Data controller
The data controller is the wholesaler: [to be completed], [to be completed], enterprise number [to be completed].
For any question about your data or to exercise your rights, write to [to be completed].
React Consulting SARL AU publishes the website and the platform and operates them technically on behalf of the wholesaler, as a processor.
Data processed and purposes
| Why | What data | Legal basis |
|---|---|---|
| Replying to your messages from the contact form | Name, email, content of the message | Legitimate interest in replying to the requests received |
| Opening and managing your account | Name, email, telephone, address, language; for a company: name, VAT or enterprise number, role of the members | Performance of the contract |
| Processing your orders, deliveries and payments | Products, quantities, amounts, time slot, delivery address, notes, messages exchanged on the order, person who placed the order | Performance of the contract |
| Keeping the accounts and meeting tax obligations | Orders, amounts, identification of the customer | Legal obligation |
| Signing you in safely | E-mail; password hash if you choose a password; two-step verification secret and backup codes if you turn it on; name, e-mail, profile picture and account id of your Google account if you sign in with Google (Google's access tokens are not kept) | Performance of the contract; legitimate interest in protecting your account |
| Measuring the traffic and speed of the public website | Page viewed, referring page, country, type of device and browser, loading times. No cookie, no storage on your device; the IP address is not kept | Legitimate interest in knowing the website's audience and improving it |
| Securing the website and preventing abuse | IP address, browser, technical signals from the anti-bot check, technical logs | Legitimate interest in protecting the service |
| Sending you browser notifications, if you turn them on | Technical identifier of the browser subscription | Consent, which can be withdrawn at any time |
Traffic statistics are aggregated: they are not used to recognise you or to follow you from one website to another. Your data is not used for targeted advertising or profiling, and it is not sold. No automated decision producing legal effects is taken about you.
Account and order data is necessary to sell you our products: without it, we cannot open an account or process an order.
Retention periods
- Contact form messages: 12 months after receipt, then deleted automatically.
- Sign-in link: 15 minutes. Link to choose a password: 30 minutes. Two-step verification in progress: 10 minutes. Invitation or confirmation link: 7 days.
- Sign-in session: 30 days. An expired session, with the IP address and browser it holds, is deleted automatically within 24 hours.
- Invitations and unconfirmed sign-ups: deleted automatically 30 days after they expire or are accepted.
- Password, two-step verification and link with Google: as long as the account exists, or until you remove them.
- Account data: for as long as the account exists. A person removed from a customer company or from the team has their account deleted at once, with their sign-in methods; the orders they placed stay with the company, without their name. When a customer company is closed, we delete what is no longer needed.
- Orders, invoices and accounting records: up to 10 years, as Belgian accounting and tax law require.
- Tracking of order e-mails: 90 days after sending, 12 months for a failed sending.
- Technical logs: 7 days at most.
- Traffic statistics: aggregated, they do not make it possible to identify you.
- Browser notifications: until they are turned off.
Recipients and processors
Your data is accessible to the wholesaler's team for what it needs. In a customer company, the members see the company's shared orders and shared cart.
- React Consulting SARL AU (Morocco): publishing, operation and maintenance of the platform.
- Cloudflare, Inc. (United States): hosting, database, files, sending of emails, technical logs and Turnstile anti-bot check and Web Analytics audience measurement.
- The wholesaler's accountant, who receives the invoices and credit notes every month to keep the accounts.
- e-invoice.be (Belgium), if invoices between businesses are sent over the Peppol network from the platform: this access point delivers the electronic invoice to the customer company. The public Peppol directory is consulted to know whether a customer company is registered in it.
- Google (Ireland and United States), only if you choose to continue with Google: Google verifies your identity and sends us your name, your e-mail address and your account id. Google then acts on its own behalf, under its privacy policy (policies.google.com/privacy).
- Google (Ireland and United States), when the delivery team opens the route of a round: the delivery addresses are sent to Google Maps, which acts on its own behalf.
- Your browser's notification service, if you turn on notifications.
- The European Commission (Belgium), for a VAT number you enter: it is checked in the public VIES register, which returns the registered name and address to pre-fill the form.
- Public authorities, where the law requires it.
Transfers outside the European Economic Area
Morocco and the United States are located outside the European Economic Area. Transfers to Morocco are governed by the European Commission's standard contractual clauses. Cloudflare and Google are certified under the EU-US Data Privacy Framework, recognised by the Commission's adequacy decision of 10 July 2023, and their contracts also include these clauses. You can obtain a copy by writing to us.
Your rights
You can request access to your data, its rectification, its erasure, the restriction of its processing and its portability. You can object to processing based on legitimate interest and withdraw your consent at any time. Write to [to be completed]: we reply within one month.
If you believe your rights are not being respected, you can lodge a complaint with the Data Protection Authority (Autorité de protection des données), rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, +32 2 274 48 00, www.dataprotectionauthority.be.
Minors
The website sells alcoholic drinks and the account is reserved for people aged 18 or over.
Changes
We update this policy when our processing changes. The date at the top of the page shows its latest version.