Privacy Policy

Last updated: 22 September 2026

Cantavanda values your privacy and is committed to protecting your personal data. This Privacy Policy explains what personal data we collect, why we process it, with whom it may be shared and what rights you have.

This Privacy Policy applies to cantavanda.com, including the webshop, contact forms, newsletter and other services offered through the Website.

1. Who is responsible for your personal data?

The data controller responsible for the processing of personal data through the Website is:

Cantamessi, Adriel
Enterprise number: BE1025816966

For questions regarding privacy or the processing of personal data, please contact us through our Contact page.

For certain processing activities, external service providers may act as independent data controllers. This may, for example, apply to certain payment processing activities carried out by Mollie.

2. What personal data do we process?

Depending on how you use the Website, we may process the following categories of personal data.

When placing an order

  • first and last name;

  • billing address;

  • delivery address;

  • email address;

  • telephone number;

  • order details;

  • selected shipping method;

  • selected payment method;

  • invoice information;

  • information relating to your order;

  • communications regarding your order.

When creating a customer account

When you create an account, we may process information such as:

  • name;

  • email address;

  • password in securely stored form;

  • billing and delivery information;

  • order history;

  • account and preference information.

When contacting us

When you contact us through a contact form or other communication channel, we may process:

  • name;

  • email address;

  • telephone number, if provided;

  • the content of your message;

  • attachments or other information you voluntarily provide.

When subscribing to our newsletter

For newsletter subscriptions, we may process:

  • email address;

  • name, where requested or provided;

  • subscription date;

  • information relating to your consent;

  • unsubscribe information;

  • technical information necessary to manage consent and newsletter delivery.

3. Why do we use personal data?

We use personal data for the following purposes.

Processing orders

We use your data to:

  • process your order;

  • process payments;

  • deliver products;

  • keep you informed about your order;

  • provide shipping and tracking information;

  • create invoices and other administrative documents;

  • provide customer support.

Managing customer accounts

When you use a customer account, we process data to manage the account, provide access and make your order history available.

Contact and customer service

When you contact us, we use your information to respond to your request and provide any necessary follow-up.

Newsletter and marketing

Where you have provided the required consent, we use your contact details to send newsletters and other permitted marketing communications.

We use Mailchimp for this purpose.

WooCommerce may also automatically synchronise relevant customer and order information with Mailchimp for the Mailchimp functionality we use.

You can unsubscribe from marketing communications at any time by using the unsubscribe link included in our newsletters or by contacting us through our Contact page.

Security

We process certain technical information to protect the Website, customer accounts and webshop against spam, fraud, unauthorised access, automated abuse and other security threats.

This may include information such as IP address, browser information, technical log information and authentication data where necessary for security purposes.

4. Legal bases for processing

We process personal data on the basis of one or more of the following legal bases under the GDPR.

Performance of a contract

This applies, for example, to:

  • processing an order;

  • delivering products;

  • processing payments;

  • managing a customer account;

  • providing customer service relating to an order.

Legal obligation

Certain information must be processed or retained because we are legally required to do so, for example for:

  • accounting;

  • invoicing;

  • tax administration;

  • statutory reporting obligations.

Consent

We rely on consent where required, for example for certain non-essential cookies or certain marketing communications.

You may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Legitimate interests

Where legally permitted, we may process personal data where this is necessary for our legitimate interests or those of a third party, provided that your interests and fundamental rights do not override those interests.

This may include:

  • securing the Website;

  • preventing fraud and abuse;

  • defending legal claims;

  • managing and improving our services;

  • internal administration.

5. Payments

We use Mollie for payment processing.

Depending on the selected payment method, payments may be processed through methods including:

  • Bancontact;

  • payment cards;

  • PayPal;

  • Apple Pay;

  • Klarna;

  • bank transfer;

  • other payment methods made available through the webshop.

We do not necessarily receive or store all payment details. For certain payment methods, payment information is processed directly by the relevant payment service provider.

Mollie may act as an independent data controller for certain processing activities relating to payment transactions and legal obligations.

6. Shipping

To fulfil orders, necessary information may be shared with shipping and logistics providers.

Depending on the selected shipping method, these may include:

  • bpost;

  • UPS;

  • Sendcloud;

  • Mondial Relay;

  • InPost;

  • Chronopost;

  • other logistics partners available at the time of ordering.

Information shared may include:

  • name;

  • delivery address;

  • email address;

  • telephone number;

  • order or shipment number;

  • information necessary to deliver or track the shipment.

7. Email and SMTP

Website emails are sent using an SMTP service provided by Hostinger.

This may include:

  • contact form messages;

  • order confirmations;

  • order updates;

  • account emails;

  • password reset emails;

  • other transactional emails.

The information necessary to send these emails may therefore be processed through Hostinger’s infrastructure.

8. Hosting

The Website is hosted by Hostinger.

For hosting, maintenance and security purposes, Hostinger may process technical information such as:

  • IP address;

  • date and time of access;

  • browser and device information;

  • server logs;

  • technical error information;

  • security information.

9. Cloudflare Turnstile

We use Cloudflare Turnstile to protect forms and certain Website functions against spam, bots, automated abuse and other malicious or unwanted traffic.

Turnstile is a privacy-focused alternative to traditional CAPTCHA systems. It helps determine whether a request is likely to originate from a genuine visitor rather than an automated system.

As part of this security process, Cloudflare may process technical information relating to the request, such as information about the device, browser, IP address and interaction with the Website.

Cloudflare processes this information in accordance with its own privacy policy and terms.

Turnstile is used for security and abuse-prevention purposes and is not used by us to create advertising profiles of Website visitors.

10. YouTube

Certain pages may contain YouTube videos.

Where possible, we use YouTube’s privacy-enhanced mode through youtube-nocookie.com.

When YouTube content is loaded or used, YouTube may process information about the browser, device and interaction with the video.

We do not use YouTube content for the purpose of creating advertising profiles of Cantavanda visitors.

11. Newsletter and Mailchimp

We use Mailchimp, a service provided by The Rocket Science Group LLC / Intuit, for our newsletter.

When you subscribe to our newsletter, your information may be transferred to and processed by Mailchimp.

WooCommerce may also synchronise relevant customer and order information with Mailchimp for the functionality we use.

Mailchimp may process European data outside the European Economic Area, including in the United States. Appropriate safeguards for international data transfers are used where required by applicable data protection law.

You can unsubscribe from our newsletter at any time.

12. Website analytics

Google Analytics is currently not used on cantavanda.com.

We also do not currently use Meta Pixel, TikTok Pixel or similar advertising pixels.

The Website does use WooCommerce/Sourcebuster functionality that may record the source of visits and certain interactions for attribution purposes. This processing is described in our Cookie Policy.

We also use Simple Page Views, a self-hosted page-view solution that records aggregated daily page views without using cookies or a third-party analytics service.

13. Cookies

For more information about cookies and similar technologies, please see our separate Cookie Policy.

The Cookie Policy explains:

  • which cookies are used;

  • why they are used;

  • how long they are stored;

  • which cookies are necessary;

  • which cookies may require consent.

14. Social media

We may provide links to social media and music platforms on the Website.

Simply linking to an external website does not automatically mean that Cantavanda transfers personal data to that service.

When you visit an external service, its own privacy policy applies.

We currently do not use active social login through Nextend Social Login.

15. Wishlist

The Website may offer wishlist functionality provided by YITH WooCommerce Wishlist.

When you use this functionality, information relating to your wishlist and, depending on how the feature is used, associated account or session information may be processed.

This information is used to provide and manage the wishlist functionality.

16. Sharing personal data with third parties

We may share personal data with service providers where this is necessary to provide our services, including:

  • hosting and infrastructure providers;

  • email and SMTP providers;

  • payment service providers;

  • shipping and logistics providers;

  • newsletter and marketing providers;

  • technical service providers;

  • security and anti-spam providers;

  • professional advisers where necessary;

  • government authorities where legally required.

We seek to ensure that service providers processing personal data on our behalf implement appropriate contractual and technical safeguards.

17. International data transfers

Some of our service providers may process personal data outside the European Economic Area.

Where personal data is transferred outside the EEA, we ensure that an appropriate legal transfer mechanism and safeguards are used where required, such as an adequacy decision, the EU-U.S. Data Privacy Framework where applicable, or Standard Contractual Clauses.

18. How long do we retain personal data?

We do not retain personal data for longer than necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

The applicable retention period depends on the type of information.

Order and invoice information

Information required for accounting, tax and legal administration is retained for the period required by applicable legislation.

Customer accounts

Account information is retained while the account remains active, unless a longer retention period is required for legal or regulatory purposes.

Contact requests

Contact information and correspondence are retained for as long as reasonably necessary to handle the request and any required follow-up.

Newsletter information

Newsletter information is retained while you remain subscribed or until you withdraw your consent, except where information must be retained to demonstrate compliance with legal obligations.

Technical and security information

Technical logs and security information are retained only for as long as necessary for security, troubleshooting, administration and legal purposes.

19. Security

We take appropriate technical and organisational measures to protect personal data against:

  • unauthorised access;

  • loss;

  • destruction;

  • alteration;

  • disclosure;

  • other unlawful processing.

These measures may include access controls, secure connections, authentication and security measures, and technical protection of the WordPress environment.

However, no method of electronic storage or transmission can guarantee complete security.

20. Your rights

Under the GDPR, you may have various rights concerning your personal data, depending on the circumstances.

You may request:

  • access to your personal data;

  • correction of inaccurate personal data;

  • deletion of personal data;

  • restriction of processing;

  • portability of certain personal data;

  • objection to certain processing;

  • withdrawal of consent where processing is based on consent.

You also have the right to lodge a complaint with the competent data protection supervisory authority.

In Belgium, this is the Belgian Data Protection Authority (GBA/APD).

21. Exercising your rights

If you have questions about privacy or wish to exercise one of your rights, please contact us through our Contact page.

Please clearly indicate:

  • which information or processing your request concerns;

  • which right you wish to exercise;

  • sufficient information for us to verify your identity where necessary.

We may request additional information where necessary to ensure that personal data is not disclosed to the wrong person.

22. Changes to this Privacy Policy

We may update this Privacy Policy when our services, processing activities, technical systems or legal obligations change.

The most recent version will always be published on this page.

The date at the top of this Privacy Policy indicates when it was last updated.

23. Contact

For questions about this Privacy Policy or the processing of personal data, please contact us through our Contact page.

Cantamessi, Adriel
Enterprise number: BE1025816966