Skip to content

Subscription: 10 % off every delivery 🐾

Try risk-free: free returns for 14 days ↩️

Free delivery from €19 📦

Privacy policy

CPRO FOOD – operated by CERAL S.A. · Scope: cprofood.com

Thank you for your interest in our online shop. Protecting your personal data is a priority for us. Below, we inform you about the personal data we collect when you use our shop, the purposes for which we process it, and the rights you have.

1. Controller

The controller within the meaning of the GDPR is:

CERAL S.A.

Rue des Héros 38, 4431 Loncin, Belgium

Company registration number (BCE/KBO): BE0427.291.334

Email: info@cprofood.com

Legal representatives: Marco Hierling & Christian Maerzke

1.1 Data protection contact

For any questions relating to data protection and the exercise of your rights, you can contact us at: datenschutzbeauftragter@proliance.ai.

When contacting us, please indicate the company concerned (CPRO FOOD / CERAL S.A.). Please do not attach sensitive information to your request (e.g. a copy of your identity document).

1.2 Data Protection Officer (DPO)

We have appointed a Data Protection Officer. You can contact them at: PROLIANCE GmbH, www.proliance.ai Leopoldstr. 21, 80802 Munich, Germany, datenschutzbeauftragter@proliance.ai.

2. General information on personal data processing

We process personal data only to the extent necessary to provide the online shop, perform the contract, comply with legal obligations, or on the basis of your consent or our legitimate interests. The legal bases include, in particular, Art. 6(1)(a) (consent), (b) (contract), (c) (legal obligation) and (f) (legitimate interest) of the GDPR.

Origin of personal data: as a rule, we process personal data that you provide to us yourself (e.g. when placing an order, creating an account or contacting us). In some cases, we also receive personal data from other sources. If you provide us with personal data concerning third parties, please ensure that those persons are informed and, where applicable, have consented.

3. Website visit & hosting (Shopify)

Our online shop is operated via the Shopify platform (Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland). When you visit the site, technically necessary personal data (e.g. IP address, date/time, pages viewed, browser/device information) is processed in server logs. The legal basis is our legitimate interest in the secure and uninterrupted operation of our website (Art. 6(1)(f) GDPR) — see Section 3.1 for details.

Shopify processes personal data on our behalf (processor within the meaning of Art. 28 GDPR). Personal data may also be transferred to third countries outside the EEA (in particular the United States). The specific recipients, processing locations and safeguards (adequacy decision / EU-US Data Privacy Framework and/or standard contractual clauses) are set out in Section 9.

Shopify's dual role: for operating the shop, Shopify acts as a processor (Art. 28 GDPR). In addition, we use certain advanced Shopify features ("enhanced features") that link personal data from your interactions with our shop – and, across merchants, with Shopify (e.g. accelerated checkout with Shop Pay, platform-wide fraud prevention, personalised features). Where Shopify processes personal data for its own purposes, Shopify is the controller for those purposes and is responsible for responding to your rights requests. For further details, see Shopify's consumer privacy policy; you may exercise certain rights vis-à-vis Shopify there, depending on your place of residence.

3.1 Server log files

When you visit the site, technically necessary connection data is processed in server log files:

  • date and time of the request;
  • name of the file requested and access status;
  • page from which the file was requested (referrer);
  • browser and operating system used;
  • IP address of the requesting device;
  • volume of data transferred.

This personal data is used to ensure a smooth connection, security and system stability, as well as for administrative purposes. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in security and operation). The personal data is deleted no later than after 90 days or anonymised by truncating the IP address.

3.2 Data security

For transmission in the customer area and at checkout, we use TLS/SSL encryption so that transmitted personal data (e.g. address and payment details) cannot be read by third parties. Payments are processed in accordance with European requirements (in particular PSD2 / strong customer authentication, PCI-DSS).

4. Processing in the order process and customer account

In the order process and customer account, we process your personal data for the following purposes:

  • Order fulfilment, customer account and contractual communication via Shopify – The processing is necessary for the execution of our contract with you (Art. 6(1)(b) GDPR).
  • Payment Processing: As part of your order, we process the data required to process the payment transaction. This includes the payment method selected by you, the invoice amount, the order number, the payment date and the payment status. We do not collect or store your full credit card details or payment account credentials at any time. We process this data for the following purposes:
    • Performance of the sales contract, in particular to allocate your payment to your order and to process returns and refunds. The legal basis is Article 6(1)(b) GDPR.
    • Compliance with statutory record-keeping obligations under accounting and tax law. The legal basis is Article 6(1)(c) GDPR.
    • Handling payment issues, chargebacks and disputes, and establishing, exercising and defending legal claims. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in protecting against payment defaults and enforcing our claims.

Retention period: Payment-related data that forms part of our accounting records is retained for the duration of the applicable statutory retention periods. In all other cases, we delete such data as soon as it is no longer required for the purposes stated above and provided that no statutory retention obligations require us to retain it.

  • Shipping and parcel tracking via Shopify Shipping and the carrier DPD – The processing is necessary for the execution of our contract with you (Art. 6(1)(b) GDPR).
  • Processing of your orders, deliveries and returns — We process your order, delivery and invoice data in order to accept and fulfil your order, reconcile payment, arrange delivery and handle returns, withdrawals and refunds. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). Invoice and accounting data are additionally retained to comply with our commercial and tax law retention obligations (Art. 6(1)(c) GDPR).
  • Customer service, ticketing, chat and telephony via Freshdesk, insofar as your enquiry relates to an order or a contract with us. This processing is necessary for the performance of our contract with you (Art. 6(1)(b) GDPR). Handling of general enquiries unrelated to an order via the same channels. This processing is based on our legitimate interest in responding to enquiries promptly, completely and in a traceable manner, and in providing a reliable customer service (Art. 6(1)(f) GDPR).
  • Subscriptions / recurring orders via Seal – The processing is necessary for the execution of our contract with you (Art. 6(1)(b) GDPR).

4.1 Payment providers in detail

If you select one of the payment methods listed below during the checkout process, we will transmit the data required for processing the payment to the respective service provider. The legal basis for this data transfer is Art. 6(1)(b) GDPR, as it is necessary for the performance of the payment method you have selected.

To the extent that these providers process data for their own purposes, they act as independent (data) controllers. In this regard, there is no joint controllership within the meaning of Art. 26 GDPR. We have no influence over this processing; the providers will inform you accordingly in their own privacy notices.

4.1.1 Shopify Payments

For processing card and digital wallet payments, as well as other payment methods offered at checkout, we use Shopify Payments, the payment service provided by our e-commerce platform.

  • Provider: Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland.
  • Payment Data Handling: You enter your payment details directly into the payment form. They are transmitted directly to the payment service; complete card details are neither collected nor stored by us.
  • Data Processed: First and last name, email address, billing and delivery address, and order-related data. If provided by you, additionally: company name, address line 2 / apartment details, and telephone number.
  • Purposes: Payment processing and fraud prevention.
  • Role: To the extent that Shopify processes customer payment data on our behalf, Shopify acts as a data processor. We have concluded a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR for this purpose.
  • Third-Country Transfers: Shopify transfers data to its Canadian parent company, Shopify Inc. This is based on the European Commission's adequacy decision for Canada pursuant to Art. 45 GDPR. Safeguards for further transfers to sub-processors pursuant to Art. 44 et seq. GDPR are established under the Data Processing Agreement concluded with Shopify.
  • Privacy Policy: shopify.com/legal/privacy

4.1.2 PayPal

  • Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.
  • Data Transfer: If you select payment via PayPal, the payment details you enter will be transmitted to PayPal.
  • PayPal's Purposes: Payment processing, payer identity verification, and fraud prevention.
  • Role: PayPal processes your payment data as an independent controller. PayPal does not act as our processor, and there is no joint controllership (Art. 26 GDPR).
  • Third-Country Transfers: PayPal also transfers data to affiliated companies outside the EU and EEA, in particular to the United States. Details on the safeguards implemented pursuant to Art. 44 et seq. GDPR can be found in PayPal’s privacy policy.
  • Privacy Policy: paypal.com/de/webapps/mpp/ua/privacy-full

4.2 Customer account / registration

You can create a customer account in our online shop. We process in particular:

  • first and last name (optionally title/salutation);
  • email address;
  • postal address;
  • date and time of registration;
  • password (stored in encrypted form).

Mandatory fields are indicated in the form. The processing of the necessary personal data is necessary for the execution of our contract with you (Art. 6(1)(b) GDPR); for voluntary information (e.g. telephone number), the processing is based on your consent (Art. 6(1)(a) GDPR). You can amend your account personal data after logging in under "My account" or contact us to request account deletion. Information on the retention period of your account data can be found in Section 10.

4.3 Contact & customer service

If you contact us by email, telephone, chat or contact form, we process your information (including name, email address, optionally telephone number and content of the enquiry) to handle your request. We use Freshdesk (Freshworks) for this purpose.

Where your enquiry relates to an order or a contract with us, the processing is necessary for the performance of that contract (Art. 6(1)(b) GDPR). For general enquiries without a link to an order, the processing is based on our legitimate interest in answering enquiries promptly, completely and traceably and in providing reliable customer service (Art. 6(1)(f) GDPR).

Enquiries with possible legal relevance or a contractual link may be retained until the applicable limitation periods expire (in Belgium, ten years for contractual claims, Art. 2262bis Civil Code), to the extent necessary for documentation or defence of rights, on the basis of our legitimate interest in documenting and defending against possible legal claims (Art. 6(1)(f) GDPR).

4.4 Shipping & logistics

In the context of order fulfilment, we pass the personal data necessary for delivery (name, delivery address, optionally telephone number and email address) to the carrier/logistics provider commissioned. The carrier processes the personal data exclusively to perform delivery. We process your personal data based on the execution of our contract with you (Art. 6(1)(b) GDPR).

Carrier used: DPD.

Pickup points: if you choose delivery to a pickup point or parcel locker, we use the app Atlas Pickup Points (Patryk Jakubik, Tale Commerce, Wyszyńskiego 7H/4, 05-200 Zielonka, Poland) to display nearby pickup points in the checkout. The address or postcode you enter is processed for this purpose, and the selected pickup point is transmitted to the carrier together with your order. The processing is necessary for the performance of our contract with you (Art. 6(1)(b) GDPR).

Delivery notification by email: if you expressly consent in the order process (Art. 6(1)(a) GDPR), we may pass your email address to the carrier before delivery in order to arrange a delivery slot or enable delivery notification.

Without consent: only name and delivery address are passed, to the extent necessary for delivery, based on the execution of our contract with you (Art. 6(1)(b) GDPR).

5. Newsletter & email marketing (Klaviyo)

For the newsletter and marketing emails, we use Klaviyo (Klaviyo Inc., USA). Sending takes place only with your consent using a double opt-in procedure: after you sign up, you receive a confirmation email with a link; only after confirmation do we add you to the mailing list. The legal basis of the processing is your consent (Art. 6(1)(a) GDPR).

When you sign up, in addition to your email address we record the IP address and the date and time of registration and confirmation in order to be able to prove consent (Art. 6(1)(f) GDPR). To measure effectiveness, our newsletters contain pseudonymous pixels/counters that evaluate opens and clicks. This processing is based on our legitimate interest in understanding how our newsletters are used and in improving their content (Art. 6(1)(f) GDPR). Klaviyo also processes personal data in the USA; for transfer safeguards (EU-US Data Privacy Framework and/or standard contractual clauses), see Section 9.

Role of Klaviyo: Klaviyo processes this personal data solely on our behalf and in accordance with our instructions – both when sending newsletters and transactional emails and for on-site tracking (see Section 7.1). Klaviyo therefore acts as our processor; we have concluded a data processing agreement pursuant to Art. 28 GDPR. Klaviyo does not pursue any purposes of its own in this context; there is no joint controllership (Art. 26 GDPR).

Transactional emails in the context of purchase or contract performance – in particular order confirmation and shipping confirmation – are also sent via Klaviyo on the basis of Art. 6(1)(b) GDPR (contract performance). These emails do not constitute advertising and are clearly distinguished from the promotional newsletter.

Invitations to review a completed purchase are treated as direct marketing (see Section 6).

5.1 Advertising to existing customers (soft opt-in)

If you have purchased goods or services from us and provided your email address, we may – within the legally permitted scope – use it to send you email advertising for our own similar products. This processing is based on our legitimate interest in informing existing customers about our own similar products (Art. 6(1)(f) GDPR). We already informed you of this use when collecting your email address; you may object at any time free of charge – via the unsubscribe link in each email or by contacting us. After your objection, we no longer use your email address for direct marketing. This also applies to profiling related to direct marketing.

6. Customer reviews & surveys

To collect product/shop reviews and conduct surveys, we use REVIEWS.io and KnoCommerce. An invitation to review a purchase you have made is sent – where the legal conditions for "soft opt-in" are met – on the basis of our legitimate interest in obtaining feedback on our products and our shop (Art. 6(1)(f) GDPR), provided that you may object at any time free of charge to the use of your email address for this purpose. Review and survey emails going beyond this (e.g. without a link to a specific purchase) are sent only with your consent (Art. 6(1)(a) GDPR).

7. Cookies, tracking & analytics

We use cookies and similar technologies. Strictly necessary cookies are required to operate the shop; the legal basis is our legitimate interest in the functional and secure operation of our shop (Art. 6(1)(f) GDPR); no consent is required for them (see Section 7.2). All non-essential cookies as well as analytics, marketing and testing services are used only with your consent (Art. 6(1)(a) GDPR). You manage your consent via our cookie banner.

Consent management: Pandectes GDPR Cookie Compliance.

You can change your cookie settings via the "Cookie settings" link in the footer of every page (see Section 7.2).

You can also manage cookies in your browser (information, blocking, deletion). Please note that disabling strictly necessary cookies may limit shop functionality.

7.1 Services used (overview by purpose)

Depending on purpose, we use in particular the following services:

  • Web analytics, tag management and server-side tracking via Google Analytics 4, Google Tag Manager and Elevar – based on your consent (Art. 6(1)(a) GDPR).
  • Behavioural analytics, heatmaps and session replay via Microsoft Clarity – based on your consent (Art. 6(1)(a) GDPR).
  • Attribution of orders to advertising channels via Klar – based on your consent (Art. 6(1)(a) GDPR).
  • Testing of different design variants of our shop via the native Shopify feature "Rollouts" – based on your consent (Art. 6(1)(a) GDPR).
  • On-site search, filters and product recommendations via Shopify Search & Discovery (native Shopify feature) – based on our legitimate interest in offering our customers a functioning and user-friendly search, filter and recommendation function so that they can quickly find suitable products (Art. 6(1)(f) GDPR).
  • Accessible use of our shop via the accessibility toolbar "All in One Accessibility" – based on our legitimate interest in providing an accessible online shop (Art. 6(1)(f) GDPR).
  • On-site tracking / CDP (behavioural personal data, site and email interactions, audiences, display of forms/pop-ups) via Klaviyo – based on your consent (Art. 6(1)(a) GDPR).
  • Advertising, conversion tracking and retargeting via Meta Pixel and Conversions API (deployed via GTM/Elevar) – based on your consent (Art. 6(1)(a) GDPR). We and Meta are joint controllers for the collection and transmission of the data (Art. 26 GDPR); for details, see "Joint controllership with Meta" in Section 7.3.
  • Conversion tracking and remarketing via Google Ads (deployed via GTM/Elevar) – based on your consent (Art. 6(1)(a) GDPR). For enhanced conversions, we transmit encrypted contact data, which Google processes on our behalf as our processor (Art. 28 GDPR). For its own purposes, Google is an independent controller. There is no joint controllership (Art. 26 GDPR).

Shopify Search & Discovery (on-site search): for search, filtering and product recommendations, we use the native Shopify feature "Search & Discovery". Your search queries, the filters you select and your interactions with the results are processed in order to display relevant results and suitable product recommendations. The legal basis is our legitimate interest in offering our customers a functioning and user-friendly search, filter and recommendation function so that they can quickly find suitable products (Art. 6(1)(f) GDPR). This processing is limited to what is technically necessary to provide these functions in our shop; no personal profile is created for advertising purposes. Processing takes place within the Shopify platform, which acts as our processor (Art. 28 GDPR; see Section 3).

Accessibility toolbar (All in One Accessibility): to make our shop easier to use for people with disabilities, we offer an accessibility toolbar provided by Skynet Technologies USA LLC. Your settings (e.g. font size, contrast, read-aloud function) are stored only locally in your browser. When the toolbar is loaded, the address of the page visited is transmitted to the provider; for users in the EU, this data is processed on servers within the EU. The legal basis is our legitimate interest in providing an accessible online shop (Art. 6(1)(f) GDPR).

Microsoft Clarity (behavioural analytics): to improve and secure our site, we use Microsoft Clarity (Microsoft Corporation, USA). Via cookies and similar technologies, Clarity collects usage and behaviour personal data (e.g. mouse movements, clicks, scrolling and navigation, pages visited, device/browser information, truncated IP address) and presents it as heatmaps and session replays. Microsoft may also use the collected personal data for its own purposes (in particular product improvement and advertising). Microsoft is an independent controller for these purposes; there is no joint controllership (Art. 26 GDPR). The legal basis is your consent (Art. 6(1)(a) GDPR), which you grant via our cookie banner. Transfer to the USA is possible (see Section 9). For further information, consult Microsoft's privacy policy.

Klaviyo (on-site tracking): in addition to sending newsletters and transactional emails (see Section 5), we use Klaviyo as a customer data platform for on-site tracking. Klaviyo sets its own cookies and similar technologies (e.g. pixels) and collects behavioural personal data – pages visited, products viewed, clicks and purchases, interactions with our emails – to link them to a profile, build audiences and personalise content. Klaviyo also controls the display of forms and sign-up elements (e.g. newsletter pop-ups) on our site. This processing takes place only with your consent (Art. 6(1)(a) GDPR), which you grant via our cookie banner. Klaviyo acts as our processor (Art. 28 GDPR) and does not pursue any purposes of its own; there is no joint controllership (see Section 5). Transfer to the USA is possible (see Section 9).

Klar (attribution of orders to advertising channels): we use the services of Klar Insights GmbH, Clemensstr. 2, 80803 Munich, Germany. We record how you reached our shop – for example via an advertisement, a search engine or a newsletter – and link this information to any order you subsequently place. This allows us to assess which of our marketing activities actually lead to sales and which do not, and to decide on this basis how to allocate our advertising budget. The following personal data is processed: the channel through which you reached our website, information about your orders with us, user and session IDs, IP address and online identifiers (cookie ID, device ID). No assessment of you as an individual and no automated decision-making in individual cases takes place. Klar acts as our processor (Art. 28 GDPR); we have concluded a data processing agreement with Klar. The following cookies are used: september_id (pseudonymous user ID), september_has_consent (stores your consent status) and september_do_not_track (set only if you opt out). The legal basis is your consent (Art. 6(1)(a) GDPR), which you grant via our cookie banner. You can permanently opt out of Klar via this link; this sets the cookie september_do_not_track on the domain cprofood.com. Please do not delete this cookie, as otherwise we cannot ensure that Klar no longer records your visits. Further information: https://app.getklar.com/legal/data-protection

Shopify Rollouts (testing design variants): to find out which design of our shop works better for our customers, we temporarily run two variants of a page in parallel using the native Shopify feature "Rollouts". You are randomly assigned to one of the variants; this assignment is stored so that you see the same variant consistently during your visit. We then evaluate only in aggregate how the variants differ – for example, how many visits result in a completed order – in order to improve the structure and design of our shop. No evaluation of individual persons takes place. Processing takes place within the Shopify platform (see Section 3); no external provider is involved. The legal basis is your consent (Art. 6(1)(a) GDPR), which you grant via our cookie banner.

7.2 Cookie settings and cookie policy (Pandectes)

To obtain, store and be able to demonstrate your cookie choices, we use the consent management tool Pandectes GDPR Cookie Compliance (Pandectes, Greece). We store your choice per category, the date and time, a randomly generated consent ID, your truncated IP address, your country and region, and the device type. The legal basis is our legal obligation to be able to demonstrate consent given (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). Pandectes acts as our processor (Art. 28 GDPR).

When you first visit our shop, a cookie banner is displayed. You can accept all cookies, reject all cookies that are not strictly necessary, or choose individual categories via "Settings". Functional cookies, performance cookies and targeting cookies are placed only after you have given your consent.

You can change your choice here: The same option is available via the "Cookie settings" link in the footer of every page.

We assign cookies to the following categories:

Strictly necessary (always active, cannot be refused): shopping cart, checkout and order process, discount codes, country and currency selection, customer account and login, Shop Pay, security and protection against manipulation, and storing your cookie choices. Providers: Shopify and Pandectes. The legal basis is our legitimate interest in the functional and secure operation of our shop (Art. 6(1)(f) GDPR); no consent is required.

Functional cookies (only with your consent): we currently do not use any functional cookies for visitors to our shop.

Performance cookies (only with your consent): counting visits and recognising traffic sources, analysing how our shop is used, heatmaps and session replays, testing design variants, and attributing orders to advertising channels. Services: Shopify Analytics, Google Analytics 4, Microsoft Clarity, Shopify Rollouts and Klar (see Section 7.1). The legal basis is your consent (Art. 6(1)(a) GDPR).

Targeting cookies (only with your consent): measuring the success of our marketing activities, personalising content and sign-up forms, and showing our ads on Facebook, Instagram and Google. Services: Shopify, Klaviyo (see Section 7.1), Meta Pixel and Google Ads (see Section 7.3). The legal basis is your consent (Art. 6(1)(a) GDPR).

Details of the individual cookies we use, including name, provider, purpose and storage period, can be found in our cookie policy. It is updated regularly by an automatic scan of our shop.

7.3 Advertising, conversion tracking & retargeting (Meta Pixel, Google Ads)

To promote our offers and measure the effectiveness of our campaigns, we use advertising and conversion tracking services. These are loaded only with your consent (Art. 6(1)(a) GDPR) via our cookie banner. In detail:

Meta Pixel (Meta Platforms Ireland Ltd., Ireland) – measurement and optimisation of our Facebook and Instagram advertising, conversion tracking, retargeting/custom audiences and similar.

Google Ads – conversion tracking & remarketing (Google Ireland Ltd., Ireland) – measurement of the effectiveness of our ads and retargeting of interested users.

Technical deployment and management of advertising tags is via Google Tag Manager and server-side tracking (Elevar).

Pseudonymous usage data may be processed and transmitted to the relevant platforms (e.g. pages visited, clicks and purchases, device/browser information, IP address, cookie/advertising identifiers). Transfer to the USA is possible (see Section 9).

You can change your cookie settings via the "Cookie settings" link in the footer of every page (see Section 7.2).

7.3.1 Joint controllership with Meta

For the Meta Pixel and the Conversions API, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, are joint controllers within the meaning of Art. 26 GDPR. We have concluded Meta's joint controller agreement for this purpose.

Scope: the joint controllership covers only the collection of your personal data on our website and its transmission to Meta. Meta alone is responsible for any further processing.

Responsibilities: we inform you about this processing and obtain your consent. Meta is responsible for fulfilling your rights under Art. 15 to 20 GDPR, for securing the processing and for notifying personal data breaches.

Your rights: you can exercise your rights against either of the joint controllers. For personal data stored by Meta, we recommend contacting Meta directly; where necessary, we will forward requests we receive to Meta. Our contact details are set out in Section 1.

The essence of the agreement is available at: facebook.com/legal/controller_addendum

7.4 Online presence on social media

We maintain publicly accessible company profiles/pages on social networks, in particular Facebook and Instagram (Meta Platforms Ireland Ltd., Ireland). If you visit or interact with these pages, the relevant providers process your personal data (e.g. usage and interaction data) under their own responsibility in accordance with their privacy policies and produce pseudonymous statistics in particular. On the basis of these page statistics ("Insights"), the provider gives us aggregated analyses on reach and interaction; for this purpose, we and Meta are joint controllers (Art. 26 GDPR), with the essential agreement provided by the provider. The legal basis for operating our pages and analysing reach is our legitimate interest in communication and visibility (Art. 6(1)(f) GDPR); where platforms use cookies or similar technologies for advertising/analytics purposes, this is based on consent you grant to the relevant provider (Art. 6(1)(a) GDPR). You can exercise your rights both vis-à-vis us and directly vis-à-vis the provider; for personal data processed by platforms under their own responsibility, contacting them directly is usually most effective. Transfer to the USA is possible (see Section 9).

8. Recipients / processors

We disclose personal data only to carefully selected recipients and only to the extent necessary. These recipients act in one of three roles:

  • Processors (Art. 28 GDPR) act solely on our instructions – in particular our shop platform (Shopify), our ERP system (Odoo), our customer service tool (Freshdesk), our email and customer data platform (Klaviyo), our analytics and attribution services (Google Analytics 4, Google Tag Manager, Elevar, Klar), our consent management tool (Pandectes, see Section 7.2), our reporting tool (Looker, see Section 8.2) and our withdrawal tool (Revoq, see Section 8.1).
  • Independent controllers process personal data for their own purposes on their own legal basis – in particular PayPal, our carrier DPD, Microsoft (Clarity), Google for its own purposes in connection with Google Ads, and Shopify where it uses advanced features for its own purposes (see Section 3).
  • Joint controllers (Art. 26 GDPR): we are joint controllers exclusively with Meta – for the Meta Pixel and Conversions API (see Section 7.3) and for our pages on Facebook and Instagram (see Section 7.4).

An overview of the services used is set out in Sections 3 to 8.

8.1 Electronic withdrawal function (withdrawal button)

To provide the electronic withdrawal function required by EU law, we use the Revoq tool. You can access this function via the "Withdraw from contract" button in the footer of every page. We process the personal data necessary to handle your withdrawal (in particular name, order/contract data and contact details). If you use the online function, we promptly send you an acknowledgement of receipt on a durable medium (e.g. by email) with information on the content of the withdrawal statement as well as the date and time of receipt. Use of the electronic function is not mandatory; withdrawal remains possible by other means (e.g. post or email). The legal basis for providing the withdrawal function and sending the acknowledgement of receipt is Art. 6(1)(c) GDPR (legal obligation); the legal basis for processing the withdrawal itself, including the refund, is Art. 6(1)(b) GDPR (reverse contract performance). Revoq acts as a processor (Art. 28 GDPR) in accordance with our instructions. Withdrawal conditions and periods under consumer law are governed by Section 9 of our Terms and Conditions of Sale.

8.2 Internal business reporting (Looker)

For the internal analysis of our business – such as sales performance, assortment planning and inventory management – we use Looker, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Looker does not collect any personal data on our website and does not set any cookies; it only analyses personal data we already hold. Google acts as our processor (Art. 28 GDPR) in accordance with our instructions. The legal basis is our legitimate interest in managing our business on a sound economic basis (Art. 6(1)(f) GDPR). Transfer to the USA is possible (see Section 9).

9. Transfer to third countries

Some providers process personal data outside the EEA, in particular in the United States. In such cases, we base the transfer on an adequacy decision (EU-US Data Privacy Framework, where certified) or the European Commission's standard contractual clauses (SCCs), supplemented where appropriate by additional safeguards.

Shopify / Shopify Payments / Shipping – EU/Ireland, parent company Canada, possibly USA: Canada adequacy decision; SCCs / BCRs as supplement.

PayPal – EU (Luxembourg): as an independent controller, PayPal may transfer personal data to affiliated companies outside the EEA, in particular in the USA, under its own responsibility (see Section 4.1).

Klaviyo – USA: EU-US Data Privacy Framework (certified); SCCs as supplement.

Google (GA4 / GTM / Google Ads / Looker) – USA: EU-US Data Privacy Framework (certified).

Microsoft (Clarity) – USA: EU-US Data Privacy Framework (certified).

Meta (Meta Pixel / Ads) – EU/Ireland, USA: EU-US Data Privacy Framework (certified).

Freshdesk (Freshworks) – USA: standard contractual clauses (SCCs) and EU-US Data Privacy Framework.

REVIEWS.io – United Kingdom (UK): UK adequacy decision.

Pandectes – EU (Greece): no transfer outside the EU.

Skynet Technologies (All in One Accessibility) – EU servers for users in the EU: no transfer outside the EU.

Atlas Pickup Points – EU (Poland): no transfer outside the EU.

Odoo ERP – EU: no transfer outside the EU.

Seal – Canada: adequacy decision for Canada.

Elevar – USA: standard contractual clauses (SCCs).

Klar – EU (Germany): no transfer outside the EU.

KnoCommerce – USA: standard contractual clauses (SCCs).

Revoq – EU (Germany/Netherlands): no transfer outside the EU; email delivery via a US-based sub-processor with EU hosting, safeguarded by the EU-US Data Privacy Framework and SCCs.

10. Retention period

We retain personal data only for as long as necessary for the relevant purposes or as required by statutory retention obligations.

Order/invoicing/accounting personal data: 7 years, from 1 January of the year following the end of the financial year (legal obligation, Art. III.86 Belgian Economic Law Code/WGB and Art. 60 VAT Code).

Customer account personal data: until account deletion; inactive accounts are deleted or anonymised no later than 3 years after the last activity. Order personal data subject to accounting remains subject to the 7-year period.

Newsletter personal data: until consent is withdrawn.

Cookie/tracking personal data: according to the storage periods shown in our cookie policy (see Section 7.2).

Support enquiries (Freshdesk): until finally resolved; contract-related or legally relevant enquiries are retained until limitation periods expire (see Section 4.3).

11. Automated decisions / profiling

There is no decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR. Where we use profiling to personalise content or offers (e.g. via Klaviyo, see Section 7.1), this takes place only within the scope described in this privacy policy and on the basis of your consent.

12. Children's / minors' personal data

Our services are not directed at children. We also do not knowingly collect personal data from children who have not reached the applicable age in your jurisdiction (in Belgium, this is 13 years old). If you are a parent or legal guardian of a child who has provided us with personal data, contact us using the details in Section 1.1.

13. Links to third-party websites

Our services may contain links to websites or online platforms operated by third parties. If you follow links to pages not linked to or controlled by us, we recommend that you review their privacy and security policies as well as their terms of use. We assume no responsibility for the content, accuracy or security of those sites. Information you provide in public or semi-public spaces (e.g. via social media widgets or third-party login integrations) may be visible to other users. The inclusion of such links does not mean that we endorse the relevant platform.

14. Your rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access (Art. 15) – obtain information about personal data concerning you, purposes, recipients, retention period and origin;
  • Right to rectification (Art. 16) – correct or complete inaccurate or incomplete personal data;
  • Right to erasure (Art. 17) – obtain deletion of your personal data. We are not always obliged to delete your personal data at your request – this right only applies in the cases and to the extent provided for by law;
  • Right to restriction of processing (Art. 18) – freeze our use of your personal data in the cases and to the extent provided for by law;
  • Right to data portability (Art. 20) – receive your personal data in a structured, commonly used and machine-readable format. This right can only be exercised if the processing is based on your consent or on an agreement concluded with you;
  • Right to object (Art. 21) to processing based on legitimate interest; for direct marketing, a general right to object without justification. We are not always obliged to accept your objection – this right only applies if we process your personal data on the basis of our legitimate interest;
  • Withdrawal of consent (Art. 7(3)) – you may withdraw consents granted at any time with future effect (e.g. newsletter, non-essential cookies/tracking), via the unsubscribe link in each email, the "Cookie settings" link in the footer of every page (see Section 7.2) or by contacting us. Lawfulness of processing carried out until withdrawal remains unaffected.

To exercise your rights, a message to the contact details in Section 1.1 is sufficient. You also have the right to lodge a complaint with the supervisory authority (Section 15).

Authorised representatives: to the extent permitted by applicable law, you may appoint an authorised person to exercise your rights on your behalf. We may require proof of authorisation and direct confirmation of your identity before processing. We handle your request within the statutory time limits and do not penalise you for exercising these rights.

Note: withdrawal of consent described here concerns personal data processing (e.g. newsletter, cookies). It is distinct from the consumer right of withdrawal for orders (termination of the purchase contract), governed by our Terms and Conditions of Sale (available at cprofood.com/terms-of-sale).

15. Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with a data protection authority. The competent authority in Belgium is:

Data Protection Authority / Gegevensbeschermingsautoriteit (APD/GBA)

Rue de la Presse 35 / Drukpersstraat 35, 1000 Brussels, Belgium

Telephone: +32 (0)2 274 48 00

Email: contact@apd-gba.be

Web: www.autoriteprotectiondonnees.be / www.gegevensbeschermingsautoriteit.be

16. Obligation to provide data

When the legal basis of our processing of the personal data is the performance of the contract between us, the provision of the personal data is necessary to conclude the contract (e.g. delivery address and payment details).

Without this personal data, we cannot perform the contract.

17. Changes to this privacy policy

We update this privacy policy when legislation, processing activities or services used change. The version published on this page is authoritative.