Privacy Policy
Last updated: May 2026
1. Data Controller
This Privacy Policy explains how ChiliSaus.be collects, uses, and protects your personal data when you visit or make a purchase from our Website, in accordance with the EU General Data Protection Regulation (GDPR) and Belgian data protection law.
Chilisaus.be — Data Controller
Kerri Innes
Dorpsstraat 22, 5051 CK Goirle, Netherlands
Email: sales@chilisaus.be
2. Data We Collect
We collect the following categories of personal data:
When you place an order:
- Full name and delivery address
- Email address
- Country of delivery
- Order history (products purchased, quantities, prices)
- Payment reference (we do not store card numbers — payments are handled by Stripe)
When you create an account:
- Email address and password (stored securely via Supabase Auth)
- Account preferences and order history
When you browse the Website:
- IP address and browser type (collected by our hosting infrastructure)
- Pages visited and session data
- Cookie data (see Section 7)
When you contact us:
- Email address and message content
- WhatsApp number and conversation history, if you contact us via WhatsApp
3. How We Use Your Data
We process your personal data for the following purposes and on the following legal bases:
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Processing and fulfilling your order | Performance of a contract (Art. 6(1)(b)) |
| Sending order confirmations and shipping updates | Performance of a contract (Art. 6(1)(b)) |
| Managing your account | Performance of a contract (Art. 6(1)(b)) |
| Responding to enquiries and customer support | Legitimate interest (Art. 6(1)(f)) |
| Fraud prevention and security | Legitimate interest (Art. 6(1)(f)) |
| Compliance with legal obligations (tax, accounting) | Legal obligation (Art. 6(1)(c)) |
| Sending marketing emails (if you opt in) | Consent (Art. 6(1)(a)) |
We do not use your data for automated decision-making or profiling that produces legal effects.
4. Who We Share Your Data With
We only share your personal data with trusted third parties who help us operate our business. We do not sell your data to third parties.
Stripe (Payment Processing)
Stripe, Inc. processes payments on our behalf. Your payment information is handled directly by Stripe and is subject to Stripe's Privacy Policy. Stripe is PCI DSS Level 1 certified. Data may be processed in the US under EU Standard Contractual Clauses.
Supabase (Database & Authentication)
Supabase stores our customer and order data. Our Supabase project is hosted in the EU (eu-west-2, London region). Supabase is GDPR-compliant and processes data under a Data Processing Agreement.
Vercel (Website Hosting)
Our Website is hosted on Vercel's infrastructure. Vercel may process IP addresses and request logs. Vercel is GDPR-compliant and operates under EU Standard Contractual Clauses where applicable.
Shipping Carriers
We share your name and delivery address with our shipping carriers (e.g., bpost, DPD, PostNL) solely for the purpose of delivering your order.
We may also disclose your data if required by law, court order, or governmental authority.
5. Data Retention
We retain your personal data only for as long as necessary:
- Order data (name, address, order history): retained for 7 years from the date of purchase, as required by Belgian accounting and tax law.
- Account data: retained for as long as your account is active. If you delete your account, your data will be removed within 30 days, except where retention is required by law.
- Customer support communications: retained for 2 years from the date of last contact.
- Marketing consent records: retained until you withdraw your consent.
- Cookie data: see Section 7.
6. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access — request a copy of the data we hold about you.
- Right to rectification — ask us to correct inaccurate or incomplete data.
- Right to erasure — request deletion of your data, subject to legal retention requirements.
- Right to restriction — ask us to limit how we use your data in certain circumstances.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interest, including direct marketing.
- Right to withdraw consent — where processing is based on consent (e.g., marketing emails), you may withdraw at any time without affecting prior processing.
To exercise any of these rights, contact us at sales@chilisaus.be. We will respond within 30 days.
If you are not satisfied with our response, you have the right to lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit):
Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels
www.dataprotectionauthority.be
contact@apd-gba.be
7. Cookies
Our Website uses cookies — small text files stored on your device — to make the site function and to improve your experience. Below is a description of the cookies we use.
Strictly Necessary Cookies
These cookies are essential for the Website to function and cannot be disabled. No consent is required for these cookies.
| Cookie | Purpose | Expiry |
|---|---|---|
| cart_session_id | Maintains your shopping cart between page loads | Session / 30 days |
| sb-*-auth-token | Keeps you logged in to your account (Supabase Auth) | Session / 1 week |
| NEXT_LOCALE | Remembers your preferred language | 1 year |
Third-Party Cookies
When you proceed to payment, Stripe may set cookies in your browser as part of its fraud prevention and payment flow. These are subject to Stripe's Cookie Policy.
We do not currently use cookies for advertising, cross-site tracking, or third-party analytics beyond what is described above. If this changes, we will update this policy and ask for your consent where required.
You can control and delete cookies through your browser settings. Disabling strictly necessary cookies may prevent the Website from functioning correctly.
8. Security
We take the security of your personal data seriously. Our Website is served over HTTPS. Passwords are hashed and never stored in plain text. Payment data is handled exclusively by Stripe and never touches our servers. We restrict access to personal data to authorised personnel only. Despite these measures, no system is completely secure — if you believe your account has been compromised, please contact us immediately.
9. Children's Privacy
Our Website is not directed at children under the age of 16. We do not knowingly collect personal data from children. Some of our products (e.g., extreme heat sauces) are intended for adults only. If you believe a child has provided us with personal data, please contact us so we can delete it.
10. Changes to This Policy
We may update this Privacy Policy from time to time. The date at the top of this page shows when it was last revised. Material changes will be communicated to registered users by email. Continued use of the Website after changes are posted constitutes acceptance of the updated policy.
11. Contact
For any questions about this Privacy Policy or to exercise your rights, contact us:
Email: sales@chilisaus.be
Post: Kerri Innes, Dorpsstraat 22, 5051 CK Goirle, Netherlands