1. Introduction

This privacy policy explains how ROSALYS collects, uses and protects your personal data, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR).

This document applies to all personal data processed via our website:
www.rosalys.be

For any questions regarding this policy or to exercise your rights, you can contact us by email at the following address:
contact@rosalys.be

2. Data Controller

The controller of your personal data is: ROSALYS, a company registered in Belgium, whose registered office is located at [insert address].

Contact email: contact@rosalys.be

3. Data collected

We collect the following data:
• First and last name
• E-mail address
• Postal address
• Telephone number
• Bank details
• Order history
• Browsing data (via cookies)

4. Purposes and legal basis of processing

a) Performance of the contract
• Order processing
• Delivery and returns
• Payment and invoicing
Legal basis: Article 6.1.b of the GDPR

b) Sending marketing communications (newsletter)
• Subject to your consent
Legal basis: Article 6.1.a of the GDPR

c) Website improvement and marketing analysis
• Analyzing navigation to improve user experience
Legal basis: Legitimate interest (Article 6.1.f)

d) Legal obligations
• Data retention for tax and accounting purposes
Legal basis: Article 6.1.c

e) Dispute resolution
• Establish proof of a transaction or respond to a request from an authority
Legal basis: Legitimate interest (Article 6.1.f)5. Data Retention

• Customer data: 10 years since the last order
• Browsing data: maximum 13 months
• Newsletter data: until consent is withdrawn

6. Rights of the persons concerned

You have the following rights:
• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object
• Right to withdraw your consent at any time
To exercise your rights, contact: contact@rosalys.be

7. Disclosure to third parties

Your data may be shared with third-party service providers (delivery, payment, accounting, website maintenance) only for the intended purposes. We never sell your data.

8. Accommodation and transfers outside the EU

The ROSALYS website is hosted by
Shopify Inc.
Data may be processed outside the EU, in countries ensuring an adequate level of protection or through standard contractual clauses.

9. Data Security

We implement appropriate technical and organizational measures to protect your data against loss, unauthorized access or disclosure.

10. Complaints

You can file a complaint with
Belgian Data Protection Authority:
https://www.autoriteprotectiondonnees.be

11. Changes

This policy may be updated. Any significant changes will be notified via the website or by email if you are a subscriber.

12. Applicable Law

This privacy policy is governed by Belgian law. Any dispute falls under the exclusive jurisdiction of the Belgian courts, specifically the French-speaking courts of Brussels, unless otherwise provided by law.