1. Data controller
VitaDry SRL, Chaussée de Wavre 146, 1050 Ixelles, Belgium. Company no.: BE1027388564. For any question about your data: contact@vitadry.be (subject « Privacy »). VitaDry has not appointed a data protection officer (DPO): this is not required for a company of its size.
Email contact@vitadry.be →2. Data collected
We collect only what is necessary: name, email, phone, shipping and billing address, order history. Payment data is processed directly by Stripe (PCI-DSS Level 1) — VitaDry never has access to it.
3. Purposes of processing
(a) Performance of the sales contract (order, payment, delivery, customer service, returns) — basis: contract. (b) Customer account (login, history, subscriptions) — basis: contract. (c) « Notify me at launch » list — basis: consent; a single email when the shop opens. (d) Contact form and replies — basis: legitimate interest in answering you. (e) Customer reviews sent through the link received after an order — basis: consent. (f) Tips and offers emails, reminder of an unfinished basket — basis: consent, only if you ticked the box provided; one-click withdrawal. (g) Audience measurement (Google Analytics 4) — basis: consent (cookies). (h) Measuring our ads on Facebook and Instagram (Meta Pixel) — basis: consent (advertising cookies). (i) Accounting and tax obligations — basis: legal obligation.
4. Retention
Order data and invoices: 10 years (Belgian accounting obligation). Inactive customer account: deletion after 3 years. Newsletter: until unsubscribe. GA4 logs: 14 months.
5. Your GDPR rights
You have rights of access, rectification, erasure (« right to be forgotten »), restriction, portability, objection and withdrawal of consent at any time. To exercise them, write to contact@vitadry.be (subject « Privacy ») — reply within 1 month at most.
6. Sharing with third parties (processors)
Your data is never sold or rented. It is only shared with: Stripe Payments Europe (Ireland — payment), Mondial Relay and bpost (delivery; the pickup point map is provided by Mondial Relay), Sendcloud (shipping labels), Supabase (Germany — database and customer accounts), Brevo (France — login and account confirmation emails), Google Workspace and Google Apps Script (Ireland — mailbox and order emails), Hostinger (Cyprus — website hosting), Google Ireland (Google Analytics, if you accept it), Meta Platforms Ireland (Meta Pixel, only if you accept advertising cookies).
7. Transfers outside the EU
Our data is hosted in the European Union. Some providers (Google, Meta, Stripe) may transfer data to the United States; these transfers are covered by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.
8. Cookies
See our Cookie Policy. You can change your preferences anytime via the « Cookie preferences » link at the bottom of the page.
9. Security
Encrypted connection (HTTPS) across the whole site, passwords never stored in readable form (handled by Supabase), database access protected by per-user access rules and server-only keys. Card data is processed by Stripe only.
10. Complaint to the supervisory authority
You can file a complaint with the Belgian Data Protection Authority (DPA): Rue de la Presse 35, 1000 Brussels — dataprotectionauthority.be
Open website →