Privacy Policy
Aspilon Cosmetics collects only what we need to run the site, process your orders, and, if you opt in, send you email.
EU Responsible Person
EU Responsible Person (as per EU Cosmetics Regulation EC 1223/2009): Matthias De Potter, Aspilon Cosmetics BV, Oktrooiplein 1, Bus 201, 9000 Gent, Belgium.
What we collect
Account & order data: your name, shipping address, email address, and the items you order. We keep this as long as legally required for invoicing and returns.
Browsing data: pages you visit, products you look at, and, only with your analytics consent, a randomly-generated device identifier so we can measure aggregate site usage.
Marketing data: only the email address and preference you give us when you subscribe. Unsubscribe one-click at any time.
Cookies & analytics
We use strictly necessary cookies for the cart, login, fraud prevention, and the consent decision itself. These are always on.
Analytics and marketing cookies only fire after you accept them via our cookie banner. Change your mind any time from the footer link.
Tracking tools we use (only with consent)
Analytics: Google Analytics 4 (GA4) for aggregate site usage, and PostHog for product analytics including pseudonymous session recording (passwords + payment fields are masked at the recording stage so they never reach our analytics; recordings are auto-deleted after 30 days).
Marketing measurement & remarketing: Google Ads conversion tracking + remarketing audiences, Meta (Facebook) Pixel, TikTok Pixel. These help us measure ad performance and stop showing irrelevant ads to people who already bought.
Tag management: Google Tag Manager hosts the above tags so we can update them without re-deploying the site. GTM itself only loads when at least one of analytics or marketing consent is granted.
Server-side error monitoring: Sentry for application crash reports. No PII fields are forwarded; Sentry collects the URL path, browser type, and error trace.
Data retention
Order + invoice data: 7 years (Belgian fiscal-law retention requirement for commercial bookkeeping).
Customer accounts: kept until you ask us to delete them, or after 3 years of inactivity (no orders, no logins).
Marketing consent: kept until you withdraw it (one-click unsubscribe in every email).
Analytics events: aggregated continuously in GA4 with 14-month event-level retention; raw event ledger on our own infrastructure auto-purged after 12 months.
PostHog data: auto-deleted after 30 days.
Your rights (EU / UK)
You can access, correct, or delete your data by emailing [email protected]. We respond within 30 days.
You have the right to data portability: on request we provide your account data in a machine-readable format (JSON or CSV).
You can object to any marketing email with a one-click unsubscribe in every message.
You can withdraw analytics or marketing consent at any time with no impact on your account or orders.
You have the right to lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit) at gegevensbeschermingsautoriteit.be.
Data sharing
We share the minimum required with: our payment processor (Stripe), our fulfilment partner (ShopWeDo), our transactional email provider (Resend), our marketing-email provider (Klaviyo), and, only with your consent, aggregate measurement tools (Google Analytics 4, Google Ads, Meta, TikTok, PostHog).
All processors are contracted under GDPR-compliant Data Processing Agreements. Processor list available on request.
We never sell personal data to third parties.
Contact
Data protection concerns + general support: [email protected].
Postal: Áspilon Cosmetics BV, Oktrooiplein 1, Bus 201, 9000 Gent, Belgium. VAT BE1020.265.004.