Legal

Privacy statement

Last updated: 17 October 2026

Hof Ter Bree-Eik takes your privacy seriously. This statement explains which personal data we collect when you use our website and webshop, why we do so, how long we keep it and what rights you have. We process your data in accordance with the General Data Protection Regulation (GDPR) and Belgian privacy law.

1. Data controller

Hof Ter Bree-Eik — [to be completed: legal form and registered name]
[to be completed: street and number], 1750 Lennik, Belgium
Company number: [to be completed: BE0…]
Email for privacy questions: [to be completed: email address]

2. What data we process

Account data: your name, email address and login details when you create an account.
Order data: your orders, chosen pickup time, payment status, any discount codes and your communication with us about an order. Card details are processed directly by our payment partner; we never see them.
Business data: for business customers, the company name, VAT number, billing address and contact person's details.
Contact data: what you send us through the contact form, the complaints page or by email.
Newsletter data: your email address and, if provided, your name when you subscribe to our newsletter.
Technical data: IP address, browser type and time of visit, for the security and proper functioning of the website, and the cookies described in our cookie policy.

3. Why, and on what legal basis

Processing your order and managing your account — to perform our contract with you: preparing your order, keeping you informed about your pickup time, and handling payments and refunds.
Invoicing and accounting — to comply with our legal obligations.
Answering your questions and complaints — based on our legitimate interest in helping you properly, or to perform the contract.
Sending our newsletter — only with your consent. You confirm your subscription via an email (double opt-in) and can unsubscribe at any time using the link at the bottom of every newsletter.
Security and abuse prevention — based on our legitimate interest in protecting the website, your account and payments against fraud and misuse.
Verifying business accounts — based on our legitimate interest, we consult public registers (such as the Belgian Crossroads Bank for Enterprises and the European VIES system) to verify company details.

We do not use your data for automated decision-making or profiling, and we never sell it to third parties.

4. Who we share data with

We work with carefully selected service providers who process your data only on our behalf and according to our instructions:

Clerk — sign-in and account management.
Stripe — online payments. For payment processing, Stripe partly acts as an independent controller; see Stripe's privacy policy.
Mailgun — sending confirmation emails, notifications and the newsletter.
Railway — hosting of the website, the database and stored files.

Some of these providers are established outside the European Economic Area, including in the United States. In that case we ensure appropriate safeguards, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Apart from that, we only pass on data when we are legally required to, for example to our accountant or to public authorities.

5. How long we keep data

Account: for as long as your account is active. Once your account is deleted, we erase or anonymise your data, except what we are legally required to keep.
Orders and invoices: 10 years, as required by Belgian accounting and VAT law.
Contact messages and complaints: until the request has been handled, and for no more than 2 years afterwards.
Newsletter: until you unsubscribe.
Technical logs: briefly, only as long as needed for security and troubleshooting.

6. Security

We take appropriate technical and organisational measures to protect your data, such as encrypted connections (HTTPS), role-based access for staff, and not storing payment details ourselves.

7. Your rights

You have the right to:

access your data and receive a copy of it;
have incorrect data corrected;
have your data erased, insofar as we are not legally required to keep it;
have the processing restricted;
have your data transferred to yourself or another party;
object to processing based on our legitimate interest;
withdraw your consent at any time, without affecting the lawfulness of earlier processing.

You can change some of your data yourself via My account. For all other requests, contact us at [to be completed: email address] or through the contact form. We will respond within one month. To prevent misuse, we may ask you to confirm your identity.

If you are not satisfied with how we handle your data, you can lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels (dataprotectionauthority.be).

8. Minors

Our webshop is aimed at adults. If you are under 16, please ask a parent or guardian for permission before giving us any data.

9. Changes

We may update this privacy statement, for example when our services or the law change. The latest version is always available on this page, with the date of the last change at the top.

2. What data we process

Account data: your name, email address and login details when you create an account.

Order data: your orders, chosen pickup time, payment status, any discount codes and your communication with us about an order. Card details are processed directly by our payment partner; we never see them.

Business data: for business customers, the company name, VAT number, billing address and contact person's details.

Contact data: what you send us through the contact form, the complaints page or by email.

Newsletter data: your email address and, if provided, your name when you subscribe to our newsletter.

Technical data: IP address, browser type and time of visit, for the security and proper functioning of the website, and the cookies described in our cookie policy.

3. Why, and on what legal basis

Processing your order and managing your account — to perform our contract with you: preparing your order, keeping you informed about your pickup time, and handling payments and refunds.

Invoicing and accounting — to comply with our legal obligations.

Answering your questions and complaints — based on our legitimate interest in helping you properly, or to perform the contract.

Sending our newsletter — only with your consent. You confirm your subscription via an email (double opt-in) and can unsubscribe at any time using the link at the bottom of every newsletter.

Security and abuse prevention — based on our legitimate interest in protecting the website, your account and payments against fraud and misuse.

Verifying business accounts — based on our legitimate interest, we consult public registers (such as the Belgian Crossroads Bank for Enterprises and the European VIES system) to verify company details.

We do not use your data for automated decision-making or profiling, and we never sell it to third parties.

4. Who we share data with

We work with carefully selected service providers who process your data only on our behalf and according to our instructions:

Clerk — sign-in and account management.

Stripe — online payments. For payment processing, Stripe partly acts as an independent controller; see Stripe's privacy policy.

Mailgun — sending confirmation emails, notifications and the newsletter.

Railway — hosting of the website, the database and stored files.

Apart from that, we only pass on data when we are legally required to, for example to our accountant or to public authorities.

5. How long we keep data

Account: for as long as your account is active. Once your account is deleted, we erase or anonymise your data, except what we are legally required to keep.

Orders and invoices: 10 years, as required by Belgian accounting and VAT law.

Contact messages and complaints: until the request has been handled, and for no more than 2 years afterwards.

Newsletter: until you unsubscribe.

Technical logs: briefly, only as long as needed for security and troubleshooting.

7. Your rights

You have the right to:

access your data and receive a copy of it;

have incorrect data corrected;

have your data erased, insofar as we are not legally required to keep it;

have the processing restricted;

have your data transferred to yourself or another party;

object to processing based on our legitimate interest;

withdraw your consent at any time, without affecting the lawfulness of earlier processing.

If you are not satisfied with how we handle your data, you can lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels (dataprotectionauthority.be).