Privacy

1.Data controller

Braza. Company number: 1040.877.997. VAT: BE1040877997. Address: Gustaaf Vanden Berghe 7, 1070 Anderlecht. Email: [email protected].

The operator of Braza, above, is the controller of your personal data. This policy explains what data we process, why, for how long, and how to exercise your rights.

2.Data collected and purposes

• Order: name, delivery address, email, phone if you provide it (only for the carrier), order contents and invoice. To prepare, deliver and invoice the order and handle a return or complaint (performance of the contract, accounting obligations).
• Customer account: name, email, password (stored encrypted, never readable), language, orders, subscription, loyalty points and referrals. To manage your account and its benefits (performance of the contract).
• Sign-in with Google or Facebook: if you choose this option, that service sends us your name and email address, nothing else (performance of the contract).
• Payment: your card details are entered and processed directly by Stripe; Braza only receives the payment status (performance of the contract, fraud prevention).
• Contact form: name, email and message, to reply to you (legitimate interest).
• Back-in-stock alert: your email, to let you know once when a coffee is back (consent).
• Newsletter: your email, for at most one email a month. If you sign up yourself: consent. If you order: our news about our coffees, unless you decline when ordering (legitimate interest, an exception the law provides for customers). Every email contains an unsubscribe link.
• Security: IP address and technical connection data, to protect the website and accounts against abuse (legitimate interest).
• Visit statistics: pages viewed, where the visit came from, country (derived from the IP address, which is not stored), language, device type and browser, and the steps of the order. They are measured without cookies with Umami, installed on our own servers: nothing is passed on to a third party, and visits are linked neither to your name nor to your email (legitimate interest).
• Suggested delivery country: your IP address is matched, on our own servers, against a country database (IP Geolocation by DB-IP, db-ip.com, CC BY 4.0 licence) to preselect the delivery country. It is neither kept nor passed on, and you can choose another country (legitimate interest).

Braza does not sell or rent your data, does no advertising profiling and makes no automated decisions about you.

3.Recipients

Your data is only shared with the service providers needed to run the service, who process it on our behalf and according to our instructions:

• Our hosting provider: site and database, on servers located in the European Union.
• Our payment provider: online payment.
• Our email service: confirmation, invoice, tracking, alerts, newsletter.
• The carrier: name, address and contact details needed for delivery.
• Google or Meta (Facebook): only if you sign in with their account.
• Our accountant: for accounting and tax obligations.

Some of these providers are based in the United States. These transfers are covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.

4.Retention periods

• Orders and invoices: 10 years, as required by Belgian accounting and tax law.
• Customer account: as long as the account is used, then deleted after 3 years without sign-in or order, or sooner at your request. Past orders are kept for the accounting period.
• Contact messages: 1 year after the last exchange.
• Back-in-stock alerts: until the alert is sent, then the address is deleted.
• Newsletter: until you unsubscribe.
• Technical security data: 12 months at most.

5.Your rights

You can access your data, have it corrected or erased, restrict its processing, object to processing based on our legitimate interest and receive the data you provided to us in a machine-readable format. Where processing is based on your consent, you can withdraw it at any time, without affecting what was done before.

Write to us at the address below: we reply within one month and may ask you to confirm your identity.

If you believe your rights are not respected, you can lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels (www.dataprotectionauthority.be).

Email: [email protected]

6.Security

Connections to the website are encrypted (HTTPS), passwords are stored as hashes, and access to the back office is protected by two-step verification and limited to those who need it.