Privacy policy

Privacy policy

Controller and contact

MAISON HALLEUX SRL, company/VAT BE 0417.106.235, registered office: 47 rue de l’Esplanade, 4141 Banneux N.D., Belgium, is responsible for the processing described for Religieux Saint-Christophe. Data enquiries and requests: contact@religieux-saintchristophe.com; post: 45 rue de l’Esplanade, 4141 Banneux, Belgium; +32 (0)4 360 85 36. Updated: 28 October 2026.

Data and sources

We process information you supply when buying, creating an account, contacting customer service or subscribing: identity, contact details, addresses, order references and contents, payment and delivery information, messages and supporting documents. Technical browsing and security data may include IP addresses and connection logs. Payment or tracking information may also come from the relevant providers. Do not send unnecessary sensitive data, including in messages or personalisation requests.

Purposes and legal grounds

Account and order management, payment, delivery and after-sales support rely on the contract or pre-contractual steps you request. Invoicing and accounting or regulatory duties rely on legal obligations. Security, fraud prevention and defending our rights rely where appropriate on our legitimate interest in protecting the shop and transactions, taking your rights into account. Newsletters and other consent-based communications depend on your choice; you may unsubscribe. Processing necessary for an order does not require marketing consent.

Consent and required data

Merely visiting the site or reading this policy does not consent to all processing. Where required, consent must be freely given, specific, informed and active. You may withdraw it without affecting earlier lawful processing. Data necessary for the contract is identified as such; without it we may be unable to fulfil the order. Optional information must not be presented as compulsory.

Recipients

Necessary data may be accessed by authorised staff and relevant hosting, maintenance, payment, delivery, accounting, customer service, customer review or chosen communication providers, depending on the services used and applicable legal grounds. Authorities or advisers may receive data where legal duties or defending rights justify it. Only information needed for their tasks should be disclosed.

Retention

Data must not be kept beyond the time required for each purpose. Account data is kept while the account is used and then for justified follow-up or legal defence needs. Orders, invoices and accounting records are retained under applicable legal duties and limitation periods; deleting an account does not erase records subject to mandatory retention. Correspondence is kept to handle the request and any necessary dispute. Marketing data is kept until consent is withdrawn or you object, subject to records needed to honour that choice and prove consent. Technical logs must be retained for a period proportionate to security and diagnostics.

Providers and international transfers

Some third-party services may involve processing outside the European Economic Area. Any such transfer must use an applicable legal mechanism, including an adequacy decision or standard contractual clauses with any necessary supplementary safeguards. You may request details of recipients, countries, retention and safeguards applicable to your data, and a copy of accessible safeguards, using the contact above.

Your rights

Subject to GDPR conditions, you may request access, rectification, erasure, restriction and portability, and object to certain processing. You may object to direct marketing at any time and withdraw consent where processing relies on it. Write to the contact above describing your request. Proportionate identity evidence may be requested only in case of reasonable doubt; a full identity card copy is not systematically required. We normally reply within one month, with a reasoned extension where legally permitted.

Complaints and security

You may complain to the Belgian Data Protection Authority: www.autoriteprotectiondonnees.be. Other applicable remedies remain available. Appropriate technical and organisational measures must protect data; this policy does not exclude GDPR duties or liability.

Cookies and similar technologies

Strictly necessary cookies support functions such as sessions and shopping baskets. Non-essential trackers requiring consent may only be placed or read after a valid choice. Continuing to browse is not consent. Accepting and refusing must be equally accessible, and subsequent withdrawal must be possible. Browser settings can delete some cookies but do not replace the site’s prior consent requirement. Active tracker names, providers and durations must be disclosed in cookie management information and kept up to date.