Privacy policy

Orders and bookings: name, email, telephone, delivery or tasting address, order contents, allergies or any details you provide to us. Legal basis: performance of the contract.

Event registrations: name, email, telephone, chosen package and number of guests. Legal basis: performance of your registration.

Allergies and intolerances (orders, tastings, events): these are health data. We only process them with your explicit consent (Article 9(2)(a) GDPR), given by entering them, and solely to prepare what we serve you. They are erased automatically one month after the event or tasting, and you can ask us to erase them sooner.

Newsletter: email, language and proof of your consent (sign-up date and IP address, confirmation through the link sent by email). Legal basis: your consent. Every mailing contains an unsubscribe link.

Customer account: email and encrypted password, managed by our service provider Supabase. Legal basis: performance of the contract.

Contact messages: name, email, optional telephone number and message content. Legal basis: legitimate interest in responding to your enquiries.

Business prospecting: the business’s name, address, telephone number and generic email address (info@, contact@…) published by the business itself on its website or public pages, and our exchanges with it. We never approach an email address in a person’s name. Every message identifies GaLo Consulting and offers an unsubscribe link, honoured immediately. Legal basis: legitimate interest in introducing our products to local businesses.

Invoicing and accounting: sales-related documents are retained for the periods required by Belgian law. Legal basis: legal obligation.

Payments are processed by Stripe. We never see or store your bank card details: they are sent directly to Stripe, a PCI-DSS Level 1 certified provider.

We keep only the transaction reference, which is needed to track the order and to process any refund.

Netlify (website hosting), Supabase (database and accounts, European infrastructure), Stripe (payment), mailprotect.be (the domain’s mail server, through which confirmation emails are sent).

Anthropic (analysis of the purchase documents we upload to our management tool, translation of the website’s texts, research of local businesses and preparation of our prospecting emails, always reviewed before sending): no data from your orders, bookings or registrations is sent to it.

Google (Customer Reviews programme): after a paid order, the confirmation page sends Google the order number, your email address, the delivery country and an estimated delivery date, so that you can be invited to review your purchase. Taking part is optional: Google only sends you the survey if you accept it in the window that appears. Legal basis: legitimate interest in gathering our customers’ feedback; Google’s processing is governed by its own privacy policy.

Our accountant and their accounting software Falco receive sales invoices, which bear the customer’s name. Legal basis: legal obligation.

Netlify, Stripe, Anthropic and Google are based in the United States or transfer data there. Any transfers of data outside the European Union are covered by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses.

No data is sold, rented or passed on for advertising purposes.

To know which pages are viewed and whether our forms work, the website itself records, without cookies or trackers and without any third-party service, the page viewed, the site you came from (for example Facebook or Google), the language, the type of device (phone, tablet or computer), the country, and anonymous actions such as adding to the basket or clicking “Sign up”.

Your IP address is never kept: combined with a secret key renewed every day and then destroyed, it is used only to avoid counting you twice on the same day. This data cannot identify you, is not passed on to anyone and is kept for 90 days in our Supabase database (European Union); only daily totals are kept afterwards. If your browser sends the “Do Not Track” or “Global Privacy Control” signal, nothing is recorded. Legal basis: our legitimate interest in knowing how our website is used (Article 6(1)(f) GDPR); you may object at any time by enabling that signal or by writing to us.

Order data: the statutory retention period for accounting records.

Event registrations: one year after the event, except data linked to a payment, which is kept for the accounting retention period.

Newsletter: until you unsubscribe, then erased within 30 days; a sign-up never confirmed is erased after 30 days.

Customer account: until it is deleted at your request.

Contact messages: three years from the last exchange.

Business prospecting: a record never contacted is erased after six months, others three years after the last exchange; for an unsubscribed address only the address itself is kept, so that it is never contacted again.

Visitor statistics: 90 days for the detail, daily totals afterwards.

You have the right of access, rectification, erasure, restriction, objection and portability. Write to info@sungura.be: we respond within one month.

Where processing is based on your consent (newsletter, allergies), you can withdraw it at any time, without affecting the processing carried out before the withdrawal.

You may lodge a complaint with the Data Protection Authority, Rue de la Presse 35, 1000 Brussels.

This website uses no advertising cookies and no third-party audience measurement cookies.

Only cookies that are strictly necessary for the website to function are set: keeping your session active while you are logged in, and remembering your chosen language (the ‘SUNGURA_LANG’ cookie, kept for one year) when you switch language. Your basket is stored in your browser’s local storage and is never sent to us before the order is confirmed.

Fonts and all other website resources are served by our own website: your visit sends no request to Google, Facebook or any other third-party service. The only exceptions: the shop pages and the confirmation of a paid order display the Google merchant badge (our store rating), and the confirmation of a paid order also loads the Google Customer Reviews module described above; Google may then set its own cookies.