Privacy Policy

Version: 11 October 2026
This translation is provided for convenience only. In case of doubt, the German version shall prevail.

The protection of your personal data is important to us. In this privacy policy we inform you which personal data we process when you visit our website https://www.feuerwerk-belgien.com and when you order in our online shop, for what purposes and on what legal basis we do so, to whom we pass data on, how long we store it and what rights you have. It is based on the EU General Data Protection Regulation (GDPR) and Belgian data protection law.

1. Controller

The controller responsible for data processing on this website is:

Stone-Store Batihome SRL, trading under the brand “Fireworks Belgium”
Aachener Straße 212, 4730 Hauset, Belgium
Authorised representative: Pascal Kessels
Company number / VAT no.: BE0567676167
Phone: +32 473 86 21 13
Email: hello@fireworks-belgium.be

2. Data protection officer

We have not appointed a data protection officer, as we are not legally required to do so. If you have any questions about data protection, please contact us directly using the contact details above.

3. Overview: purposes and legal bases

We process personal data only insofar as this is necessary for operating the website, processing your order, answering your enquiries or fulfilling legal obligations, or insofar as you have given your consent. We rely on the following legal bases of Art. 6(1) GDPR:

• Consent (point a) – e.g. for Google Analytics, for loading YouTube videos and for our newsletter;
• Contract and pre-contractual measures (point b) – e.g. for processing your order and a withdrawal;
• Legal obligation (point c) – e.g. for retaining invoices, the legally required age check and checking a licence for certain pyrotechnic articles;
• Legitimate interest (point f) – e.g. for the secure and stable operation of the website, cookieless visitor statistics and answering general enquiries. We state the legitimate interest pursued in each section.

Where information is stored on or read from your device (e.g. cookies), Art. 10/2 of the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data also applies, and for users in Germany also Section 25 TDDDG. We set strictly necessary cookies without consent and all others only with your consent.

4. Hosting, shop software and server log data (Odoo)

Our website, our online shop as well as our customer management (CRM) and our invoicing/accounting run on the “Odoo Online” platform (software as a service) of

Odoo S.A., Chaussée de Namur 40, 1367 Grand-Rosière, Belgium.

Odoo processes the data on our behalf as a processor (Art. 28 GDPR); the data processing agreement forms part of our contract with Odoo. Odoo in turn uses sub-processors for the data centres, in particular OVH SAS (France) and Google Cloud EMEA Ltd (Ireland).

Our Odoo database is assigned to the Europe hosting region and is operated in an OVH data centre in France. Odoo stores backups in further data centres in the EU; according to Odoo, an additional backup copy of existing databases may temporarily be stored in Canada. Canada is covered by an adequacy decision of the EU Commission (Art. 45 GDPR).

When you access our website, technically necessary data is processed automatically (server log data): IP address, date and time of access, page or file accessed, amount of data transferred, referrer URL, browser type and version, and operating system. We need this data to deliver the website to you and to ensure its security and stability, e.g. to fend off attacks. The legal basis is our legitimate interest in a secure and functional website (Art. 6(1)(f) GDPR).

Odoo stores the server and security logs for a maximum of 12 months in accordance with Odoo's privacy policy, unless they are needed longer in individual cases because of a security incident. According to Odoo, data deleted from our database may remain in the secured backups for up to 12 months until these are automatically overwritten. More information: https://www.odoo.com/privacy

5. Orders in the online shop (pickup only)

5.1 Ordering as a guest

Orders can be placed as a guest; there is no open registration for a customer account. We set up customer accounts by invitation only. For your order we process:

• name,
• email address,
• phone number,
• billing address,
• content and date of the order,
• selected payment method and payment status.

We use this data to accept your order, prepare it for pickup, contact you with any questions, send you the automatic acknowledgement of receipt of your order by email, issue an invoice and fulfil our accounting obligations. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and, for invoices and accounting, our legal obligation (Art. 6(1)(c) GDPR).

5.2 No shipping – pickup in Hauset only

We do not ship goods. Articles ordered online are exclusively picked up in our shop in Hauset (Aachener Straße 212, 4730 Hauset). Your data is therefore not passed on to shipping or delivery services.

5.3 Age check at pickup

Under Belgian law we are obliged to check the age of buyers when handing over fireworks and other pyrotechnic articles. At pickup we therefore inspect an official photo ID. We neither make a copy nor a scan and do not store any ID data. The legal basis is our legal obligation (Art. 6(1)(c) GDPR).

5.4 Articles that may only be supplied with a licence

Under Belgian law, certain pyrotechnic articles may only be supplied to persons with specialist knowledge who hold a valid licence (e.g. the Belgian “Pyro-Pass” or an equivalent licence from another EU member state). If you purchase such an article, we are legally obliged to check the validity of your licence in the official register before handing it over and to keep a copy of the licence together with the invoice as proof for the competent authorities for at least three years after supply. For this purpose we process the information on the licence (in particular name, licence number, validity). The legal basis is our legal obligation (Art. 6(1)(c) GDPR). We disclose this data only on request to the competent supervisory, police or judicial authorities.

5.5 Withdrawal via our online function “Withdraw from contract”

If you withdraw from a contract using our online function “Withdraw from contract”, we process the data entered there (name, email address, order number, order date, articles concerned where applicable, and your statement) as well as the date and time of receipt. We use this data to process the withdrawal, to send you the legally required acknowledgement of receipt by email and to carry out the reversal (return of goods, refund). The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our legal obligation to acknowledge receipt (Art. 6(1)(c) GDPR). The same applies if you declare your withdrawal by email, letter or using the model withdrawal form. We keep the withdrawal statement together with the order documents (see section 15).

6. Payment

6.1 No online payment

No payments are processed via our website. We do not collect any payment data (e.g. card or account details) when you order, and we do not use any online payment service provider. Payment is made exclusively at pickup in our shop (see section 6.2).

6.2 Payment methods

You pay for your order exclusively on collection in our shop, in cash or by card.

For cash payments we do not process any payment data. For card payments in the shop, the payment is processed via the payment service provider of our card terminal and the respective card network; the data required for the payment (e.g. card type, truncated card number, payment amount, date and time) is processed. We only receive the payment confirmation with this information, not full card numbers. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

If you use Google Pay, Google’s privacy provisions (Google Ireland Limited) also apply; Google receives the data required for the payment.

7. Contact form, contact by email or phone

If you write to us via the contact form on our website, we process the data you provide: name, phone number, email address, subject and your message. The same applies if you contact us by email or phone. We use this data exclusively to process and answer your enquiry. Enquiries via the contact form are stored in our Odoo system (CRM).

The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to an order or a possible purchase, and otherwise our legitimate interest in answering enquiries from customers and prospective customers (Art. 6(1)(f) GDPR). We delete your enquiry 24 months after it has been fully completed, unless a statutory retention obligation applies.

For emails to hello@fireworks-belgium.be we use the Gmail email service. The provider for users in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland. Google processes the content and metadata of the emails in order to provide the service. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR).

7a. Newsletter

What we process. If you sign up for our newsletter on our website, we process your email address, the date and time of sign-up and the list you signed up for (“Newsletter Feuerwerk-Belgien”). We do not ask for any other details. For the duration of your visit, Odoo also stores your email address in your session (cookie session_id) so that the form recognises you as signed up.

Purpose. We send you information by email about new items, the start of the season, opening and pickup times and promotions of our shop in Hauset. Directly after signing up, you receive a welcome email with a personal discount code (while the promotion lasts; see below). The newsletter is aimed only at persons aged 18 and over.

Legal basis. Your consent (Art. 6(1)(a) GDPR), which you give by entering your email address and clicking “Subscribe”; for email advertising additionally Art. XII.13 of the Belgian Code of Economic Law or, for recipients in Germany, Section 7(2) No. 2 UWG.

Sign-up without confirmation link. Your sign-up takes effect immediately (single opt-in); we do not send a separate confirmation email. If you receive a welcome email without having signed up yourself, please unsubscribe via the unsubscribe link or write to us – we will then remove your address from the list.

Welcome code. For the first 1,000 sign-ups until 31.12.2026 we generate a personal, single-use discount code (10% off purchases of €50 or more). We store the code in Odoo together with a note of the email address it was generated for, so that each person receives only one code and we can answer queries. If you redeem the code with an order, this is noted on the order and the code. The legal basis is your consent (Art. 6(1)(a) GDPR) and, on redemption, performance of the contract (Art. 6(1)(b) GDPR). Unredeemed codes expire at the end of 31.12.2026; we delete them no later than 12 months afterwards. We keep redeemed codes as part of the order records (see section 15).

Sending via Odoo. Sign-ups are stored in the email marketing module of our shop software Odoo, and the newsletter is sent through it. The provider is Odoo S.A., Chaussée de Namur 40, 1367 Grand-Rosière, Belgium, which acts as our processor (Art. 28 GDPR; see section 4). For each newsletter, Odoo records whether it was delivered or bounced, whether it was opened and which links were clicked. We use this information solely to detect delivery problems and to improve our newsletter; the legal basis is our legitimate interest in doing so (Art. 6(1)(f) GDPR). You can object to this analysis at any time (section 16) – in practice most easily by unsubscribing.

Unsubscribing and withdrawal of consent. You can withdraw your consent at any time with effect for the future and unsubscribe from the newsletter – via the unsubscribe link in every email or with an informal message to hello@fireworks-belgium.be. The lawfulness of the processing carried out until the withdrawal remains unaffected.

Storage period. We store your email address for the newsletter until you unsubscribe. After unsubscribing, your address remains stored with an unsubscribe note so that you do not receive further newsletters and we can prove that you had previously consented (Art. 6(1)(c) and (f) GDPR). We delete this information no later than 3 years after you unsubscribe. If you expressly request deletion, we delete your address immediately and keep it only on a block list whose sole purpose is to prevent you from being contacted again.

Voluntary nature. Signing up is voluntary. Without an email address we cannot send you the newsletter; orders in the shop are independent of this.

Display of the sign-up window. So that the small sign-up window on smartphones does not reappear on every visit, our website stores the entry fwb_nl_popup_v1 in your browser's local storage (whether and when the window was shown, closed or a sign-up was submitted). The entry contains no personal data such as your email address, is not transmitted to us and can be deleted by you at any time in your browser settings.

8. Cookies and similar technologies

Our website uses cookies and similar technologies. These are small text files or entries stored in your browser.

• Strictly necessary cookies are set without consent because the website and online shop would otherwise not work: session_id (session, cart and security), website_cookies_bar (stores your choice in the cookie banner), tz (time zone), frontend_lang (language) and the entry fwb_nl_popup_v1 in your browser's local storage (remembers that the newsletter window has already been shown, see section 7a). The legal basis for setting them is Art. 10/2 of the Act of 30 July 2018 or Section 25(2) No. 2 TDDDG, and for the associated data processing Art. 6(1)(b) and (f) GDPR.
• Optional cookies are only set if you click “I agree” in the cookie banner: Google Analytics (_ga, _ga_83N9PVJJFB, see section 9.1), YouTube cookies when playing embedded videos (see section 10) and the Odoo cookies odoo_utm_campaign, odoo_utm_source, odoo_utm_medium (origin via a campaign link) and seen_product_id_ (recently viewed products). The legal basis is your consent (Art. 6(1)(a) GDPR).

With “Only essentials” you reject all optional cookies; the website remains fully usable. You can withdraw or change your consent at any time with effect for the future: via our page Cookie Policy (link in the website footer); there, the button “Show the cookies bar” reopens the cookie banner. The lawfulness of the processing carried out until the withdrawal remains unaffected.

A complete list of all cookies with provider, purpose and storage period can be found in our Cookie Policy.

9. Visitor statistics

9.1 Google Analytics 4 (only with consent)

If you click “I agree” in the cookie banner, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland (“Google”). Before your consent, the analytics script is not loaded; no connection to Google Analytics is established and no analytics cookies are set.

Google Analytics uses cookies (_ga, _ga_83N9PVJJFB) and similar technologies to analyse how visitors use our website, e.g. pages visited, time spent, referring page, approximate location (country/region), device and browser information. We use these analyses to improve our offering and the usability of the website. The legal basis is your consent (Art. 6(1)(a) GDPR in conjunction with Art. 10/2 of the Act of 30 July 2018 or Section 25(1) TDDDG). Your choice is transmitted to Google via Google's consent mode (Consent Mode).

IP addresses of users in the EU are not logged or stored by Google Analytics 4. The “Google Signals” feature is deactivated; we do not link Analytics with advertising services and do not use the data for advertising purposes. User- and event-level data is automatically deleted after 2 months.

This may involve a transfer of data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; to that extent there is an adequacy decision of the EU Commission (Art. 45 GDPR). You can withdraw your consent at any time (see section 8). More information: https://policies.google.com/privacy and https://support.google.com/analytics/answer/6004245

9.2 Cookieless visitor statistics from Odoo (Plausible)

In addition, we use the cookieless visitor statistics integrated in Odoo. They are provided by our hosting provider Odoo S.A. (see section 4) as a processor; the script is loaded from download.odoo.com and the measurement data is transmitted to Odoo servers (saas-analytics.odoo.com). Technically, the analytics software “Plausible” is used.

The statistics set no cookies and store nothing in your browser’s local storage. Only aggregated information is recorded, e.g. page visited, referring website, browser, operating system, device type and the country derived from the IP address. Your IP address is not stored; to count unique visitors, it is only briefly converted together with the browser identifier into a daily changing, non-reversible value. No profile is created across several days or websites.

The legal basis is our legitimate interest in data-minimising audience measurement without cookies in order to understand and improve the use of our website (Art. 6(1)(f) GDPR). You can object to this processing at any time (see section 16).

10. YouTube videos (only after consent)

On some product pages we embed product videos from the YouTube platform. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland.

The videos are only loaded after you have clicked “I agree” in the cookie banner. Until then we only show a notice in place of the video; no connection to YouTube is established. Via this notice you can open the cookie banner and give your consent.

After your consent, your browser connects to the servers of YouTube or Google. In particular, your IP address, device and browser information, the page visited and your interaction with the video are transmitted; YouTube sets cookies (e.g. YSC, VISITOR_INFO1_LIVE, VISITOR_PRIVACY_METADATA) and uses your browser's local storage. If you are logged into a Google account, YouTube can assign the visit to your account.

The legal basis is your consent (Art. 6(1)(a) GDPR in conjunction with Art. 10/2 of the Act of 30 July 2018 or Section 25(1) TDDDG). We are jointly responsible with Google for the collection and transmission of data when embedding the video; Google alone is responsible for further processing. This may involve a transfer to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). You can withdraw your consent at any time (see section 8). More information: https://policies.google.com/privacy

11. Fonts (Google Fonts)

Our website currently loads the fonts Montserrat, Open Sans and Sen from servers of Google Ireland Limited (fonts.googleapis.com and fonts.gstatic.com) in order to display texts consistently and legibly. When a page is accessed, your browser connects to Google for this purpose; your IP address, information about your browser and operating system and the referring page are transmitted to Google. No cookies are set. A transfer to Google LLC in the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR).

The legal basis is our legitimate interest in a uniform presentation of our website (Art. 6(1)(f) GDPR). We are switching to fonts loaded directly from our own server. After that, no connection to Google will take place when loading fonts, and we will update this section. More information: https://developers.google.com/fonts/faq/privacy

12. Link to TikTok

Our website contains a simple link to our TikTok profile (@fw.belgium). This is only a link, not an embedded plugin. Data is only transmitted to TikTok when you click the link and visit the TikTok page; TikTok’s privacy policy applies there.

13. Recipients of your data

We only pass on your data insofar as this is necessary for the stated purposes, namely to:

• Odoo S.A. (Belgium) – hosting, online shop, CRM, invoicing, sending our newsletter and cookieless visitor statistics, as processor; sub-processors include OVH SAS (France) and Google Cloud EMEA Ltd (Ireland);
• the payment service provider of our card terminal and the respective card network – only for card payments in the shop (see section 6.2);
• Google Ireland Limited (Ireland) or Google LLC (USA) – Google Analytics (only with consent), YouTube videos (only with consent), Google Fonts, the Gmail email service and, if you choose this payment method, Google Pay;
• our tax adviser or accountant – insofar as necessary for accounting and tax returns; they are bound by professional secrecy;
• Authorities, courts and police – insofar as we are legally obliged to do so, e.g. the supervisory authorities for pyrotechnic articles or the tax administration.

We do not sell your data and do not pass it on to third parties for advertising purposes.

14. Transfers to countries outside the EU

In principle, we process your data within the European Union. A transfer to the USA is possible with Google (Google Analytics and YouTube only with your consent, Google Fonts, Gmail, Google Pay). It takes place on the basis of the EU Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified, or additionally on the basis of EU standard contractual clauses (Art. 46(2)(c) GDPR). For Odoo backups, storage in Canada is temporarily possible; there is an adequacy decision for this (Art. 45 GDPR). You can request a copy of the safeguards from us.

15. Storage period

We store your data only for as long as is necessary for the respective purpose or as required by statutory retention periods. It is then deleted.

• Order, invoice and accounting data (including withdrawal statements and refunds): 10 years under Belgian tax and VAT law, counted from 1 January of the year following the transaction. During this time we restrict processing to fulfilling this obligation.
• Records of items that may only be supplied with a licence (copy of the licence and invoice): at least 3 years after supply; insofar as the invoice is part of the accounts, the 10-year period applies to it.
• Contact enquiries: 24 months after the enquiry has been fully completed, unless a statutory retention obligation applies.
• Newsletter: until you unsubscribe; afterwards unsubscribe note and proof of consent for a maximum of 3 years. Unredeemed welcome codes: until 12 months after expiry (31.12.2026) (see section 7a).
• Server and security logs at Odoo: a maximum of 12 months (see section 4); deleted data may remain in backups for up to 12 months.
• Google Analytics: user and event data 2 months.
• Cookies: The storage period of the individual cookies can be found in our cookie policy.

16. Your rights

Under the GDPR you have the following rights:

• Access to your data stored by us (Art. 15 GDPR),
• Rectification of inaccurate data (Art. 16 GDPR),
• Erasure of your data (Art. 17 GDPR), unless a statutory retention obligation applies,
• Restriction of processing (Art. 18 GDPR),
• Data portability – receiving your data in a common, machine-readable format (Art. 20 GDPR),
• Withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR); processing carried out until the withdrawal remains lawful,
• Objection to certain processing (Art. 21 GDPR, see the following notice).

To exercise your rights, an informal message to hello@fireworks-belgium.be or by post to our address stated above is sufficient.

17. Right to lodge a complaint with a supervisory authority

If you believe that the processing of your data violates data protection law, you can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Belgian Data Protection Authority:

Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données)
Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, Belgium
Phone: +32 2 274 48 00 · Email: contact@apd-gba.be · Website: https://www.datenschutzbehorde.be

You can also contact the supervisory authority of your place of residence, in Germany for example the data protection supervisory authority of your federal state. However, we would appreciate it if you contacted us first with your concern.

18. Obligation to provide data; no automated decision-making

For an order we need the data listed in section 5.1; without it we cannot process the order. Presenting an official ID at pickup (section 5.3) and, where applicable, a valid licence (section 5.4) is a legal prerequisite for handing over the goods. You do not have to provide any personal data simply to visit the website.

We do not make any decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.

19. Changes to this privacy policy

We will update this privacy policy if our website, our services or the legal requirements change. The version published on this page applies.

Version: 11 October 2026