1. Who We Are
Hope Anchor Store is operated by Anchor, a Belgian sole proprietorship. The data controller for this site is Ana Clara de Oliveira Zimbrao Lindenburg. Contact: [email protected].
2. What We Collect and Why
When you place an order: email address, shipping name and address, phone number (optional, used by the carrier for delivery), and the items in your order. When you create an account: the same plus saved addresses you choose to add and your marketing preference. We do not store payment card details — Mollie handles them. The lawful basis is performance of the contract (Art. 6(1)(b) GDPR) for orders and your account, and consent (Art. 6(1)(a)) for marketing emails. Marketing consent is opt-in and revocable any time from your account.
3. Sub-processors
We share the minimum necessary data with: Mollie (payments — EU), Hetzner Online (hosting — EU), Cloudflare (CDN + DNS + edge — EU), Resend (transactional email — EU), DHL Express (live shipping rates — postal code, country and weight only, no name or email), and Sentry (error monitoring — EU region; receives stack traces only, no order or address content). We do not sell, rent or otherwise share your personal data.
4. Cookies
We set strictly necessary cookies only: a language preference, a shopping-cart session token, a logged-in account session (if you sign in), and a record of your cookie-banner choice. We do not run advertising scripts. We use Plausible for privacy-friendly, cookie-free analytics — page views and referrers, no cross-site tracking and no personal identifiers.
5. Retention
Order records (invoices, transaction data) are kept for 7 years per Belgian tax law (Art. 60 §3 BTW Code). Customer accounts are anonymised after 3 years of inactivity. Magic-link login tokens are deleted after expiry or use, and never longer than 24 hours. If you delete your account, your name, email and addresses are wiped immediately; the order rows themselves remain for the tax window with your personal details replaced by placeholders.
6. Your Rights (GDPR)
You have the right to access (Art. 15), rectify (Art. 16), erase (Art. 17), restrict (Art. 18), object to processing (Art. 21), and data portability (Art. 20). You can exercise access + erasure directly from your account page (Download my data, Delete my account). For everything else, email [email protected]. You also have the right to lodge a complaint with the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be).
7. Security
Data is encrypted in transit and at rest. Account login uses one-time email links — we never store passwords. We keep our software up to date and review changes for security impact.
8. Changes
We will update this policy when we add features that change what we collect (e.g. analytics). Material changes will be flagged on the storefront for 30 days before they take effect.