Privacy policy

1. Data controller

The controller of your personal data is LYSAR [FORME JURIDIQUE], with its registered office at [ADRESSE DU SIÈGE], registered with the Crossroads Bank for Enterprises under number [NUMÉRO BCE] (VAT [NUMÉRO TVA]).

For any questions about your data or to exercise your rights: [E-MAIL SUPPORT].

This policy explains what data we collect through the LYSAR app, why, on what legal basis, how long we keep it and what your rights are, in accordance with the General Data Protection Regulation (GDPR – Regulation (EU) 2016/679) and the Belgian Act of 30 July 2018.

2. Data we collect

Account data: first name, surname, email address, phone number, login credentials (your password is stored in encrypted form) and delivery addresses.

Order data: items purchased, sizes, amounts, order status, return history, delivery details and tracking number.

Payment data: payments are processed directly by Stripe. We only receive a transaction reference, the payment method used and, where applicable, the last 4 digits of the card.

Device data: push notification token (to send you notifications) and language preference.

Browsing data: items viewed and favourites, so we can show you personalised recommendations.

3. Purposes and legal bases

Managing your account, orders, payments, deliveries, returns and customer service: performance of the contract (Art. 6(1)(b) GDPR).

Complying with our accounting and tax obligations (keeping invoices): legal obligation (Art. 6(1)(c) GDPR).

Product recommendations based on items viewed, fraud prevention and improving the app: legitimate interests (Art. 6(1)(f) GDPR). You can object to this at any time.

Push notifications (order updates, new arrivals, promotions): your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in your phone or app settings.

4. Recipients and processors

We never sell your data. It is accessible only to authorised LYSAR staff and to our processors, who handle it on our behalf and on our instructions:

• Supabase – authentication and database;

• Stripe – secure payment processing;

• Sendcloud and partner carriers (e.g. bpost) – shipping and parcel tracking, return labels;

• Firebase Cloud Messaging (Google) – sending push notifications;

• Render – hosting our servers;

• Resend – sending transactional emails (order confirmation, shipping, returns).

We may also disclose your data to public authorities where required by law.

5. Transfers outside the European Union

Some of our providers are based in, or have infrastructure, outside the European Economic Area (notably in the United States). These transfers are covered by an adequacy decision of the European Commission (EU-US Data Privacy Framework) or by the standard contractual clauses adopted by the European Commission.

6. How long we keep your data

Account data: for as long as your account exists, then deleted within 30 days of the account being deleted.

Order data and invoices: 7 years from the end of the financial year, in accordance with Belgian accounting and tax law.

Notification token: until you log out, uninstall the app or withdraw your consent.

Browsing history: 12 months maximum.

7. Your rights

You have the right to access, rectify and erase your data, to restrict its processing, to data portability and to object to processing based on our legitimate interests. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, email us at [E-MAIL SUPPORT]. We will reply within one month. We may ask for proof of identity if we have reasonable doubts.

You also have the right to lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels – www.dataprotectionauthority.be – contact@apd-gba.be.

8. Security

We take appropriate technical and organisational measures to protect your data: encrypted connections (HTTPS/TLS), hashed passwords, access controls and reputable providers. No card details are stored on our servers.

9. Children

The app is intended for people aged 16 and over. We do not knowingly collect data from children under 16.

10. Changes

We may update this policy. The date of the last update is shown at the top of this document; if we make significant changes, we will let you know in the app or by email.