Privacy Policy

We're established in Belgium, so the EU General Data Protection Regulation governs how we handle your data — whether you're in Ohio or Antwerp. Where US state privacy laws give you additional rights, those are in section 06.

We don't sell your personal information for money. We do use advertising tools that share data with Meta and Google, which under some US state laws counts as "selling" or "sharing". Section 06 explains how to stop it.

You give us

• Order details — name, delivery and billing address, email, phone if you give one, and what you ordered.
• Payment — handled by our processor. We get confirmation it worked, the card type and last four digits. We never see or store your full card number.
• Account details — login credentials and saved addresses, if you make one.
• Email sign-up — your address and your consent.
• Correspondence — anything you write to us, including photos you send when reporting a fault.

Collected automatically

• Device and connection — IP address, browser, operating system, approximate location from IP.
• Browsing — pages viewed, time on page, clicks, cart activity, where you arrived from.
• Session recordings — Microsoft Clarity records mouse movement, scrolling and clicks as anonymised replays. Text you type into forms is masked. Detail in the Cookie Policy.

From others

Advertising and analytics providers tell us a visit came from a particular ad. Fulfilment partners and carriers send shipping and tracking updates. Our payment processor sends fraud-risk signals.

We don't use automated decision-making that has legal or similarly significant effects on you. Fraud screening may flag an order, but a person makes the call.

We may also disclose data where the law requires it, to enforce our terms, or if the business is sold or restructured. We will never trade your personal information for money.

Where it goes

Most providers are US-based, so data is transferred outside the EEA. Those transfers rely on Standard Contractual Clauses approved by the European Commission and, where applicable, certification under the EU–US Data Privacy Framework. Ask us and we'll point you to the safeguards.

• Orders and transactions — as long as accounting and tax law requires, generally seven years in Belgium.
• Account data — while your account is open, deleted on request.
• Marketing contacts — until you unsubscribe, then suppressed so we don't email you again by accident.
• Support correspondence — typically two years, so we have context if you write again.
• Analytics and session data — per each provider's schedule, generally one day to two years. Detail in the Cookie Policy.

EU, EEA and UK

Access a copy of what we hold. Rectify anything inaccurate. Erase it, where we've no legal reason to keep it. Restrict processing while a dispute is settled. Port it in machine-readable form. Object to processing based on legitimate interests, and to direct marketing at any time with no reason needed. Withdraw consent whenever you like, without affecting what came before.

Email us and we'll respond within one month. No charge, no form. If you think we've handled your data badly you can complain to the Belgian Data Protection Authority at gegevensbeschermingsautoriteit.be, or to the supervisory authority where you live.

United States

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas and a growing list of other states can know and access what we've collected, delete it subject to legal exceptions, correct inaccuracies, and opt out of sale or sharing. Exercising any of these will never get you worse prices or service.

On opting out: we don't sell data for money, but our advertising cookies may count as "sharing" for cross-context behavioural advertising. Switch off marketing cookies in our cookie settings, or send a Global Privacy Control signal from your browser — we honour it automatically.

To exercise any right, email us. We may verify your identity by confirming details from a previous order. An authorised agent can act for you with written permission.

The site runs over encrypted connections, checkout sits on PCI DSS Level 1 certified infrastructure, and access to customer data is limited to those who need it.

Nobody can promise perfect security and we won't pretend otherwise. What we can promise: if a breach affects your data, we'll tell you and the relevant authority within the timeframes the law requires, and we'll say plainly what happened.

Children

This shop is for adults. We don't knowingly collect data from anyone under 16. If you believe a child has given us information, write to us and we'll delete it.

Changes

When we change how we handle data, this page changes and the date below updates. For anything significant we'll say so directly rather than quietly editing a paragraph.