In short
- We use the personal data you send us, the data we need to run merchants' shops, and the public business contact details we use to introduce our service to businesses.
- No analytics, no advertising cookies, no sale of data. We do not store your IP address.
- For the customers of the shops we run, the merchant decides how their data is used; we process it on the merchant's behalf.
- When we write to a business, a person checks and approves every message, and a single reply stops them.
- To exercise your rights, write to privacy@addyour.shop.
This summary does not replace the policy below.
1. Who we are
SBrusse SRL, a private limited company under Belgian law, with its registered office at Rue Auguste Baccus 14, boîte 2, 1350 Orp-Jauche, Belgium (enterprise number 0644.917.861), provides the Add Your Shop service and publishes addyour.shop. We are the controller of the personal data described in this policy, unless we say otherwise.
For any question about your personal data, write to privacy@addyour.shop or to the postal address above. We have not appointed a data protection officer, as we are not required to; your message reaches the person responsible for data protection.
2. Who this policy covers
This policy applies to the personal data of:
- people who visit addyour.shop;
- people who contact us or ask us to set up a shop, through our forms, by email or by phone;
- the contact persons and staff of the businesses that use Add Your Shop (“merchants”);
- the people at businesses we contact to present our service;
- people who report content to us.
If you buy from a shop that we run for a merchant, the merchant is responsible for your data: see section 5.
3. What we use, why and for how long
| Purpose | Personal data | Legal basis (GDPR) | How long |
|---|---|---|---|
| Delivering the website securely and in your language | IP address, browser and device information, pages requested, date and time, the country that Cloudflare derives from your IP address, your browser's language preferences | Legitimate interests (art. 6(1)(f)): running a secure website and showing it in the right language | We store none of it: request logging in our hosting code is switched off, and the country and language preferences are used only at the moment of your request (see below). Cloudflare's own processing is described in section 6. |
| Remembering your language choice | The language you chose, stored in the ays_lang cookie | Legitimate interests (art. 6(1)(f)); the cookie is set only when you choose a language (see our Cookie policy) | 12 months, or until you delete the cookie |
| Answering your enquiries and requests for a shop | Name, business name, email address, phone number (optional), website, trade, country and message; the page language and type of form; date and time; the result of a simple anti-spam check. Also the emails and calls we exchange. | If you contact us about a shop for your own business as a sole trader: steps taken at your request before entering into a contract (art. 6(1)(b)). In other cases: our legitimate interest in answering you and in dealing with the business you represent (art. 6(1)(f)) | Up to 3 years after our last exchange if no contract follows. If you become a merchant, the next row applies. |
| Providing the service to merchants | Names, roles, email addresses and phone numbers of contact persons; business details (legal name, address, company and VAT numbers); Stripe account identifier; Shop settings; commission and invoicing records; correspondence and support requests | Performance of the contract (art. 6(1)(b)) where you are the merchant yourself, for example as a sole trader; otherwise our legitimate interest in performing our contract with the business you work for (art. 6(1)(f)). Legitimate interests (art. 6(1)(f)) for service messages and security | For the duration of the contract, then up to 5 years to answer questions and deal with possible claims. Accounting records: see below. |
| Introducing our service to businesses (business-to-business prospecting) | Business name, trade, website, address, business email address and phone number; name and role of a contact person where the business publishes them; public information about the business and its products that we use to write a relevant message; our contact history and your preferences | Legitimate interests (art. 6(1)(f)): presenting to businesses a service that is relevant to their trade | Up to 3 years after our last contact. If you object, see section 4. |
| Case studies and references, if you agree | Your name, business, quotes and photos that you approve | Your consent (art. 6(1)(a)), which you can withdraw at any time | Until you withdraw your consent |
| Accounting and tax obligations | Invoices, commission statements, payment records and related correspondence | Legal obligation (art. 6(1)(c)) | 10 years after the end of the financial year concerned, as required by Belgian tax law (Income Tax Code 1992, art. 315; VAT Code, art. 60); Belgian accounting law requires 7 years (Code of Economic Law, arts III.86 and III.88) |
| Security, reports of illegal content and legal claims | Name and email address of people who report content, the report and our decision; security logs of our tools; information needed to establish or defend legal claims | Legal obligation (art. 6(1)(c)), including under the Digital Services Act; legitimate interests (art. 6(1)(f)) in protecting our service and our rights | Up to 3 years after the matter is closed, or longer if legal proceedings require it |
How we choose the language of a page
When you open one of our English pages without having chosen a language, we look at your browser's language preferences: if the first language it lists that we publish is French, you are sent to the French version of the page. We never redirect you because of where you are. If Cloudflare locates your connection in France, Monaco or a French overseas territory (from your IP address, at that moment), we only add a short banner offering the French version; following its links sets the language cookie described in our cookie policy. If you have chosen a language, your choice applies instead. Search engines and other automated programs are never redirected. Nothing about this is stored.
Our forms
Requests sent through our forms are stored in our database at Cloudflare (Cloudflare D1), located in Western Europe, with the date and time, the page language, the type of form and a processing status. We do not store your IP address or browser information. Each request is also emailed to our company mailbox, hosted by Google Workspace. Two simple checks filter automated submissions: a request in which a hidden field, invisible to people, has been filled in is discarded without being stored; a request sent within three seconds of the page loading is stored with the status “suspect” and is not emailed.
The box you tick on our forms confirms that you have read this policy and that you want us to reply. It is not the legal basis of the processing, which is set out in the table above, and it is not a consent to marketing: we use your details only for the purposes above.
4. How we contact businesses
We introduce Add Your Shop to independent businesses that could benefit from it, such as bakeries, wine shops, florists, farms and makers.
- Where the data comes from: public sources only: the business's own website; open databases and directories of businesses, such as OpenStreetMap, the French BANCO and DATAtourisme databases and Overture Maps; published lists of businesses holding a label, such as Entreprise du patrimoine vivant or Haute Valeur Environnementale; online business listings, such as Google Maps; and, occasionally, other public pages about the business, such as press articles. We only use details that the business publishes for its business.
- How we prepare our messages: we read the business's website, with the help of AI tools that summarise it and suggest a first draft. A person checks every message and approves it before it is sent. These tools do not make decisions about you.
- What we send: a message presenting our service, which is related to your trade. Every message identifies us, links to this policy and tells you how to opt out.
- Electronic marketing rules: we follow the rules of the country where you are established:
- Belgium: we write only to companies and other legal persons, at an impersonal address such as info@ or contact@, unless you have agreed to hear from us (Code of Economic Law, art. XII.13; Royal Decree of 4 April 2003, art. 1);
- France: we write only to professional addresses, about a service related to your trade (Code des postes et des communications électroniques, art. L34-5, as applied by the CNIL);
- United Kingdom: we write only to corporate subscribers, such as limited companies and LLPs, and not to sole traders or partnerships unless they have agreed (Privacy and Electronic Communications Regulations 2003, regulation 22).
- Your right to object: you can object at any time, without giving a reason and free of charge, by replying to our message or by writing to privacy@addyour.shop. We stop immediately.
- Do-not-contact list: when you object, we keep only your email address or website address, with the date of your request, on a do-not-contact list, so that we never contact you again. We keep it for as long as we contact businesses, since deleting it would mean that we could write to you again.
5. Customers of the shops we run
When you order from a shop that we run for a merchant, the merchant is the controller of your personal data (your name, contact details, delivery address and order) and decides how it is used. We process it only on the merchant's behalf and on its instructions, under our Data processing agreement.
The merchant's own privacy notice explains how your data is used. To exercise your rights, contact the merchant; if you contact us, we forward your request to the merchant. Payments are processed by Stripe, as described in Stripe's privacy policy.
6. Who receives personal data
Only the people on our team who need it can access personal data, and they are bound by confidentiality. We also use the following providers, which act on our instructions unless stated otherwise:
- Cloudflare, Inc. (United States): hosting of the website and of the shops, content delivery and security, our form database (located in Western Europe), file storage and email routing. Cloudflare also uses some connection data for its own purposes, such as securing its network, as an independent controller: see Cloudflare's privacy policy.
- Google Ireland Limited (Ireland), through Google Workspace: our company mailbox, which receives the requests sent through our forms and the emails sent to our addresses.
- OVH SAS – OVHcloud (France): registration of our domain names, and the mailboxes from which we send our business emails.
- Hetzner Online GmbH (Germany): the server that hosts the database and tools we use to prepare our messages to businesses.
- Mega Limited (New Zealand): storage of the backups of that server.
- Anthropic (United States): the AI assistant that helps us research the public information about a business and draft our messages.
- Stripe: payment processing for merchants, and collection of our commission. For some purposes, such as fraud prevention and legal compliance, Stripe acts as an independent controller.
We may also share personal data with our accountant and legal advisers, who are bound by professional secrecy; with authorities and courts where the law requires it; and with a buyer or successor of our business, who would have to protect it in the same way.
We do not sell personal data, and we do not share it for advertising.
7. Transfers outside Europe
Cloudflare, Google, Stripe and Anthropic may process personal data in the United States. Cloudflare, Google and Stripe are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognised as providing adequate protection (Implementing Decision (EU) 2023/1795 of 10 July 2023), and their data processing terms also provide for the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914). Anthropic's data processing addendum incorporates those standard contractual clauses. Mega Limited is established in New Zealand, which the European Commission recognises as providing adequate protection (Decision 2013/65/EU). For data covered by UK data protection law, the UK Extension to the Data Privacy Framework, the UK addendum to the standard contractual clauses and the UK's adequacy regulations apply.
OVHcloud and Hetzner process our data in the European Union. You can ask us for a copy of the safeguards that apply to a transfer.
8. How we protect data
All connections to our website and to the shops we run are encrypted (HTTPS). Our databases at Cloudflare are encrypted at rest, we do not store IP addresses, access to personal data is limited to the people who need it, and card details are handled only by Stripe. Our security page explains more.
9. Your rights
Under the GDPR (and the UK GDPR where it applies), you have the right to:
- access your personal data and receive a copy (art. 15);
- have inaccurate data corrected (art. 16);
- have your data erased, for example when we no longer need it (art. 17);
- restrict the processing of your data, for example while we check a request (art. 18);
- receive the data you provided to us in a structured, machine-readable format, or have it sent to another organisation (portability, art. 20);
- object to processing based on our legitimate interests, for reasons relating to your situation, and at any time and without giving a reason to the use of your data for prospecting (art. 21);
- withdraw your consent at any time where we rely on it, for example if you agreed to appear in a case study (art. 7(3)).
If you live in France, you can also give us instructions about what should happen to your personal data after your death (article 85 of the French Loi Informatique et Libertés).
To exercise your rights, write to privacy@addyour.shop. It is free. We reply within one month; for complex or numerous requests, this can be extended by two more months, in which case we tell you why. If we have reasonable doubts about your identity, we may ask you for information to confirm it.
10. Complaints
If you are not satisfied with how we handle your data, please tell us first so that we can put it right. You also have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work or where you believe the infringement took place:
- Belgium (our lead supervisory authority): Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels; +32 2 274 48 00; contact@apd-gba.be; complaint form at autoriteprotectiondonnees.be (in French, Dutch or German).
- France: Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, 75007 Paris; +33 1 53 73 22 22; cnil.fr/fr/plaintes.
- United Kingdom: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; 0303 123 1113; ico.org.uk/make-a-complaint.
You can also take legal action before the courts.
11. Other information
- Automated decisions: we do not make decisions based solely on automated processing, including profiling, that produce legal effects for you or similarly significantly affect you. The AI tools we use to prepare messages to businesses only assist a person, who decides.
- Cookies: our website sets one functional cookie, only when you choose a language, and uses no analytics or advertising cookies. See our Cookie policy.
- Required information: on our forms, your name, business name and email address are needed for us to reply, and so is your website on the get-started and partner forms; your phone number and message are optional. Merchants must give us the information needed to conclude and perform the contract and to invoice; without it, we cannot provide the service.
- Children: our services are intended for businesses and are not aimed at children.
12. Changes to this policy
We update this policy when our practices or the law change. The version number and effective date at the top of the page show the current version. If a change significantly affects how we use merchants' data, we tell merchants by email.