Privacy Policy
Koffie St.-Michel NV – www.stmichel.be
Version 1.0 – last updated on 31 August 2026
1. Who is responsible for your data?
Koffie St.-Michel NV attaches great importance to the protection of your personal data and to your privacy. This privacy policy explains which personal data we collect when you visit our website www.stmichel.be, use our webshop or contact us, why we do so, how long we keep that data and what rights you have.
The controller is:
- Koffie St.-Michel NV
- Asiadok-Noordkaai 28A, 2030 Antwerp, Belgium
- Company / VAT number: BE 0406.919.552
- Telephone: +32 3 234 34 70
- E-mail: info@stmichel.be
For any question about this privacy policy or about the processing of your personal data, you can reach us at the address above or by e-mail at info@stmichel.be.
2. Who does this policy apply to?
This privacy policy applies to everyone whose personal data we process, in particular:
- visitors to our website and our webshop;
- customers and prospects, as well as the contact persons and employees of our business customers;
- suppliers, subcontractors and their contact persons;
- people who contact us through the contact form, by e-mail or by telephone.
Where we provide services on behalf of a business customer and process data in the name and on behalf of that customer, Koffie St.-Michel NV acts as a processor, and the instructions and privacy policy of that customer apply in the first place.
3. Which personal data do we process?
We only process the data we need. Depending on your relationship with us, this concerns the following categories:
- Identification and contact details: surname and first name, job title, company name, address, e-mail address, telephone and mobile number.
- Customer and contract data: quotations, orders, delivery addresses, equipment installed or provided on loan, service and intervention history, water filter follow-up, correspondence.
- Invoicing and payment data: VAT number, invoices and credit notes, payment status, bank account number. We never store your card details: online payments are handled directly in the secure environment of our payment service provider Mollie B.V.
- Webshop account data: user name, encrypted password, order history and preferences.
- Data from your communication with us: the content of your message sent through the contact form, e-mails, telephone notes and complaints.
- Technical and usage data of the website: IP address, browser and device type, language setting, pages visited, date and time of the visit, and data collected through cookies (see section 5).
Most data is provided directly by you. We may also obtain data through the employer or organisation you work for, or through public sources such as the Belgian Crossroads Bank for Enterprises, the Belgian Official Gazette, public procurement publications or your own website.
4. Why do we process your data and on what legal basis?
We process your personal data only for specified purposes and always on a legal basis set out in Article 6 of the General Data Protection Regulation (GDPR):
| Purpose of processing | Legal basis | Retention period |
|---|---|---|
| Answering questions submitted through the contact form, by e-mail or by telephone | Our legitimate interest in answering questions from (potential) customers, or taking steps at your request prior to entering into a contract | Up to 2 years after the last contact |
| Preparing quotations and managing the customer and supplier relationship | Performance of the contract or pre-contractual measures | Duration of the relationship + 10 years |
| Processing webshop orders, delivery and follow-up | Performance of the contract | Duration of the relationship + 10 years |
| Installation, maintenance, repair and filter follow-up of coffee machines and water installations | Performance of the contract | Duration of the contract + 10 years |
| Managing your webshop account | Performance of the contract | Until you delete your account, and a maximum of 1 year thereafter |
| Invoicing, accounting and compliance with tax and accounting obligations | Legal obligation | 7 years from the close of the financial year; invoices and accounting records 10 years |
| Participation in public procurement procedures and management of tender files | Legal obligation and our legitimate interest in being able to substantiate our tenders | At least 10 years after award |
| Sending commercial information, news and offers | Your consent, or our legitimate interest in informing existing business customers about similar products and services | Until you unsubscribe, and at the latest 3 years after your last interaction |
| Security, troubleshooting and improvement of the website | Our legitimate interest in offering a secure and well-functioning website | Log files: maximum 12 months |
| Analytical and marketing cookies | Your consent | See section 5 |
| Establishing, exercising or defending legal claims, for example in the event of a dispute or non-payment | Our legitimate interest in safeguarding our rights | Until the end of the proceedings and the applicable limitation period |
Where we rely on a legitimate interest, we have assessed beforehand that this interest does not override your rights and freedoms. You may object to such processing (see section 9).
Where we rely on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing carried out before the withdrawal.
5. Cookies
Our website uses cookies and similar techniques. Cookies are small text files placed on your device when you visit the website and may contain information about your browsing behaviour.
We distinguish between:
- Necessary cookies: required for the website and webshop to function, for example to remember your shopping basket, your language choice and your login, and to keep the website secure. No consent is required for these cookies.
- Functional cookies: improve ease of use, for example by remembering your preferences.
- Analytical cookies: give us anonymised or pseudonymised insight into how the website is used, so that we can improve it.
- Marketing and social media cookies: allow advertisements to be tailored to your interests and social media content (Facebook, LinkedIn, Instagram) to be displayed or shared.
On your first visit, a cookie banner asks for your consent for all non-essential cookies. You can adjust or withdraw your choice at any time through the settings in the cookie banner, or through your browser settings, where you can also delete cookies that have already been placed. Refusing cookies may cause certain parts of the website to work less well.
Non-essential cookies are stored for a maximum of 13 months; after that we ask for your consent again.
6. Who do we share your data with?
We never sell your personal data and do not pass it on to third parties for their own commercial purposes. We share your data only where necessary, with:
- Are Agency, which builds and maintains our website and webshop, and our hosting provider;
- Mollie B.V. (Keizersgracht 126, 1015 CW Amsterdam, the Netherlands), our payment service provider for online payments;
- carriers and courier services, for the delivery of your order;
- our IT suppliers, our ERP partner and the providers of our e-mail and document environment;
- our technicians and, where applicable, subcontractors who visit your premises for installation, maintenance or repair;
- our accountants, auditor, insurers, lawyers and, in the event of non-payment, debt collection agencies;
- public authorities and contracting authorities, where we are legally obliged to do so or in the context of a public contract.
With every party that processes data on our behalf, we conclude a data processing agreement setting out arrangements on confidentiality, security and the limitation of use to our instructions.
7. Transfers outside the European Economic Area
In principle, your data is processed within the European Economic Area (EEA). Where one of our service providers nevertheless processes data outside the EEA, for example when using cloud services, we ensure that this takes place on the basis of a valid transfer mechanism under the GDPR: an adequacy decision of the European Commission or the standard contractual clauses approved by the European Commission, supplemented where necessary by additional safeguards. You may request a copy of these safeguards from us.
8. How do we protect your data?
We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. These include a secure connection (SSL/TLS) on our website, access management ensuring that data is only accessible to employees who need it for their role, firewalls, virus protection, regular backups and confidentiality undertakings for our staff.
Should a personal data breach nevertheless occur that is likely to result in a risk to your rights and freedoms, we will notify the Belgian Data Protection Authority within 72 hours and, where the law requires it, also notify you.
9. What are your rights?
Under the GDPR you have the following rights:
- Right of access: you can ask which personal data we process about you and obtain a copy of it.
- Right to rectification: you can have inaccurate or incomplete data corrected or completed.
- Right to erasure: in certain cases you can request the deletion of your data, for example when it is no longer necessary or when you withdraw your consent.
- Right to restriction of processing: you can request that processing be temporarily suspended, for example while the accuracy of your data is being verified.
- Right to object: you can object to processing based on our legitimate interest. You can always object to direct marketing, without having to give reasons.
- Right to data portability: you can receive the data you provided to us in a structured, commonly used and machine-readable format, or have it transmitted to another controller.
- Right to withdraw your consent, where processing is based on consent.
- Recht om een klacht in te dienen bij de toezichthoudende autoriteit (zie punt 10).
10. How can you exercise your rights?
You can exercise your rights by sending a request by e-mail to info@stmichel.be or by post to Koffie St.-Michel NV, Asiadok-Noordkaai 28A, 2030 Antwerp, Belgium, stating which right you wish to exercise.
To avoid disclosing data to the wrong person, we may ask you to prove your identity, for example with a copy of the front of your identity card on which you have obscured your national register number and your photograph.
We will respond to your request within one month of receipt. In the case of complex or numerous requests, this period may be extended by two months; we will inform you of this within the first month. Exercising your rights is free of charge.
If you are not satisfied with the way we handle your data or your request, please let us know first. You also always have the right to lodge a complaint with the Belgian supervisory authority:
- Data Protection Authority (Gegevensbeschermingsautoriteit)
- Drukpersstraat 35, 1000 Brussels, Belgium
- Tel.: +32 2 274 48 00 – E-mail: contact@apd-gba.be
- www.dataprotectionauthority.be
You can also bring the matter before the court of your place of residence.
11. Minors
Our website and webshop are not aimed at minors. We do not knowingly collect data from persons under the age of 16 without the consent of a parent or guardian. If you believe that we nevertheless process such data, please contact us at info@stmichel.be and we will delete it as soon as possible.
12. Changes to this privacy policy
We may amend this privacy policy, for example when our services, our website or the applicable legislation change. The most recent version is always available at www.stmichel.be. In the event of significant changes, we will inform you actively. The date of the last update is stated at the bottom of this policy.
