Privacy Policy
Privacy Policy
Last updated: 18 July 2026
This Privacy Policy explains how The Modern Alchemist collects, uses, and protects your personal data when you visit our website themodernalchemist.bar or place an order through our online shop. We respect your privacy and process your data in accordance with the General Data Protection Regulation (EU 2016/679 — GDPR) and the Belgian Law of 30 July 2018 on data protection.
Who we are
The data controller responsible for your personal data is:
The Artefact SRL
55 avenue Adolphe Demeur, 1060 Saint-Gilles, Bruxelles, Belgium
Company number (BCE / KBO): 0681.618.901
VAT number: BE 0681.618.901
Contact: enjoycocktails@themodernalchemist.bar
For any question relating to your personal data, write to the address above or email us — we’ll reply within 30 days.
What data we collect
We only collect the data we actually need to deliver our products and run our business. Specifically:
When you place an order
- Identity: first name, last name
- Contact: email address, phone number (optional)
- Billing address: street, postal code, city, country
- Shipping address (if different)
- Order details: products, quantities, total, date, payment status
- Age confirmation: legal age confirmation (alcohol products — Belgian law requires 18+)
When you create an account
- The data above
- An encrypted password (we never see your password in clear)
When you visit the site (technical data)
- IP address (collected by our hosting provider for security logs only)
- Browser and device information (anonymized, via self-hosted Matomo — see Cookies & analytics below)
- Pages visited (anonymized)
What we DO NOT collect
- We do not sell, rent, or trade your personal data.
- We do not use third-party advertising trackers (no Facebook Pixel, no Google Ads).
- We do not profile you for marketing.
Why we collect it (legal basis)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Process and ship your order | Performance of a contract (Art. 6.1.b) |
| Handle returns, refunds, customer support | Performance of a contract (Art. 6.1.b) |
| Comply with Belgian accounting and tax obligations | Legal obligation (Art. 6.1.c) |
| Verify you are of legal age to purchase alcohol | Legal obligation (Art. 6.1.c) |
| Detect fraud, protect site security | Legitimate interest (Art. 6.1.f) |
| Optional account creation (faster reorder) | Consent (Art. 6.1.a) — you can delete it anytime |
Who we share it with (sub-processors)
We share strictly the data needed with these third parties — all GDPR-compliant and bound by contract:
| Recipient | Purpose | Data shared | Location |
|---|---|---|---|
| Hostinger International Ltd. | Web hosting, server logs | Order data, account data, IP | EU (Lithuania) |
| Mollie B.V. | Payment processing | Order amount, email, name | EU (Netherlands) |
| Brevo (Sendinblue SAS) | Sending transactional emails related to your order (order confirmation, shipping notice, account & password emails) | Name, email address, order details | EU (France). Privacy policy. Legal basis: performance of a contract (Art. 6.1.b). |
| bpost SA / NV | Parcel delivery | Name, shipping address, phone (for delivery notice) | Belgium |
| Our accountant | Belgian accounting & tax | Invoices, order totals | Belgium |
| OpenStreetMap Foundation | Map embed on our “Find Us” section | Your IP and User-Agent (no cookies set, no JavaScript tracking, server logs anonymised after ~180 days) | UK / EU. Privacy policy. Legal basis: legitimate interest (showing you our location). |
| Komoot GmbH (Photon) | Address autocomplete on checkout | Your IP, User-Agent and the address text you type (no cookies set, no account required) | EU (Germany). Privacy policy. Legal basis: legitimate interest (helping you fill in your delivery address correctly). |
| Proton AG (Proton Mail) | Email hosting — receiving and replying to messages you send us (e.g. customer support, enquiries) | Any personal data you include in your message (name, email address, order reference) | Switzerland — recognised by the European Commission as ensuring an adequate level of data protection (adequacy decision under GDPR Art. 45), so no additional safeguards are required. Privacy policy. Legal basis: legitimate interest (responding to your messages). |
We do not transfer your data outside the European Economic Area (EEA), with one exception: our email provider Proton is based in Switzerland, a country the European Commission recognises as ensuring an adequate level of data protection (adequacy decision under GDPR Art. 45), so no additional safeguards are required. Should we ever need to transfer data to a country without such recognition, we’ll inform you and rely on EU Standard Contractual Clauses.
How long we keep it
| Type of data | Retention |
|---|---|
| Orders, invoices, accounting | 10 years (Belgian Code of Economic Law, Art. III.86) |
| Customer account (if created) | Until you delete it, or 3 years of inactivity |
| Newsletter subscription | N/A — we don’t run a newsletter at this time |
| Server access logs | 30 days (security only) |
| Anonymized analytics | 14 months max |
After these periods we permanently delete or anonymize the data.
Cookies & analytics
Our site uses only essential cookies — those strictly necessary for the site to work:
| Cookie | Purpose | Duration |
|---|---|---|
wp_woocommerce_session_* | Holds your cart between pages | 48 hours |
woocommerce_cart_hash | Tracks cart contents for display | session |
woocommerce_items_in_cart | Counts items in your cart icon | session |
tma_cookies_ack | Remembers you saw our cookie notice | 1 year |
These cookies are exempted from prior consent under Article 129 of the Belgian Electronic Communications Act (transposing the ePrivacy Directive) because they are strictly necessary.
Analytics
We use Matomo, self-hosted on our own server at analytics.themodernalchemist.bar. Compared to most analytics tools:
- No cookies set (
disableCookiesenabled) — nopk*or any tracker - Your IP is anonymized server-side before being stored
- Your browser’s “Do Not Track” header is respected — if your browser sends DNT, we collect nothing about your visit
- No data leaves our infrastructure — Matomo runs on our subdomain, not on Google Analytics, Plausible Cloud, or any third party
- No cross-site tracking, no advertising profiling, no fingerprinting
This is why we don’t show you an intrusive consent banner — under the Belgian Electronic Communications Act (Art. 129) and CNIL guidance, cookieless first-party analytics that anonymize IPs are exempt from prior consent.
We do not use:
- Google Analytics, Plausible Cloud, or any third-party analytics service
- Facebook Pixel, TikTok Pixel, or any advertising tracker
- Cross-site tracking or fingerprinting
Third-party content (RumX)
Some rum product pages display a community rating badge provided by RumX (rumx.com). Its content is loaded directly from RumX servers, so your IP address and browser information are visible to RumX when such a page loads — exactly as when loading any external image. The badge sets no cookies and does not track you across sites. See RumX own privacy policy for details.
Your rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data (right to be forgotten) — subject to our legal retention obligations
- Restrict the processing of your data
- Portability — receive your data in a structured, commonly-used format
- Object to processing based on legitimate interest
- Withdraw consent at any time, where processing is based on consent
- Not be subject to automated decision-making (we don’t do any)
To exercise any of these rights, email us at enjoycocktails@themodernalchemist.bar. We’ll reply within 30 days. We may ask for proof of identity to make sure we’re sending data to the right person.
Complaints
If you believe we’ve mishandled your data and we haven’t resolved your concern, you may file a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit):
- Rue de la Presse 35, 1000 Bruxelles
- +32 (0)2 274 48 00
- contact@apd-gba.be
- www.dataprotectionauthority.be
Children
Our shop sells alcoholic beverages. Belgian law (Law of 24 January 1977, Art. 6) prohibits the sale of alcohol to minors under 18. You must confirm you are at least 18 years old at checkout. We do not knowingly collect data from anyone under 18.
Data security
We use standard industry practices to protect your data:
- HTTPS encryption (TLS 1.3) across the entire site
- Passwords stored hashed (bcrypt) — never in clear
- Payment data is handled entirely by Mollie; we never see your card number
- Restricted server access, regular security updates
- Daily backups retained for 14 days
In case of a personal data breach affecting your rights, we will notify the Belgian Data Protection Authority within 72 hours and inform you directly if the risk is high.
Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be highlighted on this page.
Contact
For any privacy-related question:
The Artefact SRL (The Modern Alchemist)
55 avenue Adolphe Demeur, 1060 Saint-Gilles, Bruxelles, Belgium
enjoycocktails@themodernalchemist.bar