Privacy policy

This privacy policy explains how Alammax BV processes your personal data when you visit fertilize-it.be, place an order or contact us. We do this in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Belgian data protection rules.

1. Who is responsible for your data?

The controller is Alammax BV, Westkapellestraat 370a, 8300 Knokke-Heist, Belgium, company number 0704.658.874. For questions about your privacy, contact us at info@fertilize-it.be or +32 477 52 40 98.

2. Which data do we process?

Orders

When you order: your name, email address, phone number, billing and delivery address, the contents of your order and the payment status. Your payment is handled by Mollie; we do not receive your card details.

Review requests: about 14 days after your order ships we may email you once to ask what you think of the products (our legitimate interest in hearing from existing customers, Royal Decree of 4 April 2003). You can refuse this at checkout with the box "I don't want to receive news or offers by email", and every such email has a link to stop them. [Lawyer: confirm this purpose and legal basis, and the wording of the checkout box.]

News and offers for customers: as a customer, we may later email you news and offers about similar Fertilize-it products (Royal Decree of 4 April 2003), unless you ticked the box "I don't want to receive news or offers by email" at checkout. Every such email has a link to unsubscribe free of charge. We do not send a newsletter yet. [Lawyer: confirm this purpose, its legal basis and retention, and that the checkout box is a sufficient free and simple way to refuse.]

If you start an order but do not complete the payment, we keep the details you entered for no more than 30 days.

Contact and soil-analysis requests

When you use our contact form or request a soil analysis: your name, email address, phone number, address, the size of your lawn, the problems you describe and your message.

Withdrawals

When you withdraw from a contract: the details you send us, such as your name, email address, order number and, if you name them, the products concerned, together with the date and time of your withdrawal.

Technical data

To keep the website secure and to limit abuse of our forms, technical data such as the IP address of your device are processed. Our technical logs contain no personal data and are deleted after 30 days at most.

Your cookie choice

We store your choice about cookies (see our cookie policy).

3. Why do we process your data, and on what legal basis?

• Performance of the contract (Article 6(1)(b) GDPR): to process your order, handle the payment, deliver the products, send you the invoice and answer your questions about your order.
• Legal obligation (Article 6(1)(c) GDPR): to keep invoices and order records for 10 years under Belgian VAT rules, and to handle withdrawals and refunds under consumer law.
• Legitimate interest (Article 6(1)(f) GDPR): to protect the website, prevent fraud and limit the number of submissions through our forms (rate limiting). Our interest is a secure and reliable webshop.
• Consent (Article 6(1)(a) GDPR): for statistics and marketing cookies, and to answer your contact or soil-analysis request. You can withdraw your consent at any time; this does not affect processing that took place before the withdrawal.

Without your order data we cannot carry out your order, and without your contact details we cannot answer your request.

4. How long do we keep your data?

• Orders and invoices: 10 years (Belgian VAT rules).
• Withdrawals: together with the order they relate to.
• Unfinished orders (no payment): personal data deleted after 30 days.
• Contact and soil-analysis requests: 24 months.
• Technical logs: 30 days at most.
• Your cookie choice: 6 months.

[Lawyer: the brief gives no legal basis or retention period for withdrawal requests (this draft uses legal obligation and keeps them with the order), and no retention period for the IP addresses used to rate-limit the forms. Confirm both.]

5. Who receives your data?

We do not sell your data. We only share it with the following service providers, insofar as they need it for their task:

• Vercel Inc.: hosting of the website, in its EU region in Frankfurt (Germany).
• Neon: hosting of our database, in Frankfurt (Germany).
• Mollie B.V. (the Netherlands): payment processing.
• Billit NV (Belgium): invoicing; your invoice is sent to you by email.
• MyParcel and the carriers bpost, PostNL and DPD: shipping and delivery of your order (your name, delivery address and, where needed for the delivery, your email address or phone number).
• [email service to be confirmed]: sending the emails about your order.
• GitHub: storage of encrypted backups of our database.
• Google: Google Analytics and Google Ads, only after your consent (see our cookie policy).

We may also disclose data to public authorities where the law requires us to.

[Lawyer: confirm which recipients act as processors and which as independent controllers (for example Mollie, the carriers and Google), and the transfer safeguards for providers other than Vercel (Neon, GitHub, Google).]

6. Transfers outside the European Economic Area

Vercel Inc. is a US company. Any transfer of personal data to the United States is covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses. If another provider processes data outside the European Economic Area, we make sure appropriate safeguards are in place, such as an adequacy decision of the European Commission or standard contractual clauses.

7. Cookies

We only place statistics and marketing cookies with your consent. We use Google Consent Mode v2, which is set to "denied" by default. More information is in our cookie policy.

8. Your rights

You have the right to:

• access your data;
• have incorrect data corrected;
• have your data erased;
• have the processing restricted;
• object to processing based on our legitimate interest;
• receive your data in a structured, commonly used format, or have it sent to someone else (portability);
• withdraw your consent at any time.

To exercise your rights, email us at info@fertilize-it.be. We answer within one month. We do not ask for a copy of your identity card. Only if we have reasonable doubts about your identity may we ask for a reasonable confirmation, for example from the email address you used for your order.

Some rights are limited by law: for example, we must keep invoices for 10 years, even if you ask us to erase your data.

If you are not satisfied with how we handle your data, please contact us. You can also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, www.gegevensbeschermingsautoriteit.be / www.autoriteprotectiondonnees.be, or with the supervisory authority of the EU country where you live.

9. Automated decisions

We do not take decisions about you based solely on automated processing, including profiling.

10. Security

We take appropriate technical and organisational measures to protect your data. The backups of our database are encrypted.

11. Changes

We may update this privacy policy. The version and effective date are shown at the top of this page.