Privacy policy

Look Hippie Chic values the protection of your personal data. This policy explains what information is processed when you use our shop, why it is used, who it may be shared with and how you can exercise your rights.

It applies to website visitors, customers, people who contact us and subscribers to our marketing communications. Personal data means information that identifies a natural person, directly or indirectly.

1. Data controller

The data controller is MAISON HALLEUX SRL, which operates the Look Hippie Chic shop at www.lookhippiechic.com.

• Address for order processing and the logistics department of MAISON HALLEUX SRL: 45 rue de l’Esplanade, 4141 Louveigné, Sprimont, Belgium.
• Registered office: 47 rue de l’Esplanade, 4141 Louveigné, Sprimont, Belgium.
• Company / VAT number: BE 0417.106.235.
• Email: contact@lookhippiechic.com.
• Telephone: +32 (0)4 360 85 36.

You can use this email address for any questions about your personal data or to exercise your rights.

2. Data we process

Depending on the services you use, we may process the following categories:

• Your identity and contact details: surname, first name, email address, telephone number, and billing and delivery addresses.
• Information about your account, orders, purchased products, invoices, deliveries, returns and customer service requests.
• Information needed to track payments: payment method used, transaction reference, payment status and, where required for the transaction, bank details.
• The content of your messages and information you voluntarily provide.
• Your newsletter subscription, communication preferences and information needed to demonstrate and manage your consent.
• Technical data, such as your IP address, connection logs, browser or device information and, depending on your choices and the tools enabled, browsing and interaction data.

Data mainly comes from you, your use of the website and the providers involved in payment, delivery or communications. Where a form marks information as mandatory, it is needed to handle your request or fulfil your order. Without the information essential for invoicing, payment or delivery, we cannot finalise the order.

3. Purposes and legal bases

Visiting the website does not constitute consent to all processing. Placing an order does not require you to subscribe to our newsletter or accept advertising cookies.

4. Newsletters and Brevo

We use Brevo to manage our subscriber lists and send our newsletters. For these purposes, this provider may process your email address, information needed to personalise messages and your subscription preferences on our behalf.

You can unsubscribe at any time using the unsubscribe link in each promotional message or by writing to contact@lookhippiechic.com. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

Messages necessary for your order, such as purchase confirmation or delivery information, serve a different purpose from newsletters and may continue to be sent to you to follow up on your purchase.

5. Recipients and service providers

Authorised staff within MAISON HALLEUX SRL can access data within the scope of their duties. Certain data is shared with the providers needed for the services you use:

• Payment: Stripe, PayPal and ING, depending on the payment method selected. Card payments are processed through the relevant payment service.
• Delivery: Bpost, Mondial Relay, DPD and DHL, depending on the carrier selected, to organise and track delivery.
• Hosting: OVHcloud, where our servers are hosted.
• Newsletters: Brevo, to manage subscriptions and send the relevant communications.
• Audience measurement and advertising: Google, for Google Analytics and Google Ads, depending on the features used and your consent choices.
• Social media: Meta, for the Facebook and Instagram services used for our pages, interactions and advertising campaigns.

Our shop uses PrestaShop software. Development and maintenance are carried out internally. Using this software does not, in itself, mean that all your data is shared with the PrestaShop company.

Some providers process data on our behalf; others, particularly payment or social media providers, may also act as controllers for their own processing. Their privacy policies explain that processing.

Data may also be disclosed to the competent authorities where required by law or where necessary to defend our rights. Disclosures are limited to the data necessary for their purpose.

6. Cookies, Google Analytics and Google Ads

The website uses cookies and may use other trackers. Strictly necessary cookies are used, in particular, to operate the shop, manage the basket, ensure security and remember your privacy choices. They do not require your consent where they meet the legal conditions for this exemption.

Audience measurement or advertising cookies and trackers that are not strictly necessary require your prior consent. This includes, in particular, Google Analytics and Google Ads trackers used for these purposes. Continuing to browse does not constitute acceptance.

You must be able to accept or refuse optional trackers and change or withdraw your consent as easily as you gave it. Refusing these trackers does not prevent you from placing an order.

The information provided when you make your choice must specify the tools concerned, the purposes, the recipients and the cookies’ lifespans. Cookie preferences do not replace newsletter subscription choices.

7. Facebook and Instagram

We use Facebook and Instagram to present our products, publish content, interact with our community and, at certain times, run paid advertisements.

When you interact with our pages or advertisements on these platforms, Meta also processes data under its own terms and policies. Your account’s privacy settings allow you to manage some of that processing.

Using social media pages or advertisements does not, in itself, mean that a Meta pixel is installed in the shop. Any advertising tracker used on our website is subject to the applicable consent rules and must be identified in the cookie information.

8. Transfers outside the European Economic Area

Depending on the services and processors used, some processing may involve access to data or its transfer outside the European Economic Area.

Such a transfer must rely on a mechanism permitted by the GDPR, such as an adequacy decision applicable to the recipient or standard contractual clauses accompanied, where necessary, by supplementary safeguards.

You can contact us for details of the destinations and safeguards applicable to processing concerning you, and for a copy of the relevant safeguards, subject to the protection of confidential information and third parties’ rights.

9. Data retention

Retention is limited to the period necessary for each purpose, taking into account legal obligations and the time limits applicable to defending rights. It does not automatically continue until a request for deletion is made.

• Orders and customer follow-up: while the order is being processed, then as necessary to handle returns, warranties and potential disputes, taking the applicable statutory time limits into account.
• Invoices and accounting records: for the periods required by the applicable tax and accounting legislation.
• Customer account: while it is in use, then only for information whose retention remains necessary for a legal obligation or the defence of rights. Closing an account does not result in the deletion of invoices that must be retained.
• Newsletters: until you unsubscribe or withdraw consent. Evidence needed to demonstrate consent and minimal information to honour your objection may be retained separately for as long as those purposes justify.
• Enquiries and correspondence: while they are being handled, then for the period necessary for follow-up and, where applicable, to manage a dispute.
• Security logs: for a period proportionate to detecting and managing incidents; additional retention may be necessary where an incident is investigated or becomes the subject of proceedings.
• Cookies and associated data: according to the periods specific to the tools concerned, which must be specified in the information about cookies and the services used.

At the end of the justified retention periods, data is deleted or anonymised. You can ask us for details of the retention criteria applicable to your data.

10. Your rights

Under the conditions laid down by the GDPR, you have the following rights:

• Obtain confirmation that your data is being processed and access it.
• Have inaccurate data corrected or incomplete information completed.
• Request erasure of your data where the legal conditions are met.
• Request restriction of certain processing.
• Receive data covered by the right to data portability and, where technically feasible, request its transmission to another controller.
• Object, on grounds relating to your particular situation, to processing based on a legitimate interest.
• Object at any time to the use of your data for direct marketing, including related profiling.
• Withdraw consent at any time for processing based on that consent.

If processing were to lead to a decision based solely on automated processing and producing legal effects or similarly significant effects, you would benefit from the safeguards provided by the GDPR, including, where applicable, the right to human intervention and to contest the decision.

To exercise your rights, write to contact@lookhippiechic.com, specifying your request. A copy of an identity document is not requested systematically. If we have reasonable doubts about your identity, we may request only the additional information necessary to verify it.

We normally respond within one month of receiving the request. This period may be extended by two months where justified by the complexity or number of requests; you will then be informed of the extension and its reasons within the first month.

Exercising your rights is normally free of charge. Exceptions are limited to the cases provided for by the GDPR, including certain manifestly unfounded or excessive requests. If we cannot act on a request, we explain the reasons and the available remedies.

11. Security

We implement technical and organisational measures appropriate to the risks to protect data against unauthorised access, loss, alteration or disclosure. Access to data is limited to people who need it for their duties.

You help keep your account secure by protecting your login credentials and promptly reporting any suspicious use to us. This recommendation does not limit our legal obligations concerning data protection.

12. Complaints and remedies

We invite you to contact us with any questions or difficulties. You also have the right to lodge a complaint with a supervisory authority, in particular in the country of your habitual residence, your place of work or the place of the alleged infringement.

In Belgium, you can contact the Data Protection Authority (Autorité de protection des données): www.autoriteprotectiondonnees.be.

This policy does not limit your right to a judicial remedy or the statutory rules governing the jurisdiction of courts.

13. Changes to this policy

This policy may be updated to reflect changes in our services, processing or regulations. The current version is the one published on this page. Where a change requires specific information or fresh consent, we take the required steps before the processing concerned.