1. Data controller
VitaDry SRL, Chaussée de Wavre 146, 1050 Ixelles, Belgium. Company no.: BE1027388564. GDPR / DPO contact: privacy@vitadry.be
Email privacy@vitadry.be →VitaDry · Info
Privacy policy
GDPR-compliant (EU 2016/679). Last updated: 11 September 2026.
2. Data collected
We collect only what is necessary: name, email, phone, shipping and billing address, date of birth (optional), order history. Payment data is processed directly by Stripe (PCI-DSS Level 1) — VitaDry never has access to it.
3. Processing purposes
(a) Sales contract execution (order, delivery, support) — basis: contract performance. (b) Newsletter — basis: consent. (c) Anonymized audience measurement (Google Analytics 4) — basis: consent. (d) Accounting and tax obligations — basis: legal obligation. (e) Measuring our ads on Facebook and Instagram (Meta Pixel) — basis: consent (marketing cookies), only if you accept them.
4. Retention
Order data and invoices: 10 years (Belgian accounting obligation). Inactive customer account: deletion after 3 years. Newsletter: until unsubscribe. GA4 logs: 14 months.
5. Your GDPR rights
You have rights of access, rectification, erasure (« right to be forgotten »), restriction, portability, objection and withdrawal of consent at any time. Write to privacy@vitadry.be — reply within 1 month maximum.
6. Sharing with third parties (processors)
Your data is never sold or rented. Only shared with: Stripe Payments Europe (Ireland, payment), Mondial Relay / bpost (delivery), Supabase (Germany — database, GDPR-compliant), Hostinger (Cyprus — site hosting), Google Workspace (emails, IP anonymization active), Google Apps Script (transactional emails), Google Ireland (Google Analytics, if you accept it), Meta Platforms Ireland (Meta Pixel, only if you accept marketing cookies).
7. Transfers outside the EU
Our data is hosted in the European Union. Some providers (Google, Meta, Stripe) may transfer data to the United States; these transfers are covered by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. Google Analytics 4 uses IP anonymization.
8. Cookies
See our Cookie Policy. You can change your preferences anytime via the « Cookie preferences » link at the bottom of the page.
9. Security
Mandatory HTTPS (TLS 1.3), hashed passwords (bcrypt), database access restricted by IP and API keys, encrypted daily backups.
10. Complaint to the supervisory authority
You can file a complaint with the Belgian Data Protection Authority (DPA): Rue de la Presse 35, 1000 Brussels — dataprotectionauthority.be
Open website →💬Can’t find your answer? Email us at contact@vitadry.be