Bisous du Biscuit

PRIVACY POLICY (GDPR)

Bisous du Biscuit BV

Last updated: 23 July 2026

Article 1 - Who is responsible for the processing of your personal data?

The controller within the meaning of the General Data Protection Regulation (EU) 2016/679 ("GDPR") is:

Bisous du Biscuit BV

Registered office: Kievitenlaan 17, 8420 De Haan, Belgium

Production and sales address: Stationsstraat 34/GLV, 8420 De Haan, Belgium

CBE number: 1032.675.658

VAT number: BE1032.675.658

Email: hello@bisousdubiscuit.be

Telephone: +32 (0)456 95 20 99

Website: www.bisousdubiscuit.be

Bisous du Biscuit processes personal data in accordance with the GDPR, the applicable Belgian privacy legislation and this Privacy Policy.

Bisous du Biscuit has not appointed a data protection officer, as this is not legally required for its activities.

Article 2 - Which personal data do we process?

Depending on the nature of the relationship (Consumer or Professional Customer), the services used and the way in which you interact with us, Bisous du Biscuit processes the following categories of personal data, only insofar as this is necessary for the proper processing of orders, payments, deliveries, customer service, legal obligations and communication.

2.1 Identification and contact details

  • name and first name;
  • address;
  • email address;
  • telephone number, required for the proper handling of the order, delivery and any questions or issues relating to the order;
  • company name, enterprise number and VAT number, exclusively for Professional Customers.

2.2 Order, contract and transaction data

  • data relating to orders placed and Products ordered;
  • delivery and billing details;
  • payment status and payment references;
  • internal order, reference or customer numbers linked to the order;
  • data necessary for accounting, administrative and tax obligations.

2.3 Communication data

  • content of email correspondence;
  • messages and questions sent via contact forms;
  • communication in the context of customer service, quotation requests, complaint handling or order follow-up.

2.4 Technical and usage data (website)

  • IP address;
  • browser and device data;
  • date, time and duration of the visit;
  • basic information on the use of the website;
  • technical data necessary for security, error detection and operation of the website.
  • Such data may be collected through cookies and similar technologies. Further information is included in the cookie policy of Bisous du Biscuit.

2.5 Marketing data

If you subscribe to a newsletter or commercial communication, the following data may be processed:

  • name;
  • email address;
  • preferences or interests, if communicated;
  • information relating to subscription, consent and unsubscribing.

The website contains several opportunities to subscribe to email marketing or newsletters.

2.6 Account data

If a user creates an account on the Webshop, the following additional personal data may be processed:

  • username;
  • account ID;
  • login and authentication data;
  • saved addresses;
  • preferences and settings;
  • order history;
  • subscription data;
  • account status;
  • data relating to account security and access.

The Webshop also allows checkout as a guest. In that case, the data necessary to handle the order, payment, delivery, invoicing and customer service correctly are processed, without the need to create a permanent user account.

Passwords are not stored in readable form but are protected by appropriate security measures.

Article 3 - For which purposes do we process personal data?

Bisous du Biscuit processes personal data only for specific, explicitly defined and legitimate purposes, and not in a manner incompatible with those purposes.

3.1 Performance of agreements

  • processing, confirming and fulfilling orders;
  • preparing, managing and sending invoices;
  • organising and following up the delivery of Products;
  • managing payments and payment follow-up.

3.2 Customer communication and customer service

  • responding to customer questions or requests;
  • handling complaints or comments;
  • providing support before, during and after the performance of an order.

3.3 Legal and administrative obligations

  • complying with accounting, tax and administrative obligations;
  • complying with obligations arising from applicable laws and regulations;
  • retaining supporting documents where legally required.

3.4 Professional Customers (B2B)

For Professional Customers, personal data may additionally be processed for:

  • managing business relationships;
  • preparing and following up quotations and agreements;
  • internal administration and file building in the context of the professional cooperation.

3.5 Improvement of services and website

  • analysing and improving the operation, user-friendliness and security of the website;
  • optimising services and internal processes;
  • detecting and preventing technical issues, abuse or fraud.

Such processing is always carried out on the basis of aggregated or pseudonymised data where possible.

3.6 Newsletters and marketing, where applicable

Bisous du Biscuit may process personal data for the sending of newsletters, promotions or commercial communications where a valid legal basis exists, such as consent or a legally permitted exception for existing customers.

3.7 Account management

Personal data may be processed for:

  • creating user accounts;
  • authenticating users;
  • securing accounts;
  • managing preferences and settings;
  • access to order history;
  • managing subscriptions;
  • fraud prevention;
  • support and customer service relating to accounts.

3.8 No automated decision-making

Personal data are not used for automated decision-making or profiling within the meaning of Article 22 GDPR.

Article 4 - What is the legal basis for the processing?

Bisous du Biscuit processes personal data only where and insofar as a valid legal basis exists, as provided for in Article 6 of the General Data Protection Regulation (GDPR).

Depending on the processing purpose, processing takes place on the basis of one or more of the following legal bases.

In summary, the following link between purpose and legal basis mainly applies:

  • orders, deliveries, payments, accounts and subscriptions: performance of an agreement;
  • invoicing, accounting and tax administration: legal obligation;
  • customer service, fraud prevention, security and defence of rights: legitimate interest;
  • newsletters, direct marketing outside statutory exceptions and non-essential cookies: consent.

4.1 Performance of an agreement or pre-contractual measures

Personal data may be processed where this is necessary for:

  • the performance of an agreement to which the data subject is party;
  • taking steps at the request of the data subject prior to entering into an agreement.

This legal basis applies, among other things, to the processing of orders, deliveries, payments, customer accounts, subscriptions and related customer communication.

4.2 Legal obligations

Personal data may be processed where this is necessary to comply with legal obligations incumbent on Bisous du Biscuit, including accounting, tax, administrative and other legal obligations.

4.3 Legitimate interest

Personal data may be processed where this is necessary for the purposes of the legitimate interests pursued by Bisous du Biscuit, provided that such interests are not overridden by the rights and freedoms of the data subject.

This includes, among other things:

  • customer service;
  • security of the website and IT systems;
  • fraud prevention;
  • protection of user accounts;
  • improvement of the website and services;
  • defence of legal rights and interests.

Where required, Bisous du Biscuit carries out a balancing test in accordance with the GDPR.

4.4 Consent

Prior consent is requested for certain processing activities.

This may include:

  • newsletters;
  • direct marketing;
  • non-essential cookies;
  • other processing activities for which consent is legally required.

The data subject may withdraw his or her consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

4.5 Contractual or statutory requirement

Where personal data are necessary for the performance of an agreement or compliance with a legal obligation, the provision of such data may be mandatory.

If such data are not provided, Bisous du Biscuit may be unable to provide certain services, perform an order, create an account or comply with legal obligations.

Article 5 - With whom do we share personal data?

Bisous du Biscuit shares personal data with third parties only insofar as this is necessary for the performance of its services, compliance with legal obligations or protection of its legitimate interests.

5.1 Service providers and processors

Personal data may be shared with:

  • logistics partners and courier services, for the delivery of Products;
  • payment service providers, for the processing of payments;
  • IT service providers, hosting providers and suppliers of software or cloud solutions;
  • accounting, administrative and tax service providers;
  • marketing or communication platforms;
  • professional advisers, such as accountants, legal advisers or lawyers, where necessary.

Specific service providers used or envisaged include Shopify as webshop and website platform, Shopify Payments as payment service provider and QLS as logistics partner.

These parties process personal data only for the purposes for which they are engaged.

Where they act as processors within the meaning of the GDPR, Bisous du Biscuit enters into a data processing agreement with them, setting out arrangements on confidentiality, security and protection of personal data.

5.2 Legal or judicial obligations

Personal data may be disclosed to competent public authorities, judicial authorities or supervisory authorities where this is necessary:

  • to comply with a legal obligation;
  • in the context of legal proceedings;
  • at the request of a competent authority;
  • to protect the rights, safety or interests of Bisous du Biscuit, customers or third parties.

5.3 No commercial disclosure

Personal data are not sold, rented out or made available to third parties for the commercial or marketing purposes of those third parties.

5.4 Limitation of data sharing

Bisous du Biscuit always limits the personal data shared to what is strictly necessary for the intended purpose and does not share personal data without a valid legal basis.

Article 6 - Are personal data transferred outside the European Economic Area (EEA)?

Bisous du Biscuit seeks to process personal data exclusively within the European Economic Area (EEA).

In certain cases, however, personal data may be transferred to or processed by service providers established outside the EEA, for example where IT, cloud or software services of international providers are used.

In such case, Bisous du Biscuit ensures that such transfers take place only in compliance with the applicable provisions of the General Data Protection Regulation (GDPR), and that appropriate safeguards are provided, including, among other things:

  • an adequacy decision of the European Commission;
  • the use of standard contractual clauses approved by the European Commission (Standard Contractual Clauses - SCCs);
  • additional technical and organisational measures where required.

Bisous du Biscuit ensures that, in the event of such transfers, an appropriate level of protection for the personal data is guaranteed which is essentially equivalent to the level of protection within the EEA.

Article 7 - How long do we retain personal data?

Bisous du Biscuit does not retain personal data for longer than necessary for the purposes for which they were collected and processed, taking into account statutory retention periods, evidential requirements and applicable limitation periods.

7.1 Order, invoicing and accounting data (B2C & B2B)

Personal data necessary for accounting and tax purposes are retained for a period of at least seven (7) years, in accordance with the applicable legal obligations.

7.2 Customer communication

Personal data processed in the context of communication with customers, such as emails, questions via contact forms or customer service, are retained for as long as necessary to handle and follow up the relevant question, and thereafter for a reasonable period of two (2) years after the last contact in order to handle any further communication or disputes.

7.3 Data of Professional Customers (B2B)

Personal data of Professional Customers are retained for the duration of the commercial relationship, and thereafter for as long as necessary:

  • to comply with legal obligations;
  • for the handling of any disputes;
  • or within the applicable limitation periods.

7.4 Marketing data

Personal data processed for newsletters or commercial communication are retained for as long as the data subject remains subscribed or for as long as a valid legal basis exists.

After unsubscribing, the data are deleted or included in a limited suppression list where this is necessary to prevent future unwanted communication.

7.5 Technical and cookie data

Technical data and cookie data are retained in accordance with the cookie policy and only for as long as necessary for the relevant purpose.

7.6 Other personal data

Other personal data are retained for as long as they are relevant to the intended processing purpose or for as long as a valid legal basis for processing exists.

After expiry of the applicable retention periods, personal data are securely deleted or irreversibly anonymised, in accordance with the applicable security and confidentiality requirements.

Article 8 - What rights do you have as a data subject?

In accordance with the General Data Protection Regulation (GDPR), you, as a data subject, have the following rights in relation to your personal data:

  • the right of access to your personal data;
  • the right to rectification of inaccurate or incomplete personal data;
  • the right to erasure of your personal data ("right to be forgotten"), insofar and for as long as this is legally permitted;
  • the right to restriction of processing in the cases provided for by the GDPR;
  • the right to data portability, insofar as the processing is based on consent or performance of an agreement and is carried out by automated means;
  • the right to withdraw consent at any time, insofar as the processing is based on consent;
  • the right to object to processing based on legitimate interest;
  • the right to object to processing for direct marketing purposes.

You may exercise these rights by sending a written request to:

Email: hello@bisousdubiscuit.be

Bisous du Biscuit may, in the context of handling your request, ask for additional information to verify your identity, in order to prevent abuse and adequately protect personal data.

Bisous du Biscuit shall respond within one (1) month after receipt of the request.

If the handling of the request is complex or if several requests are submitted at the same time, this period may be extended by a maximum of two (2) additional months in accordance with Article 12(3) GDPR. In that case, you will be informed of the extension and the reasons for it within the original one-month period.

Exercising these rights is free of charge, unless the request is manifestly unfounded, excessive or repetitive, in which case Bisous du Biscuit reserves the right to charge a reasonable administrative fee or refuse the request, in accordance with the GDPR.

Article 9 - Complaints and supervision

If you believe that Bisous du Biscuit does not process your personal data in accordance with the applicable privacy legislation, you may contact Bisous du Biscuit at:

Email: hello@bisousdubiscuit.be

Bisous du Biscuit will carefully examine your notification and endeavour to resolve it as far as possible.

Without prejudice to the foregoing, you have the right at any time to lodge a complaint with the competent supervisory authority:

Belgian Data Protection Authority

Rue de la Presse 35

1000 Brussels (Belgium)

Telephone: +32 (0)2 274 48 00

Email: contact@apd-gba.be

Website: https://www.gegevensbeschermingsautoriteit.be

You may also lodge a complaint directly via the online complaint form on the website of the Belgian Data Protection Authority.

Article 10 - Cookies and similar technologies

The website of Bisous du Biscuit may use cookies and similar technologies.

Cookies may be used, among other things, for:

  • the proper technical operation of the website;
  • security of the website;
  • remembering preferences;
  • statistical analysis;
  • marketing purposes, where applicable and insofar as permitted by law.

For non-essential cookies, consent is requested where legally required.

Further information on the use of cookies, the types of cookies, retention periods and the way in which cookie preferences can be managed is included in the cookie policy of Bisous du Biscuit.

Article 11 - Security of personal data

Bisous du Biscuit takes appropriate technical and organisational measures to protect personal data against loss, destruction, unauthorised access, unauthorised disclosure, misuse or any other unlawful processing.

These measures are aligned with:

  • the nature, scope and context of the processing;
  • the state of the art;
  • the likelihood and severity of the risks to the rights and freedoms of data subjects.

Such measures may include, without limitation:

  • access restrictions to personal data;
  • secure IT systems and hosting environments;
  • confidentiality obligations for persons who have access to personal data;
  • regular evaluation and updating of security measures.

However, having regard to the nature of electronic communication and data processing, Bisous du Biscuit cannot guarantee absolute security.

Article 12 - Minors

The services of Bisous du Biscuit are not specifically aimed at minors.

If Bisous du Biscuit establishes that personal data have been provided in breach of applicable legal requirements relating to consent or representation, it may take appropriate measures to regularise the situation.

Article 13 - Changes to this Privacy Policy

Bisous du Biscuit reserves the right to amend or update this Privacy Policy at any time, including in order to continue to comply with changes in legislation, guidelines of supervisory authorities or changes in its processing activities.

The most recent version of the Privacy Policy is always available on the website of Bisous du Biscuit.

Changes apply from the moment of publication on the website, unless expressly stated otherwise.

Article 14 - Language and Interpretation

This Privacy Policy has been drawn up in Dutch.

Bisous du Biscuit may have this Privacy Policy translated into one or more other languages for informational, commercial or operational purposes.

Such translations are made available solely for convenience and information purposes.

In the event of differences, contradictions, interpretation issues or deviations between the Dutch-language version and a translated version, the Dutch-language version shall prevail, insofar as this is compatible with the applicable law and the rights of data subjects under the applicable privacy legislation.

Headings, chapters and numbering are included solely to improve readability and shall not affect the interpretation of the content of the provisions.