Legal · GDPR
Privacy Policy
PRIVACY POLICY: INCUTEC BV
1. Data controller
| Name | Incutec BV |
| Registered office | Stapelhuisstraat 15, 3000 Leuven |
| Company number | 1038.934.039 (KBO, RPR Leuven) |
| contact@opendrone.be |
Incutec BV has not appointed a Data Protection Officer (DPO) because this is not mandatory for its current activities (Art. 37 GDPR).
2. What personal data do we process?
| Category | Data | Purpose |
|---|---|---|
| Order data | Name, address, email, telephone number | Processing and delivery of orders |
| Payment data | Payment method, transaction ID | Payment processing (via payment provider) |
| Account data | Email, password (hashed) | Customer account on the webshop |
| Communication | Email, content of messages | Customer service, complaint handling |
| Website usage | IP address, browser, pages visited | Website optimisation, security |
| Newsletter | Marketing communication (only with consent) |
3. Legal bases (Art. 6 GDPR)
| Processing | Legal basis |
|---|---|
| Execution of the order | Necessary for performance of a contract (Art. 6.1.b) |
| Payment processing | Necessary for performance of a contract (Art. 6.1.b) |
| Invoicing and bookkeeping | Legal obligation (Art. 6.1.c: VAT legislation, accounting law) |
| Customer service | Legitimate interest (Art. 6.1.f) |
| Website analytics | Legitimate interest (Art. 6.1.f); cookieless, no persistent identifier |
| Newsletter | Consent (Art. 6.1.a) |
| Fraud / abuse prevention | Legitimate interest (Art. 6.1.f) |
4. Retention periods
| Data | Retention period |
|---|---|
| Order and invoice data | 10 years (statutory bookkeeping retention obligation) |
| Customer account | Until deletion by the customer or 3 years after last activity |
| Customer service communication | 3 years after closure |
| Website log files | 6 months |
| Newsletter subscription | Until unsubscribed |
5. Recipients / processors
| Recipient | Purpose | Location |
|---|---|---|
| Shopify International Ltd. | Webshop and order platform | Ireland (EU) |
| Shopify Oxygen | Website hosting | EU edge network |
| Mollie B.V. | Payment processing (Bancontact, SEPA, cards) | Netherlands (EU) |
| Stripe Payments Europe Ltd. | Card processing and fraud prevention | Ireland (EU) |
| Sendcloud B.V. | Shipping labels and tracking | Netherlands (EU) |
| Bpost / DHL / DPD (carrier depending on order) | Parcel delivery | EU |
| Plausible Analytics | Cookieless website analytics | Plausible Insights OÜ — Estonia (EU); hosting in Germany |
| Polar Advisory BV (accountant) | Invoicing and annual accounts | Belgium |
| Discord Inc. | Support tickets via the Discord bridge (name, email, message content, attachments) | US — EU-US Data Privacy Framework |
| Anthropic PBC | AI-assisted draft replies for support tickets | US — data processing agreement with SCCs |
| Resend (Plus Five Five, Inc.) | Transactional support emails (resume links) | US — SCCs |
| Upstash, Inc. | Temporary ticket index for the support module | US — SCCs |
| Cloudflare, Inc. | Turnstile anti-spam verification on forms | US — EU-US Data Privacy Framework |
Transfers outside the EEA. For the US processors listed above, Incutec BV transfers personal data on the basis of appropriate safeguards (Art. 46 GDPR): certification under the EU-US Data Privacy Framework or standard contractual clauses (SCCs, Decision 2021/914). Shopify may additionally process data in Canada (adequacy decision) and through sub-processors in the US and Singapore under SCCs. All other processing keeps personal data inside the EEA.
AI assistance in support. When you submit a support ticket, the content of your message may be passed to Anthropic to prepare a draft reply. A staff member reviews every reply before it is sent; no automated decision-making takes place.
6. Rights of the data subject
You have the right to:
- Access your personal data (Art. 15)
- Rectification of inaccurate data (Art. 16)
- Erasure of your data ("right to be forgotten") (Art. 17)
- Restriction of processing (Art. 18)
- Object to processing based on legitimate interest (Art. 21). You may object to processing for direct marketing at any time and free of charge; we then stop that processing immediately (Art. 21.2-21.3)
- Portability of your data (Art. 20)
- Withdraw your consent (Art. 7.3)
Requests can be sent to: privacy@opendrone.be We respond to your request within one month (Art. 12(3) GDPR), extensible by a further two months for complex or numerous requests.
7. Complaints
You have the right to file a complaint with the Belgian Data Protection Authority (GBA):
| Address | Drukpersstraat 35, 1000 Brussels |
| Phone | +32 (0)2 274 48 00 |
| Website | https://www.gegevensbeschermingsautoriteit.be |
| contact@apd-gba.be |
You may also lodge a complaint with the supervisory authority of your place of residence or work within the EU, if you do not reside in Belgium (Art. 77 GDPR).
8. Security
Incutec BV takes appropriate technical and organisational measures to protect personal data against unauthorised access, loss or destruction:
- SSL/TLS encryption on the website
- Hashed passwords (bcrypt or equivalent)
- Access control (need-to-know basis)
- Regular backups
9. Automated decision-making
When you place an order, the webshop platform's fraud detection (Shopify Fraud Analysis) automatically evaluates signals such as payment details, delivery address, IP address and ordering pattern and assigns a risk score. An order with a high score may be refused automatically. This is automated decision-making within the meaning of Art. 22 GDPR, necessary for entering into and performing the contract (Art. 22.2.a). You have the right to human intervention, to express your point of view and to contest the decision: contact contact@opendrone.be and a staff member will review the order. No other automated decision-making or profiling takes place.
Whether providing data is required. Name, address, email and payment details are needed to fulfil an order; without them no contract can be concluded. Invoicing data must be retained by law. All other data (phone number, newsletter, account details) is optional.
Copy of safeguards. A copy of the standard contractual clauses or the DPF certification covering the transfers in section 5 can be requested via privacy@opendrone.be.
10. Data breaches
In the event of a data breach presenting a risk to your rights and freedoms, we are obliged to notify the Belgian Data Protection Authority (GBA) within 72 hours (Art. 33 GDPR). If the breach is likely to result in a high risk to your rights and freedoms, we will inform you personally as soon as possible in accordance with Art. 34 GDPR.
11. Amendments
Incutec BV may amend this privacy policy. The most recent version is always available at opendrone.be/privacy. Customers and newsletter subscribers are notified by email of material changes.