Data controller
Quentin De Brouwer — OALI
Rue Vankeerberghen 31, 4500 Huy, Belgium
Company number (CBE): 0837726246
VAT number: BE0837726246
hello@oali.be
+32 497 32 46 13 (Belgium) — +33 7 59 80 15 67 (France)
This English version is provided for information. In the event of any discrepancy, the French version prevails.
1. Who is responsible for processing your data?
The controller of your personal data is Quentin De Brouwer, trading under the name OALI.
This policy applies to the oali.be website, its Dutch and English versions, the trade area reserved for stockists, and any communication you have with us on these matters (hereinafter the “Services”).
2. What data do we collect?
2.1 Data you give us directly
When you place an order: surname, first name, billing address, delivery address, email address, phone number, order contents.
When you create a customer account: name, email address, password.
When you request access to the trade area (stockists): company name, VAT number, billing address, contact details and, where applicable, information about your business.
When you subscribe to the newsletter: email address.
When you contact us: the information you choose to include in your message.
We do not collect or store your card details. They are processed directly by our payment provider (see section 4).
2.2 Data collected automatically
When you browse the site, certain technical information is collected: IP address, browser and device type, pages viewed, date and time of the visit, referring site.
This data is collected using cookies and similar technologies, under the conditions described in section 6.
3. Why do we process your data, and on what legal basis?
| Purpose | Legal basis (GDPR) |
|---|---|
| Processing and delivering your orders, handling returns and after-sales service | Performance of a contract — art. 6.1.b |
| Creating and managing your customer account | Performance of a contract — art. 6.1.b |
| Managing trade area requests and stockist accounts | Performance of a contract or pre-contractual measures — art. 6.1.b |
| Answering your questions and requests | Legitimate interest — art. 6.1.f |
| Issuing and keeping invoices | Legal obligation — art. 6.1.c |
| Sending you our newsletter | Consent — art. 6.1.a |
| Measuring site traffic and improving the Services | Consent (cookies) — art. 6.1.a |
| Running and measuring our advertising campaigns | Consent (cookies) — art. 6.1.a |
| Preventing fraud and securing the site | Legitimate interest — art. 6.1.f |
You can withdraw your consent at any time, without affecting the lawfulness of processing already carried out.
4. Who do we share your data with?
We do not sell your personal data.
It is shared only with the providers that enable us to run the site and fulfil your orders, and only to the extent necessary for their task:
| Provider | Role | Data concerned |
|---|---|---|
| Lovable | Website hosting | Browsing data |
| Supabase | Database, customer accounts and trade area | Account, order and stockist data |
| Stripe (Stripe Payments Europe Ltd, Ireland) | Payment processing | Payment and billing data |
| Mondial Relay | Parcel delivery | Name, delivery address, phone, email |
| Google Ireland Ltd (Google Analytics, Google Tag Manager, Google Ads, Google Merchant Center) | Audience measurement and advertising | Browsing data, cookie identifiers |
| Meta Platforms Ireland Ltd (Facebook and Instagram pixel) | Measuring and targeting our ads | Browsing data, cookie identifiers |
| flock.js (audience measurement tool built into the hosting platform) | Site traffic statistics | Browsing data |
| Brevo (Sendinblue SAS, France) | Sending the newsletter | Email address, first name, language, open and click statistics |
| Proton AG (Switzerland) | Business email | Content of your exchanges with us |
Your data may also be disclosed to the competent authorities where the law requires it, or to a third party in the event of a transfer of the business.
5. Is your data transferred outside the European Union?
Some of our providers may process data outside the European Economic Area.
Google is certified under the EU-U.S. Data Privacy Framework, recognised as adequate by the European Commission.
Proton AG is established in Switzerland, a country covered by an adequacy decision of the European Commission.
The hosting of the site and the database (Lovable, Supabase) is located in the European Union.
For any other transfer, we rely on the standard contractual clauses adopted by the European Commission.
6. Cookies
The site uses cookies and similar technologies.
Strictly necessary cookies — basket, session, security. Essential for the site to work, they do not require your consent.
Audience measurement cookies — Google Analytics and the statistics tool built into our hosting (flock.js). They help us understand how the site is used.
Advertising cookies — Google Ads and the Meta pixel (Facebook, Instagram). They measure how effective our campaigns are. They are only set with your consent.
You can set your browser to refuse or delete cookies, or use the opt-out tools offered by the providers concerned, including the Google Analytics opt-out tool. Blocking some cookies may affect how the site works.
For any question about cookies, write to us at hello@oali.be.
7. How long do we keep your data?
| Data | Retention period |
|---|---|
| Order data and invoices | 10 years, in line with Belgian legal accounting and tax retention obligations |
| Customer account | 3 years from your last order or login, then deleted |
| Stockist trade account | Duration of the business relationship, then 3 years |
| Newsletter subscription | Until you unsubscribe, then deleted |
| Exchanges with customer service | 3 years from the last contact |
| Browsing data and cookies | Maximum 13 months |
8. What are your rights?
Under the GDPR, you have the following rights over your personal data:
- Access — confirmation that your data is being processed and a copy of it
- Rectification — correction of inaccurate or incomplete data
- Erasure — deletion of your data, subject to our legal retention obligations
- Restriction — temporary suspension of processing
- Portability — receiving your data in a structured, readable format, or having it transferred to a third party
- Objection — objecting to processing based on our legitimate interest
- Withdrawal of consent — at any time, for processing that depends on it
To exercise these rights, write to us at hello@oali.be. We may ask you to prove your identity. We reply within one month, which may be extended by two months for complex requests.
You can also unsubscribe from the newsletter at any time using the link in every email.
9. Security of your data
The site is served exclusively over HTTPS. Your passwords are stored in encrypted form and are never accessible in plain text, including to us. Access to the trade area is protected by security rules applied at database level.
As no system is infallible, we recommend choosing a strong password and not sharing it with anyone. If you think your account has been compromised, contact us immediately.
10. Minors
Our Services are not intended for minors and we do not knowingly collect their data. If you are the parent or guardian of a minor whose data we may have collected, contact us to request its deletion.
11. Complaints
If you believe your rights are not being respected, please contact us first at hello@oali.be. You can also lodge a complaint with:
Data Protection Authority (Belgium)
Rue de la Presse 35, 1000 Brussels — contact@apd-gba.be — www.dataprotectionauthority.be
CNIL (France), if you live in France
3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr
If you live in another EU country, you can also contact the data protection authority of your country.
12. Changes
We may update this policy to reflect changes in our practices or in the regulations. The version in force is always the one published on this page, with its last updated date.
13. Contact us
Quentin De Brouwer — OALI
Rue Vankeerberghen 31, 4500 Huy, Belgium
hello@oali.be — +32 497 32 46 13