Gantoise

Privacy Policy

Last updated: September 2026

We take the protection of your personal data seriously. In this privacy policy we explain which data we collect, why we process it, how long we keep it, with whom we share it and what rights you have under the GDPR.

Data controller

GANTOISE vzwNoorderlaan 25, 9000 Ghent, BelgiumVAT: BE0409.025.343[email protected]

Which personal data do we collect?

Account data

  • Name
  • Email address
  • Phone number
  • Password (hashed)

Order data

  • Delivery address
  • Order history
  • Payment references (no full card details)

Technical data

  • IP address
  • Browser type
  • Language preference
  • Cookies (see separate cookie policy)

Communication data

  • Emails you send us
  • Replies to confirmations, reminders or service messages

We only collect data that is necessary for the operation of our webshop and club administration.

Why do we process your data?

Performance of the contractProcessing and delivery of your order.
CommunicationConfirmations, service messages, reminders or questions about your order.
Management of your customer accountAccess to your order history, preferences and contact details.
Legal obligationsAccounting, VAT administration and retention duties under Belgian law.
Technical operation of the webshopSecurity, error tracing, language settings and fraud prevention.
Visitor statisticsAnonymised visitor numbers via Umami, which we host ourselves: without cookies and without third parties.

We do not process data for marketing purposes without your explicit consent.

With whom do we share your data?

We share your data only with parties that are necessary for the delivery of our services:

MolliePayment processing (PCI DSS Level 1)
ResendSending emails (confirmations, service messages)
BpostPackage shipping for home delivery
  • We never receive your full payment card details.
  • All partners process data in accordance with the GDPR and only on behalf of GANTOISE vzw.
  • We never sell your data to third parties.

Retention periods

  • Order data: 7 years (legal accounting obligation)
  • Account data: as long as your account is active + 30 days after deletion
  • Technical data: maximum 12 months, unless legally required otherwise
  • Communication data: maximum 24 months for internal follow-up

When retention periods expire, data is securely deleted or anonymised.

Your rights under the GDPR

Right of access
Right to rectification
Right to erasure ("right to be forgotten")
Right to restriction of processing
Right to data portability
Right to object to processing

To exercise your rights: [email protected]

We answer your request within 30 days, as legally required.

Lodge a complaint with the Belgian Data Protection Authority: www.dataprotectionauthority.be

Security

Passwords are stored hashed (bcrypt)
All connections run over HTTPS
Payments are processed via Mollie (PCI DSS Level 1)
Role-based access control
Regular security updates and monitoring

Minors

Our webshop is not intended for children under the age of 13. We do not knowingly collect data from minors without the consent of a parent or guardian.

Changes to this privacy policy

We may adapt this privacy policy when our services or legal obligations change. The most recent version is always available on our website.