Privacy policy

Quadra Belgium SRL, Rue Montgomery 38, 7500 Tournai, Belgium. Company and VAT number: BE0872099284. GDPR contact: privacy@quadrabelgium.be.

Quadra Belgium SRL is not required to appoint a Data Protection Officer within the meaning of article 37 GDPR. Any question regarding the protection of your data can be sent to privacy@quadrabelgium.be.

We only collect the data necessary for the purposes described below:

• Customer account: last name, first name, email address, password (stored as a hash, never in plain text).
• Orders: last name, first name, delivery address, phone number, email, order history and invoices.
• Payment: bank details (card number, CVV, expiration date) are collected and processed exclusively by our provider Stripe. We never store this data — only a transaction identifier and the payment status.
• Navigation: IP address (security and rate limiting), language preference, pages visited (only if you consent to analytics).
• Newsletter: email address, subscription status and confirmation date, only if you explicitly subscribe.

Each processing operation rests on a specific legal basis (article 6 GDPR):

• Performance of the sales contract (art. 6.1.b): order processing, delivery, returns management, order-related communication.
• Customer account management (art. 6.1.b): authentication, access to your personal space, order history and invoices.
• Legal and tax obligations (art. 6.1.c): retention of invoices and accounting data for 7 years (art. 60 Belgian VAT Code).
• Legitimate interest (art. 6.1.f): site security, rate limiting, fraud prevention.
• Consent (art. 6.1.a): newsletter (double opt-in), anonymous analytics, non-essential cookies.

Your data is processed by Quadra Belgium SRL and the following processors, contractually bound by a data processing agreement (DPA) compliant with article 28 GDPR:

• Stripe Payments Europe Ltd. (Ireland) — processing of card payments.
• Resend Inc. (United States) — sending of transactional emails and the newsletter.
• Vercel Inc. (United States) — site hosting, media storage (Vercel Blob), anonymous analytics (Vercel Analytics and Speed Insights, only with consent).
• Prisma Data Inc. — hosting of the PostgreSQL database (Paris, France).

Some processors (Stripe Inc., Resend Inc., Vercel Inc.) are American companies. Transfers to the United States are governed by the standard contractual clauses adopted by the European Commission (decision 2021/914) and, where applicable, by certification under the Data Privacy Framework. The actual execution of processing may take place in data centres located within the European Union.

Your data is kept for the time necessary for the purposes of the processing:

• Customer account: until the account is deleted by the user.
• Orders and invoices: 7 years from the end of the accounting year (legal obligation, art. 60 Belgian VAT Code).
• Anonymised data: after account deletion, orders are anonymised and kept for 7 years for accounting obligations.
• Newsletter: until you unsubscribe via the link in each email.
• Security logs: 30 days maximum.
• Cookie preferences: 12 months maximum, in accordance with the recommendation of the Belgian DPA.

The site uses a limited number of cookies, grouped into three categories. You can manage your preferences at any time via the « Manage cookies » link in the footer.

• Strictly necessary cookies (always active, exempt from consent under article 5.3 of the ePrivacy directive): qbe.session_token for the session, NEXT_LOCALE for language, __stripe_mid and __stripe_sid for payment fraud prevention (set by Stripe at checkout).
• Analytics (consent required): Vercel Analytics and Vercel Speed Insights anonymously measure traffic and performance. No third-party cookies, no directly identifying personal data.
• Marketing (consent required): no advertising pixel (Meta, Google Ads, etc.) is currently active. This category is kept as a precaution.

Your data is protected by: TLS encryption for all communications, password hashing, payment isolation through Stripe (PCI-DSS level 1), rate limiting against brute-force attacks, security headers (CSP, X-Frame-Options), restricted database access.

You have the following rights regarding your data at all times:

• Right of access (art. 15): view all your data from your customer area → « My information » → « Export my data » (JSON export).
• Right of rectification (art. 16): modify your information from your customer area.
• Right to erasure (art. 17): delete your account from your customer area. Your orders will be anonymised and kept for 7 years for tax compliance.
• Right to portability (art. 20): structured JSON export available from your customer area.
• Right to restriction (art. 18) and right to object (art. 21): contact privacy@quadrabelgium.be.
• Withdrawal of consent: withdraw your cookie consent via the « Manage cookies » link in the footer, unsubscribe from the newsletter via the link in each email.

The site is not intended for children under 13 (age set by article 7 of the Belgian law of 30 July 2018). We do not knowingly collect data from minors under 13. If you are a parent or guardian and believe your child has sent us data, please contact privacy@quadrabelgium.be for immediate deletion.

No decision producing legal effects or significantly affecting you is taken solely by automated means. We do not carry out profiling within the meaning of article 22 GDPR.

This policy may be updated to reflect legal or technical developments. Any substantial change will be notified by email to holders of a customer account and reflected by the date shown at the top of this page.

If you believe that the processing of your data does not comply with the regulations, you can lodge a complaint with the Belgian Data Protection Authority (DPA): www.dataprotectionauthority.be — Rue de la Presse 35, 1000 Brussels, +32 (0)2 274 48 00.