1. Data controller
SEDEO SRL, with its registered office at Rue du Marché 12, 1000 Brussels, Belgium, registered with the Crossroads Bank for Enterprises under number BE 0800.123.456 (hereinafter "SEDEO", "we"), is the controller of your personal data.
Our data protection officer (DPO) can be reached at privacy@sedeo.be or by post at the registered office address, for the attention of the "DPO SEDEO".
2. Data we collect
- Account data: surname, first name, e-mail address, telephone number, password (hashed), delivery address, postcode and city.
- Order data: products ordered, amounts, tips, order history, delivery instructions, chosen shop.
- Payment data: processed exclusively by our PCI-DSS certified payment provider. SEDEO never stores your full card number.
- Delivery data: address, time slot, courier location during the delivery (for real-time tracking).
- Browsing data: pages viewed, products and aisles visited, device and browser — only according to your cookie choices (see our cookie policy).
- Support data: the content of your exchanges with customer service, complaints and refund requests.
3. Purposes and legal bases (art. 6 GDPR)
| Purpose | Data concerned | Legal basis |
|---|---|---|
| Creating and managing your account | Account data | Performance of the contract (art. 6.1.b) |
| Processing and delivering your orders | Order and delivery data | Performance of the contract (art. 6.1.b) |
| Collecting payments and passing tips on to couriers | Payment data, tips | Performance of the contract (art. 6.1.b) |
| Invoicing, accounting and tax obligations | Order and invoicing data | Legal obligation (art. 6.1.c) |
| Fraud prevention and platform security | Account and browsing data | Legitimate interest (art. 6.1.f) |
| Traffic statistics (audience measurement) | Pseudonymised browsing data | Consent (art. 6.1.a) |
| Personalised product suggestions | Products and aisles viewed (sedeo-activity cookie) | Consent (art. 6.1.a) |
| Marketing communications (offer e-mails) | E-mail address | Consent (art. 6.1.a) — unsubscribe at any time |
| Customer support and complaint handling | Support data | Performance of the contract and legitimate interest |
4. Recipients of your data
Your data is never sold. It is shared only with:
- Partner shops — name, order contents and instructions, in order to prepare your basket.
- SEDEO couriers — name, delivery address, telephone number and instructions, for the duration of the delivery only.
- Our technical providers — hosting (servers located in the European Union), payment, sending of transactional e-mails. All are bound by a processing agreement compliant with article 28 GDPR.
- The authorities — only upon a legal request.
5. Retention periods
| Data | Period |
|---|---|
| Customer account | As long as the account is active, then 3 years after the last activity |
| Orders and invoices | 10 years (Belgian accounting obligation — art. III.86 CDE) |
| Payment data | Not retained by SEDEO (payment provider only) |
| Courier location | Deleted at the end of the delivery (anonymous aggregated retention) |
| Cookies and browsing | See the cookie policy (6 to 13 months maximum) |
| Exchanges with support | 3 years after the case is closed |
6. Your rights
In accordance with articles 15 to 22 of the GDPR, you have the following rights, which may be exercised free of charge:
- Right of access — obtain a copy of the data we hold about you.
- Right to rectification — correct inaccurate or incomplete data.
- Right to erasure ("right to be forgotten") — request the deletion of your data, subject to our legal retention obligations.
- Right to restriction of processing.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — in particular to processing based on our legitimate interest and to direct marketing.
- Right to withdraw your consent at any time (cookies, marketing e-mails), without affecting the lawfulness of prior processing.
To exercise these rights, contact privacy@sedeo.be. We reply within a maximum of one month. Proof of identity may be requested in the event of reasonable doubt.
7. Complaint to the supervisory authority
If you consider that your rights are not being respected, you may lodge a complaint with the Data Protection Authority (DPA):
- Rue de la Presse 35, 1000 Brussels
- Tel.: +32 (0)2 274 48 00 · contact@apd-gba.be
- Website: autoriteprotectiondonnees.be
8. Transfers outside the European Union
Your data is hosted and processed within the European Union. Should a transfer to a third country take place, it would be governed by an adequacy decision of the European Commission or by the standard contractual clauses (art. 46 GDPR).
9. Security
We apply appropriate technical and organisational measures: TLS 1.3 encryption of all communications, password hashing, access segregation according to internal roles, logging of administrator access and regular security testing. In the event of a data breach likely to create a risk to your rights, we will notify the DPA within 72 hours (art. 33 GDPR) and inform you if necessary.
10. Minors
SEDEO is aimed at persons aged 18 and over. We do not knowingly collect data concerning minors. The sale of alcohol is prohibited to persons under 18 (law of 24 January 1977); an age check may be carried out on delivery.
11. Changes
This policy may change, in particular to follow the recommendations of the DPA and the European Data Protection Board. Any substantial change will be notified to you by e-mail or through the application at least 15 days before it takes effect.