1. Data controller
The data controller is The Depot SRL, Kruisstraat 5, 3520 Zonhoven, Belgium, VAT BE 0893.674.972.
Contact for any question about personal data: info@thedepot.be, for the attention of the data protection officer, or by phone on +32 (0)11 18 24 18. Until a data protection officer is formally appointed, management takes on that role.
2. Data collected
We collect the data needed to sell, deliver, invoice and advise. No advertising data, no profiling, no resale to third parties.
| Category | Examples | Source |
|---|---|---|
| Identification | Name, company name, legal form, VAT number, CBE number | Form, Pro account |
| Contact details | Delivery and billing address, email, phone | Form, Pro account |
| Orders | References, quantities, prices, history, delivery notes | Pro portal, email |
| Invoicing | Invoice numbers, Peppol data, VAT mentions, bank account | The Depot, customer |
| Requests | Samples, messages, logo files | Forms, email |
| Technical | Access log, IP address, browser type | Server |
3. Purposes and legal bases
Each processing operation rests on a specific legal basis. You may object to processing based on legitimate interest; processing needed for an order cannot be refused.
| Purpose | Legal basis |
|---|---|
| Order, preparation, delivery, service | Performance of the contract (Art. 6.1.b GDPR) |
| Quotes, samples, information requests | Pre-contractual steps (Art. 6.1.b) |
| Accounting, VAT, Peppol invoice | Legal obligation (Art. 6.1.c) |
| Relationship management, reorders, history | Legitimate interest (Art. 6.1.f) |
| Security, fraud prevention | Legitimate interest (Art. 6.1.f) |
| Offers and newsletter | Consent (Art. 6.1.a), withdrawable |
| Prospecting existing customers | Legitimate interest (Art. 6.1.f), with right to object |
4. Recipients and processors
Data is accessible to the people at The Depot who need it for their work, and to service providers acting on our instructions, under a contract compliant with Article 28 GDPR.
- Website hosting: Clixite, Belgium.
- Accounting and invoicing: Exact Online, European Union.
- Carriers: Benelux partners, European Union.
- Email and request tracking: providers established in the European Union.
- Payment: authorised payment institution, European Union.
- Authorities: where the law requires it.
No transfer outside the European Union takes place other than under an adequacy decision or the European Commission's standard contractual clauses, supplemented by a local risk assessment.
5. Retention periods
- Prospects and requests: 3 years after the last contact.
- Customers: duration of the commercial relationship, then 7 years for accounting and tax documents.
- Invoices and Peppol documents: 7 years, legal obligation.
- Access logs: 12 months.
- Job applications: 6 months, unless agreed for a talent pool.
- Local preferences (language, theme, cart): until erased in the browser, 12 months maximum.
After these periods, data is irreversibly deleted or anonymised.
6. Your rights
You have the right of access, rectification, erasure, restriction, objection and portability, and the right to withdraw your consent at any time for processing based on it.
Write to info@thedepot.be stating your request and your account identifier. We reply within one month, extendable by two months for complex requests, with an explanation. The service is free.
If you are not satisfied with the answer, you may lodge a complaint with the Data Protection Authority, Rue de la Presse 35, 1000 Brussels, autoriteprotectiondonnees.be. You may also go to court.
7. Cookies and local storage
The site sets no advertising, social media or analytics cookies. No third-party pixel is loaded.
Three preferences are stored in your browser's local storage: the chosen language, the light or dark theme and the contents of the cart. They serve only to make the site work and are not passed on to anyone. You clear them by clearing the site data in your browser. No consent is required for these strictly functional elements.
8. Security
The site and the Pro portal run over HTTPS. Access is limited by role, passwords are stored securely, backups are regular and access logs are kept for 12 months.
In the event of a data breach likely to create a high risk, The Depot notifies the Data Protection Authority within 72 hours and informs the people concerned where the GDPR requires it.
9. Minors
The site is a trade site. It is not aimed at minors and we do not knowingly collect their data. If such data reaches us, it is deleted.
10. Changes
This policy may change with the law or with our tools. The update date appears at the top of the page. A substantial change is announced on the site and, for customers, by email, at least 30 days before it takes effect. Version of 5 November 2026.