Privacy policy

1. Who we are

OPIUS BV (“OPIUS”, “we”, “us” or “our”) is the controller responsible for the personal data described in this Privacy Policy.

 

OPIUS BV
Hundelgemsesteenweg 296/A
9820 Merelbeke-Melle, Belgium

Enterprise and VAT number: BE 0741.362.783
Privacy contact: info@opius.be

 

This Privacy Policy applies to the European website and online store at opius-distillery.com, related customer communications and forms operated by OPIUS BV. The separate OPIUS USA store has its own privacy policy.

2. Personal data we collect

Depending on how you interact with us, we may collect:

·      identity and contact data, such as your name, email address, telephone number, billing address, delivery address and company details;

·      account data, such as login credentials, account preferences and saved details;

·      order and transaction data, such as products purchased, order value, delivery status, returns, refunds and limited payment information;

·      communications data, such as messages, customer-service requests, survey responses and correspondence;

·      marketing data, such as newsletter subscriptions, consent records, campaign interactions and communication preferences;

·      technical and usage data, such as IP address, device and browser type, operating system, referring pages, timestamps, pages viewed, clicks, approximate location and security logs;

·      cookie and advertising data, where permitted, such as identifiers and information about interaction with our Website and advertisements; and

·      any other information you voluntarily provide through a form, competition, event registration or direct communication.

We do not intentionally request special-category personal data. Please do not send health information or other sensitive data unless it is genuinely necessary for your request.

3. How we obtain personal data

We obtain personal data directly from you when you place an order, create an account, contact us, subscribe to marketing, exercise a right, complete a form or otherwise interact with us. We also obtain technical and usage data automatically through cookies and similar technologies, subject to your choices.

We may receive data from service providers involved in payments, ecommerce hosting, delivery, fraud prevention, analytics, advertising and marketing, as well as from publicly available sources or business partners where permitted by law. If another person places an order for you or provides your details as a recipient, we may receive your name and delivery details from that person.

4. Why we use personal data and our legal bases

We use personal data only where we have a valid legal basis:

Purpose	Typical data	Legal basis
Process orders, payments, delivery, returns and refunds	Identity, contact, order and transaction data	Performance of a contract; legal obligations
Create and manage customer accounts	Identity, contact, account and order data	Performance of a contract
Answer questions, complaints and support requests	Identity, contact, order and communications data	Performance of a contract; legitimate interest in customer service
Meet accounting, tax, consumer-protection and other legal duties	Identity, contact, order, transaction and communications data	Compliance with legal obligations
Protect the Website, prevent fraud and enforce our rights	Technical, usage, account, order and transaction data	Legitimate interests in security, fraud prevention and legal claims; legal obligations where applicable
Operate and improve the Website and understand performance	Technical, usage and cookie data	Legitimate interests for strictly necessary operation; consent for non-essential analytics cookies
Send newsletters and promotional communications	Identity, contact, marketing and interaction data	Consent, or another basis permitted by direct-marketing law for existing customers; legitimate interest in maintaining suppression records
Personalise content and measure or deliver advertising	Cookie, advertising, technical and usage data	Consent where required
Manage competitions, events, surveys or other requested participation	Identity, contact, communications and submitted content	Performance of the relevant arrangement; consent where appropriate; legitimate interest in administration

Where we rely on legitimate interests, we assess whether those interests are proportionate and whether your rights override them. You may object to processing based on legitimate interests as explained below. Where processing is necessary to perform a contract, failure to provide required data may prevent us from accepting or fulfilling an order.

5. Cookies and similar technologies

We use strictly necessary cookies and similar technologies to operate the Website, keep it secure, remember privacy choices, maintain your cart and enable checkout. These technologies are used without consent only where legally permitted.

With your consent, we may also use analytics, functionality and advertising technologies to measure Website use, improve performance, personalise content, measure campaigns and show relevant advertising. Providers may include ecommerce, analytics and advertising partners such as Shopify, Google and Meta, depending on the technologies enabled on the Website.

You can accept, reject or manage non-essential cookies through the cookie banner and can change your choices at any time using the cookie settings tool on the Website. Withdrawing consent does not affect processing that took place before withdrawal. Blocking some cookies may affect optional Website features. The cookie settings tool should provide current details about individual cookies, providers, purposes and storage periods.

6. Marketing communications

We send promotional emails only where permitted by law, for example where you consented or where applicable direct-marketing rules allow communication to an existing customer about similar products. You can unsubscribe at any time using the link in each marketing email or by contacting info@opius.be.

After you unsubscribe, we may retain minimal information on a suppression list so that we can respect your choice. Unsubscribing from marketing does not stop service messages concerning an order, account, safety notice or legal matter.

7. Who receives personal data

We disclose personal data only where necessary and proportionate. Recipients may include:

·      ecommerce, website-hosting and IT service providers, including Shopify;

·      payment processors, banks and fraud-prevention providers;

·      our e-fulfilment partner Webship, and the warehousing, logistics, postal and courier partners involved in preparing, dispatching, tracking and delivering orders;

·      customer-support, email, CRM, survey and marketing service providers;

·      analytics and advertising providers, including Google and Meta, where the relevant technologies are enabled and consent has been obtained where required;

·      professional advisers, auditors, insurers and financing partners where necessary;

·      public authorities, regulators, courts or law-enforcement bodies where disclosure is required or legally justified; and

·      a purchaser, investor or successor in connection with a proposed or completed corporate transaction, subject to appropriate safeguards.

Some providers act as processors on our instructions. Others, such as certain payment, delivery, analytics or advertising providers, may act as independent controllers for aspects of their services. Their own privacy notices explain those activities. We do not sell personal data for money.

8. International transfers

Some service providers may process personal data outside the European Economic Area (EEA), including in the United States. Where required, we rely on a European Commission adequacy decision, the EU Standard Contractual Clauses, supplementary measures or another lawful transfer mechanism. You may contact us for more information about the safeguards relevant to your data.

9. How long we keep personal data

We retain personal data only for as long as necessary for the purpose for which it was collected, including legal, accounting, tax, warranty, dispute and security requirements. Our general approach is:

·      order, invoice and accounting records: for the applicable statutory period, generally up to 10 years;

·      customer account data: while the account remains active and for a limited period afterwards, unless a longer period is required for orders, legal obligations or disputes;

·      customer-service and complaint correspondence: generally up to 3 years after the matter is closed, or longer where needed for a legal claim or statutory obligation;

·      marketing subscription data: until you unsubscribe or we determine that the information is no longer useful, while retaining a minimal suppression record where necessary;

·      consent records: for as long as needed to demonstrate compliance and deal with related claims;

·      security and technical logs: for a limited period proportionate to security and troubleshooting needs; and

·      cookie data: for the periods stated in the cookie settings tool.

We may keep data longer where a dispute, investigation, legal hold or binding obligation requires it. When retention is no longer justified, we delete or anonymise the data.

10. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include access controls, secure service providers, authentication, monitoring, backups and staff procedures. No online system is completely risk-free, so we cannot guarantee absolute security.

11. Your rights

Subject to the conditions and limits in data-protection law, you may have the right to:

·      request access to your personal data and obtain a copy;

·      correct inaccurate or incomplete personal data;

·      request deletion of personal data;

·      request restriction of processing;

·      object to processing based on legitimate interests;

·      object at any time to processing for direct marketing;

·      receive certain personal data in a structured, commonly used and machine-readable format and transmit it to another controller;

·      withdraw consent at any time, without affecting earlier lawful processing; and

·      lodge a complaint with a supervisory authority.

To exercise a right, contact info@opius.be. We may request reasonable information to verify your identity and protect your data. We normally respond within one month, subject to any lawful extension.

You may complain to the Belgian Data Protection Authority / Gegevensbeschermingsautoriteit / Autorité de protection des données, Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, Belgium, via https://www.dataprotectionauthority.be or https://www.gegevensbeschermingsautoriteit.be. You may also contact the supervisory authority in the EEA country where you live or work.

12. Automated decisions

We do not make decisions based solely on automated processing that produce legal effects or similarly significant effects for you. Our providers may use automated signals to detect suspected fraud or security threats; where required, meaningful human review and applicable rights remain available.

13. Children

The Website is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided personal data to us, please contact us so that we can take appropriate action.

14. Third-party websites and social media

The Website may link to third-party websites, applications or social-media platforms. Those parties control their own processing, and their privacy notices apply. If you interact with OPIUS through social media, the platform and OPIUS may each process information for their respective purposes.

15. Changes to this Privacy Policy

We may update this Privacy Policy when our practices, providers or legal obligations change. We will publish the updated version and change the “Last updated” date. Where a change materially affects your rights or requires renewed consent, we will provide an appropriate notice or request.

16. Contact

Questions, requests or complaints about privacy may be sent to info@opius.be or by post to OPIUS BV, Hundelgemsesteenweg 296/A, 9820 Merelbeke-Melle, Belgium.