Privacy Policy
Latest update: 05/09/2026
This privacy policy explains how ISAK SRL (hereinafter «we», «the Seller»), operating the website mysterebox.eu, collects, uses and protects your personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and the Belgian law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
Article 1 — Data controller
The data controller is ISAK SRL, whose full identity (registered office, company number) appears in Article 1 of our Terms and Conditions of Sale.
For any questions regarding your personal data, contact us at the address info@mysterebox.eu.
Article 2 — Data we collect
2.1 Order-related data
When you place an order on the Site, we collect:
- Surname, first name
- Email address
- Delivery address
- Telephone number
- Order details (product, weight, amount)
2.2 Payment data
Payment is processed directly by our service provider Stripe, which acts as a processor and payment operator. We do not have access to your bank details (card number, etc.) — these are processed and secured by Stripe in accordance with its own privacy policy.
2.3 Navigation data and cookies
See Article 5 below.
2.4 Data that you voluntarily provide to us
If you contact us by email, via a form (e.g. withdrawal form) or for any other request, we collect the data you provide to us on that occasion.
Article 3 — Purposes and legal bases of processing
| Purpose | Legal basis |
|---|---|
| Processing and delivering your order | Performance of the contract (Art. 6.1.b GDPR) |
| Manage payments | Performance of the contract |
| Answering your requests (customer service, withdrawal, complaints) | Performance of the contract / legitimate interest |
| Comply with our legal and accounting obligations | Legal obligation (Art. 6.1.c GDPR) |
| Sending you our newsletter Coming soon | Consent (Art. 6.1.a GDPR) |
| Measure the site's audience and improve our services | Consent (analytical cookies) |
| Showing you targeted adverts | Consent (marketing cookies) |
| Prevent fraud and ensure the security of the Site | Legitimate interest |
Article 4 — Recipients of your data
Your data is shared solely with the service providers necessary for the operation of the Site, acting as data processors:
| Service provider | Role | Affected data |
|---|---|---|
| Mollie B.V. | Payment processing (Bancontact, etc.) | Payment details, amount, email |
| DPD Belgium | Parcel delivery | Name, address, telephone number |
| Infomaniak | Website Hosting | All data passing through the Site |
| [Newsletter tool — to be completed] | Sending the newsletter (coming soon, not currently active) | Email, first name (if applicable) |
| [Analytics tool – e.g. Google Analytics] | Audience measurement | Browsing data, IP address |
| [Marketing tool — e.g. Meta Pixel] | Targeted advertising | Browsing data, advertising identifiers |
We neither sell nor rent your personal data to third parties.
Article 5 — Cookies
The Site uses cookies and similar technologies, divided into three categories:
5.1 Strictly necessary cookies Essential for the operation of the site (shopping basket, payment session, security). They do not require your consent and cannot be disabled.
5.2 Analytics cookies (audience measurement) We use [Google Analytics / to be specified] to understand how the Site is used and to improve it. These cookies are only deposited with your prior consent, collected via our cookie management banner.
5.3 Marketing / advertising cookies We use [Meta Pixel / to be specified] to measure the effectiveness of our advertising campaigns and to present you with relevant advertisements. These cookies are only deposited with your prior consent.
You can withdraw or modify your consent at any time via the cookie management banner accessible at the bottom of the page, or via your browser settings.
Article 6 — Retention period
| Data type | Shelf life |
|---|---|
| Order and billing data | 10 years (Belgian accounting and tax obligation) |
| Customer account (if applicable) | Duration of the business relationship + 3 years |
| Prospecting data / newsletter | Until withdrawal of consent, or 3 years after the last contact |
| Analytics cookies | 13 months maximum |
| Marketing cookies | Depending on the period set by the relevant tool, generally 13 months maximum |
| Correspondence (emails, customer service) | 3 years after the closure of the request |
Article 7 — International transfers
Some of our service providers may be established or process data outside the European Economic Area (in particular US analytics/marketing tools). In such cases, this transfer is governed by a mechanism recognised by the GDPR (adequacy decision, standard contractual clauses, or certification under the EU-US Data Privacy Framework, depending on the service provider concerned).
Our hosting provider, Infomaniak, is based in Switzerland, a country that benefits from a European Commission adequacy decision guaranteeing a level of protection equivalent to the GDPR.
Article 8 — Your rights
In accordance with the GDPR, you have the following rights regarding your personal data:
- Right of access - obtain confirmation that your data is being processed and receive a copy of it.
- Right to rectification - to have inaccurate or incomplete data corrected.
- Right to erasure — request the erasure of your data, within the limits provided for by law.
- Right to restriction of processing.
- Right to data portability - to receive your data in a structured and commonly used format.
- Right to object - object to processing based on legitimate interests, or at any time to direct marketing.
- Right to withdraw your consent at any time, for the processing operations that depend on them (newsletter, cookies), without affecting the lawfulness of the prior processing.
To exercise these rights, contact us at info@mysterebox.eu. We reply within one month, which may be extended by two months for complex requests. Proof of identity may be requested.
Article 9 — Safety
We implement appropriate technical and organisational measures to protect your data against loss, unauthorised access, disclosure or alteration (secure SSL/TLS connection, restricted access to data, choice of service providers who are themselves GDPR compliant).
Article 10 — Complaint to the supervisory authority
If you consider that the processing of your data constitutes a breach of the GDPR, you have the right to lodge a complaint with:
Data Protection Authority (DPA) Rue de la Presse 35, 1000 Brussels Tel.: +32 2 274 48 00 Email: contact@apd-gba.be Site: www.autoriteprotectiondonnees.be
Article 11 — Modification of this policy
We may modify this privacy policy at any time, notably to reflect the addition of new tools (newsletter, analytics). The applicable version is the one published on the Site on the date of your visit.
