Privacy Policy
PRIVACY POLICY: INCUTEC BV
1. Data controller
| Name | Incutec BV |
| Registered office | Stapelhuisstraat 15, 3000 Leuven |
| Company number | 1038.934.039 (KBO, RPR Leuven) |
| contact@opendrone.be |
Incutec BV has not appointed a Data Protection Officer (DPO) because this is not mandatory for its current activities (Art. 37 GDPR).
2. What personal data do we process?
| Category | Data | Purpose |
|---|---|---|
| Order data | Name, address, email, telephone number | Processing and delivery of orders |
| Payment data | Payment method, transaction ID | Payment processing (via payment provider) |
| Account data | Email, password (hashed) | Customer account on the webshop |
| Communication | Email, content of messages | Customer service, complaint handling |
| Website usage | IP address, browser, pages visited | Website optimisation, security |
| Newsletter | Marketing communication (only with consent) |
3. Legal bases (Art. 6 GDPR)
| Processing | Legal basis |
|---|---|
| Execution of the order | Necessary for performance of a contract (Art. 6.1.b) |
| Payment processing | Necessary for performance of a contract (Art. 6.1.b) |
| Invoicing and bookkeeping | Legal obligation (Art. 6.1.c: VAT legislation, accounting law) |
| Customer service | Legitimate interest (Art. 6.1.f) |
| Website analytics | Legitimate interest (Art. 6.1.f); cookieless, no persistent identifier |
| Newsletter | Consent (Art. 6.1.a) |
| Fraud / abuse prevention | Legitimate interest (Art. 6.1.f) |
4. Retention periods
| Data | Retention period |
|---|---|
| Order and invoice data | 7 years (Belgian Code of Economic Law Art. III.86, and the VAT Code) |
| Customer account | Until the customer requests deletion |
| Customer service communication | 2 years after closure |
| Website log files | 6 months |
| Newsletter subscription | Until unsubscribed |
5. Recipients / processors
| Recipient | Purpose | Location |
|---|---|---|
| Odoo, self-hosted by Incutec BV | Webshop, order, account and invoicing platform (shop.incutec.com) | Hetzner Online GmbH, Falkenstein, Germany (EU) |
| Stripe Payments Europe, Ltd. | Payment processing (cards, Bancontact, iDEAL, Klarna, PayPal): payment data, email, billing address; device data for fraud prevention | 1 Grand Canal Street Lower, Dublin 2, Ireland (EU); Stripe's privacy policy: https://stripe.com/privacy |
| Mollie B.V. | Payment processing, fallback only if Stripe is unavailable (Bancontact, SEPA, cards) | Netherlands (EU) |
| bpost NV/SA | Parcel delivery and shipping labels | Belgium (EU) |
| Google Workspace (Google Ireland Ltd.) | Company mailboxes (support@ and sales@incutec.com), staff email and sign-in | Ireland (EU); Google's standard contractual clauses cover any transfer outside the EEA |
| Plausible Analytics | Cookieless website analytics | Plausible Insights OÜ — Estonia (EU); hosting in Germany |
| Polar Advisory BV (accountant) | Invoicing and annual accounts | Belgium |
| Discord Inc. | Community support tickets, opt-in via the Discord bridge (name, email, message content, attachments) | US — EU-US Data Privacy Framework |
| Anthropic PBC | AI-assisted draft replies for support tickets | US — data processing agreement with SCCs |
| Resend (Plus Five Five, Inc.) | Transactional mail: order confirmation, shipping and invoice mail, support resume links | EU region infrastructure; US legal entity — SCCs |
| Upstash, Inc. | Temporary ticket index for the support module | US — SCCs |
| Cloudflare, Inc. | Turnstile anti-spam verification on the support form | US — EU-US Data Privacy Framework |
Order and customer data (name, address, email, payment reference, order history) is processed in Odoo at shop.incutec.com, self-hosted by Incutec BV. Shopify no longer processes any Incutec order or customer data.
Transfers outside the EEA. For the US processors listed above, Incutec BV transfers personal data on the basis of appropriate safeguards (Art. 46 GDPR): certification under the EU-US Data Privacy Framework or standard contractual clauses (SCCs, Decision 2021/914). All other processing keeps personal data inside the EEA.
AI assistance in support. When you submit a support ticket, the content of your message may be passed to Anthropic to prepare a draft reply. A staff member reviews every reply before it is sent; no automated decision-making takes place.
6. Rights of the data subject
You have the right to:
- Access your personal data (Art. 15)
- Rectification of inaccurate data (Art. 16)
- Erasure of your data ("right to be forgotten") (Art. 17)
- Restriction of processing (Art. 18)
- Object to processing based on legitimate interest (Art. 21). You may object to processing for direct marketing at any time and free of charge; we then stop that processing immediately (Art. 21.2-21.3)
- Portability of your data (Art. 20)
- Withdraw your consent (Art. 7.3)
Requests can be sent to: privacy@opendrone.be We respond to your request within one month (Art. 12(3) GDPR), extensible by a further two months for complex or numerous requests.
7. Complaints
You have the right to file a complaint with the Belgian Data Protection Authority (GBA):
| Address | Drukpersstraat 35, 1000 Brussels |
| Phone | +32 (0)2 274 48 00 |
| Website | https://www.gegevensbeschermingsautoriteit.be |
| contact@apd-gba.be |
You may also lodge a complaint with the supervisory authority of your place of residence or work within the EU, if you do not reside in Belgium (Art. 77 GDPR).
8. Security
Incutec BV takes appropriate technical and organisational measures to protect personal data against unauthorised access, loss or destruction:
- SSL/TLS encryption on the website
- Hashed passwords (bcrypt or equivalent)
- Access control (need-to-know basis)
- Regular backups
9. Automated decision-making
Incutec BV does not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR. Every order is processed and, where needed, reviewed by a staff member.
Whether providing data is required. Name, address, email and payment details are needed to fulfil an order; without them no contract can be concluded. Invoicing data must be retained by law. All other data (phone number, newsletter, account details) is optional.
Copy of safeguards. A copy of the standard contractual clauses or the DPF certification covering the transfers in section 5 can be requested via privacy@opendrone.be.
10. Data breaches
In the event of a data breach presenting a risk to your rights and freedoms, we are obliged to notify the Belgian Data Protection Authority (GBA) within 72 hours (Art. 33 GDPR). If the breach is likely to result in a high risk to your rights and freedoms, we will inform you personally as soon as possible in accordance with Art. 34 GDPR.
11. Amendments
Incutec BV may amend this privacy policy. The most recent version is always available at opendrone.be/privacy. Customers and newsletter subscribers are notified by email of material changes.