicable legal obligations. Retention is determined by the type of record and its purpose. Transaction, invoice, tax, food-safety and traceability records may need to be retained for statutory periods. Account data is retained while the account is active and afterwards only where reasonably necessary for legal, security, dispute or record-keeping purposes. Customer-service and marketing-consent records are retained only as long as needed for those purposes and accountability.

MAAH applies appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, loss or disclosure. No internet service can guarantee absolute security.

Subject to the conditions in the GDPR, you may have rights to access your personal data, correct inaccurate data, request erasure, restrict processing, object to certain processing, receive portable data, and withdraw consent.

Where MAAH relies on legitimate interests, you may object on grounds relating to your particular situation. Where personal data is processed for direct marketing, you may object to that marketing.

MAAH may request information reasonably necessary to verify the identity of a person making a rights request.

MAAH does not intentionally make decisions producing legal or similarly significant effects about customers solely by automated processing unless the website and this policy expressly state otherwise. Automated calculations used for prices, VAT, inventory eligibility or checkout rules are operational transaction rules and remain subject to the applicable contract and law.

You may contact MAAH first with a privacy concern. You also have the right to lodge a complaint with a competent data-protection supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens.

MAAH may update this policy when processing activities, services or legal requirements change. The effective date identifies the current published version. Material changes will be communicated where required.

Use the privacy/contact details published on maah.nl for privacy questions and rights requests. The published company information must be kept current with MAAH's final legal entity and contact details.